URGENT Auditing-textbook questions--experience needed

awwyaamiss

WilliamMessierJrStevenGloverDouglasPrawitt-AuditingAssuranceServices_ASystematicApproach-McGraw-HillEducation20161.pdf

Home >Business & Finance homework help >Accounting homework help >URGENT Auditing-textbook questions--experience needed

mes32502_fm_i-xxx.indd i 10/20/15 11:48 AM

Auditing & Assurance Services A S Y S T E M A T I C A P P R O A C H

Final PDF to printer

mes32502_fm_i-xxx.indd ii 10/20/15 11:48 AM

Final PDF to printer

mes32502_fm_i-xxx.indd iii 10/20/15 11:48 AM

William F. Messier, Jr. University of Nevada, Las Vegas

Department of Accounting and

Norwegian School of Economics Department of Accounting, Auditing and Law

Steven M. Glover Brigham Young University

Marriott School of Management School of Accountancy

Douglas F. Prawitt Brigham Young University

Marriott School of Management School of Accountancy

T E N T H E D I T I O N

Auditing & Assurance Services A S Y S T E M A T I C A P P R O A C H

Final PDF to printer

mes32502_fm_i-xxx.indd iv 10/29/15 02:11 PM

AUDITING & ASSURANCE SERVICES: A SYSTEMATIC APPROACH, TENTH EDITION

Published by McGraw-Hill Education, 2 Penn Plaza, New York, NY 10121. Copyright © 2017 by McGraw-Hill Education. All rights reserved. Printed in the United States of America. Previous editions © 2014, 2012, and 2010. No part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written consent of McGraw-Hill Education, including, but not limited to, in any network or other electronic storage or transmission, or broadcast for distance learning.

Some ancillaries, including electronic and print components, may not be available to customers outside the United States.

This book is printed on acid-free paper.

1 2 3 4 5 6 7 8 9 0 DOW/DOW 1 0 9 8 7 6

ISBN 978-0-07-773250-9 MHID 0-07-773250-2

Senior Vice President, Products & Markets: Kurt L. Strand Vice President, General Manager, Products & Markets: Marty Lange Vice President, Content Design & Delivery: Kimberly Meriwether David Managing Director: Tim Vertovec Marketing Director: Brad Parkins Brand Manager: Nichole Pullen Director, Product Development: Rose Koos Director of Digital Content: Patricia Plumb Lead Product Developer: Ann Torbert Product Developer: Jonathan Thornton Marketing Manager: Michelle Nolte Market Development Manager: Erin Chomat Digital Product Analyst: Xin Lin Director, Content Design & Delivery: Linda Avenarius Program Manager: Daryl Horrocks Lead Content Project Managers: Pat Frederickson and Brian Nacik Buyer: Susan K. Culbertson Design: Debra Kubiak Content Licensing Specialists: Carrie Burger and Shannon Manderscheid Cover Image: © Danita Delimont/Getty Images Compositor: SPi Global Printer: R. R. Donnelley

All credits appearing on page or at the end of the book are considered to be an extension of the copyright page.

Library of Congress Cataloging-in-Publication Data

Messier, William F., author. Auditing & assurance services : a systematic approach / William F. Messier, Jr., Steven M. Glover, Douglas F. Prawitt.—Tenth edition. pages cm ISBN 978-0-07-773250-9 (alk. paper) 1. Auditing. I. Glover, Steven M., 1963- author. II. Prawitt, Douglas F. author. III. Title. IV. Title: Auditing and assurance services. HF5667.M46 2016 657’.45–dc23 2015028419

The Internet addresses listed in the text were accurate at the time of publication. The inclusion of a website does not indicate an endorsement by the authors or McGraw-Hill Education, and McGraw-Hill Education does not guarantee the accuracy of the information presented at these sites.

mheducation.com/highered

Final PDF to printer

mes32502_fm_i-xxx.indd v 10/20/15 11:48 AM

William F. Messier, Jr. holds the Kenneth and Tracy Knauss Endowed Chair in Account- ing at the Department of Accounting, University of Nevada, Las Vegas. He is also an Adjunct Professor at the Department of Accounting, Auditing and Law at the Norwegian School of Economics. Professor Messier holds a B.B.A. from Siena College, an M.S. from Clarkson University, and an M.B.A. and D.B.A. from Indiana University. He is a CPA in Florida and has held faculty positions at the University of Florida (Price Waterhouse Professor) and Georgia State University (Deloitte & Touche Professor). Professor Messier was a visiting faculty member at SDA Bocconi in Milan and the Universities of Luxembourg and Michigan. Professor Messier served as the Academic Member of the AICPA’s Auditing Standards Board and as Chair of the AICPA’s International Auditing Standards Subcommittee. He is a past editor of Auditing: A Journal of Practice & Theory and formerly President of the Audit- ing Section of the American Accounting Association. Professor Messier was the recipient of the American Accounting Association’s Outstanding Accounting Educator Award (2015), AICPA’s Distinguished Achievement in Accounting Education Award (2012), AAA Audit- ing Section’s Outstanding Educator Award (2009) and the Distinguished Service in Auditing Award (2008). In 2011, Professor Messier was awarded an honorary doctorate from the Nor- wegian School of Economics and Business Administration. Professor Messier has also served as an expert witness in audit litigation cases.

Professor Steven M. Glover is the K. Fred Skousen Professor and Associate Dean of the Marriott School of Management, Brigham Young University. Professor Glover is a CPA in Utah and holds a PhD and BS from the University of Washington and an AA in Business from BYU – Idaho. He previously worked as an auditor for KPMG LLP and as a director in the national office of PwC LLP. Professor Glover is currently serving on the AICPA Auditing Standards Board and has served on the audit committee of a nonprofit organization. He has served on the board of advisors for technology companies and he actively consults with public companies and public accounting firms. He has also served as an expert witness. Professor Glover is a past President of the Auditing Section of the American Accounting Association and he has been on auditing-related task forces of the AICPA. Professor Glover is or has served on the editorial boards of Auditing: A Journal of Practice & Theory, The Accounting Review, Current Issues in Auditing, and the review board of the AAA/CAQ Access to Audit Personnel Program. He has authored or coauthored over 40 articles and books primarily focused in the areas of auditor decision making, audit education, and audit practice. Together with Professor Prawitt and KPMG, LLP, he co-authored an award-winning monograph designed to acceler- ate the professional judgment of auditors and auditing students, as well as a monograph on professional skepticism commissioned by the Standards Working Group of the GPPC, an international consortium of the six largest public accounting network firms.

Professor Douglas F. Prawitt is the Glen Ardis Professor of Accountancy at the Marriott School of Management, Brigham Young University. Professor Prawitt is a CPA in Utah. He holds a PhD from the University of Arizona, and BS and MAcc degrees from Brigham Young University. Professor Prawitt was awarded the Marriott School’s Teaching Excellence and Outstanding Researcher awards in 1998 and 2000. He received the Merrill J. Bateman Student Choice Teaching Award in 2002, BYU’s Wesley P. Lloyd Award for Distinction in Graduate Education in 2006, and the American Accounting Association’s Deloitte/Wildman Award in 2013.

About the Authors

Final PDF to printer

vi About the Authors

mes32502_fm_i-xxx.indd vi 10/20/15 11:48 AM

Dedications

The authors dedicate this book to the following individuals:

Teddie, Stacy, Brandon, Zachary, Mark, Lindsay, Olive, and Frederick —William F. Messier, Jr.

Tina, Jessica, Andrew, Jennifer, Anna, Wayne, and Penny —Steven M. Glover

Meryll, Nathan, Matthew, Natalie, Emily, AnnaLisa, Leah, George, and Diana —Douglas F. Prawitt

He consults actively with international, regional, and local public accounting firms. He worked extensively over a five-year period with the Committee of Sponsoring Organiza- tions (COSO) on the COSO Enterprise Risk Management Framework and Internal Control over Financial Reporting—Guidance for Smaller Public Companies projects, and served a three-year appointment as a voting member of the AICPA Auditing Standards Board, from 2005–2008. In the fall of 2011, he was appointed to serve a three-year term as a member of the COSO Board and was appointed to serve a second three-year term beginning in 2014. Profes- sor Prawitt also has served in several capacities with the American Accounting Association, including as a member of the editorial boards of Auditing: A Journal of Practice & Theory, Behavioral Research in Accounting, and as associate editor of Accounting Horizons. He has authored or co-authored over 40 articles and books, primarily in the areas of auditor judgment and decision making, and audit practice. Most recently, together with Professor Steve Glover and KPMG, LLP, he co-authored an award-winning monograph designed to accelerate the professional judgment of auditors and auditing students, as well as a monograph on profes- sional skepticism commissioned by the Standards Working Group of the GPPC, an interna- tional consortium of the six largest public accounting firm networks.

Final PDF to printer

vii

mes32502_fm_i-xxx.indd vii 10/20/15 11:48 AM

Why a New Edition?

Dear Colleagues and Friends, The pace of change in the financial statement auditing environment continues to accelerate, even as the need for relia- bile, high-quality assurance over financial reporting continues to intensify. The auditing environment is far more com- plex and dynamic today than it was even 10 years ago. Today, for example, financial statement auditors practice in a regulated environment and must deal with three sets of auditing standards: the standards of the PCAOB for audits of U.S. public companies, the standards of the AICPA’s Auditing Standards Board for audits of essentially all other U.S. entities (e.g., private companies, government entities, universities), and the standards of the IFAC’s International Audit- ing and Assurance Standards Board for audits of entities based outside of the United States. And those standards have undergone change at an unprecedented pace, with few signs of slowing. It is difficult enough for us as professors to stay abreast of the unprecedented change and complexity in the auditing environment; it is simply unrealistic to expect our students to be able to grasp all of this while they are working diligently just to learn the fundamentals of financial state- ment auditing.

That is why we have focused our efforts in this new edition to present the fundamentals of auditing in a crisp, clear, and understandable way, helping students navigate the inherent complexity while gaining a deep, intuitive grasp of fundamental auditing concepts. We do this by using simple yet compelling illustrations, examples, and analogies, such as relating the demand for an audit to the desire of a prospective home buyer to hire a house inspector. Our hope is that students will not only understand the important standards and concepts underlying auditing but that they will gain an intuitive grasp of why it is important and how the underlying logic can inform their judgments not only as auditors but as business people. In terms of the three sets of extant auditing standards, we simplify the complexities involved by adopting an approach similar to that taken by all of the major international accounting firms: we start with a base set of standards (in our case, the AICPA’s new body of “clarity” standards, which are at this point very similar to the IAASB standards) and we build on that base by addressing any requirements in the PCAOB standards that require more from the auditor. The AICPA’s clarity standards are newly converged with international auditing standards, which means that by studying this book your students will learn the auditing concepts that underlie an audit performed under any of the three extant sets of standards. All of the major firms have adopted a similar approach because it allows their pro- fessionals to practice effectively in any environment, domestic or international, using a single, merged set of auditing standards, rather than having to learn the specifics of three different sets. Your students will have that same advantage in learning auditing from this book.

Although the auditing environment has become even more complex and demanding, at the same time it is increasingly important that students gain a deep understanding and working knowledge of fundamental auditing concepts and how they are applied. From the beginning we have worked hard to make this book the most up-to-date, “student-friendly” introductory auditing book on the market, and this new edition continues that effort. Some of the ways this book encourages your students (and ours) to think more clearly and deeply about what they are studying are by

1. Expanding the use of “stop and think” phrases at key places throughout the chapters to encourage students to more fully internalize key concepts and facilitate deep learning by your students.

2. Clarifying explanations and adding easy-to-understand examples throughout the book.

Final PDF to printer

viii Why a New Edition?

mes32502_fm_i-xxx.indd viii 10/20/15 11:48 AM

3. Making several chapters more concise and enhancing the focus on key concepts by deleting noncentral detail.

4. Improving end-of-chapter and supplementary materials throughout the book and on the website.

5. Adding a “Professional Judgment” module to the print copy of the book to accelerate the development of pro- fessional judgment abilities in your students. This module is based on the 2013 AAA Wildman Award winning KPMG Professional Judgment monograph, authored by Steve Glover and Doug Prawitt, in collaboration with KPMG leaders and partners.

6. New discussion cases added to Chapters 3 and 6 relating to the misappropriations of assets at Koss Corporation and Dixon, Illinois.

This new edition also contains several important updates including the introduction of industry leader IDEA® software by CaseWare Analytics. IDEA is a powerful and user-friendly data analysis tool designed to help auditors perform data analysis, audit sampling, and other audit procedures efficiently and effectively. Students are introduced to IDEA in the text and through hands-on tutorials, exercises, and problems. This edition also has been updated to reflect changes in auditing standards, such as the PCAOB’s Risk Assessment standards and the AICPA’s newly revised body of “clar- ity” standards, including the “principles underlying an audit conducted in accordance with generally accepted auditing standards.” The book also reflects new developments in how auditors assess materiality, based on research into major firms’ materiality policies by Aasmund Eilifsen and Bill Messier, and includes insights into audit sampling in practice based on research co-authored by Steve Glover. This edition also includes coverage of the newly revised COSO Internal Control-Integrated Framework. Because of their increasing complexity and importance to the audit process, this edi- tion also includes discussions of auditing the tax liability and auditing fair value measurements. The book also includes coverage of professionalism and ethics consistent with the AICPA’s newly reorganized Code of Professional Conduct. Finally, the authors took a hands-on role in improving this edition’s test bank, online quizzes, instructor PowerPoint slides, and the instructor’s manual.

While we are very much aware of the extra investment required when a book rolls to a new edition, we believe that we owe it to our colleagues and students to provide the most up-to-date materials possible so their hard work and energy in teaching and studying represents an investment in the latest, most current concepts, delivered in the most understand- able way possible. We are confident that the changes made in this edition will make it easier for you to teach effectively and for your students to learn more efficiently and more deeply.

Thank you for your support of this text and the many compliments we have received regarding past editions. We are gratified by the enthusiastic response the text has received as we have done our best to create a clear, easy-reading, student-friendly auditing textbook. As always, we welcome your feedback and suggestions, and we hope you will be pleased with the updates we have made in this new edition.

With warm regards,

William F. Messier, Jr. Ste ven M. Glo ver Dougla s F. Pra witt

Final PDF to printer

mes32502_fm_i-xxx.indd ix 10/20/15 11:48 AM

The 10th Edition includes the following important features and enhancements:

∙ A “professional judgment” module, designed to accelerate the development of the student’s profes- sional judgment and based on the AAA Deloitte/Wildman Award-winning KPMG Professional Judg- ment monograph, is now included in the print version of the book. Additional resources relating to this module are available through KPMG’s University Connection website.

∙ Increased use of “Stop and Think” questions throughout the book to encourage students to more fully internalize key concepts.

∙ User-focused, user-friendly improvements. ∙ Chapter 2 has been updated for recent changes in the audit environment, Chapter 3 presents the latest

information available on major firms’ audit guidance relating to materiality, Chapter 6 reflects COSO’s new internal control framework, and Chapter 19 includes coverage of professional conduct consistent with the AICPA’s newly reorganized Code of Professional Conduct.

∙ Increased use of Practice Insights that provide a link from the textbook material to the real world. ∙ The introduction of IDEA audit software. IDEA is a powerful and user-friendly data analysis tool

designed to help auditors perform data analysis, audit sampling, and other audit procedures efficiently and effectively. IDEA is illustrated in Chapters 8 and 9 and there are end-of-chapter IDEA assignments and problems for hands-on application throughout the book.

∙ Improved descriptions of the hands-on EarthWear Mini-Cases that provide students with opportunities to apply audit professional judgment and practice audit procedures.

∙ Clarified explanations of technical business and accounting jargon. ∙ Improved linkage between chapter content and end-of-chapter material. ∙ References to auditing standards reflect the new codification of AICPA ASB clarity standards.

Here is a sampling of the improvements made in recent editions:

Chapter 1, An Introduction to Assurance and Financial Statement Auditing ∙ Discussion of fundamental concepts of auditing streamlined and clarified

Chapter 2, The Financial Statement Auditing Environment ∙ Updated to reflect changes in audit environment ∙ Includes AICPA’s “principles underlying an audit” in addition to PCAOB’s traditional set of “generally

accepted auditing standards”

Chapter 3, Audit Planning, Types of Audit Tests, and Materiality ∙ Revised engagement letter for an integrated audit ∙ Discussion of the current practices of the major auditing firms based on a recent article by Aasmund

Eilifsen and Bill Messier

Chapter 4, Risk Assessment ∙ Improved presentation of the risk assessment process ∙ Revised presentation of the fraud risk assessment process ∙ Addition of a new case based on the fraud at Koss Corporation

Give your students an intuitive, hands-on learning experience!

Final PDF to printer

x Give your students an intuitive, hands-on learning experience!

mes32502_fm_i-xxx.indd x 10/20/15 11:48 AM

Chapter 5, Evidence and Documentation ∙ Revised Advanced Module on the use of substantive analytical procedures

Chapter 6, Internal Control in a Financial Statement Audit ∙ New discussion case about the fraud in Dixon, Illinois ∙ An extension of the Koss Corporation fraud that considers the control deficiencies

Chapter 7, Auditing Internal Control over Financial Reporting ∙ Easier to understand explanations of the important steps in the audit of internal control over

financial reporting

Chapter 8, Audit Sampling: An Overview and Application to Tests of Controls ∙ Introduction of industry leading IDEA auditing software to this edition of the book with illustrations of

how to use IDEA for attribute sampling within the chapter. ∙ Updated for academic research examining audit sampling in practice

Chapter 9, Audit Sampling: An Application to Substantive Tests of Account Balances ∙ Introduction of industry leading IDEA auditing software to this edition of the book with illustrations of

how to use IDEA for monetary unit sampling within the chapter. ∙ Updated for academic research examining audit sampling in practice

Chapters 10–16, Business Process Chapters ∙ Revised for enhanced clarity and brevity ∙ Clarified illustrations linking assertions to possible misstatements to example controls and tests

of controls ∙ Updated exhibits and practice insights for recent events

Chapter 17, Completing the Audit Engagement ∙ Improved examples to illustrate the possible self-fulfilling prophecy effects of going concern opinions,

and to explain the role and impact of commitments in completing an audit ∙ Clarified discussion of auditor’s responsibility for subsequent events ∙ Enhanced discussion of evaluation of misstatements in light of qualitative materiality considerations ∙ New coverage of iron curtain versus roll-over methods of assessing materiality of misstatements

Chapter 18, Reports on Audited Financial Statements ∙ Updated for recent developments including the new “clarified” form of the ASB audit report

Chapter 19, Professional Conduct, Independence, and Quality Control ∙ Updated for changes in the newly reorganized AICPA Code of Professional Conduct ∙ Discussion of quality control and peer review/inspection updated for recent changes in

relevant standards

Chapter 20, Legal Liability ∙ Updated for important recent cases and statutory law

Chapter 21, Assurance, Attestation, and Internal Auditing Services ∙ Updated standards relating to practitioner independence in compilation engagements ∙ Attestation reports updated for new AICPA standards ∙ Updated to reflect changes in IIA standards ∙ Updated to reflect changes to structure around Trust Services principles and practices

Final PDF to printer

Give your students an intuitive, hands-on learning experience! xi

mes32502_fm_i-xxx.indd xi 10/20/15 11:48 AM

Tenth Edition Supplements

Connect instructor resources library offers:

∙ Solutions Manual, revised by William F. Messier, Jr., Steven M. Glover, and Douglas F. Prawitt ∙ Instructor’s Manual ∙ Test Bank with AACSB, AICPA, and Bloom’s Taxonomy tags ∙ Instructor PowerPoint Presentations ∙ EarthWear Mini-Case Solutions ∙ Solutions to IDEA Solutions

Addtional resources include: Links to Professional Resources, Sample Syllabi, Text Updates, and Digital Image Library

Connect student resources include: ∙ EarthWear Mini-Cases ∙ IDEA Assignments and Problems, by Messier, Glover, and Prawitt ∙ Student PowerPoint Presentations ∙ Relevant Accounting and Auditing Pronouncements by chapter ∙ Link to EarthWear Clothiers home page ∙ Link to Willis & Adams, CPAs home page

Assurance of Learning Ready Many educational institutions today are focused on the notion of assurance of learning, an important ele- ment of some accreditation standards. The Messier, Glover, and Prawitt Auditing and Assurance Services: A Systematic Approach book is designed specifically to support your assurance of learning initiatives with a simple, yet powerful, solution.

Each chapter in the book begins with a list of numbered learning objectives, which appear throughout the chapter as well as in the end-of-chapter assignments. Each test bank question for Auditing and Assurance Services: A Systematic Approach maps to a specific chapter learning outcome/objective listed in the text. Each test bank question also identifies topic area, level of difficulty, Bloom’s Taxonomy level, AACSB and AICPA skill areas. You can use Connect to easily query for learning outcomes/objectives that directly relate to the learning objectives for your course.

Final PDF to printer

xii

mes32502_fm_i-xxx.indd xii 10/20/15 11:48 AM

The continuing rapid pace of change in auditing standards and practices, together with the recent crises in the financial markets, has had a significant effect on the auditing profession. In this ever-changing environment, it is crucial that stu- dents learn from the most up-to-date, student-friendly resources. As always, the author team of Auditing & Assurance Services: A Systematic Approach is dedicated to providing the most current professional content and real-world applica- tion, as well as helping students develop professional judgment and prepare for the CPA exam.

In their 10th edition, authors Messier, Glover, and Prawitt continue to reinforce the fundamental values central to their past nine editions:

Student Engagement. The authors believe students are best served by acquiring a strong understanding of the basic concepts that underlie the audit process and how to apply those concepts to various audit and assurance services. The primary purpose for an auditing text is not to serve as a reference manual but to facilitate student learning, and this text is written accordingly. The text is accessible to students through straightforward writing and the use of engaging, relevant real-world examples, illustrations, and analogies. The text explicitly encourages students to think through fundamental concepts and to avoid trying to learn auditing through rote memorization. Students are prompted by the text to “stop and think” at important points in the text, in order to help them apply the principles covered. Consistent with this aim, the text’s early chapters avoid immersing students in unnecessary detail such as the minutia relating to all the complexities of audit reporting, focusing instead on students’ intuition relating to the fundamental audit concepts of materiality, audit risk, and audit evidence relating to management assertions. The first chapter provides a high-level introduction to what an audit report looks like while avoiding immersion in unnecessary detail. It also lays out a clear explanation and illustration of the demand for assurance and provides an understandable overview of the auditing process from start to finish. A case involving EarthWear Clothiers, a mail-order retailer, is integrated throughout the book and additional student resources and includes free student access to several useful hands-on mini-cases, with full solutions available to the instructor. Finally, “practice insights” throughout the book engage students and help them see the application of concepts in a practical setting.

A Systematic Approach. The text continues to take a systematic approach to the audit process by first introducing the three underlying concepts: audit risk, materiality, and evidence. This is followed by a discussion of audit planning, the assessment of control risk, and a discussion of the nature, timing, and extent of evidence necessary to reach the appropriate level of detection risk. These concepts are then applied to each major business process and related account balances using a risk-based approach. The text has been revised to include the risk assessment process included in the standards adopted by the Auditing Standards Board and the International Auditing and Assurance Standards Board, as well as the PCAOB’s newly adopted Risk Assessment Standards.

Decision Making. In covering these important concepts and their applications, the book focuses on critical judg- ments and decision-making processes followed by auditors. Much of auditing practice involves the application of auditor judgment. If a student understands these basic concepts and how to apply them to an audit engagement, he or she will be more effective in today’s dynamic audit environment. Two of the authors of this textbook recently worked with KPMG to develop a monograph designed to accelerate the development of professional judgment in students. We are very excited to include in this edition a “professional judgment” module as part of the printed material in the text. This module is based on the KPMG Professional Judgment monograph, which was awarded the 2013 AAA Deloitte/Wildman award for the work published within the most recent five-year period that has had the most significant impact on the practice of professional accountancy. Access to additional directly related resources, including videos, mini-cases, and problems, are available on KPMG’s University Connection website for integration into the auditing course, as instructors see fit.

How does 10e prepare your students?

Final PDF to printer

xiii

mes32502_fm_i-xxx.indd xiii 10/20/15 11:48 AM

Free IDEA software

The educational version of IDEA software is avail- able for free with each new book. IDEA is new to this edition and the authors wrote chapter-specific IDEA assignments and problems, all of which are found inside Connect. Exposing students to IDEA allows them the opportunity to work with real professional audit software.

Real-World Integration and Hands-On Mini-Cases.

Mini EarthWear cases “Hands-on” mini-cases are integrated throughout the text. Enhanced case descriptions and a new mini-case on the search for unrecorded liabilities were added this edition. The mini-cases are also available in Connect, giving your students the opportunity to actually do some common audit- ing procedures.

Practical applications for the modern student

Rev. Confirming Pages

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 29

mes32502_ch01_001-034.indd 29 09/30/15 02:33 PM

know, if the securities acts had not been passed by Congress in the 1930s, no one would be interested in having an audit performed.”

Required: Draft a memo that highlights your thoughts about Lee’s statement that audits only

take place because they are required by law.

INTERNET ASSIGNMENT

LO 1-1, 1-9 1-30 Using an Internet browser, identify five Internet sites that contain accounting or auditing resources. For each site identified, prepare a brief summary of the types of information that are available. For example, the PCAOB’s home page (www.pcaobus.org) contains extensive information on the organization’s activities (you may use the PCAOB site as one of the five). Your five summaries should not exceed a total of one typed page.

HANDS-ON CASES

EarthWear Online

EarthWear Introduction In this activity you will become further acquainted with EarthWear Clothiers and their auditors Willis and Adams. This introductory activity also provides an opportunity to become familiar with the structure and format of the EarthWear Online cases.

Visit Connect’s additional student resources to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Rev. Confirming Pages

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 7

mes32502_ch01_001-034.indd 7 09/30/15 02:33 PM

adds credibility to the report and reduces information risk, or the risk that information cir- culated by a company’s management will be false or misleading. Reducing information risk potentially benefits both the owner and the manager. Figure 1–1 provides an overview of this agency relationship.

While the setting we’ve outlined is very simple, understanding the basics of the owner– manager relationship is helpful in understanding the demand for auditing. The principal– agent model is a powerful conceptual tool that can be extrapolated to much more complex employment and other contractual arrangements. For example, how can a lender prevent management from taking the borrowed funds and using them inappropriately? One way is to place restrictive covenants in the debt agreement with which the entity and its management must comply. Again, this arrangement gives rise to a demand for the auditing of information reported by management to the lender.

Overview of the Principal–Agent Relationship Leading to the Demand for Auditing

F I G U R E 1 – 1

Auditor gathers evidence to evaluate fairness of agent’s financial reports. Auditor issues audit opinion to accompany agent’s financial reports, adding credibility to the reports and reducing principal’s information risk.

Principal provides capital and hires agent to manage resources.

Information asymmetry and conflicts of interest lead to information risk

for the principal.

Agent is accountable to principal; provides financial reports. Agent hires auditor

to report on the fairness of agent’s

financial reports. Agent pays auditor

to reduce principal’s information risk.

Auditor

Agent (Manager)

Principal (Absentee Owner)

Practice I N S I G H T

At the heart of a capital-market economy is the flow of reliable information, which investors, credi- tors, and regulators use to make informed decisions. Chief Justice Warren Burger gave his view of the significance of the audit function in a 1984 Supreme Court decision:

By certifying the public reports that collectively depict a corporation’s financial status, the indepen- dent auditor assumes a public responsibility transcending any employment relationship with the cli- ent. The independent public accountant performing this special function owes ultimate allegiance to the corporation’s creditors and stockholders, as well as to the investing public.

More than 30 years later, the message is the same—users of financial statements rely on the external auditor to act with honor and integrity in protecting the public interest.

Rev. Confirming Pages

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 29

mes32502_ch01_001-034.indd 29 09/30/15 02:33 PM

know, if the securities acts had not been passed by Congress in the 1930s, no one would be interested in having an audit performed.”

Required: Draft a memo that highlights your thoughts about Lee’s statement that audits only

take place because they are required by law.

INTERNET ASSIGNMENT

HANDS-ON CASES

EarthWear Online

Visit Connect’s additional student resources to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Practice Insights Practice Insights in each chapter highlight important and interesting real-world trends and practices.

AACSB Statement McGraw-Hill Education is a proud corporate member of AACSB International. Understanding the importance and value of AACSB accreditation, Auditing and Assurance Services 10e recognizes the curricula guidelines detailed in the AACSB stan- dards for business accreditation by connecting selected questions in the text and test bank to the six general knowledge and skill guidelines in the AACSB standards. The statements contained in Auditing and Assurance Services 10e are provided only as a guide for the users of this textbook. The AACSB leaves content coverage and assessment within the purview of individual schools, the mission of the school, and the faculty. While Auditing and Assurance Services 10e and the teaching package make no claim of any specific AACSB qualification or evaluation, we have within Auditing and Assurance Services 10e labeled selected questions according to the six general knowledge and as a helpful starting point.

Final PDF to printer

Required=Results

mes32502_fm_i-xxx.indd xiv 10/20/15 11:48 AM

McGraw-Hill Connect® Learn Without Limits Connect is a teaching and learning platform that is proven to deliver better results for students and instructors.

Connect empowers students by continually adapting to deliver precisely what they need, when they need it, and how they need it, so your class time is more engaging and effective.

Mobile

Connect Insight® Connect Insight is Connect’s new one-of-a-kind visual analytics dashboard—now available for both instructors and students—that provides at-a-glance information regarding student performance, which is immediately actionable. By presenting assignment, assessment, and topical performance results together with a time metric that is easily visible for aggregate or individual results, Connect Insight gives the user the ability to take a just-in- time approach to teaching and learning, which was never before available. Connect Insight presents data that empowers students and helps instructors improve class performance in a way that is efficient and effective.

88% of instructors who use Connect require it; instructor satisfaction increases

by 38% when Connect is required.

Students can view their results for any

Connect course.

Analytics

Using Connect improves passing rates by 10.8% and retention by 16.4%.

Connect’s new, intuitive mobile interface gives students and instructors flexible and convenient, anytime–anywhere access to all components of the Connect platform.

Final PDF to printer

mes32502_fm_i-xxx.indd xv 10/20/15 11:48 AM

SmartBook® Proven to help students improve grades and study more efficiently, SmartBook contains the same content within the print book, but actively tailors that content to the needs of the individual. SmartBook’s adaptive technology provides precise, personalized instruction on what the student should do next, guiding the student to master and remember key concepts, targeting gaps in knowledge and offering customized feedback, and driving the student toward comprehension and retention of the subject matter. Available on smartphones and tablets, SmartBook puts learning at the student’s fingertips—anywhere, anytime.

Adaptive

Over 4 billion questions have been answered, making McGraw-Hill

Education products more intelligent, reliable, and precise.

THE FIRST AND ONLY ADAPTIVE READING EXPERIENCE DESIGNED TO TRANSFORM THE WAY STUDENTS READ

More students earn A’s and B’s when they use McGraw-Hill Education Adaptive products.

Final PDF to printer

xvi

mes32502_fm_i-xxx.indd xvi 10/20/15 11:48 AM

First and foremost, we thank our families for their continuous and unfailing support. We would like to acknowledge the American Institute of Certified Public Accountants for permission to quote from auditing standards, the Code of Professional Conduct, the Uniform CPA Examination, and the Journal of Accountancy. We would like to thank CaseWare IDEA for granting permission to distribute the educational version of IDEA software with our textbook. We would also like to thank Cassy Budd of Brigham Young University for her help with updating the Test Bank, Instructor’s Manual, Quizzes, and PowerPoints; and Jonathan Liljegren for revision of the EarthWear Mini-Cases. Finally, we would like to extend our gratitude to Christina Brenchley, Scott Jackson, and Andrew Glover for their research assistance.

Acknowledgments

Final PDF to printer

xvii

mes32502_fm_i-xxx.indd xvii 10/20/15 11:48 AM

Brief Contents

PART 1 Introduction to Assurance and Financial Statement Auditing 1

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 2

Chapter 2 The Financial Statement Auditing Environment 36

PART 2 Audit Planning and Basic Auditing Concepts 67

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 68

Chapter 4 Risk Assessment 98

Chapter 5 Evidence and Documentation 128

PART 3 Understanding and Auditing Internal Control 177

Chapter 6 Internal Control in a Financial Statement Audit 178

Chapter 7 Auditing Internal Control over Financial Reporting 220

PART 4 Statistical and Nonstatistical Sampling Tools for Auditing 261

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 262

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 300

PART 5 Auditing Business Processes 337

Chapter 10 Auditing the Revenue Process 338

Chapter 11 Auditing the Purchasing Process 386

Chapter 12 Auditing the Human Resource Management Process 422

Chapter 13 Auditing the Inventory Management Process 450

Final PDF to printer

xviii Brief Contents

mes32502_fm_i-xxx.indd xviii 10/20/15 11:48 AM

Chapter 14 Auditing the Financing/Investing Process: Prepaid Expenses, Intangible Assets, and Property, Plant, and Equipment 480

Chapter 15 Auditing the Financing/Investing Process: Long-Term Liabilities, Stockholders’ Equity, and Income Statement Accounts 506

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 528

PART 6 Completing the Audit and Reporting Responsibilities 561

Chapter 17 Completing the Audit Engagement 562

Chapter 18 Reports on Audited Financial Statements 596

PART 7 Professional Responsibilities 627

Chapter 19 Professional Conduct, Independence, and Quality Control 628

Chapter 20 Legal Liability 672

PART 8 Assurance, Attestation, and Internal Auditing Services 707

Chapter 21 Assurance, Attestation, and Internal Auditing Services 708

Advanced Module: Professonal Judgment Framework—Understanding and Developing Professional Judgment in Auditing 748 (Also visit KPMG’s University Connection website for relevant resources, including videos, mini-cases, instructor notes, and problems, that were created to accompany the AAA Deloitte/ Wildman award-winning KPMG Professional Judgment Framework monograph, on which this module is based.)

Index 757

Final PDF to printer

xix

mes32502_fm_i-xxx.indd xix 10/23/15 07:45 AM

Table of Contents

PART 1 Introduction to Assurance and Financial Statement Auditing 1

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 2

Tips for Learning Auditing 4 The Demand for Auditing and Assurance 5

Principals and Agents 5

The Role of Auditing 6

An Assurance Analogy: The Case of the House Inspector 8

Seller Assertions, Information Asymmetry, and

Inspector Characteristics 8

Desired Characteristics of the House Inspection

Service 8

Relating the House Inspection Analogy to

Financial Statement Auditing 9

Management Assertions and Financial

Statements 10

Auditing, Attest, and Assurance Services Defined 12 Auditing 12

Attestation 13

Assurance 13

Fundamental Concepts in Conducting a Financial Statement Audit 14

Materiality 14

Audit Risk 15

Audit Evidence Regarding Management Assertions 16

Sampling: Inferences Based on Limited Observations 16

The Audit Process 17 Overview of the Financial Statement Auditing

Process 17

Major Phases of the Audit 18

The Unqualified/Unmodified Audit Report 21

Other Types of Audit Reports 22

Conclusion 23 Key Terms 24 Review Questions 25 Multiple-Choice Questions 25 Problems 27 Discussion Case 28 Internet Assignment 29 Hands-On Cases 29

Chapter 2 The Financial Statement Auditing Environment 36

Types of Auditors 38 External Auditors 38

Internal Auditors 38

Government Auditors 39

Forensic Auditors 40

Types of Other Audit, Attest, and Assurance Services 40

Other Audit Services 40

Attest Services 41

Assurance Services 41

Other Nonaudit Services 42

Public Accounting Firms 42 Organization and Composition 42

A Decade of Challenge and Change for Financial Statement Auditors 44

Government Regulation 44

Society’s Expectations and the Auditor’s Responsibilities 45

The Context of Financial Statement Auditing 45 The Business Entity as the Primary Context of

Auditing 45

A Model of Business 46 Corporate Governance 46

Objectives, Strategies, Processes, Controls,

Transactions, and Reports 48

A Model of Business Processes: Five

Components 48

Final PDF to printer

xx Table of Contents

mes32502_fm_i-xxx.indd xx 10/20/15 11:48 AM

Organizations That Affect the Public Accounting Profession 49

Securities and Exchange Commission (SEC) 51

Public Company Accounting Oversight Board

(PCAOB) 51

American Institute of Certified Public Accountants

(AICPA) 51

International Auditing and Assurance Standards

Board (IAASB) 52

Financial Accounting Standards Board

(FASB) 52

International Accounting Standards Board

(IASB) 52

Auditing Standards 52 Three Sets of Auditing Standards: The Roles of the

ASB, PCAOB, and IAASB 53

The 10 Generally Accepted Auditing Standards 53

Principles Underlying an Audit Conducted in

Accordance with Generally Accepted Auditing

Standards 55

Statements on Auditing Standards and the AU

Codification 55

Ethics, Independence, and the Code of Professional Conduct 57

Conclusion 58 Key Terms 58 Review Questions 59 Multiple-Choice Questions 60 Problems 62 Discussion Cases 64 Internet Assignments 65 Hands-On Cases 66

PART 2 Audit Planning and Basic Auditing Concepts 67

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 68

Client Acceptance and Continuance 70 Prospective Client Acceptance 70

Client Continuance 71

Preliminary Engagement Activities 71 Determine the Audit Engagement Team

Requirements 71

Assess Compliance with Ethical and Independence

Requirements 72

Establish an Understanding with the Entity 72

Planning the Audit 78 Audit Strategy and Plan 78

Assess Business Risks 78

Establish Materiality 78

Consider Multilocations or Business Units 79

Assess the Need for Specialists 79

Consider Violations of Laws and

Regulations 79

Identify Related Parties 80

Consider Additional Value-Added Services 81

Document the Overall Audit Strategy, Audit Plan,

and Prepare Audit Programs 81

Supervision of the Audit 83 Types of Audit Tests 83

Risk Assessment Procedures 83

Tests of Controls 83

Substantive Procedures 84

Dual-Purpose Tests 84

Materiality 85 Steps in Applying Materiality 86

An Example 88

Key Terms 90 Review Questions 90 Multiple-Choice Questions 91 Problems 92 Discussion Case 95 Internet Assignments 95 Hands-On Cases 96

Chapter 4 Risk Assessment 98

Audit Risk 100 The Audit Risk Model 100

Use of the Audit Risk Model 102

The Auditor’s Risk Assessment Process 104 Management’s Strategies, Objectives, and Business

Risks 104

Auditor’s Risk Assessment Procedures 105

Assessing Business Risks 106

Evaluate the Entity’s Risk Assessment

Process 109

Assessing the Risk of Material Misstatement 109 Causes and Types of Misstatements 110

The Fraud Risk Assessment Process 111

Final PDF to printer

Table of Contents xxi

mes32502_fm_i-xxx.indd xxi 10/20/15 11:48 AM

Examples of Audit Documentation 148

Format of Audit Documentation 150

Organization of Audit Documentation 151

Ownership of Audit Documentation 151

Audit Document Archiving and

Retention 151

Substantive Analytical Procedures 154

Final Analytical Procedures 162

Short-Term Liquidity Ratios 163

Activity Ratios 163

Profitability Ratios 164

Coverage Ratios 165

Key Terms 165 Review Questions 166 Multiple-Choice Questions 167 Problems 169 Discussion Cases 172 Internet Assignment 174 Hands-On Cases 174

PART 3 Understanding and Auditing Internal Control 177

Chapter 6 Internal Control in a Financial Statement Audit 178

Introduction 180 Internal Control—an Overview 180

Definition of Internal Control 180

Controls Relevant to the Audit 180

The Effect of Information Technology on Internal

Control 181

The COSO Framework 181 Components of Internal Control 181

Control Environment 182

The Entity’s Risk Assessment Process 185

Control Activities 186

Information and Communication 188

Monitoring of Controls 189

Planning an Audit Strategy 189 Substantive Strategy 191

Reliance Strategy 192

Obtain an Understanding of Internal Control 193 Overview 193

Understanding the Control Environment 193

The Auditor’s Response to the Results of the Risk Assessments 115

Evaluation of Audit Test Results 117 Documentation of the Auditor’s Risk Assessment and

Response 118 Communications about Fraud to Management, the

Audit Committee, and Others 118 Key Terms 120 Review Questions 121 Multiple-Choice Questions 121 Problems 123 Discussion Case 125 Internet Assignment 126 Hands-On Cases 127

CHAPTER 5 Evidence and Documentation 128

The Relationship of Audit Evidence to the Audit Report 130

Management Assertions 131 Assertions about Classes of Transactions and

Events during the Period 131

Assertions about Account Balances at the Period

End 133

Assertions about Presentation and

Disclosure 134

The Concepts of Audit Evidence 135 The Nature of Audit Evidence 135

The Sufficiency and Appropriateness of Audit

Evidence 135

The Evaluation of Audit Evidence 137

Audit Procedures for Obtaining Audit Evidence 138 Inspection of Records or Documents 138

Inspection of Tangible Assets 139

Observation 140

Inquiry 140

Confirmation 141

Recalculation 141

Reperformance 142

Analytical Procedures 142

Scanning 142

Reliability of the Types of Evidence 142 The Audit Testing Hierarchy 143

An “Assurance Bucket” Analogy 145

Audit Documentation 146 Functions of Audit Documentation 146

Content of Audit Documentation 147

Final PDF to printer

xxii Table of Contents

mes32502_fm_i-xxx.indd xxii 10/20/15 11:48 AM

Control Deficiency 223

Material Weakness 223

Significant Deficiency 223

Likelihood and Magnitude 223

Management’s Assessment Process 225 Identify Financial Reporting Risks and Related

Controls 225

Consider Which Locations to Include in the

Evaluation 226

Evaluate Evidence about the Operating

Effectiveness of ICFR 226

Reporting Considerations 226

Management’s Documentation 227

Performing an Audit of ICFR 228 Plan the Audit of ICFR 229

The Role of Risk Assessment and the Risk of

Fraud 229

Scaling the Audit 230

Using the Work of Others 230

Identify Controls to Test 231 Identify Entity-Level Controls 231

Identifying Significant Accounts and Disclosures

and Their Relevant Assertions 232

Understanding Likely Sources of

Misstatements 232

Select Controls to Test 233

Evaluate the Design and Test the Operating Effectiveness of Controls 234

Evaluating Design Effectiveness of Controls 234

Testing and Evaluating Operating Effectiveness of

Controls 234

Evaluating Identified Control Deficiencies 236 Examples of Control Deficiency Evaluation 237

Remediation of a Material Weakness 239 Written Representations 239 Auditor Documentation Requirements 240 Auditor Reporting on ICFR 240

Elements of the Auditor’s Report 241

Unqualified Report 241

Adverse Report for a Material Weakness 241

Disclaimer for Scope Limitation 242

Other Reporting Issues 244 Management’s Report Incomplete or Improperly

Presented 244

The Auditor Decides to Refer to the Report of

Other Auditors 244

Subsequent Events 245

Understanding the Entity’s Risk Assessment

Process 194

Understanding the Information System and

Communications 195

Understanding Control Activities 195

Understanding Monitoring of Controls 195

Documenting the Understanding of Internal

Control 196

The Effect of Entity Size on Internal Control 196

The Limitations of an Entity’s Internal

Control 197

Assessing Control Risk 199 Identifying Specific Controls That Will Be Relied

Upon 199

Performing Tests of Controls 199

Concluding on the Achieved Level of Control

Risk 200

Documenting the Achieved Level of Control

Risk 200

An Example 200

Substantive Procedures 201 Timing of Audit Procedures 202

Interim Tests of Controls 202

Interim Substantive Procedures 203

Auditing Accounting Applications Processed by Service Organizations 203

Communication of Internal Control–Related Matters 204

General Controls 206

Application Controls 207

Symbols 209

Organization and Flow 210

Key Terms 211 Review Questions 211 Multiple-Choice Questions 212 Problems 214 Discussion Cases 216 Hands-On Cases 218

Chapter 7 Auditing Internal Control over Financial Reporting 220

Management Responsibilities under Section 404 222 Auditor Responsibilities under Section 404 and AS5 222 Internal Control over Financial Reporting

Defined 222 Internal Control Deficiencies Defined 223

Final PDF to printer

Table of Contents xxiii

mes32502_fm_i-xxx.indd xxiii 10/20/15 11:48 AM

Key Terms 290 Review Questions 291 Multiple-Choice Questions 292 Problems 294 Discussion Case 297 Hands-On Cases 298

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 300

Sampling for Substantive Tests of Details of Account Balances 302

Monetary-Unit Sampling 303 Advantages 304

Disadvantages 304

Applying Monetary-Unit Sampling 304

Planning 304

Performance 308

Evaluation 310

Nonstatistical Sampling for Tests of Account Balances 318

Identifying Individually Significant Items 318

Determining the Sample Size 318

Selecting Sample Items 319

Calculating the Sample Results 319

An Example of Nonstatistical Sampling 320

Advantages 324

Disadvantages 324

Applying Classical Variables Sampling 324

Key Terms 328 Review Questions 329 Multiple-Choice Questions 330 Problems 331 Discussion Cases 335 Hands-On Cases 336

PART 5 Auditing Business Processes 337

Chapter 10 Auditing the Revenue Process 338

Revenue Recognition 341 Overview of the Revenue Process 342

Types of Transactions and Financial Statement

Accounts Affected 343

Types of Documents and Records 345

Management’s Report Contains Additional

Information 245

Reporting on a Remediated Material Weakness at

an Interim Date 245

Additional Required Communications in an Audit of ICFR 245

Use of Service Organizations 246

Safeguarding of Assets 247

Generalized Audit Software 247

Custom Audit Software 248

Test Data 249

Key Terms 249 Review Questions 250 Multiple-Choice Questions 251 Problems 253 Internet Assignments 259 Hands-On Cases 259

PART 4 Statistical and Nonstatistical Sampling Tools for Auditing 261

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 262

Overview of Audit Sampling 264 Definitions and Key Concepts 265

Audit Sampling 265

Sampling Risk 265

Confidence Level 267

Tolerable and Expected Error 267

Audit Evidence Choices That Do and Do Not

Involve Sampling 268

Types of Audit Sampling 269 Nonstatistical versus Statistical Sampling 269

Types of Statistical Sampling Techniques 270

Attribute Sampling Applied to Tests of Controls 271 Planning 271

Performance 279

Evaluation 283

Nonstatistical Sampling for Tests of Controls 287 Determining the Sample Size 287

Selecting the Sample Items 288

Calculating the Computed Upper Deviation

Rate 288

Conclusion 289

Final PDF to printer

xxiv Table of Contents

mes32502_fm_i-xxx.indd xxiv 10/20/15 11:48 AM

Timing 372

Confirmation Procedures 373

Alternative Procedures 374

Auditing Other Receivables 374 Evaluating the Audit Findings—Revenue-Related

Accounts 375 Key Terms 375 Review Questions 376 Multiple-Choice Questions 377 Problems 379 Discussion Cases 382 Internet Assignments 383 Hands-On Cases 383

Chapter 11 Auditing the Purchasing Process 386

Expense and Liability Recognition 388 Overview of the Purchasing Process 388

Types of Transactions and Financial Statement

Accounts Affected 389

Types of Documents and Records 390

The Major Functions 393

The Key Segregation of Duties 395

Inherent Risk Assessment 396 Industry-Related Factors 396

Misstatements Detected in Prior Audits 396

Control Risk Assessment 396 Understand and Document Internal Control 396

Plan and Perform Tests of Controls 398

Set and Document Control Risk 398

Control Activities and Tests of Controls—Purchase Transactions 398

Occurrence of Purchase Transactions 399

Completeness of Purchase Transactions 399

Authorization of Purchase Transactions 400

Accuracy of Purchase Transactions 401

Cutoff of Purchase Transactions 401

Classification of Purchase Transactions 401

Control Activities and Tests of Controls—Cash Disbursement Transactions 402

Occurrence of Cash Disbursement

Transactions 402

Completeness of Cash Disbursement

Transactions 402

Authorization of Cash Disbursement Transactions 402

Accuracy of Cash Disbursement Transactions 402

Cutoff of Cash Disbursement Transactions 403

The Major Functions 349

Key Segregation of Duties 350

Inherent Risk Assessment 351 Industry-Related Factors 351

The Complexity and Contentiousness of Revenue

Recognition Issues 352

The Difficulty of Auditing Transactions and

Account Balances 352

Misstatements Detected in Prior Audits 352

Control Risk Assessment 353 Understand and Document Internal Control 353

Plan and Perform Tests of Controls 354

Set and Document Control Risk 354

Control Activities and Tests of Controls—Revenue Transactions 355

Occurrence of Revenue Transactions 355

Completeness of Revenue Transactions 357

Authorization of Revenue Transactions 357

Accuracy of Revenue Transactions 357

Cutoff of Revenue Transactions 358

Classification of Revenue Transactions 358

Control Activities and Tests of Controls—Cash Receipts Transactions 358

Occurrence of Cash Receipts Transactions 358

Completeness of Cash Receipts Transactions 359

Authorization of Cash Discounts 360

Accuracy of Cash Receipts Transactions 361

Cutoff of Cash Receipts Transactions 361

Classification of Cash Receipts 361

Control Activities and Tests of Controls—Sales Returns and Allowances Transactions 361

Relating the Assessed Level of Control Risk to Substantive Procedures 362

Auditing Revenue-Related Accounts 362 Substantive Analytical Procedures 363 Tests of Details of Classes of Transactions, Account

Balances, and Disclosures 364 Completeness 364

Cutoff 366

Existence 367

Rights and Obligations 367

Valuation and Allocation 368

Classification 369

Other Presentation and Disclosure

Assertions 470

Evaluating the Audit Findings—Inventory 471 Key Terms 471 Review Questions 472 Multiple-Choice Questions 472 Problems 474 Discussion Case 478 Internet Assignment 479 Hands-On Cases 479

Chapter 14 Auditing the Financing/Investing Process: Prepaid Expenses, Intangible Assets, and Property, Plant, and Equipment 480

Auditing Prepaid Expenses 482 Inherent Risk Assessment—Prepaid Expenses 482 Control Risk Assessment—Prepaid Expenses 482 Substantive Procedures—Prepaid Insurance 483

Substantive Analytical Procedures for Prepaid

Insurance 483

Tests of Details of the Prepaid Insurance 484

Existence and Completeness 484

Rights and Obligations 484

Valuation 484

Classification 484

Auditing Intangible Assets 484 Inherent Risk Assessment—Intangible Assets 485 Control Risk Assessment—Intangible Assets 486 Substantive Procedures—Intangible Assets 486

Substantive Analytical Procedures for Intangible

Assets 486

Tests of Details of Intangible Assets 487

Final PDF to printer

Table of Contents xxvii

mes32502_fm_i-xxx.indd xxvii 10/23/15 07:45 AM

Tests of Details—Investments 546

Understanding How Management Makes Fair

Value Measurements 550

Considering Whether Specialized Skills or

Knowledge Is Required 550

Testing the Entity’s Fair Value

Measurements 550

Evaluating the Reasonableness of the Fair Value

Measurements 551

Key Terms 551 Review Questions 552 Multiple-Choice Questions 553 Problems 555 Internet Assignment 559 Hands-On Case 559

PART 6 Completing the Audit and Reporting Responsibilities 561

Chapter 17 Completing the Audit Engagement 562

Review for Contingent Liabilities 564 Audit Procedures for Identifying Contingent

Liabilities 565

Legal Letters 565

Commitments 567 Review of Subsequent Events for Audit of Financial

Statements 568 Dual Dating 570

Audit Procedures for Subsequent Events 571

Review of Subsequent Events for the Audit of Internal Control over Financial Reporting 571

Final Steps and Evidence Evaluation 572 Final Analytical Procedures 572

Representation Letter 573

Working Paper Review 573

Final Evaluation of Audit Results 576

Evaluating Financial Statement Presentation and

Disclosure 578

Independent Engagement Quality Review 579

Archiving and Retention 579

Going Concern Considerations 579

Communications with Those Charged with Governance and Management 582

Valuation 516

Completeness of Disclosures 516

Auditing Dividends 516 Auditing Retained Earnings 517 Auditing Income Statement Accounts 517 Assessing Control Risk for Business Processes—

Income Statement Accounts 518 Substantive Procedures—Income Statement

Accounts 518 Direct Tests of Balance Sheet Accounts 518

Substantive Analytical Procedures for Income

Statement Accounts 518

Tests of Selected Account Balances 519

Key Terms 520 Review Questions 521 Multiple-Choice Questions 521 Problems 523 Discussion Case 525 Internet Assignment 526 Hands-On Cases 526

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 528

Auditing Cash 530 Types of Bank Accounts 531

General Cash Account 531

Imprest Cash Accounts 531

Branch Accounts 531

Control Risk Assessment—Cash 532 Substantive Procedures—Cash 532

Substantive Analytical Procedures—Cash 532

Substantive Tests of Details of Transactions and

Balances—Cash 532

Auditing the General Cash Account 533

Fraud-Related Audit Procedures 538

Auditing a Payroll or Branch Imprest

Account 541

Auditing a Petty Cash Fund 541

Disclosure Issues for Cash 542

Auditing Investments 543 Control Risk Assessment—Investments 543

Assertions and Related Control Activities 544

Segregation of Duties 545

Substantive Procedures—Investments 545 Substantive Analytical

Procedures—Investments 545

Final PDF to printer

xxviii Table of Contents

mes32502_fm_i-xxx.indd xxviii 10/20/15 11:48 AM

Report by a Predecessor Auditor 613

Other Information in Documents Containing Audited Financial Statements 613

Special Reports Relating to Financial Statements 614 Financial Statements Prepared According to a

Special Purpose Framework 614

Specified Elements, Accounts, or Items of a

Financial Statement 615

Compliance Reports Related to Audited Financial

Statements 615

Big Changes Coming to Audit Reporting 616 Key Terms 618 Review Questions 618 Multiple-Choice Questions 619 Problems 621 Discussion Case 625 Hands-On Cases 626

PART 7 Professional Responsibilities 627

Chapter 19 Professional Conduct, Independence, and Quality Control 628

Ethics and Professional Conduct 630 Ethics and Professionalism Defined 630

Theories of Ethical Behavior 631

Example—an Ethical Challenge 632

An Overview of Ethics and Professionalism in Public Accounting 634

A Tale of Two Companies 634

Standards for Auditor Professionalism 635

The Newly Revised AICPA Code of Professional Conduct: A Comprehensive Framework for Auditors 636

Principles of Professional Conduct 638

Rules of Conduct 639

Integrity, Objectivity, and Independence 640 Integrity and Objectivity—Framework, Rule, and

Interpretations 640

Independence 641

Other Sections of the Code of Professional Conduct 653

General Standards and Accounting

Principles 653

Responsibilities to Clients 654

Communications Regarding the Audit of Internal

Control over Financial Reporting 583

Management Letter 584

Subsequent Discovery of Facts Existing at the Date of the Auditor’s Report 584

Key Terms 585 Review Questions 586 Multiple-Choice Questions 586 Problems 588 Discussion Cases 592 Internet Assignments 595 Hands-On Cases 595

Chapter 18 Reports on Audited Financial Statements 596

Reporting on the Financial Statement Audit: The Standard Unqualified/Unmodified Audit Report 598

The Standard Unqualified Audit Report for Public

Companies 598

The Standard Unmodified Audit Report for All

Entities Other Than Public Companies 599

Explanatory Language Added to the Standard Unqualified/Unmodified Financial Statement Audit Report 600

Modified Wording for Opinion Based in Part on

the Report of Another Auditor 600

Circumstances Requiring Explanatory Language

in an Additional Paragraph 601

Departures from an Unqualified/Unmodified Financial Statement Audit Report 604

Conditions for Departure 605

Types of Financial Statement Audit Reports Other

Than Unqualified/Unmodified 605

The Effect of Materiality on Financial Statement

Reporting 606

Discussion of Conditions Requiring Other Types of Financial Statement Audit Reports 607

Scope Limitation 607

Statements Not in Conformity with GAAP 609

Auditor Not Independent 610

Special Reporting Issues 611 Reports on Comparative Financial Statements 611

Different Reports on Comparative Financial

Statements 611

A Change in Report on the Prior-Period Financial

Statements 612

Final PDF to printer

Table of Contents xxix

mes32502_fm_i-xxx.indd xxix 10/23/15 07:45 AM

Discussion Cases 706 Hands-On Cases 706

PART 8 Assurance, Attestation, and Internal Auditing Services 707

Chapter 21 Assurance, Attestation, and Internal Auditing Services 708

Assurance Services 710 Types of Assurance Services 711

Attest Engagements 711 Types of Attest Engagements 712

Attestation Standards 713 General Standards 713

Standards of Fieldwork 715

Standards of Reporting 715

Reporting on an Entity’s Internal Control over Financial Reporting (ICFR) 715

Conditions for Conducting an Engagement

Relating to ICFR 716

Examination Engagement on an Entity’s

ICFR 716

Reporting on Management’s Assertion about

Internal Control 716

Financial Forecasts and Projections 717 Types of Prospective Financial Statements 717

Examination of Prospective Financial

Statements 718

Agreed-Upon Procedures for Prospective Financial

Statements 719

Compilation of Prospective Financial

Statements 720

Accounting and Review Services 722 Compilation of Financial Statements 723

Review of Financial Statements 724

Internal Auditing 726 Internal Auditing Defined 727

The Institute of Internal Auditors 727

IIA Standards 727

Code of Ethics 728

Internal Auditors’ Roles 729

Internal Audit Product Offerings 732

Interactions between Internal and External

Auditors 732

Other Responsibilities and Practices 655

Disciplinary Actions 657

Don’t Lose Sight of the Forest for the Trees 657

Quality Control Standards 658 System of Quality Control 659

Elements of Quality Control 659

PCAOB Inspections of Registered Public

Accounting Firms 661

Key Terms 661 Review Questions 663 Multiple-Choice Questions 663 Problems 666 Discussion Cases 668 Internet Assignment 669 Hands-On Cases 670

Chapter 20 Legal Liability 672

Introduction 674 Historical Perspective 674

Overview of Auditor Legal Liability 675

Common Law—Clients 677 Breach of Contract—Client Claims 677

Negligence—Client Claims 677

Fraud—Client Claims 679

Common Law—Third Parties 680 Ordinary Negligence—Third-Party Claims 680

Fraud and Gross Negligence—Third-Party

Claims 686

Damages under Common Law 687

Statutory Law—Civil Liability 688 Securities Act of 1933 688

Securities Exchange Act of 1934 689

Private Securities Litigation Reform Act of 1995,

the Securities Litigation Uniform Standards Act

of 1998, and the Class Action Fairness Act of

2005 693

Sarbanes-Oxley Act of 2002 695

SEC and PCAOB Sanctions 695

Foreign Corrupt Practices Act 697

Racketeer Influenced and Corrupt

Organizations Act 697

Statutory Law—Criminal Liability 698 Key Terms 699 Review Questions 700 Multiple-Choice Questions 700 Problems 703

Final PDF to printer

xxx Table of Contents

mes32502_fm_i-xxx.indd xxx 10/20/15 11:48 AM

Advanced Module: Professonal Judgment Framework—Understanding and Developing Professional Judgment in Auditing 748 (Also visit KPMG’s University Connection website to access related resources, including videos, mini-cases, instructor notes, and problems, that were created to accompany the Deloitte/Wildman award-winning KPMG Professional Judgment Framework monograph, on which this module is based.)

Index 757

Advanced Module: Examples of Assurance Services— Trust Services and PrimePlus Services 734

Trust Services 734

Trust Services and SOC 2 and SOC 3

Reports 735

CPA WebTrust 735

CPA PrimePlus Services 738

Key Terms 739 Review Questions 739 Multiple-Choice Questions 740 Problems 742 Discussion Case 746 Internet Assignments 746 Hands-On Cases 747

Final PDF to printer

mes32502_ch01_001-034.indd 1 09/30/15 02:33 PM

PART ONE

Introduction to Assurance and Financial Statement Auditing

CHAPTER 1 An Introduction to Assurance and Financial Statement Auditing

CHAPTER 2 The Financial Statement Auditing Environment

Final PDF to printer

mes32502_ch01_001-034.indd 2 09/30/15 02:33 PM

CHAPTER

1 1-1 Understand why studying auditing can be valuable to you

whether or not you plan to become an auditor, and why it is different from studying accounting.

1-2 Understand the demand for auditing and be able to explain the desired characteristics of auditors and audit services through an analogy to a house inspector and a house inspection service.

1-3 Understand the relationships among auditing, attestation, and assurance services.

1-4 Know the basic definition of a financial statement audit.

1-5 Understand three fundamental concepts that underlie financial statement auditing.

1-6 Be able to explain why on most audit engagements an auditor tests only a sample of transactions that occurred.

1-7 Be able to describe the basic financial statement auditing process and the phases in which an audit is carried out.

1-8 Know what an audit report is and understand the nature of an unqualified report.

1-9 Understand why auditing demands logic, reasoning, and resourcefulness.

AU-C 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with GAAS AU-C 210, Terms of Engagement AU-C 450, Evaluation of Misstatements Identified During an Audit AU-C 700, Forming an Opinion and Reporting on Financial Statements AU-C 705, Modifications to the Opinion in the Independent Auditor’s Report AU-C 706, Emphasis of Matter Paragraphs and Other Matter Paragraphs in the Independent Auditor’s Report PCAOB Auditing Standard No. 1, References in Auditors’ Reports to the Standards of the Public Company Accounting Oversight Board PCAOB Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements

PCAOB Auditing Standard No. 8, Audit Risk (AU-C 200) PCAOB Auditing Standard No. 9, Audit Planning (AU-C 300) PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit (AU-C 320) PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

*References to AU-C sections have been updated to reflect the new, clarified codification of ASB standards. Where the ASB has a standard that is similar to a PCAOB standard, the AU-C reference is included in parentheses after the PCAOB standard.

Final PDF to printer

mes32502_ch01_001-034.indd 3 09/30/15 02:33 PM

An Introduction to Assurance and Financial Statement Auditing

Y ou will learn in this chapter that auditing consists of a set of practical conceptual tools that help accounting professionals to find, organize, and evaluate evidence about the assertions of another party. The

demand for capable accountants and auditors of high integrity has never been greater. Opportunities for auditors are plentiful and rewarding and can lead to attractive career opportunities in other areas. Those who practice as auditors often later go into financial management, becoming controllers, chief financial officers (CFOs), and even chief executive officers (CEOs). But even those who do not plan to become an auditor can benefit greatly from an understanding of financial statement auditing and its underlying concepts. Learning these tools is valuable to any business decision maker.

The past decade has been challenging for the auditing profession. In the early 2000s, a series of high-profile accounting frauds began to cause inves- tors to doubt the integrity of the nation’s financial reporting system, includ- ing the role of the external auditor. To restore investor confidence, Congress passed the Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act in July 2002—the most significant legislation related to finan- cial statement audits of public companies since the Securities Acts of 1933 and 1934. The implications of the Sarbanes-Oxley Act are discussed throughout the text in appropriate places. While the public scrutiny, government reforms, and establishment of a regulated process for creating auditing standards for public companies have been challenging for accountants and auditors, the events of the last several years have also served as powerful reminders of just how critical the roles of accounting and auditing are in our society.

We live in a time when the amount of information available for decision makers via electronic databases, the Internet, and other sources is rapidly expanding, and there is a great need for the information to be reliable, cred- ible, relevant, and timely. High-quality information is necessary if managers, investors, creditors, and regulatory agencies are to make informed decisions. Auditing and assurance services play an important role in ensuring the reliabil- ity, credibility, and relevance of business information.

The following examples present situations that illustrate how auditing increases the reliability and credibility of an entity’s financial statements:

Sara Thompson, a local community activist, has been operating a not-for-profit center that provides assistance to abused women and their children. She has financed most of her operations from private contributions. Ms. Thompson applied to the State Health and Human Services Department requesting a large grant to expand her two shelters to accommodate more women. In completing the grant application, Ms. Thompson discovered that the state’s laws for government grants require that recipients be audited to ensure that existing funds are being used appropriately. Ms. Thompson hired a CPA to audit the center’s financial state- ments. Based on the center’s activities, the intended use of the funds, and the auditor’s clean report, the grant was approved.

Conway Computer Company is a wholesaler of computer products. The company was started by George and Jimmy Steinbuker five years ago. Two years ago, a venture capital

Final PDF to printer

Tips for Learning Auditing

You will find that the study of auditing is different from any of the other accounting courses you have taken in college, and for good reason. Most accounting courses focus on learning the rules, techniques, and computations required to prepare and analyze financial information. Auditing, on the other hand, focuses on learning the analytical and logical skills necessary to evaluate the relevance and reliability of financial information as well as of the systems and processes responsible for recording and summarizing that information. As such, you will find the study of auditing to be much more conceptual in nature than your other accounting courses. This is simply due to the nature of auditing. Thus, we will periodically prompt you to “stop and think” about the concepts being discussed throughout the book. Seeking to thor- oughly understand and apply principles as you read them will greatly improve your success in studying auditing.

Learning auditing essentially helps you understand how to gather and assess evidence so you can evaluate assertions (or claims) made by others. This text is filled with the tools and techniques used by financial statement auditors in practice. You’ll find that the “tool kit” used by auditors consists of a coherent, logical framework, together with techniques useful for analyzing financial data and gathering evidence about others’ assertions. Acquiring this conceptual tool kit can be valuable in a variety of settings, including practicing as an auditor, running a small business, providing consulting services, and even making executive busi- ness decisions. An important implication is that learning this framework makes the study of

LO 1-1

4 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 4 10/22/15 03:10 PM

firm acquired 40 percent of the company and thus provided capital for expansion. Conway Computer’s revenues and profits increased by 25 percent in each of the last two years, and the Steinbuker brothers and the venture capital firm decided to take the company public through a stock sale. However, they knew that the company’s financial statements needed to be audited by a reputable public accounting firm before a registration statement could be filed with the Securities and Exchange Commission and in order for inves- tors to trust the stock offering. The company hired a major public accounting firm to perform its audits and the company successfully sold stock to the public.

These situations show the importance of auditing to both private and public enter- prise. By adding an audit to each situation, the users of the financial statements have addi- tional assurance that the financial statements report honestly and accurately, and they will be more willing to rely on those statements. Auditors can also provide valuable assurance for operating information, information systems reliability and security, and the effective- ness of an entity’s internal control. Consider the following example:

EarthWear Clothiers is a successful mail-order retailer of high-quality clothing for outdoor sports. Over the last few years the company has expanded sales through its Internet site. EarthWear’s common stock is listed and traded on NASDAQ. Securities laws require company officials to cer-

tify that they have properly designed, implemented, and tested internal control over their accounting and reporting information systems. EarthWear’s public accounting firm, Willis & Adams, examines the design and documentation of EarthWear’s internal control on a yearly basis and conducts independent tests to ver- ify that EarthWear’s controls are operating effectively. Willis & Adams issues a report to the public express- ing its opinion as to whether EarthWear’s internal control is well designed and operating effectively. Thus, stockholders, creditors, and other stakeholders can have greater confidence in the financial reports issued by EarthWear’s management.

Most readers of an introductory auditing text initially have little understanding of what auditing and assurance services entail. Thus, we start by helping you understand in gen- eral terms why there is a demand for auditing and assurance services. We then compare auditing to other well-known forms of assurance to provide an intuitive understanding of the economic role auditing plays. Finally, we define auditing, attestation, and assurance services and give you an overview of the financial statement auditing process.

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 5

mes32502_ch01_001-034.indd 5 09/30/15 02:33 PM

auditing valuable to you as a future accountant or business decision maker, whether or not you plan to become a financial statement auditor.

While the concepts and techniques you will learn in this book will be useful to you regardless of your career path, our experience is that students frequently fall into the trap of defining auditing in terms of memorized lists of rules, tools, and techniques. The study of auditing and the related concepts and techniques will make a lot more sense if you build your intuition of why audits are needed, if you understand the necessary characteristics of audits and auditors, and if you focus on what an auditor does, and why. Don’t fall into the trap of attempting to study auditing through rote memorization! Instead, pause frequently to be sure you understand both “what?” and “why?” as you study the concepts and techniques of audit- ing, as well as “how” auditing is carried out.

As you saw in the introduction to this chapter, reliable information is important for man- agers, investors, creditors, and regulatory agencies to make informed decisions. Auditing helps ensure that information is reliable, credible, and relevant. In fact, the assurance provided by auditing is vital to the proper functioning of our economic system!

The Demand for Auditing and Assurance

In view of the fact that many of the largest companies spend millions of dollars each year for their annual audit, it is worth asking why an entity would decide to spend so much money on an audit?1 Some might answer that audits are required by law. While true in cer- tain circumstances, this answer is far too simplistic. Audits are often utilized in situations where they are not required by law, and audits were in demand long before securities laws required them. In fact, evidence shows that some forms of accounting and auditing existed in Greece as early as 500 BC.2 However, the development of the corporate form of business and the expanding world economy over the last 200 years have given rise to an explosion in the demand for the assurance provided by auditors. In 1926, several years prior to the Securities Acts of 1933 and 1934, which required audits for publicly traded companies in the United States, 82 percent of the companies on the New York Stock Exchange were audited by inde- pendent auditors.3

Principals and Agents The demand for auditing can be understood as the need for accountability when business owners hire others to manage their businesses, as is typical in modern corporations. Until the late 18th and early 19th centuries, most organizations were relatively small and were owned and operated as sole proprietorships or partnerships. Because businesses were generally run by their owners and borrowing was limited, accountability to outside parties often was mini- mal. The birth of modern accounting and auditing occurred during the industrial revolution, when companies became larger and needed to raise capital to finance expansion.4 Over time, capital markets developed, enabling companies to raise the investment capital necessary to expand to new markets, finance expensive research and development, and fund the buildings, technology, and equipment needed to deliver products to market. A capital market allows a public company to sell small pieces of ownership (i.e., stocks) or to borrow money in the form

LO 1-2

1See G. L. Sundem, R. E. Dukes, and J. A. Elliott, The Value of Information and Audits (New York: Coopers & Lybrand, 1996), for a more detailed discussion of the demand for accounting information and auditing. 2G. J. Costouros, “Auditing in the Athenian State of the Golden Age (500–300 BC),” The Accounting Historian Journal (Spring 1978), pp. 41–50. 3G. J. Benston, “The Value of the SEC’s Accounting Disclosure Requirements,” The Accounting Review (July 1969), pp. 515–32. 4Also see M. Chatfield, A History of Accounting Thought (Hinsdale, IL: Dryden Press, 1974), for a discussion of the historical development of accounting and auditing. See D. L. Flesher, G. J. Previts, and W. D. Samson, “Auditing in the United States: A Historical Perspective,” ABACUS (2005), pp. 21–39, for a discussion of the development of auditing in the United States.

Final PDF to printer

6 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 6 09/30/15 02:33 PM

of thousands of small loans (i.e., bonds) so that vast amounts of capital can be raised from a wide variety of investors and creditors. A public company is a company that sells its stocks or bonds to the public, giving the public a valid interest in the proper use of the company’s resources. Thus, the growth of the modern corporation led to diverse groups of owners who are not directly involved in running the business (stockholders) and the use of professional managers hired by the owners to run the corporation on a day-to-day basis. In this setting, the managers serve as agents for the owners (who are sometimes referred to as principals) and fulfill a stewardship function by managing the corporation’s assets.

Accounting and auditing play important roles in this principal–agent relationship. We first explain the roles of accounting and auditing from a conceptual perspective. Then we’ll use an analogy involving a house inspector to illustrate the concepts. First, it is important to understand that the relationship between an owner and manager often results in information asymmetry between the two parties. Information asymmetry means that the manager gener- ally has more information about the “true” financial position and results of operations of the entity than does the absentee owner.

Stop and Think: What negative consequences could information asymmetry have for the absentee owner? How do the perspectives and motives of the manager and absentee owner differ?

Because their goals may not coincide, there is a natural conflict of interest between the manager and the absentee owner. If both parties seek to maximize their self-interest, the man- ager may not always act in the best interests of the owner. For example, the risk exists that a manager may follow the example of Tyco Inc.’s former CEO Dennis Kozlowski, who spent Tyco funds on excessive personal benefits such as $6,000 shower curtains, or Andrew Fastow, the former CFO of Enron, who pleaded guilty to manipulating the reported earnings of Enron in order to inflate the price of the company’s stock so that he could earn larger bonuses and sell his stock holdings at artificially high prices. The owner can attempt to protect him or her- self against the possibility of improper use of resources by reducing the manager’s compensa- tion by the amount of company resources that the owner expects the manager to consume. But rather than accept reduced compensation, the manager may agree to some type of monitoring provisions in his or her employment contract, providing assurance to the owner that he or she will not misuse resources. For example, the two parties may agree that the manager will periodically report on how well he or she has managed the owner’s assets. Of course, a set of criteria is needed to govern the form and content of the manager’s reports. In other words, the reporting of this financial information to the owner must follow some set of agreed-upon principles in holding the manager accountable. As you can see, one primary role of account- ing information is to hold the manager accountable to the owner—hence the word accounting.

The Role of Auditing Of course, reporting in accordance with an agreed-upon set of accounting principles doesn’t solve the problem by itself. Because the manager is responsible for reporting on the results of his or her own actions, which the absentee owner cannot directly observe, the manager is in a position to manipulate the reports. Again, the owner adjusts for this possibility by assum- ing that the manager will manipulate the reports to his or her benefit and by reducing the manager’s compensation accordingly. It is at this point that the demand for auditing arises. If the manager is honest, it may very well be in the manager’s self-interest to hire an auditor to monitor and report to the owner on his or her activities. The owner likely will be willing to invest more in the business and to pay the manager more if the manager can be held account- able for how he or she uses the owner’s invested resources. As the amount of capital involved and the number of potential owners increase, the potential impact of accountability also increases. The auditor’s role is to determine whether the reports prepared by the manager con- form to the contract’s provisions. Thus, the auditor’s verification of the financial information

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 7

mes32502_ch01_001-034.indd 7 09/30/15 02:33 PM

Overview of the Principal–Agent Relationship Leading to the Demand for Auditing

F I G U R E 1 – 1

Principal provides capital and hires agent to manage resources.

Information asymmetry and conflicts of interest lead to information risk

for the principal.

Agent is accountable to principal; provides financial reports. Agent hires auditor

to report on the fairness of agent’s

financial reports. Agent pays auditor

to reduce principal’s information risk.

Auditor

Agent (Manager)

Principal (Absentee Owner)

Practice I N S I G H T

More than 30 years later, the message is the same—users of financial statements rely on the external auditor to act with honor and integrity in protecting the public interest.

Final PDF to printer

8 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 8 09/30/15 02:33 PM

In summary, auditing is demanded because it plays a valuable role in monitoring the contractual relationships between the entity and its stockholders, managers, employees, and debt holders. Certified public accountants have been charged with providing audit services because of their traditional reputation of competence, independence, objectivity, and concern for the public interest. As a result, they are able to add credibility to information produced and reported by management to outside parties. The role of the Certified Public Accountant is discussed in more detail in Chapter 2.

Before we discuss financial statement auditors further, let’s illustrate the concepts we’ve just covered using an analogy: buying a home. In the purchase of an existing house, informa- tion asymmetry usually is present because the seller typically has more information about the house than does the buyer. There is also a natural conflict of interest between the buyer and the seller. Sellers generally prefer a higher selling price and may be motivated to overstate the positive characteristics and understate or remain silent about the negative characteristics of the property they have for sale. In other words, there is information risk to the buyer.

Seller Assertions, Information Asymmetry, and Inspector Characteristics To support the asking price, sellers typically make assertions about their property. For instance, the seller of an older home might declare that the roof doesn’t leak, that the founda- tion is sound, that there is no rot or pest damage, and that the plumbing and electrical systems are in good working order. Fortunately, many sellers are honest and forthcoming, but this is not always the case. The problem is that the buyer often does not know if she or he is dealing with an honest seller or if the seller has the necessary expertise to evaluate all the structural or mechanical aspects of the property. Lacking the necessary expertise to validate the seller’s assertions, the buyer can logically reduce information risk by hiring a house inspector.

Stop and Think: Imagine for a moment that you are buying a house and are wisely considering hiring an inspector. Test your intuition—what characteristics would you like your inspector to possess?

Desired Characteristics of the House Inspection Service Now that you have identified some of the characteristics of a good inspector, which likely included competence, honesty, and objectivity, consider the key characteristics of the service he or she will provide. Are some of the seller’s assertions more important than others? For instance, you are probably not equally concerned with the assertions that there is no structural rot and that the lightbulbs in the master bathroom are working. Depending on what you are willing to pay, the inspection could theoretically range from the extremes of driving past the house to taking the home entirely apart, board by board. How thorough do you want the inspector to be? Do you want the inspector to issue a “pass-fail” grade based on a quick walk- through or would you like more details, such as careful examination of the furnace and air conditioner? As you can see, there are many factors to take into account in deciding on the nature and extent of the assurance service you want to buy. In Table 1–1 we have listed what we think are desirable characteristics of a house inspector and of the service provided by an inspector. Pause for a moment to compare your thinking with ours.

The concepts contained in Table 1–1 are in fact fundamental to most forms of inspec- tion (including financial statement audits). Certainly home inspections and other assurance

LO 1-2

An Assurance Analogy: The Case of the House Inspector

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 9

mes32502_ch01_001-034.indd 9 09/30/15 02:33 PM

services must focus on the assertions that are most important, and they must be conducted in a timely and cost-effective manner. Some assertions are more important than others because of their potential risk or cost. For example, a house inspector should recognize the signs that indicate an increased risk of a leaky roof. If those signs are present, he or she should investi- gate further, because damage caused by a leaky roof can be very expensive to repair. At the same time, just because the seller asserts that he or she recently lubricated all the door and window hinges doesn’t mean it would be wise to pay the inspector to validate this assertion.

Stop and Think: How might a house inspection be similar to a financial statement audit?

Relating the House Inspection Analogy to Financial Statement Auditing Now that we have discussed some of the basic characteristics of house inspectors and their services, let’s consider how these relate to financial statement auditors. As noted previously, the demand for the assurance provided by a house inspector comes from information asym- metry and conflicts of interest between the buyer and the seller. Information asymmetry and conflicts of interest also exist between managers of companies and potential investors. For example, if managers are overly optimistic or if they wish to inflate their bonus compensa- tion, they may unintentionally or intentionally overstate the company’s earnings and assets (e.g., by understating the allowance for doubtful accounts or by claiming to have more cash than they really have). One important difference between our house inspector example and financial statement auditing is that the buyer of a home typically hires the inspector. In other words, the buyer identifies and hires the inspector rather than hiring someone that the seller recommends—presumably because by hiring an inspector directly, they increase the likeli- hood that the inspector will be objective and independent.

However, as was discussed previously, the companies selling stocks or bonds to the pub- lic typically hire and pay the auditor, rather than the other way around. To raise capital in the marketplace, companies often sell many small parcels of stocks and bonds to a large number of investors. Suppose a financial statement audit of a given company would cost $500,000. Under such circumstances, it obviously doesn’t make sense for each individual investor to pay for an audit. Instead, the company hires and pays for the auditor because a reputable indepen- dent auditor’s opinion can provide assurance to thousands of potential investors. In addition, recall from our previous discussion that the initial demand for auditing comes not from the principal but from the agent. By purchasing the assurance provided by an audit, the company can sell its stocks and bonds to prospective owners and creditors at more favorable prices,

Important Characteristics of House Inspectors and Inspections

Desirable Characteristics of House Inspectors • Competent—they possess the required training, expertise, and experience to evaluate the property for sale. • Objective—they have no reason to side with the seller; they are independent of the seller’s influence. • Honest—they will conduct themselves with integrity, and they will share all of their findings with the buyer. • Skeptical—they will not simply take the seller’s assertions at face value; they will conduct their own analysis and testing. • Responsible and/or liable—they should stand behind their assessment with a guarantee and/or be subject to litigation if they fail to act with due care.

Desirable Characteristics of a House Inspection Service • Timely—the results of the service are reported in time to benefit the decision maker. • Reasonably priced—the costs of the services must not exceed the benefits. For this to occur the service provider will likely need to focus attention on

the most important and risky assertions and likely can’t provide absolute assurance, even with respect to important seller assertions. • Complete—the service addresses all of the most important and risky assertions made by the seller. • Effective—the service provides some degree of certainty that it will uncover significant risks or problems. • Systematic and reliable—the service is based on a systematic process, and the conclusions are based on reliable evidence. In other words, another

comparable inspector would likely find similar issues and come to similar conclusions. • Informative—the service provides a sense for how likely mechanical or structural failure is in the near future and provides an estimate of the cost to

repair known defects or failures.

T A B L E 1 – 1

Final PDF to printer

10 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 10 09/30/15 02:33 PM

significantly reducing the cost of capital. In fact, studies indicate that audits save companies billions of dollars in costs of obtaining capital; for example, by getting lower interest rates on loans and selling stock at higher prices.

Given that the seller of stocks and bonds typically hires the auditor, consider just how crucial a strong reputation is to an independent auditor. Four large, international accounting firms dominate the audits of large publicly traded companies, auditing over 95 percent of the revenue produced by all such companies in the United States. One reason these firms domi- nate the audits of large companies is because they have well-known names and strong reputa- tions. Entities who buy assurance from these firms know that potential investors and creditors will recognize the auditing firm’s name and reputation and feel assured that they therefore face reduced information risk.

The fact that the entity being audited typically hires and pays the auditor also highlights just how important auditor objectivity and independence are to the investing public. In fact, Arthur Andersen, the once highly regarded member of the former “Big 5” international accounting firms, failed in 2002 at least in part because the firm lost its reputation as a high- quality, objective auditor whose opinion could be relied upon by investors and creditors. Later in the book we will discuss some changes enacted over the past several years to strengthen the independence of financial statement auditors, including prohibiting auditors from providing many kinds of consulting services to their public audit clients.

Management Assertions and Financial Statements We’ve seen that home sellers make a number of different assertions about which a home buyer might want independent assurance. What assertions does a company that is selling its stocks or bonds make? Some of the most important assertions entities make to investors are implicit in the entities’ financial statements. Immediately after this chapter you will find a set of financial statements for EarthWear, a hypothetical seller of high-quality outdoor cloth- ing. We’ll use EarthWear examples and exercises throughout the book to illustrate important audit concepts and techniques. Let’s consider what assertions EarthWear makes to potential investors when it publishes its financial statements. For example, EarthWear lists the asset account “Cash” on its balance sheet and indicates that the account’s year-end balance was $48.9 million.

Stop and Think: Consider for a moment what assertions the company is making about cash.

An obvious answer is that EarthWear’s management is asserting that the cash is really there—that it “exists.” They are also implicitly asserting that all the cash that the company owns is included in the records—in other words, the financial records are “complete” with respect to the company’s cash. Finally, management is asserting that the cash amount is fairly and accurately recorded, and that no other parties have valid claims to the cash. Such asser- tions are implicit for each account in the financial statements.

Financial statement assertions are management’s expressed or implied claims about information reflected in the financial statements. Assertions are central to auditing because they are the focus of the auditor’s evidence collection efforts. In other words, much of what auditors do revolves around collecting and evaluating evidence about management’s financial statement assertions.

One of the main tasks of the auditor is to collect sufficient appropriate evidence that management’s assertions regarding the financial statements are correct. If you were to audit EarthWear, how would you go about collecting evidence for the cash account? The process is really quite logical and intuitive. First, you would carefully consider the most important asser- tions the company is making about the account, and then you would decide what evidence you would need to substantiate the truthfulness of each important assertion. For example, to ensure the cash exists, you might examine bank statements or send a letter to the bank

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 11

mes32502_ch01_001-034.indd 11 09/30/15 02:33 PM

requesting confirmation of the balance. To ensure the cash hasn’t been pledged or restricted, you might review the minutes of key management meetings to look for discussions or agree- ments on this issue.

We will discuss management assertions in greater depth in Chapter 5, but for now take a look at Table 1–2, which lists all of the management assertions that auditors focus on in an audit. This presentation divides management assertions into three aspects of information reflected in the financial statements: transactions, account balances, and presentation and dis- closure. For example, EarthWear’s management asserts, among other things, that transactions relating to inventory actually occurred, that they are complete (i.e., no valid transactions were left out), that they are classified properly (e.g., as an asset rather than an expense), and that they are recorded accurately and in the correct period. Similarly, management asserts that the inventory represented in the inventory account balance exists, that the entity owns the inven- tory, that the balance is complete, and that the inventory is properly valued. Finally, manage- ment asserts that the financial statements properly present the inventory (e.g., inventory is appropriately listed as a current asset on the balance sheet) and that all required disclosures having to do with inventory (e.g., a footnote indicating that the company uses the FIFO inventory method) are complete, accurate, and understandable. Understanding the assertions in terms of transactions, account balances, and presentation and disclosure is helpful because the three categories help the auditor focus on the different types of audit procedures needed to test the assertions in the three different categories. Chapter 5 discusses the types of proce- dures available to the auditor in more detail.

Once you have finished auditing the important assertions relating to each account included in the company’s financial statements, you will need to report your findings to the company’s shareholders and to the investing public because EarthWear is publicly traded.

Now, instead of EarthWear’s auditor, imagine you are a prospective investor in Earth- Wear. As an investor, would the reputation of the company’s auditor matter to you? Would you want to know that the audit firm used an appropriate, well-recognized audit approach to gather sufficient, appropriate evidence? What form of report would you expect? What if the lead partner on the audit were a close relative of EarthWear’s president? Considering these questions makes it easy to see that the desired characteristics of auditors and audit services are similar to those relating to house inspectors and house inspection services.

Summary of Management Assertions by Category

Assertions about classes of transactions and events for the period under audit: • Occurrence—transactions and events that have been recorded have occurred and pertain to the entity. • Completeness—all transactions and events that should have been recorded have been recorded. • Authorization—all transactions and events have been properly authorized.* • Accuracy—amounts and other data relating to recorded transactions and events have been recorded appropriately. • Cutoff—transactions and events have been recorded in the correct accounting period. • Classification—transactions and events have been recorded in the proper accounts. Assertions about account balances at the period end: • Existence—assets, liabilities, and equity interests exist. • Rights and obligations—the entity holds or controls the rights to assets, and liabilities are the obligations of

the entity. • Completeness—all assets, liabilities, and equity interests that should have been recorded have been recorded. • Valuation and allocation—assets, liabilities, and equity interests are included in the financial statements at

appropriate amounts and any resulting valuation or allocation adjustments are appropriately recorded.

Assertions about presentation and disclosure: • Occurrence and rights and obligations—disclosed events, transactions, and other matters have occurred and

pertain to the entity. • Completeness—all disclosures that should have been included in the financial statements have been included. • Classification and understandability—financial information is appropriately presented and described, and

disclosures are clearly expressed. • Accuracy and valuation—financial and other information are disclosed fairly and at appropriate amounts.

*International and AICPA auditing standards consider Authorization to be a subset of the Occurrence assertion and thus do not list it separately. We list Authorization as a separate assertion about classes of transactions and events for instructional clarity.

T A B L E 1 – 2

Final PDF to printer

12 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 12 09/30/15 02:33 PM

We hope the analogy of house inspectors and auditors as assurance providers has helped you understand the basic intuition behind the necessary characteristics of auditors and audit- ing and why auditing is in demand, even when it is not required by law. We will refer back to this analogy occasionally throughout the book to remind you of this basic intuition. As you study this book, we encourage you to keep in mind how the concepts you are learning relate to important characteristics of auditors and home inspectors and the services they offer. Keep the big picture in mind!

Auditing, Attest, and Assurance Services Defined

Accounting professionals can provide assurance about the reliability and relevance of infor- mation given by one party to another. The broadest category of such services is simply called assurance services. Attest services are a subset of assurance services, and auditing is a type of attest service. Many times these terms are used interchangeably because they are related, and at a general level, they encompass the same process: the evaluation of evidence to determine whether information has been recorded and presented in accordance with a predetermined set of criteria, together with the issuance of a report that indicates the degree of correspondence.

Figure 1–2 illustrates the concept that attest services are a subset of the broader category of assurance services, and, in turn, auditing services are a specialized type of attest service. We’ll discuss each category in turn, from narrowest to broadest.

Auditing Consider the following formal definition of auditing:

Auditing is a systematic process of objectively obtaining and evaluating evidence regarding asser- tions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and communicating the results to interested users.5

Let’s discuss this definition in plain English. The phrase “systematic process” implies that there should be a well-planned and thorough approach for conducting an audit. This approach involves “objectively obtaining and evaluating evidence.” In other words, the audi- tor must objectively search for and evaluate the relevance and validity of evidence. The type, quantity, and reliability of evidence will vary between audits, but the process of obtaining and evaluating evidence makes up most of the auditor’s activities on any audit.

As our analogy between house inspection and auditing illustrates, the evidence gath- ered by the auditor must relate to “assertions about economic actions and events.” The audi- tor compares the evidence gathered to management’s financial statement assertions in order to assess “the degree of correspondence between those assertions and established criteria.”

LO 1-3

LO 1-4

5American Accounting Association, Committee on Basic Auditing Concepts, “A Statement of Basic Auditing Concepts” (Sarasota, FL: AAA, 1973).

The Relationship among Auditing, Attest, and Assurance ServicesF I G U R E 1 – 2

Auditing Attest Assurance

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 13

mes32502_ch01_001-034.indd 13 09/30/15 02:33 PM

While different types of “criteria” might be available in various settings, generally accepted accounting principles usually serve as the basis for evaluating management’s assertions in the context of a financial statement audit.

The last key phrase in the definition, “communicating the results to interested users,” relates to the report the auditor provides to the intended users of the reported information. The communication will vary depending on the type and purpose of the audit, and the nature of the auditor’s findings. In the case of financial statement audits, very specific types of reports are prescribed by auditing standards to communicate the auditor’s findings. We will show you what an audit report relating to financial statements looks like later in this chapter.

Attestation Auditors have a reputation for independence and objectivity. As a result, it has always been common for various parties to request that auditors attest to information beyond historical financial information. However, professional standards did not allow for such services until the profession established a separate set of attestation standards in 1986. These standards pro- vide the following definition for attest services:

Attest services occur when a practitioner is engaged to issue . . . a report on subject matter, or an assertion about subject matter, that is the responsibility of another party.

Notice that this definition is broader than the one previously discussed for auditing because it is not limited to economic events or actions. The subject matter of attest services can take many forms, including prospective information, analyses, systems and processes, and even the specific actions of specified parties. Note that financial statement auditing is a particular, specialized form of an attest service.

Assurance In the late 1990s, the accounting profession expanded the potential breadth of auditors’ activi- ties beyond auditing and attest services to include a broader set of assurance services. Extend- ing auditors’ activities to assurance services allows reporting not only on the reliability and credibility of information but also on the relevance and timeliness of that information. Assur- ance services are defined as follows:

Assurance services are independent professional services that improve the quality of information, or its context, for decision makers.

This definition captures some important concepts. First, the definition focuses on decision making. Making good decisions requires quality information, which, in the context of the broad set of assurances services, can be financial or nonfinancial. Second, it relates to improving the quality of information or its context. An assurance service engagement can improve quality through increasing confidence in the information’s reliability and relevance. Context can be improved by clarifying the format and background with which the information is presented. Third, the definition includes “independence,” which relates to the objectiv- ity of the service provider. Last, the definition includes the phrase “professional services,” which implies the application of professional judgment and due care by the provider. To sum- marize, assurance services can include almost any service provided by accounting profession- als that involves capturing information, improving its quality, or enhancing its usefulness for decision makers.

This text focuses primarily on financial statement auditing because it represents the major type of assurance service offered by most public accounting firms. In addition, in many instances, the approach, concepts, methods, and techniques used for financial statement audits also apply to other attest and assurance service engagements. While this text focuses primarily on financial statement auditing, Chapters 2 and 21 describe various examples of audit, attest, and assurance services commonly offered by different kinds of auditors, including internal auditors who are often directly employed by the company for which they provide services.

Final PDF to printer

14 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 14 09/30/15 02:33 PM

Figure 1–3 presents a simplified overview of the process for a financial statement audit. Take a moment to think through the steps in this figure. The auditor gathers evidence about the business transactions that have occurred and about the account balances into which the trans- actions have been accumulated. The auditor uses this evidence to compare the assertions con- tained in the financial statements to the criteria used by management in preparing them (i.e., GAAP). The auditor’s report communicates to the user the degree of correspondence between the assertions and the criteria. Be sure you understand Figure 1–3 before you continue read- ing! Taking a moment to think through these concepts will help you make sense of the three fundamental concepts underlying a financial statement audit, which we will explain next.

The conceptual and procedural details of a financial statement audit build on three fun- damental concepts: materiality, audit risk, and evidence relating to management’s financial statement assertions. The auditor’s assessments of audit risk and materiality influence the nature, timing, and extent of the audit evidence to be gathered. This section briefly discusses the concepts of materiality, audit risk, and audit evidence. Chapters 3 through 5 cover each of these concepts in greater depth, but your study of those chapters will be easier and more effective if you take the time now to understand the concepts of materiality, audit risk, and audit evidence at a general level.

Materiality Materiality refers to the amount by which a set of financial statements could be misstated without affecting the judgment of reasonable people. For example, suppose a company’s earnings per share (EPS) is $4.50 but due to an unintentional error the company mistakenly

LO 1-5

Fundamental Concepts in Conducting a Financial Statement Audit

An Overview of the Financial Statement Auditing ProcessF I G U R E 1 – 3

Terms of Engagement

Implements internal controls

Conducts transactions

Accumulates transactions into account balances

Prepares financial statements

Issues financial statements to users

Obtains evidence

Tests management assertions against criteria

(GAAP)

Determines overall fairness of financial statements

Issues audit report to accompany

financial statements

Management Auditor

Evi den

As se

rti on

Com mun

icati on

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 15

mes32502_ch01_001-034.indd 15 09/30/15 02:33 PM

reports EPS of $4.52. This very small difference is unlikely to affect an investor’s decisions in any significant way. Thus, the auditor will likely consider the difference to be immaterial.

One of the auditor’s first tasks in planning an audit is to make a judgment about just how big a misstatement would have to be before it would significantly affect users’ judgments. The concept of materiality is important because it simply isn’t practical or cost beneficial for auditors to ensure that financial statements are completely free of any small misstatements.

The Financial Accounting Standards Board has provided the following definition of materiality:

Information is material if omitting it or misstating it could influence decisions that users make on the basis of the financial information of a specific reporting entity.6

The focus of this definition is on the users of the financial statements. In planning the engagement, the auditor assesses the magnitude of a misstatement that may affect users’ deci- sions. This materiality assessment helps the auditor determine the nature, timing, and extent of audit procedures used to collect audit evidence. Let’s relate the concept of materiality to our house inspector analogy—we would not be willing to pay a house inspector to validate the remaining life on lightbulbs or thoroughly test every cabinet hinge. These items are not material to the buyer’s decision.

While other factors must be considered in determining materiality, a common rule of thumb is that total (aggregated) misstatements of more than about 3 to 5 percent of income before tax would cause the financial statements to be materially misstated. Suppose the audi- tor decides that the financial statements of a client with $8 million in net income would be materially misstated if total misstatements exceed 5 percent of income, or $400,000. The auditor would design audit procedures precise enough to detect misstatements that, either by themselves or in combination with other misstatements, might exceed the materiality thresh- old of $400,000. When testing is complete for all accounts, the auditor will evaluate the audit results and ask the company to adjust its financial records for identified misstatements. The auditor will issue a clean audit opinion if the auditor’s estimate of remaining, unadjusted mis- statements in all the accounts add up to less than overall materiality of $400,000. This is why the wording of the standard auditor’s report indicates that the financial statements “present fairly in all material respects . . .” As we will explain next, in connection with the concept of audit risk, there can be no guarantee that the auditor will uncover all material misstatements. In fact, the auditor provides no assurance that immaterial misstatements will be detected.

Audit Risk The second major concept involved in auditing is audit risk, which is the risk that the auditor may mistakenly give a “clean” opinion on financial statements that are materially misstated.

Audit risk is the risk that the auditor mistakenly expresses a clean audit opinion when the financial statements are materially misstated.7

The auditor’s standard report states that the audit provides “reasonable assurance” that the financial statements do not contain material misstatements. The phrase “reasonable assurance” implies that even when the auditor does a good job, there is some risk that a mate- rial misstatement could be present in the financial statements and the auditor will fail to detect it. The auditor plans and conducts the audit to achieve an acceptably low level of audit risk. The auditor controls the level of audit risk through the effectiveness and extent of the audit work conducted. The more effective and extensive the audit work (and thus the type and amount of audit evidence collected), the lower the risk that a misstatement will go undetected and that the auditor will issue an inappropriate report. But it is important to understand that the concept of reasonable assurance means that an auditor could conduct an audit completely in accordance with professional auditing standards and fail to detect material misstatements. A

6Financial Accounting Standards Board, Statement of Financial Accounting Concepts No. 8, Chapter 3: “Qualitative Characteristics of Useful Accounting Information.” 7AU 320, Materiality in Planning and Performing an Audit.

Final PDF to printer

16 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 16 09/30/15 02:33 PM

house inspector cannot absolutely guarantee the absence of any significant problems without taking apart a house board by board, which of course is simply not practical. Similarly, due to cost constraints and the sheer impossibility of investigating every item reflected in an entity’s financial statements, the risk that an auditor will mistakenly issue a clean opinion on materially misstated financial statements should be low, but it cannot be driven to zero. Even careful and competent auditors can only offer reasonable, rather than absolute, assurance.

Audit Evidence Regarding Management Assertions The third major concept involved in auditing is evidence regarding management’s assertions, or, more simply, audit evidence. Most of the auditor’s work in arriving at an opinion on the financial statements consists of obtaining and evaluating audit evidence relating to manage- ment’s assertions. Audit evidence consists of the underlying accounting data and any addi- tional information available to the auditor, whether originating from the client or externally.

As illustrated earlier in our discussion about EarthWear, management’s assertions are used as a framework to guide the collection of audit evidence. The assertions, in conjunction with the assessment of materiality and audit risk, are used by the auditor to determine the nature, timing, and extent of evidence to be gathered. Once the auditor has obtained sufficient appropriate evidence that the management assertions can be relied upon for each significant account and disclosure, the auditor has reasonable assurance that the financial statements are fairly presented. Note the two key descriptors of audit evidence: sufficient and appropriate.

The sufficiency of audit evidence simply refers to the quantity of evidence the auditor obtains—does the auditor have enough evidence to justify a conclusion as to whether manage- ment’s assertions are fairly stated? The appropriateness of audit evidence refers to whether the evidence is relevant and reliable. Relevance refers to whether the evidence relates to the specific management assertion being tested. Reliability refers to the diagnosticity of the evi- dence. In other words, can a particular type of evidence be relied upon to signal the true state of the account balance or assertion being examined? Using the house inspection example, inspecting the foundation of a house may not give us relevant evidence about whether the roof leaks. Likewise, evidence about the roof that is obtained by standing on the ground and look- ing up likely would not be as reliable as evidence obtained by climbing up on the roof or by inspecting the attic space.

While the auditor has a professional responsibility to obtain “sufficient appropriate evi- dence,” the auditor seldom has the luxury of obtaining completely convincing evidence about the true state of a particular management assertion. In most situations, the auditor is able to obtain only persuasive evidence that the assertion is fairly stated.

You might ask why the auditor relies on concepts such as materiality and audit risk in design- ing an audit. Why not test all account balances and all transactions that occurred during the period so that audit risk can be driven to zero, even for immaterial misstatements? The main reason is the cost and infeasibility of such an audit. In a very small business, the auditor might be able to examine all transactions that occurred during the period and all the accounts that exist at the end of the period and still issue the audit report in a reasonable amount of time. However, it is unlikely that the owner of the business could afford to pay for such an extensive audit. For a large organization, the sheer volume of transactions, which might well reach into the millions, prevents the auditor from examining every transaction. Similarly, ending account balances can reflect millions of individual items (e.g., individual inventory items making up the ending inventory account). Thus, just as with a house inspection, there is a trade-off between the exactness or precision of the audit and its cost.

To deal with the problem of not being able to examine every transaction and account, the auditor selects a subset of transactions and accounts to examine. Many times the auditor, based

LO 1-6

Sampling: Inferences Based on Limited Observations

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 17

mes32502_ch01_001-034.indd 17 09/30/15 02:33 PM

on previous audits, understanding of the client’s internal control system, and knowledge of the client’s industry, is aware of items in an account balance that are more likely to contain mis- statements. For example, the auditor’s prior knowledge may indicate that individual accounts receivable involving certain types of customers are more likely to contain misstatements. The auditor can use this knowledge to specifically select those particular accounts receivable for examination. When the auditor has no special knowledge about which particular transactions or items may be misstated, he or she uses random sampling procedures that increase the likeli- hood of obtaining a sample that is representative of the population of transactions or account items. In such cases, the auditor uses the laws of probability to make inferences about poten- tial misstatements based on examining a sample of transactions or items.

The size of the subset of items the auditor examines is primarily a function of materiality and the desired level of assurance for the account or assertion being examined. There is an inverse relation between sample size and materiality, and a direct relation between sample size and desired level of assurance. For example, if an auditor assesses a small materiality amount for an account, a larger sample will be needed than if materiality were a larger amount. This occurs because the auditor must gather more evidence (a larger sample) to have a reasonable likelihood of detecting smaller errors. You can think of materiality as the “fineness of the auditor’s filter.” A lower materiality amount requires the auditor to use a finer filter in order to detect smaller errors, and it takes more work to create a finer filter. Similarly, as the desired level of assurance increases for a given materiality amount, the sample size necessary to test an assertion becomes greater.

The Audit Process

Now that we have explained some of the fundamental concepts of auditing, let’s summarize the logical thought processes underlying a financial statement audit and then walk through the major phases of an audit. Be sure and take some time here—a thorough understanding of this section will be a great help to you in understanding subsequent chapters!

Overview of the Financial Statement Auditing Process Consider the auditor’s task from a logical perspective. The end product of an auditor’s work is an opinion indicating whether or not the client’s financial statements are free of material mis- statement. What might an auditor do to obtain the information needed to develop and support that opinion? The auditor must first obtain a thorough understanding of the client, its business and industry, and its information system. The auditor must understand the risks the client faces, how it deals with those risks, and what remaining risks are most likely to result in a material misstatement in the financial statements. Armed with this understanding, the auditor plans procedures that will produce evidence helpful in developing and supporting his or her opinion on the financial statements.

To understand this process intuitively, consider what financial statements are made of. From your financial accounting courses, you know that accounting systems capture, record, and summarize individual transactions. Entities must design and implement controls to ensure that those transactions are initiated, captured, recorded, and summarized appropriately. These individual transactions are grouped and summarized into various account balances, and finally, financial statements are formed by organizing meaningful collections of those account balances (e.g., current liabilities). We have just identified three stages in the account- ing process that take place in the preparation of financial statements: internal controls are implemented to ensure that the client’s information system appropriately captures and records individual transactions, which are then collected into ending account balances. This sum- mary might seem like an oversimplification, but it will help you understand the stages of a client’s accounting process on which auditors focus to collect evidence.

Keep in mind that the auditor’s job ultimately is to express an opinion on whether the financial statements are fairly stated. It makes sense, then, that the auditor can design

LO 1-7

Final PDF to printer

18 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 18 09/30/15 02:33 PM

procedures to collect direct information about the ending account balances that make up the financial statements. For example, an auditor might confirm the ending balance of the cash account by contacting the client’s bank, or the auditor might verify the ending balance of the inventory account by physically examining individual inventory items that make up the ending balance. But remember—account balances are made up of transactions that occurred over the past year (or earlier). If the auditor designs procedures to test whether the transac- tions were captured and handled properly, the auditor can obtain indirect information about whether the ending account balances are likely to be fairly stated. This information is clearly one step removed from the ending account balances themselves. But we can even back up one more step. If the auditor designs procedures to test whether the entity’s internal control over financial transactions is effective, the auditor can obtain additional indirect information regarding whether the account balances are fairly stated.

Carefully think through the logic in this last step: if controls are effective, then the trans- actions will probably be captured and summarized properly, which means in turn that the account balances are likely to be free of material misstatement. Thus, information about inter- nal control is even more indirect than information about transactions, but it is useful infor- mation nonetheless! In fact, while it is indirect, evidence about internal control is often a relatively cost-effective form of audit evidence.

To summarize, the auditor can collect evidence in each of three different stages in a cli- ent’s accounting system to help determine whether the financial statements are fairly stated: (1) the internal control put in place by the client to ensure proper handling of transactions (e.g., evaluate and test the controls); (2) the transactions that affect each account balance (e.g., examine a sample of the transactions that happened during the period); and (3) the end- ing account balances themselves (e.g., examine a sample of the items that make up an ending account balance at year-end). Evidence that relates directly to ending account balances is usually the highest quality, but also the costliest, evidence. Thus, an auditor will usually rely on a combination of evidence from all three stages in forming an audit opinion regarding the fairness of the financial statements. On which of these three areas it is best to focus depends on the circumstances, and this is generally left to the auditor’s discretion. Chapters 3 and 5 address the types of procedures and types of evidence available to the auditor in more detail.

Major Phases of the Audit The audit process can be broken down into a number of audit phases (see Figure 1–4). While the figure suggests that these phases are sequential, they are actually quite iterative and inter- related in nature. Phases often include audit procedures designed for one purpose that provide evidence for other purposes, and sometimes audit procedures accomplish purposes in more than one phase. Figure 1–4 shows the specific chapters where each of these phases is dis- cussed in detail.

Client Acceptance/Continuance Professional standards require that public account- ing firms establish policies and procedures for deciding whether to accept new clients and to retain current clients. The purpose of such policies is to minimize the likelihood that an auditor will be associated with clients that lack integrity. If an auditor is associated with a client that lacks integrity, the risk increases that material misstatements may exist and not be detected by the auditor. For a prospective new client, the auditor is required to confer with the predecessor auditor and the auditor frequently conducts background checks on top man- agement. The knowledge that the auditor gathers during the acceptance/continuance process provides valuable understanding of the entity and its environment, thus helping the auditor assess risk and plan the audit.

Preliminary Engagement Activities There are generally three preliminary engagement activities: (1) determine the audit engagement team requirements; (2) ensure the indepen- dence of the audit firm and audit team; and (3) establish an understanding with the client regarding the services to be performed and the other terms of the engagement.

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 19

mes32502_ch01_001-034.indd 19 09/30/15 02:33 PM

Once the decision has been made to accept an audit engagement, the auditor begins pre- liminary engagement activities by updating his or her understanding of the entity and its envi- ronment. This understanding includes the nature of the entity and the industry in which it operates, how it measures its own performance, the nature of its information system, and the quality of its internal control. The auditor’s understanding of the entity and its environment helps in assessing the risk of material misstatement and in setting the scope of the audit.

The engagement partner or manager forms an audit team composed of members who have the appropriate audit and industry experience for the engagement, determines whether special- ists (e.g., tax specialists) are needed, and makes sure that the audit firm and individual team members are free from prohibited relationships that might threaten the auditor’s objectivity.

Major Phases of an AuditF I G U R E 1 – 4

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control (Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Final PDF to printer

20 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 20 09/30/15 02:33 PM

Finally, the auditor establishes an understanding with the client regarding the services to be performed and the terms of the engagement, including such considerations as timing of the audit and expected audit fees. Chapter 3 addresses the preliminary engagement activities of the audit process in more detail.

Plan the Audit Proper planning is important to ensure that the audit is conducted in an effective and efficient manner. In order to plan the audit properly, the audit team must make a preliminary assessment of the client’s business risks and determine materiality. The audit team relies on these judgments to then assess risk relating to the likelihood of material mis- statements in the financial statements. Audit planning should take into account the auditor’s understanding of the entity’s internal control system (discussed next). This assessment of internal control will be in greater depth if the client is a public company, because for public companies the auditor is required to report on both the company’s internal control over finan- cial reporting and the company’s financial statements. The outcome of the auditor’s planning process is a written audit plan that sets forth the nature, extent, and timing of the audit proce- dures to be performed. You will learn about the issues that are involved in this phase of the audit in Chapters 3, 4, and 5.

Consider and Audit Internal Control A company’s system of internal control is put in place by the company’s board of directors and management to help the company achieve reliable financial reporting, effective and efficient operations, and consistent compliance with applicable laws and regulations. The quality of a company’s internal control over finan- cial reporting is of direct relevance to auditors. As part of obtaining an understanding of the entity and its environment, the auditor obtains an understanding of internal control to help the auditor assess risk and identify areas where financial statements might be misstated. Chapter 6 covers the role of internal control in a financial statement audit, and Chapter 7 specifically addresses the audit of internal control for public companies. Later chapters apply the process of considering and auditing internal control in the context of various busi- ness processes.

Audit Business Processes and Related Accounts Auditors usually organize audits by grouping financial statement accounts according to the business processes that primar- ily affect those accounts. For example, sales revenue and accounts receivable are both part of a company’s sales and collection process and are audited together. The auditor applies audit procedures to the accounts in order to obtain audit evidence about management’s asser- tions relating to each account and reduce the risk of undetected material misstatement to an appropriately low level. On most engagements, actually conducting the planned audit tests comprises most of the time spent on a financial statement audit or an audit of internal control over financial reporting. For public company clients, the audit of internal control is done in an integrated way with the financial statement audit. This topic is addressed in Chapter 7 and throughout the book where appropriate.

Complete the Audit The auditor must obtain sufficient appropriate evidence in order to reach and justify a conclusion on the fairness of the financial statements. After the auditor has finished gathering reliable evidence relating to management’s financial statement assertions, the auditor assesses the sufficiency of the evidence and obtains additional evidence where deemed necessary. In this phase, the auditor also addresses a number of issues, including the possibility of undisclosed contingent liabilities, such as lawsuits, and searches for any events subsequent to the balance sheet date that may impact the financial statements. Chapter 17 discusses the completion phase of the audit in detail.

Evaluate Results and Issue Audit Report The final phase in the audit process is to evaluate results and choose the appropriate audit report to issue. The auditor’s report, also known as the audit opinion, is the main product or output of the audit. Just as the report of a

LO 1-8

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 21

mes32502_ch01_001-034.indd 21 09/30/15 02:33 PM

house inspector communicates the inspector’s findings to a prospective buyer, the audit report communicates the auditor’s findings to the users of the financial statements.

After completion of the audit work, the auditor determines if the preliminary assessments of risks were appropriate in light of the evidence collected and whether sufficient evidence was obtained. The auditor then aggregates the total known and estimated uncorrected mis- statements and determines whether they cause the financial statements to be materially mis- stated. If the uncorrected misstatements are judged to be material, the auditor will request that the client correct the misstatements. If the client refuses, the auditor issues an opinion that clearly indicates that the financial statements are materially misstated and explains the nature of the misstatement. If the uncorrected misstatements are insignificant enough that they do not cause the financial statements to be materially misstated, or if the client is willing to cor- rect the misstatements, the auditor issues an unqualified (i.e., “clean”) report.

The Unqualified/Unmodified Audit Report The unqualified audit report is by far the most common type of report issued.8 In this context, unqualified means that, because the financial statements are free of material misstatements, the auditor does not find it necessary to qualify (i.e. specify any exceptions to) his or her “clean” audit opinion. While it is fairly common for the auditor to find misstatements need- ing correction, audit clients are almost always willing to make the adjustments necessary to receive a clean opinion. Exhibit 1–1 presents an audit report issued on EarthWear Clothier’s financial statements. This report covers financial statements that include balance sheets for two years and statements of income, stockholders’ equity, and cash flows for three years. The audit report presented in Exhibit 1–1 is the standard type of unqualified audit opinion issued for publicly traded companies.

Take a moment to read through the report. You will see that the title refers to the “Inde- pendent Registered Public Accounting Firm” issuing the audit report. The report is addressed to the individual or group that is the intended recipient of the report. The body of the report begins with an introductory paragraph indicating which financial statements are covered by the report, that the statements are the responsibility of management, and that the auditor has a responsibility to express an opinion.

The second, or scope, paragraph communicates to the users, in very general terms, what an audit entails. In addition to indicating that the audit was conducted in accordance with appli- cable auditing standards, it emphasizes the fact that the audit provides only reasonable assur- ance that the financial statements contain no material misstatements. The scope paragraph also discloses that an audit involves an examination of evidence on a test basis (i.e., using samples rather than examining entire populations), an assessment of accounting principles used and significant estimates, and an overall evaluation of financial statement presentation. Finally, the scope paragraph expresses the auditor’s judgment that the audit provides a reasonable basis for the opinion to be expressed in the report.

The third paragraph contains the auditor’s opinion concerning the fairness of the finan- cial statements based on the audit evidence. Note two important phrases contained in this paragraph. First, the phrase “present fairly . . . in conformity with U.S. generally accepted accounting principles” indicates the criteria against which the auditor assesses management assertions. Second, the opinion paragraph contains the phrase “in all material respects,” emphasizing the concept of materiality. Note that the scope paragraph indicates how the audit was conducted—in accordance with the standards of the PCAOB—because EarthWear is a publicly traded company. Audit reports for nonpublic companies refer instead to “generally accepted auditing standards.”

The fourth paragraph contains explanatory language. As shown in Exhibit 1–1, when the auditor’s opinion on a public company’s financial statements is presented separately from the auditor’s report on the client’s internal control over financial reporting, as is the case here, the report must refer to the audit of internal control in an explanatory paragraph.

8A “clean” audit report is referred to as “unqualifed” by PCAOB auditing standards and as “unmodified” by AICPA and international auditing standards. See Chapters 2 and 18.

Final PDF to printer

22 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 22 09/30/15 02:33 PM

The financial statement audit report concludes with the manual or printed signature of the CPA firm providing the audit and with the date of the report. The audit report date indi- cates the last day of the auditor’s responsibility for the review of significant events that have occurred after the date of the financial statements.

Other Types of Audit Reports For an audit report to be unqualified, the audit must be done in accordance with applicable standards (e.g., the standards of the PCAOB), the auditor must be independent, there must be no significant limitations imposed on the auditor’s procedures, and the client’s financial state- ments must be free of material departures from GAAP. If any one of these conditions is not met, the auditor issues a report that appropriately conveys to the reader the nature of the report and the reasons why the report is not unqualified.

For example, suppose a client’s financial statements contain a misstatement that the audi- tor considers material and the client refuses to correct the misstatement. The auditor will likely qualify the report, explaining that the financial statements are fairly stated except for the misstate- ment identified by the auditor. If the misstatement is considered so material that it pervasively affects the interpretation of the financial statements, the auditor will issue an adverse opinion, indicating that the financial statements are not fairly stated and should not be relied upon.

The Auditor’s Standard Unqualified Report–Comparative Financial Statements (with explanatory paragraph)

Title: REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

Addressee: To the Stockholders of EarthWear Clothiers

Introductory paragraph: We have audited the consolidated balance sheets of EarthWear Clothiers as of December 31, 2015 and 2014, and the related consolidated statements of operations, stockholders’ equity, and cash flows for each of the three years in the period ended December 31, 2015. These financial statements are the responsibility of the Company’s management. Our responsibility is to express an opinion on these financial statements based on our audits.

Scope paragraph: We conducted our audit in accordance with the standards of the Public Company Accounting Over- sight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

Opinion paragraph: In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2015 and 2014, and the results of its operations and its cash flows for each of the three years in the period ended December 31, 2015, in conformity with U.S. generally accepted accounting principles.

Explanatory paragraph referring to the audit of internal control:

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the effectiveness of EarthWear Clothiers’ internal control over financial report- ing as of December 31, 2015, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), and our report dated February 15, 2016, expressed an unqualified opinion that EarthWear Clothiers main- tained, in all material respects, effective internal control over financial reporting.

Name of auditor: Willis & Adams Boise, Idaho

Date of report: February 15, 2016

E X H I B I T 1 – 1

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 23

mes32502_ch01_001-034.indd 23 09/30/15 02:33 PM

Other types of reports are available to the auditor as well, depending on the circum- stances. For example, if the auditor is unable to obtain all the necessary information to con- clude whether the inventory account is fairly stated (which is called a “scope limitation”), the auditor will qualify the report, indicating that the financial statements are fairly stated except for the fact that the auditor was unable to obtain sufficient appropriate evidence about the inventory account. If the scope limitation is so pervasive that it limits the ability of the auditor to conclude on the financial statements as a whole (e.g., the client’s financial records were all destroyed in a fire), the auditor will issue a “disclaimer of opinion,” indicating that it is not possible to express an opinion on the fairness of the financial statements.

While it is important for you to be familiar with the basic components of the audit report as part of understanding an overview of the audit process, we cover the different types of financial statement audit reports in detail in Chapter 18. Our experience is that while it is helpful to get an idea of what an audit report looks like early on, students find it more intui- tive to learn the fundamental concepts of auditing and how an audit is conducted before being immersed in the details of audit reporting.

The audit report represents the culmination of the audit process and is the way the auditor communicates his or her opinion about a client’s financial statements with outside parties. An example of an unqualified audit report is included in this chapter to give you a basic idea of what the most common type of audit report for a public company looks like and how auditors report their opinion to the public. Be aware that changes are coming for audit reporting—the biggest change perhaps being that the auditor will communicate “critical audit matters” in the audit report. Critical audit matters are those that involve difficult, subjective, or complex auditor judgments or pose significant difficulty to the auditor in completing the audit. We’ll discuss these coming changes further in Chapter 18.

Conclusion

You can see from this chapter that a good financial statement auditor needs to understand not only accounting but also the concepts and techniques of gathering and evaluating evi- dence to assess management’s financial statement assertions. In addition, an auditor needs a deep understanding of business in general as well as of the specific industries in which his or her clients operate. This is why professionals with auditing experience frequently have attractive opportunities to move into other areas of business and management. Chief execu- tive officers, business owners, chief financial officers, consultants, and controllers are often former auditors.

This chapter is designed to help you develop an intuitive understanding of basic auditing concepts. As you study auditing, you will need to commit some details to memory. But we can’t emphasize this enough: you will understand and appreciate the details of the auditing process much more fully if you make a serious effort to understand at an intuitive, common sense level why financial statement auditing is in demand, the fundamental concepts and logic underlying an audit, and the basic process by which it is carried out.

Keep in mind that auditing is a fundamentally logical process of thinking and reasoning—don’t be hesitant to exercise your common sense and reasoning skills! You will benefit much more from your reading of this text (and likely do better on exams) if you study it with a reasoning, inquisitive approach, rather than merely attempting to memorize details. As you learn new auditing concepts, take some time to understand the underlying logic and how the concepts interrelate with other concepts. As you learn about auditing pro- cedures, ask yourself how and why the procedure might yield relevant evidence, and think of other ways you might obtain useful evidence. Rote memorization alone is not a good way to study auditing!

Being a good auditor sometimes requires imagination and innovation. For example, a few years back an auditor was faced with figuring out how to verify a client’s assertion regarding the existence of inventory. The problem was that the “inventory” consisted of

LO 1-9

Final PDF to printer

24 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 24 09/30/15 02:33 PM

thousands of head of cattle on a ranch covering dozens of square miles. There was no stan- dard procedure manual for the auditor to refer to—he simply had to figure out an effective and efficient way to obtain persuasive evidence that the cattle existed in the numbers asserted by the ranch’s management.

In the end, the auditor decided to charter a small airplane to fly over the ranch and sys- tematically take photos—1 per 50 square acres. The auditor was able to obtain a count of the cattle from the photos. He also evaluated veterinary records to see if the number of required annual vaccinations delivered by the vet approximated the number of cattle counted in the photos. Finally, he did some calculations based on average bovine birth and death rates, taking into account recorded purchases and sales of livestock during the year. Using this combina- tion of procedures, the auditor was able to obtain persuasive evidence supporting manage- ment’s assertion regarding inventory (and got an airplane ride in the process).

We hope this example helps illustrate why you will need to approach the study of audit- ing differently from that of most other accounting courses, and how learning auditing con- cepts can benefit you even if you do not plan to become a financial statement auditor. We can promise you this—in learning the concepts and techniques of auditing, you will not only acquire the tools to become an effective financial statement auditor, you will also learn new ways of reasoning and analyzing that will be highly useful to you in many different contexts and settings.

KEY TERMS

Assurance services. Independent professional services that improve the quality of informa- tion, or its context, for decision makers. Encompasses attest services and financial statement audits. Attest services. Services provided by a practitioner engaged to issue a report on subject mat- ter, or an assertion about subject matter, that is the responsibility of another party. Encom- passes financial statement audits. Audit evidence. All the information used by the auditor in arriving at the conclusions on which the audit opinion is based. Audit evidence includes the information contained in the accounting records underlying the financial statements, as well as other information. Audit risk. The risk that the auditor expresses an inappropriate audit opinion when the finan- cial statements are materially misstated. Auditing. A systematic process of (1) objectively obtaining and evaluating evidence regard- ing assertions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and (2) communicating the results to inter- ested users. Financial statement assertions. Expressed or implied representations by management that are reflected in the financial statement components. Information asymmetry. The concept that the manager generally has more information about the true financial position and results of operations of the entity than the absentee owner does. Materiality. The maximum amount by which the auditor believes the financial statements could be misstated and still not affect the decisions of users. Misstatement. An instance where a financial statement assertion is not in accordance with the criteria against which it is audited (e.g., GAAP). Misstatements may be classified as fraud (intentional), other illegal acts such as noncompliance with laws and regulations (intentional or unintentional), and errors (unintentional). Reasonable assurance. The concept that an audit done in accordance with auditing standards may fail to detect a material misstatement in a client’s financial statements. In an auditing context this term has been defined to mean a high but not absolute level of assurance.

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 25

mes32502_ch01_001-034.indd 25 09/30/15 02:33 PM

Reporting. The end product of the auditor’s work, indicating the auditing standards followed and expressing an opinion as to whether an entity’s financial statements are fairly presented in accordance with agreed-upon criteria (e.g., GAAP). Risk of material misstatement. The preaudit risk that the entity’s financial statements con- tain a material misstatement whether caused by error or fraud. Unqualified/unmodified audit report. A “clean” audit report, indicating the auditor’s opin- ion that a client’s financial statements are fairly presented in accordance with agreed-upon criteria (e.g., GAAP).

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 1-1 1-1 Why is studying auditing different from studying other accounting topics? How might understanding auditing concepts prove useful for consultants, business man- agers, and other business decision makers?

LO 1-2 1-2 Discuss why there is a demand for auditing services in a free-market economy. What evidence suggests that auditing would be demanded even if it were not required by government regulation?

LO 1-2 1-3 What is meant by the statement “The agency relationship between absentee owners and managers produces a natural conflict of interest”?

LO 1-2 1-4 Why is independence such an important requirement for auditors? How does inde- pendence relate to the agency relationship between owners and managers?

LO 1-3, 1-4 1-5 Define auditing, attest, and assurance services. LO 1-4 1-6 The Committee on Basic Auditing Concepts has provided a widely cited definition

of auditing. What does the phrase “systematic process” mean in this definition? LO 1-5 1-7 Define audit risk and materiality. How are these concepts reflected in the auditor’s

report? LO 1-6 1-8 Briefly describe why on most audit engagements an auditor tests only a sample of

transactions that occurred. LO 1-7 1-9 What are the major phases of an audit? LO 1-7 1-10 What are the primary elements involved in the planning phase of an audit? LO 1-8 1-11 Identify the four paragraphs of the auditor’s standard unqualified report for a public

company client. LO 1-9 1-12 Briefly discuss why auditors must often exercise creativity and innovation in

auditing financial statements. Give an example different from the one offered in the text.

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 1-2, 1-4 1-13 An independent audit adds value to the communication of financial information because the audit

a. Confirms the exact accuracy of management’s financial representations. b. Lends credibility to the financial statements. c. Guarantees that financial data are fairly presented. d. Assures the readers of financial statements that any fraudulent activity has been

corrected.

Final PDF to printer

26 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 26 09/30/15 02:33 PM

LO 1-2, 1-4 1-14 Which of the following best describes the reason why an independent auditor is often retained to report on financial statements?

a. Management fraud may exist, and it is more likely to be detected by independent auditors than by internal auditors.

b. Different interests may exist between the entity preparing the statements and the persons using the statements, and thus outside assurance is needed to enhance the credibility of the statements.

c. A misstatement of account balances may exist, and all misstatements are gener- ally corrected as a result of the independent auditor’s work.

d. An entity may have a poorly designed internal control system.

LO 1-3 1-15 Which of the following best describes relationships among auditing, attest, and assurance services?

a. Attest is a type of auditing service. b. Auditing and attest services represent two distinctly different types of services—

there is no overlap. c. Auditing is a type of assurance service. d. Assurance is a type of attest service.

LO 1-3 1-16 Which of the following statements relating to attest and assurance services is not correct?

a. Independence is an important attribute of assurance service providers. b. Assurance services can be performed to improve the quality or context of infor-

mation for decision makers. c. Financial statement auditing is a form of attest service but it is not an assurance

service. d. In performing an attest service, the CPA determines the correspondence of the

subject matter (or an assertion about the subject matter) against criteria that are suitable and available to users.

LO 1-5, 1-7 1-17 For what primary purpose does the auditor obtain an understanding of the entity and its environment?

a. To determine the audit fee. b. To decide which facts about the entity to include in the audit report. c. To plan the audit and determine the nature, timing, and extent of audit procedures

to be performed. d. To limit audit risk to an appropriately high level.

LO 1-5 1-18 Which of the following statements best describes the role of materiality in a financial statement audit?

a. Materiality refers to the “material” from which audit evidence is developed. b. The higher the level at which the auditor assesses materiality, the greater the

amount of evidence the auditor must gather. c. The lower the level at which the auditor assesses materiality, the greater the

amount of evidence the auditor must gather. d. The level of materiality has no bearing on the amount of evidence the auditor

must gather.

LO 1-7 1-19 Which of the following is the most important reason for an auditor to gain an under- standing of an audit client’s system of internal control over financial reporting?

a. Understanding a client’s system of internal control can help the auditor assess risk and identify areas where financial statement misstatements might be more likely.

b. Understanding a client’s system of internal control can help the auditor make valuable recommendations to management at the end of the engagement.

c. Understanding a client’s system of internal control can help the auditor sell con- sulting services to the client.

d. Understanding a client’s system of internal control is not a required part of the audit process.

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 27

mes32502_ch01_001-034.indd 27 09/30/15 02:33 PM

LO 1-7 1-20 Preliminary engagement activities include a. Understanding the client and the client’s industry. b. Determining audit engagement team requirements. c. Ensuring the independence of the audit team and audit firm. d. All of the above.

LO 1-8 1-21 Which of the following statements best describes what is meant by an unqualified audit opinion?

a. Issuance of an unqualified auditor’s report indicates that in the auditor’s opinion the client’s financial statements are not fairly enough presented in accordance with agreed-upon criteria to qualify for a clean opinion.

b. Issuance of an unqualified auditor’s report indicates that the auditor is not quali- fied to express an opinion that the client’s financial statements are fairly presented in accordance with agreed-upon criteria.

c. Issuance of an unqualified auditor’s report indicates that the auditor is expressing different opinions on each of the basic financial statements regarding whether the client’s financial statements are fairly presented in accordance with agreed- upon criteria.

d. Issuance of a standard unqualified auditor’s report indicates that in the auditor’s opinion the client’s financial statements are fairly presented in accordance with agreed-upon criteria, with no need for the inclusion of qualifying phrases.

LO 1-8 1-22 The auditing standards that are used to guide the conduct of the audit are a. Implicitly referred to in the opening paragraph of the auditor’s standard report. b. Explicitly referred to in the opening paragraph of the auditor’s standard report. c. Implicitly referred to in the scope paragraph of the auditor’s standard report. d. Explicitly referred to in the scope paragraph of the auditor’s standard report. e. Implicitly referred to in the opinion paragraph of the auditor’s standard report. f. Explicitly referred to in the opinion paragraph of the auditor’s standard report.

LO 1-8 1-23 A client has used an inappropriate method of accounting for its pension liability on the balance sheet. The resulting misstatement is material, but the auditor does not consider its effect to be pervasive. The auditor is unable to convince the client to alter its accounting treatment. The rest of the financial statements are fairly stated in the auditor’s opinion. Which kind of audit report should the auditor issue under these circumstances?

a. Standard unqualified opinion. b. Qualified opinion due to departure from GAAP. c. Adverse opinion. d. No opinion at all.

PROBLEMS All applicable problems are available with Connect.

LO 1-2 1-24 Greenbloom Garden Centers is a small, privately held corporation that has two stores in Orlando, Florida. The Greenbloom family owns 100 percent of the com- pany’s stock, and family members manage the operations. Sales at the company’s stores have been growing rapidly, and there appears to be a market for the com- pany’s sales concept—providing bulk garden equipment and supplies at low prices. The controller prepares the company’s financial statements, which are not audited. The company has no debt but is considering expanding to other cities in Florida. Such expansion may require long-term borrowings and is likely to reduce the fam- ily’s day-to-day involvement in all of the company’s operations. The family does not intend to sell stock in the company.

Final PDF to printer

28 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch01_001-034.indd 28 09/30/15 02:33 PM

Required: Discuss the factors that may make an audit necessary and potentially valuable for the company. Be sure to consider the concept of information risk.

LO 1-2, 1-4, 1-5 1-25 You were recently hired by the CPA firm of Honson & Hansen. Within two weeks, you were sent to the first-year staff training course. The instructor asks you to pre- pare answers for the following questions:

a. How is audit evidence defined? b. How does audit evidence relate to assertions and to the audit report? c. What characteristics of evidence should an auditor be concerned with when

searching for and evaluating audit evidence?

LO 1-7 1-26 John Josephs, an audit manager for Tip, Acanoe & Tylerto, was asked to speak at a dinner meeting of the local Small Business Administration Association. The presi- dent of the association has suggested that he talk about the various phases of the audit process to help small business owners better understand what auditors do. John has asked you, his trusted assistant, to prepare an outline for his speech. He suggests that you answer the following:

a. List and briefly describe the various phases of an audit. b. Describe how audit procedures designed for one purpose might also provide evi-

dence for other purposes. Give an example. c. One of the phases involves understanding an entity’s internal control. Why might

the members of the association be particularly interested in the work conducted by auditors in this phase of the audit?

LO 1-8 1-27 Many companies post their financial statements and auditor’s report on their home pages, generally under a heading labeled “investor relations.” Use one of the Internet search engines to do the following:

a. Visit Intel’s (www.intel.com) and Microsoft’s (www.microsoft.com) home pages and review their financial statements, including their auditors’ reports.

b. Search the web for the home page of a non-U.S. company and review its finan- cial statements, including its auditor’s report. For example, BMW’s home page (www.bmwgroup.com, under Investor Relations) allows a visitor to download the financial statements and accompanying audit report as a .pdf file. Identify the auditing standards followed by the company’s auditors.

c. Compare the standard U.S. audit report with the audit report for the non-U.S. company (e.g., BMW). Note that in some cases, non-U.S.-based companies’ reports use a U.S. audit report.

d. Visit the SEC’s website (www.sec.gov), and find the link for EdgarScan. Find, download, and print the auditor’s report for a U.S. company of your choice. Iden- tify whether or not the audit report is an unqualified, or “clean,” opinion and explain how you could tell.

LO 1-8 1-28 Using the audit report included in Chapter 1, identify and briefly explain the phrases or words that indicate to the users that the financial statements are not necessar- ily an “exact” representation of the results of operations and financial position of a company.

DISCUSSION CASE

LO 1-1, 1-2 1-29 You recently attended your five-year college reunion. At the main reception, you encountered an old friend, Lee Beagle, who recently graduated from law school and is now practicing with a large law firm in town. When you told him that you are a CPA and employed by a regional CPA firm, he made the following statement: “You

Final PDF to printer

Chapter 1 An Introduction to Assurance and Financial Statement Auditing 29

mes32502_ch01_001-034.indd 29 09/30/15 02:33 PM

know, if the securities acts had not been passed by Congress in the 1930s, no one would be interested in having an audit performed.”

Required: Draft a memo that highlights your thoughts about Lee’s statement that audits only

take place because they are required by law.

INTERNET ASSIGNMENT

HANDS-ON CASES

EarthWear Online

Visit Connect’s additional student resources to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch01_001-034.indd 30 09/30/15 02:33 PM

Final PDF to printer

mes32502_ch01_001-034.indd 31 09/30/15 02:33 PM

Final PDF to printer

mes32502_ch01_001-034.indd 32 09/30/15 02:33 PM

Final PDF to printer

mes32502_ch01_001-034.indd 33 09/30/15 02:33 PM

Final PDF to printer

mes32502_ch01_001-034.indd 34 09/30/15 02:33 PM

Final PDF to printer

e a r t h we a r A N N U A L R E P O R T

2015

Company History and Operations EarthWear Clothiers was founded in Boise, Idaho, by James Williams and Calvin Rogers in 1973 to make high-quality clothing for outdoor sports, such as hiking, skiing, fly-fishing, and white-water kayaking. Over the years, the Company’s product lines have grown to include casual clothing, accessories, shoes, and soft luggage. EarthWear offers its products through three retailing options: catalogs, retail outlets, and its website.

The Company strives to provide excellent, high-quality products at reasonable prices. EarthWear has a commitment to excellence in customer service and an unconditional guarantee. The Company is also conscious of its environmental responsibilities. All Company facilities are insulated, recycle, and conserve power. The Company continuously monitors the environmental impact of its products. The Company believes that many of its customers share this concern for the environment.

The Company offers its products principally through regular mailings of its monthly catalogs in the United States, Europe, and Japan. EarthWear has 10 U.S. outlet stores, four in the U.K., two in Germany, and two in Japan. The Company also offers its products over the Internet (www.mhhe.com/earthwear). During 2011, the Company expanded its global presence by launching sites in France, Italy, Ireland, and several eastern European countries. Currently, revenue from catalog sales, retail outlets, and the website are 74 percent, 5 percent, and 21 percent, respectively. Management expects that Internet sales will grow significantly in the future, perhaps replacing catalogs as the major source of sales.

EarthWear was incorporated in Idaho in 1975 and became a Delaware corporation in 1986 when it went public.

2 © Creatas/PunchStock RF

company growth strategy EarthWear’s growth strategy has three elements. First, the Company attempts to increase sales by expanding its customer base and by increasing sales to existing customers through improved product offerings. Second, the Company seeks to generate additional sales by targeted mailings of special issues of its catalogs and by offering its products through its web site. Third, the Company is pursuing additional opportunities to expand its merchandising skills internationally.

catalogs and sales operations During 2015 the Company mailed 12 issues of its regular monthly catalog with an average of 75 pages per issue from its U.S. operations. Worldwide, the Company mailed approximately 160 million full- price catalogs. EarthWear views each catalog issue as a unique opportunity to communicate with its customers. Products are described in visual and editorial detail, and the Company uses such techniques as background stories and distinctive covers to stimulate the readers’ interest.

Each issue of the regular catalog offers certain basic product lines for men and women. The regular catalog also offers seasonal merchandise. In addition, EarthWear mails two end- of-season clearance catalogs. The Company mails its catalogs to prospective customers who are identified based on lists of magazine subscribers and lists of households meeting certain demographic criteria. In addition, the Company identifies prospective new customers through its national advertising campaign.

In 1991 the Company introduced its first business specialty catalog, which offered its products to groups and companies for corporate incentive programs. EarthWear’s embroidery capabilities allow for the design and monogram of unique logos or emblems for groups and companies. In 2015 the Company mailed five issues of its corporate sales catalogs.

The international business segment includes operations in Japan, Germany, and the United Kingdom, and various Internet sites. Catalogs mailed in those countries are written in the local languages and denominated in local currencies. In the spring of 2011, EarthWear launched local websites in each of these countries in their respective languages and currencies.

c us t o m e r data ba s e A principal factor in the Company’s success has been the development of its own list of active customers. At the end of 2015 the Company’s mailing list consisted of about 21.1 million persons, approximately 7 million of whom were viewed as customers because they had made at least one purchase from the Company within the last 24 months. The Company routinely updates and refines the database before mailing catalogs to monitor customer interest as reflected in criteria such as the recency, frequency, dollar amount, and product type of purchases.

EarthWear believes that its customer database has desirable demographic characteristics and is well suited to the products offered in “the Company’s” catalogs. A survey conducted by the Company in the United States during 2014 indicated that approximately 50 percent of its customers were in the 35–54 age group and had median incomes of $78,000.

The Company advertises nationally to build its reputation and to attract new customers. In 2014 an advertising campaign appeared in about 40 national magazines, as well as on five national cable television networks. In addition, the Company advertises in approximately 75 national, regional, and local p u b l i c a t i o n s i n C a n a d a , t h e U n i t e d Kingdom, Germany, and Japan. EarthWear also advertises on a number of Internet search engines and websites.

p r o d u c t d e v e l o p m e n t EarthWear concentrates on clothing and other products that are aimed at customers interested in outdoor activities. The Company’s products are styled and quality crafted to meet the changing tastes of the Company’s customers rather than to mimic the changing fads of the fashion world. At the same time, the Company seeks to maintain customer interest by developing new products, improving existing core products, and reinforcing its value positioning.

The Company continues to incorporate innovations in fabric, construction, and detail that add value and excitement and differentiate EarthWear from the competition. In order to ensure that products are manufactured to the Company’s quality standards at reasonable prices, product managers, designers, and quality assurance specialists develop the Company’s own products.

EarthWear deals directly with its suppliers and seeks to avoid intermediaries. All goods are produced by independent manufacturers except for most of its soft luggage, which is assembled at the Company’s facilities. During 2015 the Company purchased merchandise from approximately 300 domestic and foreign manufacturers. One manufacturer and one intermediary accounted for about 14 and 29 percent of the Company’s received merchandise, respectively, in 2015. In 2015 about 80 percent of the Company’s merchandise was imported, mainly from Asia, Central America, Mexico, and Central America. The Company will continue to take advantage of worldwide sourcing without sacrificing customer service or quality standards.

3 © Monkey Business Images Ltd/Getty Images RF

Order Entry, Fulfillment, and Delivery EarthWear has toll-free telephone numbers that customers can call 24 hours a day, seven days a week (except Christmas Day) to place orders or to request a catalog. Approximately 90 percent of catalog orders are placed by telephone. Telephone calls are answered by the Company’s well-trained sales representatives, who utilize online computer terminals to enter customer orders and to retrieve information about product characteristics and availability. The Company’s three U.S. telephone centers are located in Boise, Idaho; Reston, Virginia; and Canton, Ohio. International telephone centers are located in London, England; Tokyo, Japan; and Mannheim, Germany.

The Company’s order entry and fulfillment system permits shipment of in-stock orders on the following day, but orders requiring monogramming or inseaming typically require one or two extra days. The Company’s” sales representatives enter orders into an online order entry and inventory control system. Customers using the Company’s Internet site see color photos of the products, their availability, and prices. When ordering a product over the Internet, the customer completes a computer screen that requests information on product code, size, color, and so on. When the customer finishes shopping for products, he or she enters delivery and credit card information into a computer-based form. EarthWear provides assurance through CPA WebTrust SM that the website has been evaluated and tested to meet WebTrust SM principles and criteria. This assurance service is provided by the Company’s independent auditors, Willis & Adams, LLP.

Orders are generally shipped by United Parcel Service (UPS) at various tiered rates that depend on the total dollar value of each customer’s order. Other expedited delivery services are available at additional charge. Domestically, the Company utilizes two-day UPS service at standard rates, enhancing its customer service. Comparable services are offered in international markets.

4 © Quasarphoto/Getty Images RF

merchandise liquidation Liquidations (sales of overstock and end-of-season merchandise at reduced prices) were approximately 12 percent, 11 percent, and 8 percent of net sales in 2015, 2014, and 2013, respectively. Most liquidation sales were made through catalogs and other print media. The balance was sold principally through the Company’s outlet retail stores.

competition The Company’s principal competitors are retail stores, including specialty shops, department stores, and other catalog companies. Direct competitors include Eddie Bauer, Land’s End, L. L. Bean, Patagonia, and Timberland. The Company may also face increased competition from other retailers as the number of television shopping channels and the variety of merchandise offered over the Internet increase. The apparel retail business in general is intensely competitive. EarthWear competes principally on the basis of merchandise value (quality and price), its established customer list, and customer service, including fast order fulfillment and its unqualified guarantee.

t r a d e m a r k s The Company uses the trademarks of “EarthWear” and “EWC” on products and catalogs.

seasonality of business The Company’s business is highly seasonal. Historically, a disproportionate amount of the Company’s net sales and most of its profits have been realized during the fourth quarter. If the Company’s sales were materially different from seasonal norms during the fourth quarter, the Company’s annual operating results could be materially affected. Accordingly, results for the individual quarters do not necessarily indicate results to be expected for the entire year. In 2015, 37 percent of the Company’s total revenue came in the fourth quarter.

e m p l oy e e s The Company believes that its skilled and dedicated workforce is one of its key resources. Employees are not covered by collective bargaining agreements, and the Company considers its employee relations to be excellent. As a result of the highly seasonal nature of the Company’s business, the size of the Company’s workforce varies, ranging from approximately 3,500 to 5,300 individuals in 2015. During the peak winter season of 2015, approximately 2,700 of the Company’s 5,300 employees were temporary employees.

executive officers of the company James G. Williams, is chairman of the board and former chief executive officer. Mr. Williams was one of the two original founders of EarthWear. He stepped down as chief executive officer in December 1999.

Calvin J. Rogers, is president and chief executive officer of the Company. Mr. Rogers was one of the two original founders of the Company. He assumed his present position in December 1999.

Dominique DeSantiago, is executive vice president and chief operating officer. Mr. DeSantiago joined the Company as chief operating officer in June 1991. He was promoted to vice president in October 1994. Mr. DeSantiago was previously employed by Eddie Bauer in various capacities.

Linda S. McDaniel, is senior vice president of sales. She joined the Company in July 1996. Ms. McDaniel served as divisional vice president, merchandising, with Patagonia between 1986 and 1990. Ms. McDaniel was the president and chief executive officer for Mountain Goat Sports from 1990 until 1996. She has been serving as a director of the Company since November 1997.

James C. ("JC") Watts, is senior vice president and chief financial officer. Mr. Watts joined the Company in May 1996, assuming his current position. He was previously employed by Federated Department Stores.

Mary Ellen Tornesello, is senior vice president of operations. Ms. Tornesello joined the Company in 1994 as operations manager. She served as vice president of operations from 1995 until 1997, at which time she assumed her present position.

5 © Jules Frazier/Getty Images RF

Market information The common stock of the Company is listed and traded on NASDAQ under the symbol EWCC. The high and low prices of the Company’s common stock for 2015 were $52.50 and $21.75 per share. The closing price of the Company’s stock on December 31, 2015, was $26.75 per share.

Shareholders As of December 31, 2015, the number of shareholders of record of common stock of the Company was 2,120. This number excludes shareholders whose stock is held in nominee or street name by brokers.

Independent Auditors The Company has been audited by Willis & Adams since incorporation in 1975.

Net Sales Cost of sales

Gross Profit Selling, general, and administrative expenses Nonrecurring charge (credit)

Income from operations Other income (expense): Interest expense Interest income Other

Total other income (expense), net

Income before income taxes Income tax provision

Net income

Basic earnings per share

Diluted earnings per share

Basic weighted average shares outstanding Diluted weighted average shares outstanding

$ 950,484 546,393

404,091 364,012 ____

40,079

(983) 1,459 (4,798)

(4,322)

35,757 13,230

$ 22,527

1.15

1.14

19,531 19,774

For the period ended December 31

$ 857,885 472,739

385,146 334,994 (1,153)

51,305

(1,229) 573 (1,091)

(1,747)

49,559 18,337

$ 31,222

1.60

1.56

19,555 20,055

$ 891,394 490,530

400,864 353,890 8,190

38,784

(5,027) 10 (1,593)

6,609

32,175 11,905

$ 20,270

1.02

1.01

19,806 19,996

2014 20132015

EARTHWEAR CLOTHIERS Consolidated Statements of Operations

(In thousands, except share data)

Assets

Current assets: Cash and cash equivalents Receivables, net Inventory Prepaid advertising Other prepaid expenses Deferred income tax benefits

Total current assets

Property, plant, and equipment, at cost Land and buildings Fixtures and equipment Computer hardware and software Leasehold improvements

Total property, plant, and equipment Less accumulated depreciation and amortization

Property, plant, and equipment, net Intangibles, net

Total assets

Liabilities and shareholders' investment

Current liabilities: Lines of credit Accounts payable Reserve for returns Accrued liabilities Accrued profit sharing Income taxes payable

Total current liabilities

Deferred income taxes

Shareholders' investment: Common stock, 26,121 shares issued Donated capital Additional paid-in capital Deferred compensation Accumulated other comprehensive income Retained earnings Treasury stock, 6,546 and 6,706 shares at cost

Total shareholders' investment

Total liabilities and shareholders' investment

2015 2014

December 31

$ 48,978 12,875 122,337 11,458 6,315 7,132

209,095

70,918 67,513 64,986 3,010

206,426 85,986

120,440 423

$ 329,959

$ 11,011 62,509 5,890 26,738 1,532 8,588

116,268

9,469

261 5,460 20,740 (79) 3,883 317,907 (143,950)

204,222

$ 329,959

$ 49,668 11,539 105,425 10,772 3,780 6,930

188,115

66,804 66,876 47,466 2,894

184,040 76,256

107,784 628

$ 296,527

$ 7,621 48,432 5,115 28,440 1,794 6,666

98,067

5,926

261 5,460 19,311 (153) 1,739 295,380 (129,462)

192,535

$ 296,527

EARTHWEAR CLOTHIERS Consolidated Balance Sheets

(In thousands)

EARTHWEAR CLOTHIERS Consolidated Statements of Cash Flows

(In thousands)

Cash flows from (used for) operating activities:

Net income Adjustments to reconcile net income to net cash flows from operating activities: Nonrecurring charge (credit) Depreciation and amortization Deferred compensation expense Deferred income taxes Loss on disposal of fixed assets Changes in assets and liabilities excluding the effects of divestitures: Receivables, net Inventory Prepaid advertising Other prepaid expenses Accounts payable Reserve for returns Accrued liabilities Accrued profit sharing Income taxes payable Tax benefit of stock options Other

Net cash from (used for) operating activities

Cash flows from (used for) investing activities: Cash paid for capital additions

Net cash flows used for investing activities

Cash flows from (used for) financing activities: Proceeds from (payment of) short-term debt Purchases of treasury stock Issuance of treasury stock

Net cash flows used for financing activities

Net increase (decrease) in cash and cash equivalents

Beginning cash and cash equivalents

Ending cash and cash equivalents

Supplemental cash flow disclosures: Interest paid Income taxes paid

$ 22,527

15,231 75 3,340 $284

(1,336) (16,912) (686) (2,534) 14,078 775 (709) (262) 1,923 1,429 2,144

39,367

(28,959)

3,390 (18,192) 3,704

(11,097)

(690)

49,668

$ 48,978

$ 987 6,278

$ 31,222

(1,153) 13,465 103 5,376 602

2,165 37,370 3,110 1,152 (8,718) 439 (4,982) 328 (2,810) 1,765 437

79,871

(18,208)

(17,692) (2,935) 4,317

(16,310)

45,352

4,317

$ 49,668

$ 1,229 13,701

$ 20,270

8,190 12,175 424 (3,866) 381

(3,666) 13,954 (1,849) (1,628) 2,716 692 4,545 (1,320) (3,834) 349 733

48,269

(30,388)

4,228 (23,112) 1,199

(17,685)

197

4,120

$ 4,317

$ 5,000 18,107

2015 2013

For the period ended December 31

2014

Balance, December 31, 2012 Purchase of treasury stock Issuance of treasury stock Tax benefit of stock options exercised Deferred compensation expense Comprehensive income: Net income Foreign currency translation adjustments

Comprehensive income

Balance, December 31, 2013 Purchase of treasury stock Issuance of treasury stock Tax benefit of stock options exercised Deferred compensation expense Comprehensive income: Net income Foreign currency translation adjustments

Comprehensive income

Balance, December 31, 2014 Purchase of treasury stock Issuance of treasury stock Tax benefit of stock options exercised Deferred compensation expense Comprehensive income: Net income Foreign currency translation adjustments Unrealized gain on forward contracts

Comprehensive income

Balance, December 31, 2015

$ 261 $ 5,460 $ 17,197 ($ 681) $ 569 $243,888 ($108,931) $ 157,763 (23,112) (23,112) 1,199 1,199 349 349 424 424

$ 20,270 20,270 20,270

733 733 733

$ 21,003

$ 261 $ 5,460 $ 17,546 ($ 257) $ 1,302 $264,158 ($130,844) $ 157,626 (2,935) (2,935) 4,317 4,317 1,765 1,765 103 103

$ 31,222 31,222 31,222 60 60 60 377 377 377

$ 31,659

$ 261 $ 5,460 $ 19,311 ($ 154) $ 1,739 $295,380 ($129,463) $ 192,534 (18,192) (18,192) 3,704 3,704 1,429 1,429 75 75

$ 22,527 22,527 22,527

(1,151) (1,151) (1,151)

3,295 3,295 3,295

$ 24,671

$ 261 $ 5,460 $ 20,740 ($ 79) $ 3,883 $ 317,907 ($143,950) $ 204,222

EARTHWEAR CLOTHIERS Consolidated Statements of Stockholders’ Investment

(In thousands)

Accumulated Additional Other Comprehensive Common Donated Paid-In Deferred Comprehensive Retained Treasury Income Stock Capital Capital Compensation Income Earnings Stock Total

EARTHWEAR CLOTHIERS Five-Year Consolidated Financial Summary (unaudited)

(In thousands, except per share data)

Income statement data: Net Sales Pretax Income Percent of net sales Net income

Per share of common stock: Basic earnings per share Diluted earnings per share Common shares outstanding

Balance sheet data: Current assets Current liabilities PPE and intangibles Total assets Noncurrent liabilities Shareholders' investment

Other data: Net working capital Capital expenditures Depreciation and amortization expense Return on average shareholders' investment Return on average assets

2015 2014 2013 2012 2011

950,484 857,885 891,394 821,359 503,434 35,757 49,559 32,175 66,186 38,212 3.8% 5.8% 3.6% 8.1% 7.6% 22,527 31,222 20,270 41,698 22,929

1.15 1.60 1.02 2.01 1.54 1.14 1.56 1.01 2.00 1.53 19,531 19,555 19,806 20,703 14,599

209,095 188,115 191,297 194,445 122,418 116,268 98,067 133,434 118,308 65,505 120,863 108,412 105,051 87,312 46,658 329,959 296,527 296,347 281,757 170,121 9,469 5,926 5,286 5,686 4,211 204,222 192,535 157,627 157,763 100,405

92,827 90,048 57,863 76,136 56,913 28,959 18,208 30,388 31,348 8,316

15,231 13,465 12,175 9,833 6,101

11% 18% 13% 28% 24% 7% 11% 7% 16% 15%

For the period ended December 31

NET INCOME NET SALES NET INCOME PER SHARE

$0.50

$1.00

$1.50

$2.00

2005 2006 20072003 2004

$2.00

$1.50

$1.00

$0.50

2011 2012 2013 2014 20152013 2014 2015

$900,000

$800,000

$700,000

$600,000

$500,000

$400,000

$50,000

2013 2014 2015

$30,000

$20,000

$10,000

$40,000

note a: summary of significant accounting policies

NATURE OF BUSINESS EarthWear markets high quality clothing for outdoor sports, casual clothing, accessories, shoes, and soft luggage. The Company manages its business in three operating segments consisting of core, business-to-business, and international. The Company’s primary market is the United States; other markets include Canada, Europe, and Japan.

PRINCIPLES OF CONSOLIDATION The consolidated statements include the accounts of the Company and its subsidiaries after elimination of intercompany accounts and transactions.

USE OF ESTIMATES The preparations of financial statements in conformity with generally accepted accounting principles requires management to make estimates and assumptions that affect the reported amounts of assets and liabilities and disclosure of contingent assets and liabilities at the date of the financial statements and the reported amounts of revenues and expenses during the reporting periods. Actual results may differ from these estimates.

REVENUE RECOGNITION The Company records revenue at the time of shipment for catalog and e-commerce sales and at the point of sale for stores. The Company provides a reserve for returns.

RESERVE FOR LOSSES ON CUSTOMER RETURNS At the time of sale, the Company provides a reserve equal to the gross profit on projected merchandise returns, based on prior returns experience.

INVENTORY Inventory is stated at the last-in, first-out (LIFO) cost, which is lower than market. If the first- in, first-out method of accounting for inventory had been used, inventory would have been approximately $10.8 million and $13.7 million higher than reported at December 31, 2015 and 2014, respectively.

ADVERTISING The Company expenses the costs of advertising for magazines, television, radio, and other media the first time the advertising takes place, except for direct-response advertising, which is capitalized and amortized over its expected period of future benefits. Direct-response advertising consists primarily of catalog production and mailing costs, which are generally amortized within three months from the date catalogs are mailed.

DEPRECIATION Depreciation expense is calculated using the straight-line method over the estimated useful lives of the assets, which are 20 to 30 years for buildings and land improvements and 5 to 10 years for leasehold improvements and furniture, fixtures, equipment, and software. The Company allocates one half year of depreciation to the year of addition or retirement.

INTANGIBLES Intangible assets consist primarily of goodwill, and is not amortized but is tested at least annually for impairment.

FINANCIAL INSTRUMENTS WITH OFF-BALANCE- SHEET RISK The Company uses import letters of credit to purchase foreign-sourced merchandise. The letters of credit are primarily U.S. dollar-denominated and are issued through third-party financial institutions to guarantee payment for such merchandise within the agreed-upon time periods. At December 31, 2015, the Company had outstanding letters of credit of approximately $23 million, all of which had expiration dates of less than one year.

F O R E I G N C U R R E N C Y T R A N S L AT I O N S A N D T R A N S AC T I O N S F i n a n c i a l s t a t e m e n t s o f t h e foreign subsidiaries are translated into U.S. dollars in accordance with ASC Topic 830. Translation adjustments are recorded in accumulated other comprehensive income, which is a component of stockholders’ equity.

note b: stockholders’ equity

COMMON STOCK The Company currently is authorized to issue 70 million shares of $0.01 par value common stock.

TREASURY STOCK The Company’s board of directors has authorized the purchase of a total of 12.7 million shares of the Company’s common stock. A total of 6.5 million and 6.7 million had been purchased as of December 31, 2015 and 2014, respectively.

STOCK AWARDS AND GRANTS The Company has a restricted stock award plan. Under the provisions of the plan, a committee of the Company’s board may award shares of the Company’s common stock to its officers and key employees. Such shares vest over a 10-year period on a straight-line basis.

The granting of these awards has been recorded as deferred compensation based on the fair market value of the shares at the date of the grant. Compensation expense under these plans is recorded as shares vest.

STOCK OPTIONS The Company has 3.5 million shares of common stock that may be issued pursuant to the exercise of options granted under the Company’s stock option plan. Options are granted at the discretion of a c o m m i t t e e o f t h e C o m p a n y ’s board of directors to officers and key employees of the Company. No option may have an exercise price less than the fair market value per share of the common stock at the date of the grant.

N O

T E

S T

O T

H E

C O

N S

O LI

D A

T E

D F

IN A

N C

IA L

S TA

T E

M E

N T

note c: lines of credit

The Company has unsecured domestic lines of credit with various U.S. banks totaling $150 million. There were $23.4 million amounts outstanding at December 31, 2015 compared to $20.2 million outstanding at December 31, 2014. In addition, the Company has unsecured lines of credit with foreign banks totaling the equivalent of $30 million for its wholly owned subsidiaries. At December 31, 2015, $11 million was outstanding at interest rates averaging 4.6 percent, compared with $7.6 million at December 31, 2014.

note d: long-term debt

There was no long-term debt at December 31, 2015 and 2014.

note e: leases

The Company leases store and office space and equipment under various lease arrangements. The leases are accounted for as operating leases.

note f: retirement plans

The Company has a retirement plan that covers most regular employees and provides for annual contributions at the discretion of the board of directors. Included in the plan is a 401(k) feature that allows employees to make contributions.

management’s discussion and analysis:

2015 was a year during which we’ve seen the results of our strategic initiatives of the last two years take hold. Sales momentum picked up toward the end of the third quarter and continued strongly through our all-important holiday season, and we reported a double-digit increase in both revenue and earnings for the fourth quarter. This success enabled us to complete the year with an annual 10.8 percent increase in total revenue, but a 27.8 percent decrease in earnings, mainly due to the weakness of the first nine months. Our strong finish for the year was gratifying in the face of a difficult economy.

M A N AG E M E N T ’ S D I S C U S S I O N A N D A N A LYS I S : RESULTS OF OPERATIONS FOR 2015 COMPARED TO 2014

TOTAL REVENUE INCREASED BY 10.8 PERCENT Total revenue for the year just ended was $950.5 million, compared with $857.9 million in the prior year, an increase of 10.8 percent. Seasonally strong sales resulted in a higher level of backorders during the fourth quarter and a first-time fulfillment rate of 85 percent for the year as a whole, slightly below the prior year’s rate. Overall merchandise sales growth was primarily attributable to changes in circulation, which included adding back our post-Thanksgiving catalog and our January full-price catalog, shifting the timing of our fall/winter mailings, increasing page circulation

and improving merchandise selection and creative presentations.

NET INCOME DECREASED Net income for 2015 was $22.5 million, down 27.8 percent from the $31.2 million earned in 2014. Diluted earnings per share for the year just ended were $1.14, compared with $1.56 per share for the prior year. The diluted weighted average number of common shares outstanding was 19.8 million for 2015 and 20.0 million for 2014.

GROSS PROFIT MARGIN Gross profit for the year just ended was $404 million, or 42.5 percent of total revenue, compared with $385 million, or 44.9 percent of total revenue, for the prior year. Liquidations were about 11 percent of net merchandise sales in 2015, compared with 12 percent in the prior year. In 2015, the cost of inventory purchases was down 2.0 percent, compared with deflation of 2.7 percent in 2014. This reduction was a result of improved sourcing. As a result, the LIFO inventory reserve was reduced by $2.8 million and $3.8 million in 2015 and 2014, respectively.

S E L L I N G , G E N E R A L , A N D A D M I N I S T R AT I V E EXPENSES Selling, general, and administrative (SG&A) expenses increased 9.0 percent to $364 million in 2015, compared with $334 million in the prior year. As a percentage of sales, SG&A was 38.3 percent in 2015 and 38.9 percent in the prior year. The decrease in the SG&A ratio was primarily the result of lower catalog costs associated with increased page circulation, as well as lower information services expenses as we continued to invest in the Internet and upgrade systems capabilities. The cost of producing and mailing catalogs represented about 39 percent and 38 percent of total SG&A in 2015 and 2014, respectively.

C R E D I T L I N E S A N D CA P I TA L E X P E N D I T U R E S Interest expense on lines of credit was down in 2015 due to lower average borrowing levels. Interest expense decreased to $1.0 million in 2015, compared to $1.2 million in 2014. We spent $29 million in cash on capital expenditures, which included $20 million for computer hardware and software. In addition, the Company acquired a new airplane by exchanging two of its own aircraft in 2015. Also, we purchased about $18 million in treasury stock. No long-term debt was outstanding at year-end 2015. Depreciation and amortization expense was $15.2 million, up 13.1 percent from the prior year, mainly due to computer software. Rental expense was $10.4 million, up 3.4 percent from 2014, primarily due to additional computer hardware.

M A

N A

G E

M E

N T

’S D

E C

IS IO

N A

N D

A N

A LY

S IS

To the Stockholders

EarthWear Clothiers, Inc.

Management of EarthWear Clothiers, Inc. (the “Company”) is responsible for the preparation, consistency, integrity, and fair presentation of the consolidated financial statements. The consolidated financial statements have been prepared in accordance with accounting principles generally accepted in the United States of America applied on a consistent basis and, in management’s opinion, are fairly presented. The financial statements include amounts that are based on management’s informed judgments and best estimates.

Management has established and maintains comprehensive systems of internal control that provide reasonable assurance as to the consistency, integrity, and reliability of the preparation and presentation of financial statements; the safeguarding of assets; the effectiveness and efficiency of operations; and compliance with applicable laws and regulations. The concept of reasonable assurance is based upon the recognition that the cost of the controls should not exceed the benefit derived. Management monitors the systems of internal control and maintains an independent internal auditing program that assesses the effectiveness of internal control. Management assessed the Company’s internal control over financial reporting for financial presentations in conformity with accounting principles generally accepted in the United States of America. This assessment was based on criteria for effective internal control over financial reporting established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (the COSO report). Based on this assessment, management believes that the Company maintained effective internal control over financial reporting for financial presentations in conformity with accounting principles generally accepted in the United States of America as of December 31, 2015.

The Board of Directors exercises its oversight role with respect to the Company’s systems of internal control primarily through its Audit Committee, which is comprised solely of outside directors. The Committee oversees the Company’s systems of internal control and financial reporting to assess whether their quality, integrity, and objectivity are sufficient to protect shareholders’ investments.

The Company’s consolidated financial statements have been audited by Willis & Adams LLP (“Willis & Adams”), independent auditors. As part of its audit, Willis & Adams considers the Company’s internal control to plan the audit and determine the nature, timing, and extent of auditing procedures considered necessary to render its opinion as to the fair presentation, in all material respects, of the consolidated financial statements, which is based on independent audits made accordance with the standards of the Public Company Accounting Oversight Board (United States). Management has made available to Willis & Adams all the Company’s financial records and related data, and information concerning the Company’s internal control over financial reporting, and believes that all representations made to Willis & Adams during its audits were valid and appropriate.

Calvin J. Rogers James C. Watts

President and Chief Senior Vice President and Executive Officer Chief Financial Officer

M A

N A

G E

M E

N T

E P

O R

T O

N F

IN A

N C

IA L

S TA

T E

M E

N T

N D

I N

T E

R N

A L

C O

N T

R O

L O

V E

R F

IN A

N C

IA L

R E

P O

R T

IN G

To the Stockholders

EarthWear Clothiers, Inc.

We have audited EarthWear Clothiers’ internal control over financial reporting as of December 31, 2015, based on criteria established in Internal Control–Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). EarthWear Clothiers’ management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management Report on the Financial Statements and Internal Control. Our responsibility is to express an opinion on the effectiveness of the Company’s internal control over financial reporting based on our audit.

We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedure may deteriorate.

In our opinion, EarthWear Clothiers maintained effective internal control over financial reporting as of December 31, 2015, in all material respects, based on criteria established in Internal Control–Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated financial statements of EarthWear Clothiers and our report dated February 15, 2016 expressed an unqualified opinion.

Willis & Adams, CPAs

Boise, Idaho February 15, 2016

R E

P O

R T

F IN

D E

P E

N D

E N

T R

E G

IS T

E R

E D

P U

B LI

C A

C C

O U

N T

IN G

F IR

To the Stockholders

EarthWear Clothiers, Inc.

We have audited the consolidated balance sheets of EarthWear Clothiers as of December 31, 2015 and 2014,

and the related consolidated statements of operations, stockholders' equity, and cash flows for each of the

three years in the period ended December 31, 2015. These financial statements are the responsibility of the

Company's management. Our responsibility is to express an opinion on these financial statements based on

our audits.

We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board

(United States). Those standards require that we plan and perform the audit to obtain reasonable assurance

about whether the financial statements are free of material misstatement. An audit includes examining, on

a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also

includes assessing the accounting principles used and significant estimates made by management, as well as

evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis

for our opinion.

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects,

the financial position of the Company as of December 31, 2015 and 2014, and the results of its operations

and its cash flows for each of the three years in the period ended December 31, 2015, in conformity with U.S.

generally accepted accounting principles.

We also have audited, in accordance with the standards of the Public Company Accounting Oversight

Board (United States), the effectiveness of EarthWear Clothiers' internal control over financial reporting as of

December 31, 2015, based on criteria established in Internal Control—Integrated Framework issued by the

Committee of Sponsoring Organizations of the Treadway Commission (COSO) and our report dated

February 15, 2016 expressed an unqualified opinion. EarthWear Clothiers maintained, in all material respects,

effective internal control over financial reporting.

Willis & Adams, CPAs

Boise, Idaho February 15, 2016

R E

P O

R T

F IN

D E

P E

N D

E N

T R

E G

IS T

E R

E D

P U

B LI

C A

C C

O U

N T

IN G

F IR

mes32502_ch02_035-066.indd 35 10/10/15 02:56 PM

Final PDF to printer

mes32502_ch02_035-066.indd 36 10/10/15 02:56 PM

CHAPTER

2 2-1 Be familiar with the different types of auditors. 2-2 Be familiar with the various types of audit, attest, and

assurance services offered by accounting professionals. 2-3 Understand the organization of public accounting firms

and the composition of audit teams. 2-4 Understand the significant changes that have taken place

in the auditing profession over the past decade. 2-5 Know that management is primarily responsible for the

entity’s financial statements and understand the auditor’s responsibility for detecting errors, material fraud, and illegal acts.

2-6 Recognize that an audit is shaped by the auditee’s business, industry, and economic environment and understand the essential components and processes characteristic of most business entities.

2-7 Be familiar with a five-component model of business processes used to organize an audit.

2-8 Identify and be familiar with the major organizations that affect the public accounting profession’s environment.

2-9 Understand that auditing standards are established by both U.S. and international standard setters.

2-10 Be familiar with the 10 “generally accepted auditing standards” and the “principles underlying an audit conducted in accordance with generally accepted auditing standards.”

2-11 Understand the nature of auditing standards. 2-12 Understand that the auditing profession places a

premium on ethical behavior and is governed by a Code of Professional Conduct.

FASB Statement of Financial Accounting Concepts No. 8, Chapter 3—Qualitative Characteristics of Useful Financial Information AT 50, Attestation Standards AU-C 200, Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with GAAS AU-C 240, Consideration of Fraud in a Financial Statement Audit

PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500) PCAOB Auditing Standard No. 16, Communications with Audit Committees (AU-C 260)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

mes32502_ch02_035-066.indd 37 10/10/15 02:56 PM

T his chapter is designed to give you an overview of the auditing pro- fession and to help you understand the environment in which auditors function. The chapter begins by briefly introducing the various types of

auditors and the types of audit, attest, and assurance services that auditors offer. This is followed by a description of public accounting firms and a dis- cussion of the far-reaching changes in the public accounting profession over the past several years. One of the most important and useful skills auditors develop is the ability to quickly understand and analyze various business mod- els, strategies, and processes and to identify key risks relevant to a particular entity—these elements largely shape the immediate context in which audit- ing is performed. Accordingly, the chapter introduces a high-level model of business that is useful for organizing an audit. The chapter then discusses the major professional and regulatory organizations that affect the public account- ing profession and explains how auditing standards are established in today’s rather messy professional and regulatory environment. Because ethical behav- ior and reputation play key roles in shaping the public accounting profession and its environment, the chapter provides a brief overview of the profession’s Code of Professional Conduct.

The book also includes a module on professional judgment in auditing, which your instructor may assign you to read. The module is based on the award-winning KPMG Professional Judgment Framework, which two of the authors of this book helped KPMG, LLP to create and implement in its U.S. audit practice. The module, found immediately after Chapter 21, will help you begin to develop your own professional judgment by learning what a good audit judgment process looks like and how to avoid common judgment traps and biases.

The Financial Statement Auditing Environment

Final PDF to printer

38 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 38 10/10/15 02:56 PM

This book focuses primarily on external auditors and how they provide assurance on the financial statements they audit. However, before moving ahead to help you understand the environment in which external auditors work, let’s briefly discuss exactly what an external auditor is and introduce you to some other types of auditors, including internal auditors, gov- ernment auditors, and forensic auditors. One important requirement for each type of auditor is independence in some form from the entity being audited. As described below, each dif- ferent type of auditor usually specializes in a particular type of audit work. However, each type of auditor often provides more than one of the various types of audit and other services described in the next section.

External Auditors External auditors are often referred to as independent auditors. An external auditor may prac- tice as a sole proprietor or as a member of a CPA firm, as discussed later in the chapter. Such auditors are called “external” or “independent” because they are not employees of the entity being audited. The terms external auditor and independent auditor are generally used interchangeably. External auditors audit financial statements for publicly traded and private companies, partnerships, municipalities, individuals, and other types of entities. They may also conduct compliance, operational, and forensic audits for such entities (see next section).

To sign an audit opinion on an entity’s financial statements in the United States, an exter- nal auditor must be a certified public accountant (CPA). The CPA certificate is regulated by state law through licensing departments in each state.1 State requirements for CPA certifica- tion can be summed up as the “Three Es”—Education, Examination, and Experience. The education requirements for becoming a CPA vary among the states, with a minimum certifi- cation requirement of a four-year college degree with selected courses in business and accounting. In addition, the District of Columbia and 46 states require 150 semester credit hours of education at an accredited college or university, and some states require professional experience before the CPA certificate is granted. All states require that an individual pass the Uniform CPA Examination, administered by the American Institute of Certified Public Accountants (AICPA) (see Exhibit 2–1).

Internal Auditors Auditors who are employees of individual companies, government agencies, and other enti- ties are called internal auditors. In major corporations, internal audit staffs are often quite large, and the director of internal auditing (sometimes called the chief audit executive, or CAE) is usually a major job title within the entity.

The Institute of Internal Auditors (IIA) is the primary organization supporting internal audi- tors. Its mission is to “provide dynamic leadership for the global profession of internal auditing.” The IIA has developed a set of professional standards to be followed by internal auditors and has established a certification program. An individual who meets the certification requirements established by the IIA, including passing a uniform written examination, can become a certified internal auditor (CIA).2 Many internal auditors also have a CPA certificate.

The IIA defines internal auditing as “an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organiza- tion accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

Internal auditors often conduct financial, internal control, compliance, operational, and forensic audits within their organizations (see next section). In some cases they may assist the

LO 2-1

1The National Association of State Boards of Accountancy (NASBA) maintains a listing of the CPA Licensure Requirements by state, as well as links to individual state boards of accountancy. See www.nasba.org. 2See the IIA’s home page (www.theiia.org) for more information on the IIA and the requirements to become a certi- fied internal auditor.

Types of Auditors

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 39

mes32502_ch02_035-066.indd 39 10/10/15 02:56 PM

external auditors with the annual financial statement audit. Internal auditors also often are involved in assurance and consulting engagements for their entities. Chapter 21 offers more detail on the IIA and the internal auditing profession.

Government Auditors Government auditors are employed by federal, state, and local agencies. Government auditors are usually considered to be a type of internal auditor. At the federal level, two agencies use auditors extensively: the Government Accountability Office (GAO) and the Internal Revenue Service (IRS). The GAO is under the direction of the comptroller general of the United States and is responsible to Congress. GAO auditors conduct audits of activities, financial transac- tions, and accounts of the federal government. They also assist Congress by performing spe- cial audits, surveys, and investigations. The majority of the audits conducted by GAO auditors are compliance and operational audits (see next section).

The IRS is part of the U.S. Treasury Department. The main activity of IRS auditors is examining and auditing the books and records of organizations and individuals to deter- mine their federal tax liability. IRS audits are compliance audits, ensuring that individuals and organizations are complying with federal tax laws.

Three other federal agencies that conduct audits are the Army Audit Agency, the Defense Contract Audit Agency (DCAA), and the Federal Bureau of Investigation (FBI). FBI auditors,

The Computer-Based Uniform CPA Examination

The Uniform Certified Public Accountant Examination is delivered in a computer-based format at test cen- ters across the United States. An individual must pass the examination in order to qualify for licensure as a CPA in the U.S. CPAs are the only licensed accounting professionals in the U.S. There is no national CPA licensure process in the U.S.—CPA licenses are issued by each state’s Board of Accountancy. According to the AICPA, “the purpose of the Uniform CPA Examination is to provide reasonable assurance to Boards of Accountancy that those who pass the CPA Examination possess the level of technical knowledge and the skills necessary for initial licensure in protection of the public interest.”

Examination Content The CPA examination has a total length of 14 hours and has four sections: Auditing and Attestation (AUD), Financial Accounting and Reporting (FAR), Regulation (REG), and Business Environment and Concepts (BEC).

The AUD, FAR, and REG sections contain three sets (or “testlets”) of 24–30 multiple choice questions each, and one set of six or seven short “task-based simulations.” The simulations provide a set of facts and require candidates to access authoritative literature and complete related tasks. The BEC section contains three multiple choice testlets and three “written communication tasks” on BEC topics.

Sections

• Auditing and Attestation (4 hours). Covers knowledge of auditing procedures, generally accepted auditing standards, and other standards related to attest engagements, ethics, and the skills needed to apply that knowledge.

• Financial Accounting and Reporting (4 hours). Covers knowledge of generally accepted accounting principles for business enterprises, not-for-profit organizations, and governmental entities and the skills needed to apply that knowledge.

• Regulation (3 hours). Covers knowledge of federal taxation, ethics in tax practice, professional and legal responsibilities, and business law and the skills needed to apply that knowledge.

• Business Environment and Concepts (3 hours). Covers knowledge of general business environ- ment and business concepts that candidates need to know in order to understand the underlying business reasons for and accounting implications of business transactions and the skills needed to apply that knowledge.

As of January 1, 2011, the CPA exam began to include questions on international accounting and audit- ing standards.

Source: adapted from information provided at www.cpa-exam.org/.

E X H I B I T 2 – 1

Final PDF to printer

40 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 40 10/10/15 02:56 PM

for example, frequently investigate for fraud in government agencies and other organizations subject to federal laws. Last, most state and local governments have agencies that perform functions similar to the GAO and IRS but at the state or local level.

Forensic Auditors Forensic auditors are employed by corporations, government agencies, public accounting firms, and consulting and investigative services firms. They are specially trained in detect- ing, investigating, and deterring fraud and white-collar crime (see the discussion of forensic auditing later in this chapter). Some examples of situations where forensic auditors are often involved include

∙ Reconstructing incomplete or damaged accounting records to settle an insurance claim over inventory valuation.

∙ Probing money-laundering activities by tracking and reconstructing cash transactions. ∙ Identifying and investigating transactions and assets in business or marital disputes. ∙ Investigating and documenting embezzlement allegations and negotiating insurance

settlements.

The Association of Certified Fraud Examiners (ACFE) is the primary organization support- ing forensic auditors. The ACFE is a 75,000-member professional organization dedicated to reducing the incidence of fraud and white-collar crime and assisting its members in fraud detection and deterrence.

The ACFE offers a certification program for individuals wanting to become CFEs. An individual interested in becoming a CFE must pass the Uniform CFE Examination.3 CFEs have various professional backgrounds, including auditors, accountants, fraud investigators, loss prevention specialists, attorneys, educators, and criminologists. CFEs gather evidence, take statements, write reports, and assist in investigating fraud in its varied forms. They some- times act as expert witnesses in court cases.

3See the Association of Certified Fraud Examiners’ home page (www.acfe.com) for more information on the associa- tion and the CFE program.

Opportunities where auditors can provide audit, attest, or assurance services arise from the need for management to be accountable to employees, shareholders, customers, and commu- nities. In this section, examples of these types of services are briefly discussed.

Other Audit Services In addition to the financial statement audit, there are four major types of audits: internal con- trol audits, compliance audits, operational audits, and forensic audits. These audits are often performed by auditors employed by public accounting firms, but similar services may be performed by internal, forensic, or governmental auditors.

Internal Control Audits Financial statement auditors have always had the option of test- ing controls to obtain indirect evidence about the fairness of the financial statements. How- ever, until recently, auditors were generally neither required nor allowed to express an opinion on an entity’s system of internal control as part of a financial statement audit.4 This changed

LO 2-2

4Exceptions include audits of government agencies and audits of large banks complying with the Federal Deposi- tory Institution Corporation Improvement Act (FDICIA) of 1991, which, similar to the Sarbanes-Oxley requirement for all public companies, requires an independent audit of the effectiveness of the entity’s internal control over financial reporting.

Types of Other Audit, Attest, and Assurance Services

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 41

mes32502_ch02_035-066.indd 41 10/10/15 02:56 PM

when the Sarbanes-Oxley Act required public companies to engage an external auditor to provide an opinion on the effectiveness of internal control. An audit of internal control is available but not required for private entities.

Because the objectives and work involved in performing an audit of internal control and an audit of financial statements are closely interrelated, auditing standards for public compa- nies require an integrated audit of internal control and financial statements. We provide more detail about the audit of internal control for public companies in Chapter 7.

Compliance Audits A compliance audit determines the extent to which rules, policies, laws, covenants, or government regulations are followed by the entity being audited. For example, a university may ask auditors to determine whether applicable rules and policies are being followed with respect to the granting of student loans. Another example is the examina- tion of tax returns of individuals and companies by the Internal Revenue Service for compli- ance with the tax laws.

Operational Audits An operational audit involves a systematic review of part or all of an organization’s activities to evaluate whether resources are being used effectively and efficiently. The purpose of an operational audit is to assess performance, identify areas for improvement, and develop recommendations. Sometimes this type of audit is referred to as a performance audit or management audit. Operational audits present different challenges than financial statement audits or compliance audits because operational audits often require the auditor to identify or create objective, measurable criteria against which to assess effective- ness and efficiency. Operational auditing has increased in importance in recent years, and this trend will likely continue. An example of an operational audit is when an entity employs audi- tors to assess the efficiency and effectiveness of its use of information technology resources.

Forensic Audits The purpose of a forensic audit is to detect or deter fraudulent activi- ties. Forensic auditing has increased significantly in recent years. As we mentioned above in discussing forensic auditors, some examples of where a forensic audit might be conducted include business or employee fraud, various other types of criminal investigations where money or other assets are involved, and matrimonial disputes involving division of assets.

Attest Services Auditors can provide numerous types of attest services regarding almost any subject matter. For example, an auditor might be asked to attest to the nature and quantity of inventory stored in an entity’s warehouse so that the entity can obtain a bank loan with the inventory as collat- eral. A promising new area of attestation services relates to assertions companies make about sustainability–claimed reductions in carbon emissions or appropriate handling of hazardous waste, for example. Chapter 21 presents more detailed information about attest services.

Assurance Services As we discussed in Chapter 1, auditing and attestation are specialized forms of the more gen- eral category of assurance services. Thus, CPAs can offer a variety of services that provide assurance but that do not qualify as auditing or attestation. These nonattest services can be

Practice I N S I G H T

Occupational fraud is a widespread problem that affects practically every organization. Occupa- tional frauds fall into one of three major categories: asset misappropriations (e.g., stealing inventory), corruption (e.g., bribing government officials), and fraudulent financial statements (e.g., intentionally overstating assets in order to receive a bank loan). All three types of potential fraud are of concern to auditors but financial statement fraud typically represents the gravest concern because the amounts involved are often highly material.

Final PDF to printer

42 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 42 10/10/15 02:56 PM

considered as a form of consulting services. One example of this type of service is PrimePlus©, which involves CPAs providing assurance to family members that elderly parents or other fam- ily members are being cared for properly, their assets and expenses are being managed appro- priately, and financial predators are not taking advantage of them. Assurance services provided by CPAs are governed by either the attest or consulting standards. Chapter 21 provides more detailed information on assurance services.

Other Nonaudit Services In addition to audit, attest, and assurance services, many public accounting firms perform three other broad categories of nonaudit services. Note that the Sarbanes-Oxley Act prohibits exter- nal auditors from providing many forms of nonaudit assurance and consulting work to public companies for which the auditor also provides a financial statement audit (see Chapter 19).

Tax Preparation and Planning Services Many public accounting firms have tax profes- sionals that assist clients with preparing and filing tax returns, provide advice on tax and estate planning, and represent clients on tax issues before the Internal Revenue Service or tax courts.

Management Advisory Services Management advisory services (MAS) involve provid- ing advice and assistance concerning an entity’s organization, human resources, finances, operations, IT systems, or other activities. Due to independence requirements, CPA firms perform MAS primarily for private entities or for public companies for whom they do not provide a financial statement audit. Due to the Sarbanes-Oxley Act, accounting and consult- ing firms have experienced significant growth in the area of internal control consulting for nonaudit clients.

Compilation and Review Services Public accounting firms perform a number of accounting-related services for their nonpublic or nonaudit clients. These services include bookkeeping, payroll processing, and preparing financial statements. When a public account- ing firm provides nonaudit accounting services relating directly to the financial statements of companies, the services are known as compilations or reviews. These forms of services provide less assurance than a financial statement audit. Compilation and review services are discussed in more detail in Chapter 21.

Public Accounting Firms

Small organizations can be audited by a single auditor operating as the sole owner of a pub- lic accounting firm. However, larger businesses and other organizations require significantly more resources than a single auditor can provide. Thus, public accounting firms range in size from a single proprietor to thousands of owners (or “partners”) together with tens of thou- sands of professional and administrative staff employees. In addition to financial statement audits, public accounting firms typically offer a wide variety of professional services, includ- ing many of those already discussed in this chapter.

Organization and Composition Public accounting firms are organized as proprietorships, general or limited liability partner- ships, or corporations. Typically, relatively small, local public accounting firms are organized as proprietorships, general partnerships, or corporations. Regional, national, and international accounting firms are normally structured as limited liability partnerships (LLPs). Structuring public accounting firms as proprietorships and ordinary general partnerships does not provide limited liability for the owners (known as partners). In such cases, aggrieved parties can seek recourse not only against the CPA firm’s assets but also against the personal assets of indi- vidual partners.

LO 2-3

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 43

mes32502_ch02_035-066.indd 43 10/10/15 02:56 PM

Because of the risk of litigation against CPAs, public accounting firms typically organize as corporations when possible. However, corporations are created and governed by individ- ual states, and some states do not allow accounting firms to organize as corporations. Thus, because they span state boundaries, it is generally not possible for larger firms to structure themselves as corporations. This is why large national and international public accounting firms have structured themselves as limited liability partnerships (LLPs). An LLP is gener- ally governed by the laws applicable to general partnerships. However, this organizational structure provides greater personal protection against lawsuits. Under an LLP, partners are not personally responsible for liabilities arising from other partners’ and most employees’ negligent acts. However, the personal assets of the responsible partner(s) and the assets of the partnership itself are vulnerable to lawsuits resulting from partners’ or employees’ acts.

Public accounting firms are often categorized by size. For example, the largest firms are the “Big 4” public accounting firms: Deloitte, Ernst & Young, KPMG, and PwC. These large international organizations have annual global revenues ranging from about $25 billion to over $34 billion. U.S. revenues for these firms range from $7 billion to over $14 billion. As a group, the Big 4 audit about 90 percent of publicly traded companies in the United States that have revenues between $500 million and $1 billion, and about 98 percent of public companies with annual sales greater than $1 billion.5

Following the Big 4 in size are several national firms with international affiliations. This “mid-tier” includes such firms as Grant Thornton, McGladrey, and BDO. The total global annual revenues for each of these firms are in the range of over $4 billion to about $7 billion. Last, there are thousands of regional and local CPA firms that have one or a few offices. These CPA firms provide audit, tax, accounting, and other services, generally to smaller entities.

Audits are usually conducted by teams of auditors. The typical audit team is composed of, in order of authority, a partner, a manager, one or two seniors, and several staff mem- bers. Audit teams for large international entities are typically made up of several partners and managers and many seniors and staff. The lead engagement partner has the authority and decision-making responsibility for auditing matters, including the issuance of the audit report. Table 2–1 summarizes the duties performed by each member of the audit team.

5According to data included in the Audit Analytics database as of 2015. Also see U.S. Government Accountability Office Report to Congressional Addressees, “Continued Concentration in Audit Market for Large Public Companies Does Not Call for Immediate Action,” January 2008.

Selected Duties of Audit Team Members

Audit Team Member Selected Duties

Partner • Reach agreement with the auditee on the scope of the service to be provided. • Ensure that the audit is properly planned and that the audit is conducted in

accordance with applicable auditing standards. • Assemble an audit team that has the required skills and experience. • Supervise the audit team and review the working papers. • Conclude on the adequacy of audit evidence and sign the audit report.

Manager • Ensure that the audit is properly planned, including scheduling of team members. • Supervise the preparation of and approve the audit program. • Review the working papers, financial statements, and audit report. • Deal with invoicing and ensure collection of payment for services. • Inform the partner about any auditing or accounting problems encountered.

Senior/In-charge • Assist in the development of the audit plan. • Prepare budgets. • Assign tasks to associates and direct the day-to-day performance of the audit. • Supervise and review the work of associates. • Inform the manager about any auditing or accounting problems encountered.

Associate/Staff • Perform the audit procedures assigned to them. • Prepare adequate and appropriate documentation of completed work. • Inform the senior about any auditing or accounting problems encountered.

T A B L E 2 – 1

Final PDF to printer

44 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 44 10/10/15 02:56 PM

Events taking place in the business world during the past decade have dramatically reshaped the environment in which external auditors work.

During the economic boom of the late 1990s and early 2000s, accounting firms aggres- sively sought opportunities to market a variety of high-margin nonaudit services to the enti- ties they audited. Independence standards in force at the time allowed auditors to perform many such services, including information systems design and implementation and internal audit services, even for public company auditees. The consulting revenue of the largest public accounting firms grew very rapidly, until in many instances consulting revenues from audi- tees far exceeded the fee for the external audit.

In October 2001, Enron, one of the largest public companies in the United States, became the subject of an SEC investigation into its accounting practices. The investigation quickly uncovered massive financial deception that had been going on for several years. Arthur Andersen, the then “Big 5” public accounting firm that audited Enron’s financial statements, immediately became embroiled in the controversy, because the firm had failed to report the vast extent of Enron’s improper accounting. Many argued that this failure came about at least in part because Andersen was paid tens of millions of dollars in separate fees for consulting and internal auditing services, which amounted to significantly more than the fee for the exter- nal audit. Andersen stopped providing audits of public companies and began to dismantle its business in August 2002, after the firm was federally indicted and subsequently convicted on charges of obstruction of justice relating to the Enron situation. Though the conviction was later overturned by the U.S. Supreme Court, it was too late—the fatal damage had been done.

Shortly after the Enron incident, numerous other scandals involving corporate giants, brokerage firms, stock exchanges, mutual fund managers, and several of the large public accounting firms were uncovered. The Enron scandal alone weakened investor confidence in the stock market, but the subsequent series of scandals caused a crisis of confidence in the integrity of the entire system of public ownership and accountability in the United States.

Government Regulation Under pressure to restore public confidence, Congress passed the Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act in July 2002. Similar to the impact of the Securities Acts of 1933 and 1934, the Sarbanes-Oxley Act (commonly known as SOX) started a process of broad reform in corporate governance practices that would affect the duties and practices of public companies, financial analysts, external auditors, and securities exchange markets.6

With respect to the accounting profession, the Sarbanes-Oxley Act effectively trans- ferred authority to set and enforce auditing standards for public company audits to the Public Company Accounting Oversight Board (discussed in more detail below). In addition, the Act mandated that the SEC impose strict independence rules, prohibiting auditors from provid- ing many types of nonaudit services to public company auditees. The Act imposed several other important mandates, including that audit firms rotate audit partners on audit engage- ments every five years, and that public companies obtain an integrated audit (including audits of both financial statements and internal control over financial reporting). The Act is extremely important in its implications for boards and managements of public companies, for the accounting profession, and for the capital markets system in the United States. Chapter 20 provides further discussion of the Sarbanes-Oxley Act.

More recently, the international financial crisis of 2007–2009 resulted in the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. The Act

LO 2-4

6See William R. Kinney, Jr., “Twenty-Five Years of Audit Deregulation and Re-Regulation: What Does It Mean for 2005 and Beyond?” Auditing: A Journal of Practice & Theory, vol. 24, supplement, 2005, for an excellent discussion of the developments that gave rise to government regulation over the auditing profession.

A Decade of Challenge and Change for Financial Statement Auditors

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 45

mes32502_ch02_035-066.indd 45 10/10/15 02:56 PM

significantly changed government regulation of many types of financial services compa- nies, especially banks and other deposit-taking institutions. Dodd-Frank also amended the Sarbanes-Oxley Act by granting authority to the PCAOB to inspect foreign audit firms that practice in the United States or that have U.S. auditees and by exempting public companies with under $75 million market capitalization from the requirement to submit to an audit of internal control over financial reporting (see Chapter 7 for more detail).

It would be difficult to overemphasize the impact of the events of the past 10 to 15 years on the auditing profession. While these changes caused pain and turmoil, they served to high- light and reaffirm the essential importance of auditing in our economic system, as well as the importance of integrity and professionalism in protecting the public interest.

The Context of Financial Statement Auditing

The first chapter explained why assurance is in demand, defined what auditing is, and laid out the phases through which financial statement auditing is carried out. This chapter is designed to help you understand how business and professional contexts shape the environment in which external auditors operate. You’ve already learned about different kinds of auditors and audit services, public accounting firms, and the auditor’s role in society. Now let’s turn our attention to the primary context that shapes the external auditor’s environment: the business or entity being audited.

The Business Entity as the Primary Context of Auditing In studying subsequent chapters, you will be building your auditing tool kit. How you apply auditing tools on any particular engagement will depend greatly on the nature of the entity’s business. For example, if you are auditing an Alaskan salmon farm, some of your concerns will be whether the entity’s inventories have been counted properly (which can be a real

LO 2-6

Because financial statement audits play an important role in the functioning of our economy, society expects auditors to exercise due care in their work. Due professional care requires that the auditor exercise professional skepticism, which is an attitude that includes a questioning mind and a critical assessment of audit evidence.7 If the auditor fails to exercise due profes- sional care, he or she can be held liable for civil damages or even criminal penalties.

Many readers of financial statements believe that auditors are ultimately responsible for the financial statements or at least that they have a responsibility to detect all errors, fraud, and illegal acts. This is simply not true. While auditors must exercise professional skepti- cism and due care in their work, the financial statements ultimately are the responsibility of management. In fact, the Sarbanes-Oxley Act of 2002 requires that CEOs and CFOs of public companies take explicit responsibility for their company’s financial statements by “certify- ing,” among other things, that they are responsible for establishing and maintaining internal control, and that the financial statements fairly present the entity’s financial conditions and operations. It is important to remember that while auditors have important responsibilities, management is primarily responsible for maintaining effective internal control and for ensur- ing the fairness of the company’s financial statements.

The auditor’s responsibility to provide reasonable assurance with respect to errors, fraud, and illegal acts clearly shapes the auditor’s environment and the work that he or she performs. We will share more information on auditors’ responsibility for errors, fraud, and illegal acts in Chapters 3 and 4, and we provide details on auditors’ potential legal liability in Chapter 20.

LO 2-5

7See Steven M. Glover and Douglas F. Prawitt, “Enhancing Auditor Professional Skepticism,” a white paper commis- sioned and published by the Standards Working Group of the GPPC, May 2013.

Society’s Expectations and the Auditor’s Responsibilities

Final PDF to printer

46 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 46 10/10/15 02:56 PM

challenge when the inventory consists of live fish in multiple large ocean pens!) and whether they are free of disease. Such inventory might not be properly valued on the entity’s financial records. If you are auditing an NBA team on the other hand, inventories won’t be a major issue. But you would certainly want to keep up on the ins-and-outs of player negotiations and contracts, and the dynamics of the free agent market! The point is that the context provided by the entity’s business greatly impacts the auditor and the audit and is thus a primary aspect of the environment in which financial statement auditing is conducted.

Practice I N S I G H T

It has been said that no man can serve two masters. In some respects, this saying reflects the deli- cate balance that the external auditor must achieve—working in close contact with and being paid by the entity while protecting the public. Prior to 2002, the external auditor often was engaged by and reported directly to the entity’s senior management, which was also responsible for the finan- cial statements being audited. Section 301 of the Sarbanes-Oxley Act of 2002 mandates that the entity’s audit committee be directly responsible for the appointment, compensation, and oversight of the work of the auditor. In addition, the auditor now reports directly to the audit committee. Further, Section 303 makes it unlawful for an officer or director to take any action to fraudulently influence, coerce, or manipulate the work or conclusions of the auditor.

A Model of Business

While businesses in different industries can have strikingly different characteristics, most have some fundamental conceptual characteristics in common. These commonalities provide a way for auditors to organize how they approach financial statement audits, regardless of the type of entity they are auditing. Figure 2–1 presents a fundamental, widely accepted model of busi- ness, representing the central context in which auditors operate. The components of the model are governance, objectives, strategies, business processes, risks, controls, and reporting.

Practice I N S I G H T

The nature of an auditee’s business can have a dramatic effect on the nature of the auditor’s work and work environment. For example, an auditor working at a meat-packing company will have very different experiences (with very different sights, sounds, and smells!) from an auditor working at a banking entity. Further, many auditors eventually specialize in certain industries and acquire significant expertise in those industries. This expertise and specialization often leads to attractive employment opportunities in industry, for example as a controller or CFO. Thus, in choosing which firm (or which office of a large firm) at which to seek a job, new auditors are well advised to carefully consider whether the firm (or office) has a significant presence in the industries in which the prospective auditor is most interested.

Corporate Governance To form a business enterprise, entrepreneurs decide on an appropriate organizational form (e.g., corporation or partnership) and hire managers to manage the resources that have been made available to the enterprise through investment or lending. Due to the way resources are invested and managed in the modern business world, a system of corporate governance is necessary, through which managers are overseen and supervised. Simply defined, corporate governance consists of all the people, processes, and activities in place to help ensure proper stewardship over an entity’s assets. This is why in Figure 2–1 corporate governance runs along the entire right-hand side of the model. Strong corporate governance ensures that those managing an entity properly utilize their time, talents, and the entity’s resources in the best interest of absentee own- ers, and that they faithfully report the economic condition and performance of the enterprise. The body primarily responsible for management oversight in U.S. corporations is the board of direc- tors. The audit committee, consisting of a subset of the board, oversees the internal and external auditing work done for the organization. Through this link, and through the audit of financial statements, auditors play an important role in facilitating effective corporate governance.

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 47

mes32502_ch02_035-066.indd 47 10/10/15 02:56 PM

Business Processes

In fo

rm at

io n

Sy st

em s a

nd Int

ern al C

ont rols

to Ens ure Transactions Are Properly Executed, Captured, and

Processed Inform

ation System

sandInternalControlstoEnsureTransactionsAr ePro

perl yE

xec ute

d, Ca

pt ur

ed ,a

nd Pr

oc es

se d

Financing process

Human resource

management process

Purchasing process

Inventory management

process

Revenue process

Business Objectives and Strategies

Management and Board of Directors

Performance Measurement and Assessment

External Financial Reporting

R is

k A

ss es

sm en

t a nd

M an

ag em

en t

C orporate G

overnance

Business Transactions

An Overview of BusinessF I G U R E 2 – 1

Final PDF to printer

48 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 48 10/10/15 02:56 PM

Objectives, Strategies, Processes, Controls, Transactions, and Reports As depicted at the center-top of Figure 2–1 and running down through the model, manage- ment, with guidance and direction from the board of directors, decides on a set of objectives, along with strategies designed to achieve those objectives. The organization then undertakes certain processes in order to implement its strategies. The organization must also assess and manage risks that may threaten the achievement of its objectives. While the processes imple- mented in business organizations are as varied as the different types of businesses themselves, most business enterprises establish processes that fit in five broad business process catego- ries, sometimes known as business cycles. The five categories that characterize the processes of most businesses are the financing process, the purchasing process, the human resource management process, the inventory management process, and the revenue process. Each busi- ness process involves a variety of important transactions.

As depicted around the inside edge of the circle in Figure 2–1, the enterprise designs and implements accounting information systems to capture the details of those transactions. It also designs and implements a system of internal control to ensure that the transactions are handled and recorded appropriately and that its resources are protected. The accounting infor- mation system must be capable of producing financial reports, which summarize the effects of the organization’s transactions on its account balances and which are used to establish management accountability to outside owners (see bottom of Figure 2–1). The next section provides a brief overview of the five business process categories listed above. Auditors often rely on this process model to divide the audit of a business’s financial statements into manage- able pieces. Chapters 10 through 16 go into considerable detail regarding how these business processes typically function and how they are used to organize an audit.

A Model of Business Processes: Five Components At the center of Figure 2–1 are the five basic business processes into which auditors typically organize a financial statement audit. Let’s briefly discuss each of the five business processes.

The Financing Process Businesses obtain capital through borrowing or soliciting invest- ments from owners and typically invest in assets such as land, buildings, and equipment in accordance with their strategies. As part of this process, businesses also need to repay lenders and provide a return on owners’ investments. These types of transactions are all part of the financing process. Let’s illustrate using our example company, EarthWear Clothiers. Earth- Wear tends not to rely on long-term debt financing. Instead, it primarily uses capital provided by shareholders to invest in long-term assets, such as its headquarters building, retail stores, and various order and distribution centers across the United States and in Japan, Germany, and the United Kingdom.

The Purchasing Process Businesses must acquire goods and services to support their operations. For example, EarthWear purchases clothing from various wholesale suppliers to sell to its customers. The company must also purchase electrical power, office supplies, cus- todial services, and other items to support its activities.

The Human Resource Management Process Business organizations hire personnel to perform various functions in accordance with the enterprise’s mission and strategy. At EarthWear this process starts with the establishment of sound policies for hiring, training, evaluating, compensating, terminating, and promoting employees. The main transaction in this process that affects the financial statement accounts is a payroll transaction, which usually begins with an employee performing a job and ends with payment being made to the employee.

LO 2-7

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 49

mes32502_ch02_035-066.indd 49 10/10/15 02:56 PM

The Inventory Management Process This process varies widely between different types of businesses. Manufacturers, wholesalers, and retailers, including EarthWear, all typi- cally have significant, numerous, and often complex transactions belonging to the inventory management process. While the transactions to purchase finished goods or raw materials inventories are included in the purchasing process, the inventory management process for a manufacturer includes such transactions as accumulating and allocating costs to inventory and making adjustments to record inventory at the lower of cost or market. Service providers (such as auditors, lawyers, or advertising agencies) rarely have significant inventories to man- age, since their primary resources typically consist of information, knowledge, and the time and effort of people.

The Revenue Process Businesses generate revenue through sales of goods or services to customers. They collect the proceeds of those sales in cash, either immediately or through collections on receivables. For example, EarthWear Inc. retails high-quality clothing for out- door activities. To be successful, EarthWear must successfully process orders for, and deliver its clothing to, customers. It must also collect cash on those sales, either at the point of sale or through later billing and collection of receivables. Management establishes controls to ensure that sales and collection transactions are appropriately handled and recorded.

Relating the Process Components to the Business Model

Stop and Think: Take another look at Figure 2–1. How might the components of our model differ for an entity in automobile manufacturing versus banking, and how might those differences affect the auditor’s work? How might differences in these components affect the risk of material misstatement in the financial statements?

Management engages in the five business processes discussed above to implement the organization’s strategies and achieve its objectives. Management then identifies risks, or pos- sible threats to the achievement of its objectives (including compliance with applicable laws and regulations and reliable external reporting), and ensures that the organization’s system of internal control mitigates those risks to acceptable levels. The organization’s accounting information system must be capable of reliably measuring the performance of the business to assess whether objectives are being met and to comply with external reporting require- ments. Financial statements, which are affected by all the different components of our busi- ness model, represent an important output of the entity’s efforts to measure the organization’s performance and an important form of external reporting and accountability.

This discussion illustrates how important an entity’s business environment is to the work of a financial statement auditor. That’s why auditors must become expert not only in account- ing and auditing but also in the businesses and industries in which their auditees operate. Next we’ll discuss the professional and regulatory organizations that play key roles in shaping the external auditing environment.

Organizations That Affect the Public Accounting Profession

A chapter on the environment of auditing wouldn’t be complete without a discussion of the professional and regulatory organizations that affect the practice of auditing by independent auditors. Figure 2–2 provides a representation of the relationship of these organizations to a financial statement audit conducted in the United States. The following subsections discuss the activities of four of these organizations plus two international standard-setting bodies.

LO 2-8

Final PDF to printer

50 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 50 10/10/15 02:56 PM

Organizations That Affect Financial Statement Audits in the United StatesF I G U R E 2 – 2

Securities and Exchange Commission

Oversees formulation of accounting

principles

Private sector audit standard setting

for nonpublic companies

Oversees formulation of auditing standards

for publicly traded companies

Financial Accounting

Standards Board*

Public Company Accounting

Oversight Board*

American Institute of

Certified Public Accountants

Entities prepare financial statements in accordance with

accounting principles

Independent Auditor follows auditing standards to audit

financial statements for compliance with accounting

principles

PCAOB issues auditing standards for audits of

public companies

ASB issues auditing standards for audits of nonpublic companies; also issues attestation

and assurance standards

FASB issues accounting principles for

use by preparers

*The Governmental Accounting Standards Board (GASB) issues accounting standards, and the Government Accountability O�ce (GAO) issues auditing standards for governmental entities. Standards issued by the GAO are based on ASB standards; they are modified only as necessary for purposes of governmental audits.

Auditing Standards Board*

Financial Statement

Users

Audited Financial

Statements

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 51

mes32502_ch02_035-066.indd 51 10/10/15 02:56 PM

Securities and Exchange Commission (SEC) The SEC is a federal government agency that administers the Securities Act of 1933, the Securities Exchange Act of 1934, and the Sarbanes-Oxley Act of 2002, among others. The Securities Act of 1933 regulates disclosure of material information in a registration statement for an initial public offering of securities. S forms, which are used for issuing the securities, contain the audited financial statements of the registrant. The Securities Exchange Act of 1934 regulates ongoing reporting by companies whose securities are listed and traded on a stock exchange or that possess assets greater than $10 million and its equity securities are held by 500 or more persons. The most common documents encountered by auditors under the Secu- rities Exchange Act of 1934 are the 10K, 10Q, and 8K. The 10K and 10Q are, respectively, annual and quarterly reports, which include the financial statements that are filed with the SEC by a publicly traded company. An 8K is filed whenever a significant event occurs that may be of interest to investors (such as the sale of a division or a change of auditor).

Because the SEC has responsibility and authority to oversee the establishment of account- ing and auditing standards, the FASB, ASB, and PCAOB work closely with the SEC when formulating such standards.

Public Company Accounting Oversight Board (PCAOB) The PCAOB describes itself as “a nonprofit corporation established by Congress to oversee the audits of public companies in order to protect the interests of investors and further the public interest in the preparation of informative, accurate and independent audit reports.” While the board is a nonprofit corporation, it is in reality a quasi-governmental regulatory agency overseen by the SEC. The Sarbanes-Oxley Act of 2002 essentially transferred author- ity for standard setting, inspection, investigation, and enforcement for public company audits from the profession (as represented by the AICPA) to the PCAOB. All public accounting firms providing audits for public companies are required to register with, pay fees to, and fol- low the rules and standards of the PCAOB. As of March 2015, over 2,100 public accounting firms were registered with the PCAOB.

The PCAOB conducts a program of regular inspections to assess the degree of compli- ance of registered public accounting firms with SOX, PCAOB, and SEC rules and profes- sional standards. The PCAOB also has broad investigative and disciplinary authority over registered audit firms. However, the PCAOB does not have authority to set standards relating to the audits of entities that are not broker-dealers or publicly traded companies.

The PCAOB can impose sanctions on registered firms to deter possible recurrence of rule violations and to enhance the quality and reliability of future audits. The sanctions can range from revoking a firm’s registration or barring a particular individual from participating in audits of public companies to monetary penalties and requirements for remedial measures.

American Institute of Certified Public Accountants (AICPA) The AICPA is a private professional association of over 400,000 CPAs in 145 different coun- tries. It performs a number of functions that directly bear on the activities of member CPAs. The most important of these functions is the promulgation of rules and standards that guide audit and related services provided to nonpublic companies; governmental entities such as states, counties, municipalities and school districts; and other entities such as universities and charities.

In addition to the Auditing Standards Board (ASB), which we’ll discuss later in this chapter, the AICPA houses several standing committees that issue professional rules and stan- dards relevant to assurance providers. We list the most important of the standards here but we’ll discuss them in other chapters:

∙ The Code of Professional Conduct (Chapter 19). ∙ Quality control and peer review standards (Chapter 19). ∙ Attestation standards (Chapter 21). ∙ Compilation and review standards (Chapter 21).

Final PDF to printer

52 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 52 10/10/15 02:56 PM

In addition to its standard-setting role, the AICPA supports accounting and auditing research, produces a number of important publications, and provides a wide range of continu- ing education programs. For example, the AICPA publishes the Journal of Accountancy, The Tax Advisor, various Auditing Research Monographs, Auditing Practice Releases, and Indus- try Audit and Accounting Guides. The AICPA is responsible for preparing and grading the Uniform CPA Examination and plays an important role in administering the CPA certification in conjunction with the individual State Boards of Accountancy.

International Auditing and Assurance Standards Board (IAASB) The IAASB is sponsored and funded by the International Federation of Accountants (IFAC), which describes itself as “the global organization for the accountancy profession dedicated to serving the public interest by strengthening the profession and contributing to the develop- ment of strong international economies.” IFAC was founded in 1977 and is based in New York City. In addition to the IAASB, IFAC houses independent standard-setting boards that develop international standards on ethics, education, and public sector accounting standards. The IAASB, whose predecessor organization was established in 1978, was reorganized and renamed to its current form in 2002, at about the time the Sarbanes-Oxley Act was passed in the United States. The IAASB issues International Standards on Auditing (ISA) and is the predominantly recognized international auditing standard setter outside the United States. The AICPA’s Auditing Standards Board recently completed a major project to converge its auditing standards with the IAASB’s standards to the extent possible, and these two sets of standards are largely similar.

Financial Accounting Standards Board (FASB) The FASB is a privately funded body whose mission is to establish standards for financial accounting and reporting. You should already be familiar with the FASB from your financial accounting classes. The FASB’s Accounting Standards Codification (or ASC) is recognized as the source of U.S. GAAP by the SEC, the PCAOB, and the AICPA.

An important group within the FASB is the Emerging Issues Task Force (EITF). The EITF was established by the FASB to meet accountants’ needs for timely guidance on accounting practices and methods and to limit the number of issues requiring formal pro- nouncements from the FASB. See the FASB’s website (www.fasb.org) for more information on the FASB’s activities.

International Accounting Standards Board (IASB) The IASB is the international counterpart to the FASB. The IASB’s standards are the predom- inantly recognized accounting standards outside of the United States. The IASB is responsible for the development and publication of International Financial Reporting Standards (IFRS), and for approving interpretations of IFRS. The IASB is sponsored and funded by the IFRS foundation, which is an independent, not-for-profit, private sector organization.

We won’t go into more detail here, but you should be aware that you are living in momen- tous times in the history of the accounting profession, as the IASB and FASB engage in the complex and difficult task of attempting to converge international and U.S. financial account- ing standards. This, of course, is highly relevant to auditors because these accounting stan- dards serve as the criteria against which an entity’s financial statements are audited.

Auditing Standards

Auditing standards help to ensure that financial statement audits are conducted in a consistent and thorough manner to produce reliable opinions and serve as an important set of criteria for evaluating the quality of the auditor’s performance. As discussed earlier, three different

LO 2-9, 2-10

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 53

mes32502_ch02_035-066.indd 53 10/10/15 02:56 PM

organizations set auditing standards that are relevant for financial statement auditors in the U.S. and internationally: the AICPA’s ASB, the U.S. PCAOB, and the IFAC’s IAASB.

Three Sets of Auditing Standards: The Roles of the ASB, PCAOB, and IAASB Until 2003, the ASB was responsible for establishing all auditing standards in the United States. However, when the U.S. Congress passed the Sarbanes-Oxley Act of 2002, it gave the PCAOB the authority to either set auditing standards for U.S. public company audits or to dele- gate that role to another party. The PCAOB chose to take on the standard-setting role in-house. However, because it initially had no auditing standards of its own, the PCAOB adopted the ASB’s standards that existed as of April 2003 and labeled them “the interim standards of the PCAOB.” Since that time, the ASB has largely converged its auditing standards with interna- tional standards but many of these changes have not been reflected in the PCAOB’s standards.

Accounting firms that audit the financial statements of nonpublic entities in the United States are required to comply with the auditing standards established by the ASB. Firms that audit the financial statements of public companies registered by the SEC in the United States are required to follow the auditing and related professional practice standards established by the PCAOB.

About the same time the PCAOB was created, the previous international auditing standard-setting body was reorganized and renamed as the International Auditing and Assur- ance Standards Board. Over 100 countries now use the IAASB’s standards.

Let’s summarize the overall standard-setting picture from the perspective of various sized accounting firms operating in the United States. Smaller accounting firms that focus on audits of nonpublic company entities (including private businesses, universities, charities, city and county governments, and other governmental entities) adhere to ASB standards. Larger accounting firms in the Unites States that audit both nonpublic and public companies must ensure that they follow both ASB and PCAOB standards. Global accounting firms, which provide financial statement audits for nonpublic U.S. entities, U.S. public companies, and international companies around the world, must ensure that their audit approaches and meth- odologies meet the requirements of all three standard setters.

Fortunately, the ASB and IAASB work closely together. In fact, the ASB recently com- pleted a major effort to converge its standards to those of the IAASB, and thus the ASB and IAASB standards are now very similar. Firms that must apply ASB, IAASB, and PCAOB standards formulate their global audit methodologies and policies starting with IAASB stan- dards and add specific requirements from the ASB and PCAOB standards as necessary. In this way, the global firms are able to apply a single audit methodology that is generally the same for audits of all entities around the world while ensuring that the additional requirements of the U.S. standard setters are met.

At this point you may be wondering which set of standards you will be learning in this book or whether, heaven forbid, you might have to learn all three. Not to worry—similar to the approach taken by the large, international accounting firms, you will learn a single set of foundational auditing concepts that apply to any type of entity. In this book we use the U.S. ASB standards as a foundation and build in any requirements from PCAOB standards that are more stringent than ASB requirements. Because the IAASB and ASB standards are largely converged, you will also be acquiring a solid understanding of auditing concepts and standards used internationally. The bottom line is that the concepts you will learn in this book encompass the requirements of all three standard setters and are consistent with the audit poli- cies and methodologies of the world’s leading accounting firms.

The 10 Generally Accepted Auditing Standards The ASB first issued what are known as the 10 generally accepted auditing standards (GAAS) in 1947 and periodically modified them to reflect changes in the auditor’s environment. The PCAOB adopted these standards in 2003, and refers to them, together with its own standards,

Final PDF to printer

54 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 54 10/10/15 02:56 PM

as “the standards of the PCAOB.” The 10 generally accepted auditing standards are composed of three categories of standards: general standards (three), standards of field work (three), and standards of reporting (four). Exhibit 2–2 contains the 10 generally accepted auditing stan- dards as they currently appear in PCAOB standards.

Three General Standards The three general standards deal with the auditor’s qualifica- tions and the quality of his or her work. These standards will remind you of the characteristics of a reliable house inspector listed in Chapter 1. The first general standard recognizes that an auditor must have adequate training and proficiency. This is gained through formal education, continuing education programs, and experience. Auditors should stay current with the latest accounting and auditing pronouncements and with developments in the business world that may affect the entities that they audit.

The second general standard requires that the auditor maintain an attitude of indepen- dence on an engagement. Independence precludes relationships that may impair the audi- tor’s objectivity. An auditor must not only be independent in fact (i.e., actually be objective) but also avoid actions or relationships that may appear to affect independence. If an auditor is perceived as lacking independence, users may lose confidence in the auditor’s ability to report truthfully on financial statements. The AICPA’s Code of Professional Conduct and the SEC’s independence regulations identify a number of relationships (such as having business or financial interests in entities that they audit or providing certain types of consulting ser- vices) that are believed to impair the auditor’s appearance of independence and that are thus prohibited.

Due professional care is the focus of the third general standard. In simple terms, due care means that the auditor plans and performs his or her duties with the skill and care that is com- monly expected of accounting professionals.

Three Standards of Field Work The standards of field work relate to the actual conduct of the audit. These three standards provide the conceptual background for the audit process (and will remind you of some of the desirable characteristics of a house inspection service).

Generally Accepted Auditing Standards (PCAOB)

General Standards 1. The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor. 2. In all matters relating to the assignment, an independence in mental attitude is to be maintained by the auditor or auditors. 3. Due professional care is to be exercised in the performance of the audit and the preparation of the report.

Standards of Field Work 1. The work is to be adequately planned and assistants, if any, are to be properly supervised. 2. A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of tests

to be performed. 3. Sufficient appropriate evidential matter is to be obtained through inspection, observation, inquiries, and confirmations to afford a rea-

sonable basis for an opinion regarding the financial statements under audit.

Standards of Reporting 1. The report shall state whether the financial statements are presented in accordance with generally accepted accounting principles

(GAAP). 2. The report shall identify those circumstances in which such principles have not been consistently observed in the current period in rela-

tion to the preceding period. 3. Informative disclosures in the financial statements are to be regarded as reasonably adequate unless otherwise stated in the report. 4. The report shall contain either an expression of opinion regarding the financial statements, taken as a whole, or an assertion to the

effect that an opinion cannot be expressed. When an overall opinion cannot be expressed, the reasons therefore should be stated. In all cases where an auditor’s name is associated with financial statements, the report should contain a clear-cut indication of the char- acter of the auditor’s work, if any, and the degree of responsibility the auditor is taking.

E X H I B I T 2 – 2

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 55

mes32502_ch02_035-066.indd 55 10/10/15 02:56 PM

The first standard of field work deals with planning and supervision. Proper planning leads to a more effective audit that is more likely to detect material misstatements and facilitates completing the engagement in a reasonable amount of time. This standard also requires that assistants on the engagement be properly supervised.

The second standard of field work requires that the auditor gain a sufficient understand- ing of the entity’s internal control to effectively plan the nature, timing, and extent of fur- ther audit procedures. In this context, nature refers to what procedures are performed, timing refers to when the audit work is done (whether at interim or at period-end), and extent refers to how much work is done. Taken together, the nature, timing, and extent of audit procedures are referred to in practice as the “scope” of the audit procedures. If the auditor identifies areas of weakness in an entity’s internal control, this information can help the auditor focus on areas where misstatements may be more likely to occur.

Sufficient, appropriate evidence is the focus of the third field work standard. Most of the auditor’s work involves the search for and evaluation of evidence regarding management’s assertions in the financial statements. The auditor uses various audit procedures to gather this evidence. You should be aware that auditing standards typically give general guidance; the point at which the evidence for a particular management assertion is sufficient and appropri- ate generally is a matter of professional judgment.

Four Standards of Reporting The four standards of reporting require that the auditor consider each of the following issues before rendering an audit report: (1) whether the finan- cial statements are presented in accordance with generally accepted accounting principles; (2) whether those principles are consistently applied; (3) whether all appropriate disclosures have been made; and (4) what degree of responsibility the auditor is taking, as well as the character of the auditor’s work. We gave an overview of the nature of the auditor’s report in Chapter 1, and will offer further detail in Chapter 18.

Principles Underlying an Audit Conducted in Accordance with Generally Accepted Auditing Standards The 10 GAAS were originally developed by the ASB and for decades served as the frame- work for codifying (i.e., organizing) the SASs into AU sections. However, as part of improv- ing clarity and converging with international standards, the ASB replaced the 10 GAAS with a more comprehensive and coherent description of “the principles underlying an audit conducted in accordance with generally accepted auditing standards.” These principles are grouped into four categories: the purpose and premise of an audit, personal responsibilities of the auditor, auditor actions in performing the audit, and reporting. Thus, while the PCAOB at least for now retains the 10 GAAS as part of its standards, the 10 GAAS are included in neither the international standards issued by the IAASB nor the newly converged and clarified ASB standards.

Exhibit 2–3 contains the full text of the principles underlying an audit. Take a few moments to familiarize yourself with this new conceptualization of generally accepted audit- ing standards. You will note that the principles underlying an audit include all of the key con- cepts conveyed in the 10 GAAS, but do so in a more organized and coherent manner. They also address other key concepts that are not addressed in the 10 GAAS, such as explicitly identify- ing the fundamental purpose of an audit and management’s responsibilities.

Statements on Auditing Standards and the AU Codification Statements on Auditing Standards (SAS) are issued by the ASB. The SAS are considered to be minimum standards of performance for auditors. Standards issued by the PCAOB, on the other hand, are called “Auditing Standards” (AS). The AS issued by the PCAOB add to or modify the existing body of standards that the PCAOB adopted from the ASB in April 2003. As mentioned previously, standards issued by the IAASB are called International Standards on Auditing (ISA). The ASB’s newly rewritten SAS are very similar to the ISA as a result of the ASB’s clarity and convergence project.

LO 2-11

Final PDF to printer

56 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 56 10/10/15 02:56 PM

Principles Underlying an Audit Conducted in Accordance with Generally Accepted Auditing Standards

Purpose of an Audit and Premise upon which an Audit is Conducted 1. The purpose of an audit is to provide financial statement users with an opinion by the auditor on

whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework. An auditor’s opinion enhances the degree of confidence that intended users can place in the financial statements.

2. An audit in accordance with generally accepted auditing standards is conducted on the premise that management and, where appropriate, those charged with governance, have responsibility

a. for the preparation and fair presentation of the financial statements in accordance with the appli- cable financial reporting framework; this includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error; and

b. to provide the auditor with i. all information, such as records, documentation, and other matters that are relevant to the

preparation and fair presentation of the financial statements; ii. any additional information that the auditor may request from management and, where appro-

priate, those charged with governance; and iii. unrestricted access to those within the entity from whom the auditor determines it necessary to

obtain audit evidence.

Responsibilities 3. Auditors are responsible for having appropriate competence and capabilities to perform the audit;

complying with relevant ethical requirements; and maintaining professional skepticism and exercising professional judgment, throughout the planning and performance of the audit.

Performance 4. To express an opinion, the auditor obtains reasonable assurance about whether the financial state-

ments as a whole are free from material misstatement, whether due to fraud or error. 5. To obtain reasonable assurance, which is a high, but not absolute, level of assurance, the auditor • plans the work and properly supervises any assistants. • determines and applies appropriate materiality level or levels throughout the audit. • identifies and assesses risks of material misstatement, whether due to fraud or error, based on an

understanding of the entity and its environment, including the entity’s internal control. • obtains sufficient appropriate audit evidence about whether material misstatements exist, through

designing and implementing appropriate responses to the assessed risks. 6. The auditor is unable to obtain absolute assurance that the financial statements are free from material

misstatement because of inherent limitations, which arise from • the nature of financial reporting; • the nature of audit procedures; and • the need for the audit to be conducted within a reasonable period of time and so as to achieve a

balance between benefit and cost.

Reporting 7. Based on an evaluation of the audit evidence obtained, the auditor expresses, in the form of a writ-

ten report, an opinion in accordance with the auditor’s findings, or states that an opinion cannot be expressed. The opinion states whether the financial statements are presented fairly, in all material respects, in accordance with the applicable financial reporting framework.

Source: AICPA, Preface to Codification of Statements on Auditing Standards, Principles Underlying an Audit Conducted in Accordance With Generally Accepted Auditing Standards. COPYRIGHT © 2010 American Institute of CPAs. Reprinted by permission.

E X H I B I T 2 – 3

Unlike financial accounting pronouncements, which usually provide very specific rules, the SAS and the AS tend to be relatively general in nature. The auditor must apply due diligence and sound professional judgment given the particular circumstances of the engagement in conducting an audit. Keep in mind that the auditor never has sufficient evi- dence to “guarantee” that the financial statements do not contain material misstatements and must use judgment to determine when he or she has sufficient appropriate evidence to reach a justified conclusion.

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 57

mes32502_ch02_035-066.indd 57 10/10/15 02:56 PM

Each SAS specifies one or more objectives that provide a link between the specific requirements of the SAS and the overall objectives of the auditor, as laid out in the Principles Underlying an Audit. ASB and PCAOB auditing standards include requirements that convey varying levels of auditor responsibility. The words “must,” “shall,” and “is required” indi- cate unconditional responsibilities with which the auditor must comply. The word “should” indicates a responsibility to comply unless the auditor decides on alternative actions that are sufficient to achieve the objectives of the requirement. Finally, the words “may,” “might,” and “could” describe actions and procedures that auditors have a responsibility to consider.

SAS are classified by two numbering categories: SAS and AU numbers (“AU” for Audit- ing Standards). The SAS numbering applies to the order in which the standards are issued by the ASB and are thus chronological. The SAS are then reorganized or “codified” by topical content, closely following the structure of the Principles Underlying an Audit Performed in Accordance with GAAS. The summary below shows how the SAS are reorganized into the ASB’s new “clarity standard” AU codification scheme:

AU-C 200 General Principles and Responsibilities AU-C 300–499 Risk Assessment and Response to Assessed Risks AU-C 500 Audit Evidence AU-C 600 Using the Work of Others AU-C 700 Audit Conclusions and Reporting AU-C 800–999 Special Considerations

A major complication for auditors going forward is the development of two different sets of U.S. auditing standards as the PCAOB standards diverge from those it adopted from the ASB and as the ASB converges its own standards with those of the IAASB. While ASB and PCAOB standards are still reasonably similar in most respects, their standards continue to diverge and their AU codification schemes are not consistent with each other. We believe such a development greatly and unnecessarily complicates the auditing standards environ- ment. The widespread use of international auditing standards in countries outside the United States further complicates the environment for large public accounting firms that practice internationally.8

8See S. Glover, D. Prawitt, and M. Taylor, “Audit Standard Setting and Inspection for U.S. Public Companies: A Critical Assessment and Recommendations for Fundamental Change,” Accounting Horizons, vol. 23, no. 2, 2009.

Ethics, Independence, and the Code of Professional Conduct

As indicated by the second general standard and item number 3 of the Principles Underlying an Audit Performed in Accordance with GAAS, ethical behavior and independence on the part of the auditor are vital to the audit function. The demand for auditing arises from the need for a competent, independent person to monitor the contractual arrangements between principal and agent. If an auditor is incompetent or lacks independence, the parties to the contract will place little or no value on the audit.

Ethics refers to a system or code of conduct based on moral duties and obligations that indicate how we should behave. Professionalism refers to the conduct, aims, or qualities that characterize a profession or professional person.9 All professions (e.g., medicine, law, and accounting) operate under some type of code of ethics or code of conduct. The AICPA’s Code of Professional Conduct establishes guidance for acceptable behavior for auditors. The Code of Professional Conduct contains principles, rules of conduct, and interpretations of the rules of conduct. A major portion of the Code identifies actions that may impair audi- tors’ independence.

LO 2-12

9S. Mintz and R. Morris, Ethical Obligations and Decision-Making in Accounting: Text and Cases, 2nd ed. (New York: McGraw-Hill/Irwin, 2010)

Final PDF to printer

58 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 58 10/10/15 02:56 PM

The AICPA’s Code of Professional Conduct applies to all auditors, including those audit- ing public companies. Why? Because the SEC requires that the auditor signing an audit report for a public company be a CPA, and the courts have consistently held CPAs to the standards of conduct established by the Code. Further, the Code of Professional Conduct has been adopted into the laws of many of the individual states and was also adopted by the PCAOB in 2003. Thus, the Code is an important element of the environment in which auditors work.

Auditors are frequently faced with situations that may test their professionalism, ethical character, and independence. For example, auditors’ independence is tested when auditees engage in opinion shopping—that is, when an auditee seeks the views of other CPAs, hoping to find an auditor who will agree with the entity’s desired accounting treatment. Chapter 19 contains an in-depth discussion of professional ethics and the Code of Professional Conduct.

Practice I N S I G H T

Auditor independence was emphasized in the 1933 Senate Banking Hearings on proposed secu- rities laws when, like in 2002, social responsibility and public confidence were on the minds of the members of Congress. Colonel Arthur Carter, then managing partner of Haskins & Sells (now Deloitte & Touche LLP) and president of the New York State Society of CPAs, appeared before the Senate Banking Committee and emphasized that the accountants that audit the financial statements of public companies should be independent (U.S. Congress, Senate Banking Hearings, 1933).

Conclusion

Chapter 1 introduced the concept of assurance and discussed the basics of financial statement auditing. This chapter explains the broader context in which financial statement auditing takes place. To fully understand auditing, you must be aware of the factors that shape the auditing environment, including the general economic and business environment, the characteristics of the entity’s particular business and industry, and the standards, social responsibilities, and codes of conduct that guide the financial statement auditor’s work. You must also understand the nature of public accounting firms within which auditors conduct audits of businesses and other entities of various sizes, and you should be aware of the outside professional, regulatory, and standard-setting bodies that directly impact how auditing is done. This chapter provides an introduction to these elements of the complex and ever-changing environment in which financial statement auditing is performed.

As you can see from reading the first two chapters of this book, the tasks, assessments, and evaluations that auditors perform require a great deal of professional judgment. In fact, judgment is so important, you may often find your instructor very correctly answering ques- tions in class with “it depends” or “that is a matter of professional judgment.” The good news is that professional judgment is a skill that can be learned and improved with knowledge and practice. To help you learn what good professional judgment looks like, as well as how to rec- ognize and avoid common threats to good judgment, we have provided an advanced module at the end of this book titled “Professional Judgment Framework.” This framework is adapted from the award-winning framework that two of the authors of this book helped KPMG, LLP to formulate and implement in its U.S. audit practice.

KEY TERMS

Audit committee. A committee consisting of members of the board of directors, charged with overseeing the entity’s system of internal control over financial reporting, internal and external auditors, and the financial reporting process. Members typically must be independent of management.

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 59

mes32502_ch02_035-066.indd 59 10/10/15 02:56 PM

Board of directors. Persons elected by the stockholders of a corporation to oversee manage- ment and to direct the affairs of the corporation. Business processes. Processes implemented by management to achieve entity objectives. Business processes are typically organized into the following categories: financing processes, purchasing, human resource management, inventory management, and revenue. Code of Professional Conduct. A set of principles, rules, and interpretations that establish guidance for acceptable behavior for accountants and auditors. Corporate governance. The oversight mechanisms in place to help ensure the proper stew- ardship over an entity’s assets. Management and the board of directors play primary roles, and the independent auditor plays a key facilitating role. Ethics. A system or code of conduct based on moral duties and obligations that indicates how an individual should behave. Generally accepted accounting principles (GAAP). Accounting principles that are gener- ally accepted for the preparation of financial statements in the United States. GAAP stan- dards are currently issued primarily by the FASB, with oversight and influence by the SEC. International Financial Reporting Standards (IFRS) are set by the International Accounting Standards Board. Generally accepted auditing standards (GAAS). Ten broad statements guiding the conduct of financial statement auditing. The 10 GAAS are still found in PCAOB standards but they have been replaced in the ASB standards by the “Principles Underlying an Audit Conducted in Accordance with Generally Accepted Auditing Standards.” Illegal acts. Violations of laws or government regulations. Independence. A state of objectivity in fact and in appearance, including the absence of any significant conflicts of interest. Integrated audit. An audit of both financial statements and internal control over financial reporting, provided by the external auditor. Required for public companies. International Standards on Auditing (ISA). Statements issued by IFAC’s International Auditing and Assurance Standards Board. Management advisory services. Consulting services that may provide advice and assis- tance concerning an entity’s organization, personnel, finances, operations, systems, or other activities. Principles Underlying an Audit Performed in Accordance with GAAS. The ASB replaced the 10 Generally Accepted Auditing Standards with these Principles, organized into four parts: Purpose of an Audit and Premise upon which an Audit is Conducted, Auditor Respon- sibilities, Audit Performance, and Audit Reporting. Public accounting firm. An organization created to provide professional accounting-related services, including auditing. Usually formed as a proprietorship or as a form of partnership. Standards (AS) of the PCAOB. Standards regarding the conduct of financial statement audits for public companies. Currently consist of a mix of standards and statements estab- lished by the ASB, as these statements and standards were adopted by the PCAOB in 2003 on an interim basis, together with Auditing Standards (AS) issued by the PCAOB since 2003. Statements on Auditing Standards (SAS). Statements issued by the AICPA’s Auditing Standards Board.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 2-1 2-1 List the various types of auditors and describe their respective roles in a sentence or two each.

LO 2-2 2-2 Give one example each of compliance, operational, and forensic audits.

Final PDF to printer

60 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 60 10/10/15 02:56 PM

LO 2-4 2-3 Briefly discuss the key events that led up to the Sarbanes-Oxley Act of 2002 and the creation of the PCAOB.

LO 2-4 2-4 Discuss how the events that have so dramatically affected auditors and the public accounting profession since the Enron scandal may in some sense be “healthy” for the profession.

LO 2-5 2-5 Compare and contrast management’s responsibility for the entity’s financial state- ments with the auditor’s responsibilities for detecting errors and fraud in the finan- cial statements.

LO 2-6 2-6 Briefly discuss each of the components of the high-level model of business presented in the chapter (i.e., objectives, strategies, processes, etc.). Why might understanding the characteristics of an entity’s business in each of these areas be important for a financial statement auditor?

LO 2-6 2-7 What roles do information systems and systems of internal control play in the high- level model of business discussed in the chapter, and why might it be important for an auditor to understand these roles?

LO 2-8 2-8 The AICPA performs a number of functions that directly bear on independent audi- tors of nonpublic entities, including promulgation of rules and standards. List four types of rules or standards issued by the AICPA.

LO 2-8 2-9 What kind of organization is the PCAOB, why was it formed, and what does it do? LO 2-8 2-10 What role does the SEC play in the establishment of accounting and auditing stan-

dards for public companies? LO 2-8 2-11 Identify three of the documents required by the Securities Exchange Act of 1934 that

are commonly encountered by auditors. Briefly describe the purpose of each of these documents.

LO 2-10 2-12 List the four categories of Principles Underlying an Audit Conducted in Accor- dance with GAAS. How do the Principles relate to the 10 GAAS, and how are they different?

LO 2-10 2-13 List the three categories of GAAS. Discuss why the GAAS and the SAS are consid- ered minimum standards of performance for auditors.

LO 2-12 2-14 Why is independence such an important standard for auditors? How does auditor independence relate to the agency relationship between owners and managers dis- cussed in Chapter 1?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 2-1 2-15 Which of the following is not a part of the role of internal auditors? a. Assisting the external auditors. b. Providing reports on the reliability of financial statements to investors and

creditors. c. Consulting activities. d. Operational audits.

LO 2-2 2-16 Operational auditing is oriented primarily toward a. Efficiency and future improvements to accomplish the goals of management. b. The accuracy of data reflected in management’s financial records. c. Verification that an entity’s financial statements are fairly presented. d. Past protection provided by existing internal control.

LO 2-2 2-17 Which of the following would be considered a nonattest assurance service engagement?

I. Expressing an opinion about the reliability of an entity’s financial statements. II. Reviewing and commenting on an entity-prepared business plan. a. I only. c. Both I and II. b. II only. d. Neither I nor II.

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 61

mes32502_ch02_035-066.indd 61 10/10/15 02:56 PM

LO 2-4 2-18 Which of the following best places the events of the last decade in proper sequence? a. Sarbanes-Oxley Act, increased consulting services to auditees, Enron and other

scandals, prohibition of most consulting work for auditees, establishment of PCAOB.

b. Increased consulting services to auditees, Sarbanes-Oxley Act, Enron and other scandals, prohibition of most consulting work for auditees, establishment of PCAOB.

c. Enron and other scandals, Sarbanes-Oxley Act, increased consulting services to auditees, prohibition of most consulting work for auditees, establishment of PCAOB.

d. Increased consulting services to auditees, Enron and other scandals, Sarbanes- Oxley Act, prohibition of most consulting work for auditees, establishment of PCAOB.

LO 2-5 2-19 Which of the following statements best describes management’s and the exter- nal auditor’s respective levels of responsibility for a public company’s financial statements?

a. Management and the external auditor share equal responsibility for the fairness of the entity’s financial statements in accordance with GAAP.

b. Neither management nor the external auditor has significant responsibility for the fairness of the entity’s financial statements in accordance with GAAP.

c. Management has the primary responsibility to ensure that the company’s finan- cial statements are prepared in accordance with GAAP, and the auditor provides reasonable assurance that the statements are free of material misstatement.

d. Management has the primary responsibility to ensure that the company’s finan- cial statements are prepared in accordance with GAAP, and the auditor provides a guarantee that the statements are free of material misstatement.

LO 2-6 2-20 Which of the following best describes the relationship between business objectives, strategies, processes, controls, and transactions?

a. To achieve its objectives, a business formulates strategies and implements pro- cesses, which are carried out through business transactions. The entity’s informa- tion and internal control systems must be designed to ensure that the transactions are properly executed, captured, and processed.

b. To achieve its strategies, a business formulates objectives and implements pro- cesses, which are carried out through the entity’s information and internal con- trol systems. Transactions are conducted to ensure that the processes are properly executed, captured, and processed.

c. To achieve its objectives, a business formulates strategies to implement its trans- actions, which are carried out through business processes. The entity’s informa- tion and internal control systems must be designed to ensure that the processes are properly executed, captured, and processed.

d. To achieve its business processes, a business formulates objectives, which are carried out through the entity’s strategies. The entity’s information and internal control systems must be designed to ensure that the entity’s strategies are properly executed, captured, and processed.

LO 2-8 2-21 The Public Company Accounting Oversight Board a. Is a quasi-governmental organization that has legal authority to set auditing stan-

dards for audits of public companies. b. Is a quasi-governmental organization that has legal authority to set accounting

standards for public companies. c. Is a quasi-governmental organization that has a policy to ignore public comment

and input in the process of setting auditing standards. d. Is a quasi-governmental organization that is independent of the SEC in setting

auditing standards.

Final PDF to printer

62 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 62 10/10/15 02:56 PM

LO 2-10 2-23 Which of the following best describes the general character of the three generally accepted auditing standards classified as standards of field work?

a. Description of the competence, independence, and professional care of persons performing the audit.

b. Criteria for the content of the auditor’s report on financial statements and related footnote disclosures.

c. Criteria for audit planning and evidence gathering. d. The need to maintain an independence of mental attitude in all matters relating to

the audit.

PROBLEMS All applicable problems are available with Connect.

LO 2-1, 2-2 2-24 Audits can be categorized into five types: (1) financial statement audits, (2) audits of internal control, (3) compliance audits, (4) operational audits, and (5) forensic audits.

Required: For each of the following descriptions, indicate which type of audit (financial state- ment audit, audit of internal control, compliance audit, operational audit, or forensic audit) best characterizes the nature of the audit being conducted. Also indicate which type of auditor (external auditor, internal auditor, government auditor, or forensic auditor) is likely to perform the audit engagement.

a. Evaluate the policies and procedures of the Food and Drug Administration in terms of bringing new drugs to market.

b. Determine the fair presentation of Ajax Chemical’s balance sheet, income state- ment, and statement of cash flows.

c. Review the payment procedures of the accounts payable department for a large manufacturer.

d. Examine the financial records of a division of a corporation to determine if any accounting irregularities have occurred.

e. Evaluate the feasibility of forecasted rental income for a planned low-income public housing project.

f. Evaluate a company’s computer services department in terms of the efficient and effective use of corporate resources.

g. Audit the partnership tax return of a real estate development company. h. Investigate the possibility of payroll fraud in a labor union pension fund.

LO 2-10 2-25 Dale Boucher, the owner of a small electronics firm, asked Sally Jones, CPA, to con- duct an audit of the company’s records. Boucher told Jones that the audit was to be completed in time to submit audited financial statements to a bank as part of a loan

LO 2-9 2-22 Which of the following is correct regarding the types of audits over which the ASB and the PCAOB, respectively, have standard-setting authority in the United States?

ASB PCAOB

a. Nonpublic company audits Nonpublic company audits

b. Public company audits Public company audits

c. Nonpublic company audits Public company audits

d. Public company audits Nonpublic company audits

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 63

mes32502_ch02_035-066.indd 63 10/10/15 02:56 PM

application. Jones immediately accepted the engagement and agreed to provide an auditor’s report within one month. Boucher agreed to pay Jones her normal audit fee plus a percentage of the loan if it was granted.

Jones hired two recent accounting graduates to conduct the audit and spent sev- eral hours telling them exactly what to do. She told the new hires not to spend time reviewing the entity’s system of internal control but to concentrate on proving the mathematical accuracy of the general and subsidiary ledgers and summarizing the data in the accounting records that supported Boucher’s financial statements. The new hires followed Jones’s instructions and after two weeks gave Jones the financial statements excluding footnotes. Jones reviewed the statements and pre- pared an unqualified auditor’s report. The report did not refer to generally accepted accounting principles, and no audit procedures were conducted to verify the year- to-year application of such principles.

Required: a. Briefly describe each of the generally accepted auditing standards and indicate

how the action(s) of Jones resulted in a failure to comply with each of the 10 gen- erally accepted auditing standards.

b. Briefly describe the four categories of Principles Underlying an Audit Conducted in Accordance with Generally Accepted Auditing Standards and indicate in what ways the action(s) of Jones violate(s) each of the four categories of principles.

(AICPA, adapted)

LO 2-10 2-26 Terri Harrison, CPA, has discussed various reporting considerations with CFOs from three of the entities she audits. The three CFOs presented the following situa- tions and asked how they would affect the audit report.

a. One of the entities has changed its depreciation method on its machinery from straight line to double declining balance. Both Harrison and the entity agree that the new depreciation method better reflects the usage of the machinery in the manufacturing process. The entity agrees with Harrison that the change is material but claims that it needs disclosure only in the “Summary of Signifi- cant Accounting Policies” footnote to the financial statements, not in Harrison’s report.

b. The second entity has a loan agreement that restricts the amount of cash divi- dends that can be paid and requires the maintenance of a particular current ratio. The entity is in compliance with the terms of the agreement, and it is not likely that there will be a violation in the foreseeable future. The entity believes there is no need to mention the restriction in the financial statements because such men- tion might mislead the readers.

c. The third entity correctly accounted for the acquisition of a majority-owned domestic subsidiary when that transaction occurred but did not properly pres- ent the minority interest in retained earnings or net income of the subsidiary in the consolidated financial statements. The entity agrees with Harrison that the minority interest presented in the consolidated financial statements is materially misstated but takes the position that the minority shareholders of the subsidiary should look to that subsidiary’s financial statements for information concerning their interest therein.

Required: Each of the situations presented relates to one of the four generally accepted auditing standards of reporting. Identify and describe the applicable generally accepted audit- ing standard of reporting in each situation, and discuss how the particular entity’s situation relates to the standard.

(AICPA, adapted)

Final PDF to printer

64 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 64 10/10/15 02:56 PM

DISCUSSION CASES

LO 2-2, 2-10, 2-12 2-27 Part I: Merry-Go-Round (MGR), a clothing retailer located primarily in shopping malls, was founded in 1968.10 By the early 1990s, the company had gone public and had expanded to approximately 1,500 stores, 15,000 employees, and $1 billion in annual sales. The company’s locations in malls targeted the youth and teen market. The company was listed by Forbes magazine as one of the top 25 companies in the late 1980s. However, in the early 1990s, the company faced many challenges. One of its cofounders died, and the other left to pursue unrelated business interests. The company faced stiff competition from other retailers (e.g., The Gap and Banana Republic), fashion trends changed, and mall traffic declined. Sales fell, and experts speculated that MGR failed to anticipate key industry trends and lost sight of its cus- tomer market. To try to regain its strong position, the company acquired Chess King, Inc., a struggling chain of men’s clothing stores located in malls, in 1993.

The company’s sales continued to fall, and later in 1993 the company brought back one of its cofounders to manage the company and wrote down a significant amount of inventory. However, this inventory write-down caused the company to violate loan covenants. Facing bankruptcy, the company, based on the advice of its newly hired law firm Swidler and Berlin, hired turnaround specialists from Ernst and Young (E&Y) to help overcome the financial crisis and develop a long- term business plan. However, the company’s decline continued, and it filed for Chapter 11 reorganization in 1994. In 1996, the remaining assets were sold for pen- nies on the dollar.

Subsequently, a group of 9,000 creditors (including former employees and stock- holders) began litigation against parties it deemed responsible for their losses. These parties included E&Y, which the creditors sued for $4 billion in punitive and com- pensatory damages (E&Y’s fees from MGR totaled $4.5 million).

The lawsuit alleged that E&Y’s incompetence was the main cause of MGR’s decline and demise. The lawsuit alleged in part that

∙ The turnaround team did not act quickly enough. ∙ The leader of the team took an eight-day vacation at a critical point during the

engagement. ∙ The cost-cutting strategy called for only $11 million in annual savings, despite the

fact that the company was projected to lose up to $200 million in 1994. ∙ While closing unprofitable stores was key to MGR’s survival, by 1995 only 230

of 1,434 stores had been closed and MGR still operated two stores in some malls. ∙ The turnaround team included inexperienced personnel—a retired consultant, a

partner with little experience in the United States or with retail firms in general, and two recent college graduates.

∙ E&Y charged exorbitant hourly rates and charged unreasonable expenses (e.g., charges included reimbursement for a dinner for three of the consultants totaling in excess of $200).

E&Y denied any wrongdoing but in April 1999 agreed to pay $185 million to settle with the injured parties.

Required: a. Although this was not an audit engagement for E&Y, some of the allegations

against the firm can be framed in terms of the 10 generally accepted auditing standards. Which of the 10 GAAS was E&Y alleged to have violated?

10The following articles were sources for the information in the case: E. MacDonald, “Ernst & Young Will Pay $185 Million to Settle Claims of Merry-Go-Round,” The Wall Street Journal, April 29, 1999, and E. McDonald and S. J. Paltrow, “Merry-Go-Round: Ernst & Young Advised the Client, but Not about Everything—It Didn’t Reveal Business Ties Alleged to Pose Conflict with Its Consulting Job—Settlement for $185 Million,” The Wall Street Journal, August 8, 1999, p. A1.

Final PDF to printer

Chapter 2 The Financial Statement Auditing Environment 65

mes32502_ch02_035-066.indd 65 10/10/15 02:56 PM

b. Although this was not an audit engagement for E&Y, some of the allegations against the firm can be framed in terms of the Principles Underlying an Audit Conducted in Accordance with Generally Accepted Auditing Standards. Which of the Principles was E&Y alleged to have violated?

c. Should there be specific professional standards for CPAs who consult? Given that non-CPAs who consult do not have formal professional standards, describe the advantages and disadvantages that result from CPAs being subject to such standards.

LO 2-12 2-28 Part II: Merry-Go-Round. Additional charges made against E&Y included the fol- lowing (recall that MGR hired E&Y for turnaround consulting services):

∙ E&Y had a close relationship with Rouse Co., one of MGR’s primary landlords (E&Y was soliciting business from Rouse and provided significant tax services).

∙ Swidler (the law firm that recommended E&Y to MGR) and E&Y had partici- pated in at least 12 different business arrangements, some of which resulted in Swidler receiving significant fees from E&Y.

∙ E&Y did not disclose either of these relationships to MGR.

Required: a. Do you think that E&Y acted unethically, given that it had these relationships? b. How could these relationships have affected E&Y’s advice to MGR? In other

words, refer to the charges above and speculate as to whether any of the alleged wrong-doings by E&Y may have stemmed from the relationships described above.

INTERNET ASSIGNMENTS

LO 2-1, 2-2, 2-8 2-29 Visit the GAO’s home page (www.gao.gov) and search for a recently completed audit. Prepare a summary of the GAO audit, including background on the issue and the GAO’s primary findings and recommendations.

LO 2-8 2-30 a. Go to the AICPA’s website (www.aicpa.org). Find the AICPA’s mission state- ment (currently under the link “About the AICPA”). Read and briefly summarize the AICPA’s mission as described in its mission statement.

b. Go to the SEC’s website (www.sec.gov). Find the SEC’s description of its mis- sion (currently under the “What We Do” link under the heading “About the SEC”). Read the material under the link “Introduction,” describing the SEC’s primary mission and purpose. Write a paragraph summarizing the SEC’s mission and purpose.

c. Go to the SEC’s website (www.sec.gov) and click on the “What We Do” link (under the “About” link). Read the material under the link “Creation of the SEC,” describing the SEC’s creation in the 1930s. Write a paragraph summarizing when and why the SEC was formed. What were the triggering events leading up to the SEC’s formation?

d. Go to the PCAOB’s website (www.pcaobus.org). Find and briefly summarize the PCAOB’s description of its standard-setting process (click on the “Standards” link along the top of the page; then select “The Standard-Setting Process” towards the bottom of the page, under the subheading “Current Standard-Related Activities”).

e. Go to www.ifac.org/IAASB/ and read the brief history of the IAASB found under the “About IAASB” link. Write a one-page summary of the development and sta- tus of the IAASB and its International Statements on Auditing Standards around the world.

f. Go to www.ifrs.com and read about how the IASB is structured, how it is funded, and how it sets accounting standards. Write one page summarizing what you find. Include a paragraph regarding the current status of the IASB’s and FASB’s con- vergence efforts.

Final PDF to printer

66 Part 1 Introduction to Assurance and Financial Statement Auditing

mes32502_ch02_035-066.indd 66 10/10/15 02:56 PM

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch03_067-097.indd 67 10/14/15 02:03 PM

PART TWO

Audit Planning and Basic Auditing Concepts

CHAPTER 3 Audit Planning, Types of Audit Tests, and Materiality

CHAPTER 4 Risk Assessment

CHAPTER 5 Evidence and Documentation

Final PDF to printer

mes32502_ch03_067-097.indd 68 10/14/15 02:03 PM

CHAPTER

3 3-1 Understand the auditor’s requirements for client

acceptance and continuance. 3-2 Understand the steps that are involved in the preliminary

engagement activities. 3-3 Know what is required to establish an understanding

with the entity. 3-4 Know the types of information that are included in an

engagement letter. 3-5 Understand how the work of the internal auditors can

assist in the performance of the audit. 3-6 Know the responsibilities of the audit committee and

how it relates to the external auditors.

3-7 Know the steps that are performed in planning an audit engagement.

3-8 Understand the importance of supervision to the planning and conduct of the audit.

3-9 Know the types of audit tests. 3-10 Understand the concept of materiality. 3-11 Know the steps to applying materiality in an audit. 3-12 Apply the materiality steps to an example (EarthWear).

FASB ASC Topic 850, Related Party Disclosures AU-C 210, Terms of Engagement AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 250, Consideration of Laws and Regulations in an Audit of Financial Statements AU-C 510, Opening Balances—Initial Audit Engagements, Including Reaudit Engagements AU-C 520, Analytical Procedures AU-C 530, Audit Sampling AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 580, Written Representations AU-C 600, Special Considerations—Audits of Group Financial Statements AU-C 610, Using the Work of Internal Auditors AU-C 620, Using the Work of an Auditor’s Specialist PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

mes32502_ch03_067-097.indd 69 10/14/15 02:03 PM

Audit Planning, Types of Audit Tests, and Materiality

P lanning an audit includes establishing the overall audit strategy for the engagement and developing an audit plan, which includes risk assess- ment procedures and planned audit responses to the risks of material

misstatement. If the audit is not properly planned, the auditor may issue an incorrect audit report or conduct an inefficient audit. The audit starts with the initial appointment or reappointment of the auditor by the entity or audit com- mittee. Next, the auditor performs a number of activities that go into develop- ing an overall audit strategy.

This chapter covers the following phases of the audit identified in Chapter 1, Figure 1–4:

• Client acceptance and continuance.

• Preliminary engagement activities.

• Planning the audit.

It then covers the major types of audit tests and the concept of materiality.

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

70 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 70 10/14/15 02:03 PM

The first phase of the audit process that relates to audit planning is client acceptance and continuance (see Figure 3–1). The extent of effort that goes into evaluating a new client is normally much greater than the decision to continue with an existing client. With a continuing client the auditor possesses extensive knowledge about the entity and its environment.

Prospective Client Acceptance A public accounting firm should investigate a prospective client prior to accepting the engage- ment. Table 3–1 lists procedures that a firm might conduct to evaluate a prospective client. Performance of such procedures would normally be documented in a memo or by completion of an entity acceptance questionnaire or checklist.

When the prospective client has previously been audited, the successor auditor makes certain inquiries of the predecessor auditor before accepting the engagement. The successor auditor should request permission of the prospective client before contacting the predecessor auditor. Because the Code of Professional Conduct does not allow an auditor to disclose con- fidential client information without the entity’s consent, the prospective client must authorize the predecessor auditor to respond to the successor’s requests for information. The successor auditor should make the following inquiries of the predecessor auditor:

∙ Information that might bear on the integrity of management. ∙ Disagreements with management about accounting policies, auditing procedures,

or other similarly significant matters. ∙ Communications to those charged with governance regarding fraud and

noncompliance with laws or regulations by the entity. ∙ Communications to management and those charged with governance regarding

significant deficiencies and material weaknesses in internal control. ∙ The predecessor auditor’s understanding about the reasons for the change of

auditors.

Such inquiries of the predecessor auditor may help the successor auditor determine whether to accept the engagement. The predecessor auditor should respond fully to the

LO 3-1

Client Acceptance and Continuance

Client acceptance and continuance

Preliminary engagement activities

Plan the audit

The Phases of an Audit That Relate to Audit PlanningF I G U R E 3 – 1

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 71

mes32502_ch03_067-097.indd 71 10/14/15 02:03 PM

successor’s requests unless an unusual circumstance (such as a lawsuit) exists. If the predeces- sor’s response is limited, the successor auditor must be informed that the response is limited.

In the unusual case where the prospective client refuses to permit the predecessor to respond, the successor auditor should have reservations about accepting the entity. Such a situation raises serious questions about management’s motivations and integrity. In addition, if the entity has unusual business risks such as possible going concern issues, the auditor is not likely to accept the prospective client because the engagement risk may be too high.

After accepting the engagement, the successor auditor may need information on begin- ning balances and consistent application of GAAP in order to issue an unqualified report. The successor auditor should request that the entity authorize the predecessor auditor to permit a review of his or her working papers. In most instances, the predecessor auditor will allow the successor auditor to make copies of any working papers of continuing interest (for example, details of selected balance sheet accounts).

If the entity has not previously been audited, the public accounting firm should com- plete all the procedures listed in Table 3–1. The auditor should review the prospective client’s financial information and carefully assess management integrity by communicating with the entity’s bankers and attorneys, as well as other members of the business community. Many public accounting firms have full-time staff that complete background checks and monitor news of public clients.

Client Continuance Public accounting firms should evaluate periodically whether to continue their relationship with current clients. This evaluation may take place at or near the completion of an audit or when some significant event occurs. Conflicts over accounting and auditing issues or disputes over fees may lead a public accounting firm to disassociate itself from the entity. See Internet Assignment 3-34.

Procedures for Evaluating a Prospective Client

1. Obtain and review available financial information (annual reports, interim financial statements, income tax returns, etc.). 2. Inquire of third parties about any information concerning the integrity of the prospective client and its management. (Such inquiries should be directed

to the prospective client’s bankers and attorneys, credit agencies, and other members of the business community who may have such knowledge.) 3. Consider whether the prospective client has any circumstances that will require special attention or that may represent unusual business or audit risks,

such as litigation or going concern issues. 4. Determine if the firm is independent of the entity and able to provide the desired service. 5. Determine if the firm has the necessary technical skills and knowledge of the industry to complete the engagement. 6. Determine if acceptance of the entity would violate any applicable regulatory agency requirements or the Code of Professional Conduct.

T A B L E 3 – 1

Preliminary Engagement Activities

There are generally three preliminary engagement activities: (1) determining the audit engagement team requirements, (2) ensuring that the audit team and audit firm are in compli- ance with ethical and independence requirements, and (3) establishing an understanding with the entity.

Determine the Audit Engagement Team Requirements Public accounting firms need to ensure that their engagements are completed by auditors having the proper degree of technical training and proficiency given the circumstances of the entity. Factors that should be considered in determining staffing requirements include engagement size and complexity, level of risk, any special expertise, personnel availability, and timing of the work to be performed. For example, if the engagement involves a high

LO 3-2

Final PDF to printer

72 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 72 10/14/15 02:03 PM

level of risk, the firm should staff the engagement with more experienced auditors. Simi- larly, if the audit involves a specialized industry (banking, insurance, and so on) or if the entity uses sophisticated IT processing or holds financial instruments, the firm must ensure that members of the audit team possess the requisite expertise. Generally, a time budget for planned work is prepared in order to assist with the staffing requirements and to schedule the fieldwork.

Stop and Think: Suppose an entity held financial instruments (i.e., derivatives) that are accounted for using fair value accounting. What type of expertise would the audit team need?

Assess Compliance with Ethical and Independence Requirements A public accounting firm should establish policies and procedures to ensure that persons at all organizational levels within the firm meet the profession’s ethical requirements (QC 10), including maintaining independence in accordance with the Code of Professional Conduct (see Chapter 19). A firm should document compliance with this policy by having all per- sonnel complete an annual independence questionnaire. This questionnaire requests infor- mation about the auditor’s financial or business relationships with the firm’s clients. Under certain circumstances, family members’ financial or business relationships are attributable to the auditor. For example, if the spouse of an auditor participating in an engagement were an accounting supervisor for the entity, independence would be considered impaired.

At the engagement level, the partner-in-charge should ensure that all individuals assigned to the engagement are independent of the entity. This can be accomplished by reviewing the annual independence reports for each member of the audit team or through the firm’s inde- pendent database.

Another area of concern related to independence is unpaid client fees. If an account receivable from an entity takes on the characteristics of a loan, the auditor’s independence may be impaired. Many public accounting firms adopt a policy of not completing the current audit until all of the prior year’s fees have been paid.

Finally, the CPA firm must be concerned when it also provides consulting services for an audit client. While the performance of consulting services does not, in and of itself, impair independence, the audit team must remain objective when evaluating client activities that were developed by its firm’s consultants. For companies currently subject to the Sarbanes- Oxley Act, the auditor is not permitted to provide certain types of consulting services for audit clients. See Chapter 19 for a list of these services.

Establish an Understanding with the Entity The auditor should establish an understanding with the entity about the terms of the engage- ment. This understanding reduces the risk that either party may misinterpret what is expected or required of the other party. The terms of the engagement, which are documented in the engagement letter, should include the objectives of the engagement, management’s responsi- bilities, the auditor’s responsibilities, and the limitations of the engagement. In establishing an understanding with the client, three topics should be discussed: (1) the engagement letter, (2) using the work of the internal auditors, and (3) the role of the audit committee.

The Engagement Letter Auditing standards state that the auditor should document the understanding through a written communication with the entity. An engagement letter is used to formalize the arrangements reached between the auditor and the entity. This letter serves as a contract, outlining the responsibilities of both parties and preventing misunderstandings between the two parties. Exhibit 3–1 shows a sample engagement letter for EarthWear.

LO 3-3

LO 3-4

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 73

mes32502_ch03_067-097.indd 73 10/14/15 02:03 PM

A Sample Engagement Letter—EarthWear Clothiers

Willis & Adams, P.C.

Boise, Idaho April 1, 2015 Mr. Chad Simon Chair, Audit Committee EarthWear Clothiers P.O. Box 787 Boise, Idaho 83845

Dear Mr. Simon:

The purpose of this letter is to confirm our understanding of the terms of our engagement as independent accountants of EarthWear Clothiers (the “Company”).

Integrated Audit of the Financial Statements and Internal Control Over Financial Reporting—Services and Related Report We will perform an integrated audit of the consolidated financial statements of the Company at December 31, 2015, and for the year then ending and of the effectiveness of the Company’s internal control over financial reporting as of December 31, 2015. Upon completion of our audits, we will provide you with our audit report on the audit work referred to above. If for any reason we are unable to complete our integrated audit or are unable to form or have not formed an opinion, we may decline to express an opinion or decline to issue a report as a result of this engagement.

In conjunction with the financial statement audit, we will perform reviews of the Company’s unaudited consolidated quarterly financial statements for each of the first three quarters in the year ending December 31, 2015, before the Form 10-Q is filed. These reviews will be conducted in accordance with standards established by the Public Company Accounting Oversight Board (PCAOB), and are substantially less in scope than an audit. Accordingly, a review may not reveal material modifications necessary to make the quarterly financial informa- tion conform with generally accepted accounting principles. We will communicate to the audit committee and management any matters that come to our attention as a result of the review that we believe may require material modifications to the quarterly financial information to make it conform with accounting principles generally accepted in the United States. If for any reason relating to the affairs or manage- ment of the Company we are unable to complete our review, we will notify the audit committee and management.

Our Responsibilities and Limitations The objective of a financial statement audit is the expression of an opinion on the financial statements. We will be responsible for perform- ing the audit in accordance with the standards established by the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud. The audit will include examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, and evaluating the overall financial statement presenta- tion. We will consider the Company’s internal control over financial reporting in determining the nature, timing, and extent of auditing procedures necessary for expressing our opinion on the financial statements.

The objective of an audit of internal control over financial reporting is the expression of an opinion on the effectiveness of the Com- pany’s internal control over financial reporting. We will be responsible for performing the audit in accordance with the standards estab- lished by the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. The audit will include obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control over financial reporting based on the assessed risk, and performing such other procedures as we consider necessary in the circumstances.

Under the standards established by the PCAOB, the existence of one or more material weaknesses will require us to issue an adverse opinion regarding the effectiveness of the Company’s internal control over financial reporting.

All significant deficiencies and material weaknesses relating to internal control over financial reporting identified while performing our work will be communicated in writing to management and the audit committee. All deficiencies in internal control over financial reporting (i.e., those deficiencies in internal control over financial reporting that are of a lesser magnitude than significant deficiencies) identified while performing our work will be communicated in writing to management of the Company, and the Audit Committee will be informed when such a communication has been made. We will communicate in writing to the Board of Directors of the Company if we conclude that the oversight of the Company’s external financial reporting and internal control over financial reporting by the Company’s audit committee is ineffective.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projec- tions of any evaluation of effectiveness of internal control over financial reporting from December 31, 2015, the date of our audit of the

(continued )

E X H I B I T 3 – 1

Final PDF to printer

74 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 74 10/14/15 02:03 PM

A Sample Engagement Letter—EarthWear Clothiers (continued)

Company’s internal control over financial reporting, to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

We will design our audit to obtain reasonable, but not absolute, assurance of detecting errors or fraud that would have a material effect on the financial statements as well as other illegal acts having a direct and material effect on financial statement amounts, and of identify- ing material weaknesses in internal control over financial reporting. Absolute assurance is not attainable due to the nature of audit evi- dence and the characteristics of fraud. Also, an audit is not designed to detect errors or fraud that are immaterial to the financial statements or other illegal acts having an indirect or immaterial financial statement impact or deficiencies in internal control over financial reporting that, individually or in combination, are less severe than a material weakness. It is important to recognize that there are inherent limitations in the auditing process. An audit is based on the concept of selective testing of the data underlying the financial statements, which involves judgment regarding the areas to be tested and the nature, timing, extent and results of the tests to be performed. Accordingly, there is some risk that a material misstatement of the financial statements or a material weakness in internal control over financial reporting would remain undetected. Because of the characteristics of fraud, an audit designed and executed in accordance with the standards established by the PCAOB may not detect a material misstatement due to fraud. Characteristics of fraud include (i) concealment through collusion among management, employees, or third parties; (ii) withheld, misrepresented, or falsified documentation; and (iii) the ability of manage- ment to override or instruct others to override what otherwise appears to be effective controls. Further, while effective internal control over financial reporting reduces the likelihood that errors, fraud, or other illegal acts will occur and remain undetected, it does not eliminate that possibility. For these reasons we cannot ensure that errors, fraud, or other illegal acts, if present, will be detected. However, we will com- municate to the audit committee and management of the Company, as appropriate, any such matters identified during our audit.

We also are responsible for determining that the audit committee is informed about certain other matters related to the conduct of our audit, including (i) any disagreements with management about matters that could be significant to the Company’s financial statements or our report thereon; (ii) any serious difficulties encountered in performing the audit; (iii) information relating to our independence with respect to the Company; and (iv) other matters related to the Company’s financial statements including its significant accounting policies and practices, including critical accounting policies and alternative treatments within accounting principles generally accepted in the United States. Lastly, we are responsible for ensuring that the audit committee receives copies of certain written communications between us and management, including management representation letters and written communications on accounting, auditing, internal control, or operational matters.

The financial statement audit and the audit of the Company’s internal control over financial reporting will not be planned or conducted in contemplation of reliance by any specific third party or with respect to any specific transaction. Therefore, items of possible interest to a third party will not be specifically addressed and matters may exist that would be assessed differently by a third party, possibly in connec- tion with a specific transaction.

Management’s Responsibilities The Company’s management is responsible for the financial statements, including disclosures, and information referred to above and for establishing and maintaining effective internal control over financial reporting. In this regard, management is responsible for establish- ing policies and procedures that pertain to the maintenance of accounting records, the authorization of receipts and disbursements, the safeguarding of assets, the proper recording of transactions in the accounting records, and for reporting financial information in conformity with accounting principles generally accepted in the United States. Management also is responsible for the design and implementation of programs and controls to prevent and detect fraud, and for informing us (i) about all known or suspected fraud affecting the entity involv- ing (a) management, (b) employees who have significant roles in internal control over financial reporting, and (c) others where the fraud could have a material effect on the financial statements; and (ii) of its knowledge of any allegations of fraud or suspected fraud affecting the entity received in communications from employees, former employees, analysts, regulators, short sellers, or others. Management is responsible for (i) adjusting the financial statements to correct material misstatements relating to accounts or disclosures and for affirming to us in the representation letter that the effects of any uncorrected misstatements aggregated by us are immaterial, both individually and in the aggregate, to the financial statements taken as a whole; and (ii) notifying us of all deficiencies in the design or operation of internal control over financial reporting identified as part of management’s assessment, including separately disclosing to us all such deficien- cies that it believes to be significant deficiencies or material weaknesses in internal control over financial reporting. Management also is responsible for identifying and ensuring that the Company complies with the laws and regulations applicable to its activities. Furthermore, management of the Company is responsible for:

• Establishing and maintaining internal control over financial reporting; • Evaluating the effectiveness of the Company’s internal control over financial reporting using suitable control criteria; • Supporting its evaluation with sufficient evidential matter, including documentation; and • Presenting a written assessment of the effectiveness of the Company’s internal control over financial reporting as of the end of the

Company’s most recent fiscal year.

As part of management’s responsibility for the financial statements and the effectiveness of internal control over financial reporting, management is responsible for making available to us, on a timely basis, all of the Company’s financial records and relevant information

E X H I B I T 3 – 1

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 75

mes32502_ch03_067-097.indd 75 10/14/15 02:03 PM

A Sample Engagement Letter—EarthWear Clothiers (continued)

and company personnel to whom we may direct inquiries. Management is responsible for maintaining evidential matter, including docu- mentation of the design of controls to provide reasonable support for management’s assessment of the operating effectiveness of internal control over financial reporting.

As required by the standards of the PCAOB, we will make specific inquiries of management and others about the representations embodied in the financial statements and the internal control over financial reporting. Standards of the PCAOB also require that at the conclusion of the engagement we obtain a letter from management that confirms certain representations made during the audit of the financial statements and internal control over financial reporting. The results of our tests, the responses to our inquiries and the written representations comprise the evidential matter we intend to rely upon in forming our opinion on the financial statements and the effective- ness of the Company’s internal control over financial reporting. Similarly, the results of our analytical procedures, the responses to our inquiries, and the written representations obtained comprise the basis for our review on the unaudited quarterly financial information.

Document Retention The Company agrees to maintain documentation sufficient to support its assessment of internal control over financial reporting as of December 31, 2015, for a period of seven years from the date of our audit report.

Other Documents Standards established by the Public Company Accounting Oversight Board (United States) require that we read any annual report that con- tains our audit report. The purpose of this procedure is to consider whether other information in the annual report, including the manner of its presentation, is materially inconsistent with information appearing in the financial statements. We assume no obligation to perform procedures to corroborate such other information as part of our audit.

With regard to electronic filings, such as in connection with the SEC’s Electronic Data Gathering, Analysis, and Retrieval (“EDGAR”) system, you agree that, before filing any document in electronic format with the SEC with which we are associated, you will advise us of the proposed filing on a timely basis. We will provide you with a signed copy of our report(s) and consent(s). These manually signed documents will serve to authorize the use of our name prior to any electronic transmission by you. For our files, you will provide us with a complete copy of the document as accepted by EDGAR.

The Company may wish to include our report on these financial statements in a registration statement to be filed under the Securi- ties Act of 1933 or in some other securities offering. You agree that the aforementioned audit report, or reference to our Firm, will not be included in any such offering without our prior permission or consent. Any agreement to perform work in connection with an offering, including an agreement to provide permission or consent, will be a separate engagement.

Timing and Fees Completion of our work is subject to, among other things, (1) appropriate cooperation from the Company’s personnel, including timely preparation of necessary schedules; (2) timely responses to our inquiries; and (3) timely communication of all significant accounting and financial reporting matters. When and if for any reason the Company is unable to provide such schedules, information, and assistance, Willis & Adams and the Company will mutually revise the fee to reflect additional services, if any, required of us to complete the audit.

Our fee estimates are based on the time required by the individuals assigned to the engagement. Individual hourly rates vary according to the degree of responsibility involved and experience and skill required. We estimate our fees for this integrated audit of internal control and financial statements will be $2,250,000, exclusive of out-of-pocket expenses. This estimate takes into account the agreed-upon level of preparation and assistance from company personnel; we will advise management should this not be provided or should any other cir- cumstances arise which may cause actual time to exceed that estimate. Invoices rendered are due and payable upon receipt.

This engagement letter reflects the entire agreement between us relating to the services covered by this letter. It replaces and super- sedes any previous proposals, correspondence, and understandings, whether written or oral. The agreements of the Company and Willis & Adams contained in this engagement letter shall survive the completion or termination of this engagement.

If you have any questions, please contact us. If the services outlined herein are in accordance with your requirements and if the above terms are acceptable to you, please have one copy of this letter signed in the space provided below and return it to us.

Very truly yours,

Willis & Adams

M. J. Willis

M. J. Willis, Partner

APPROVED:

By Chad Simon

Chair, Audit Committee

Date April 3, 2015

E X H I B I T 3 – 1

Final PDF to printer

76 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 76 10/14/15 02:03 PM

In addition to the items mentioned in the sample engagement letter in Exhibit 3–1, the engagement letter may include:

∙ Arrangements involving the use of specialists or internal auditors. ∙ Any limitation of the liability of the auditor or client, such as indemnification

to the auditor for liability arising from knowing misrepresentations to the auditor by management or alternative dispute resolution procedures. (Note that regulatory bodies, such as the SEC, may restrict or prohibit such liability-limiting arrangements.)

∙ Additional services to be provided relating to regulatory requirements. ∙ Arrangements regarding other services (e.g., assurance, tax, or consulting services).

Using the Work of the Internal Audit Function When the entity has an internal audit function (IAF), the auditor may use the work of the IAF as evidence and request the IAF provide direct assistance in conducting the audit. The auditor first needs to obtain an under- standing of the IAF, including information about the activities that it performs. The auditor next must determine whether any of these activities are relevant to the audit of the financial statements. If the auditor determines that the work of the IAF can be used for purposes of the audit, the auditor must evaluate:

∙ The extent to which the IAF’s organizational status and relevant policies and procedures support the objectivity of the internal auditors;

∙ The level of competence of the IAF; and ∙ The application by the IAF of a systematic and disciplined approach, including

quality control.

Table 3–2 presents factors that the auditor should consider when assessing the IAF. In Chapter 7, we discuss the effect the Sarbanes-Oxley Act has had on the use and assessment of the IAF for the audit of internal control over financial reporting.

The IAF’s work may affect the nature, timing, and extent of the audit procedures per- formed by the auditor. For example, as part of their regular work, the IAF may review, assess, and monitor the entity’s controls that are included in the accounting system. Similarly, part of the IAF work may include confirming accounts receivables or observing certain physi- cal inventories. If the IAF is reliable, the auditor may use the IAF’s work in these areas to reduce the scope of audit work. The materiality of the account balance and its related audit risk may also determine how much the auditor can rely on the IAF’s work. When internal auditors work directly for the auditor, the auditor should supervise, review, evaluate, and test their work.

The Role of the Audit Committee An audit committee is a subcommittee of the board of directors that is responsible for the financial reporting and disclosure process.1 For public

LO 3-5

LO 3-6

1Some privately held companies may not have an audit committee. In those circumstances the auditor should com- municate with those charged with governance. Those charged with governance are persons with the responsibility for overseeing the strategic direction of the entity and obligations related to the accountability of the entity.

Practice I N S I G H T

The Securities and Exchange Commission has a long-standing view on matters of auditor indem- nification: when an accountant and an entity enter into an agreement of indemnity which seeks to provide the accountant immunity from liability for his or her own negligent acts, whether of omis- sion or commission, the accountant is not independent. Furthermore, inclusion of such a clause in an engagement letter that a registrant would release, indemnify, or hold harmless from any liability and costs resulting from knowing misrepresentations by management would also impair the firm’s independence (SEC, Financial Reporting Polices, Section 600-602.02.f.i. Indemnification by Client).

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 77

mes32502_ch03_067-097.indd 77 10/14/15 02:03 PM

companies, the auditor is required to establish an understanding of the terms of the audit engagement with the audit committee and to record that understanding in an engagement letter (AS16). Under Section 301 of the Sarbanes-Oxley Act, the audit committee of a public company has the following requirements:

∙ Each member of the audit committee must be a member of the board of directors and shall be independent.

∙ The audit committee is directly responsible for the appointment, compensation, and oversight of the work of any registered public accounting firm employed by the company.

∙ The audit committee must preapprove all audit and nonaudit services provided by its auditor.

∙ The audit committee must establish procedures for the receipt, retention, and treatment of complaints received by the company regarding accounting, internal control, and auditing.

∙ Each audit committee member must have the authority to engage independent counsel or other advisors, as it determines necessary to carry out its duties.

The audit committee should meet with the external auditor before the engagement starts to discuss the auditor’s responsibilities and significant accounting policies. It may also provide limited input into the scope of the auditor’s work, such as requesting that the external auditor visit certain locations. The audit committee may also engage the external or internal audi- tors to conduct special investigations. The external auditor is required to make a number of important communications to the audit committee during or at the end of the engagement. Chapter 17 covers them in detail.

The audit committee should also interact with the internal audit function. An ideal arrangement for establishing the independence of the internal audit function is for the head of internal auditing (chief audit executive) to report functionally to the audit committee and administratively to senior management (i.e., CEO and CFO).

Factors for Evaluating the Reliability of the Internal Audit Function

Objectivity • Whether the organizational status of the IAF, including the function’s authority and accountability, supports the ability of the function to be free from

bias, conflict of interest, or undue influence of others to override professional judgments (e.g., the IAF reports to audit committee or an officer with appropriate authority, or if the function reports to management, whether it has direct access to audit committee).

• Whether the IAF is free of any conflicting responsibilities (e.g., having managerial or operational duties or responsibilities that are outside of the IAF). • Whether audit committee oversees employment decisions related to the IAF. • Whether any constraints or restrictions placed on the IAF by management or audit committee exist (e.g., in communicating the IAF’s findings to the

external auditor). • Whether the internal auditors are members of relevant professional bodies and their memberships obligate their compliance with relevant professional

standards relating to objectivity or whether their internal policies achieve the same objectives.

Competence • Whether the IAF is adequately and appropriately resourced relative to the size of the entity and the nature of its operations. • Whether established policies for hiring, training, and assigning internal auditors to internal audit engagements exist. • Whether the internal auditors have adequate technical training and proficiency in auditing (e.g., the internal auditors’ possession of a relevant profes-

sional designation and experience). • Whether the internal auditors possess the required knowledge relating to the entity’s financial reporting and the applicable financial reporting frame-

work and whether the IAF possesses the necessary skills to perform work related to the entity’s financial statements. • Whether the internal auditors are members of relevant professional bodies that oblige them to comply with the relevant professional standards, includ-

ing continuing professional development requirements.

Systematic and Disciplined Approach • The existence, adequacy, and use of documented internal audit procedures or guidance covering such areas as risk assessments, work programs,

documentation, and reporting, the nature and extent of which is commensurate with the size and circumstances of an entity. • Whether the IAF has appropriate quality control policies and procedures or quality control requirements in standards set by relevant professional bodies

for internal auditors. Such bodies may also establish other appropriate requirements such as conducting periodic external quality assessments.

T A B L E 3 – 2

Final PDF to printer

78 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 78 10/14/15 02:03 PM

Audit Strategy and Plan Engagement planning involves all the issues the auditor should consider in developing an overall audit strategy for conducting the audit. In establishing the audit strategy, the auditor should determine the scope of the engagement, ascertain the reporting objectives to plan the timing of the audit, and consider the factors that will determine the focus of the audit team’s efforts. Developing the audit strategy helps the auditor determine what resources are needed to perform the engagement.

Once the overall audit strategy has been established, the auditor develops an audit plan. The audit plan is more detailed than the audit strategy. In the audit plan, the auditor docu- ments a description of the nature, timing, and extent of the planned audit procedures to be used in order to comply with auditing standards. Basically, the audit plan should consider how to conduct the audit in an effective and efficient manner.

The nature and extent of planning activities that are necessary depend on the size and complexity of the entity and the auditor’s previous experience with the entity. The auditor should be guided by the results of the entity acceptance/continuance process, procedures per- formed to gain the understanding of the entity, and preliminary engagement activities. The auditor should modify the overall audit strategy and the audit plan as necessary if circum- stances change significantly during the course of the audit. Additional steps that should be performed include:

∙ Assess business risks. ∙ Establish materiality. ∙ Consider multilocations. ∙ Assess the need for specialists. ∙ Consider violations of laws and regulations. ∙ Identify related parties. ∙ Consider additional value-added services. ∙ Document the overall audit strategy, audit plan, and prepare audit programs.

Assess Business Risks In Chapter 1, audit risk was defined as the risk that the auditor expresses an inappropriate audit report when the financial statements are materially misstated. One way that the auditor reduces audit risk to an acceptably low level is by obtaining an understanding of the entity and its environment. Based on this understanding, the auditor identifies those business risks that may result in material misstatements. The auditor then evaluates how the entity responds to those business risks and ensures that those responses have been adequately implemented. Based on this information, the auditor assesses the level of risk of material misstatement in the financial statement accounts. The risk of material misstatement is used to plan the audit- ing procedures to be performed. Chapter 4 provides a detailed discussion of the auditor’s risk assessment process.

Establish Materiality As discussed in Chapter 1, it is too costly for auditors to audit all transactions that occur within the entity. Thus, auditors consider materiality from a reasonable user perspec- tive and communicate to users that “the financial statements present fairly in all mate- rial respects.” The consideration of materiality is a matter of professional judgment and will vary across entities. During the planning of the audit, the auditor establishes a level of overall materiality for evaluating the financial statements as a whole. The auditor also

LO 3-7

Planning the Audit

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 79

mes32502_ch03_067-097.indd 79 10/14/15 02:03 PM

establishes tolerable misstatement—the amount of overall materiality used to plan and per- form audit procedures at the account or disclosure level.2 The last section in this chapter provides a comprehensive discussion of the process followed by the auditor in establishing materiality for the overall financial statements and tolerable misstatement for significant accounts or disclosures.

Consider Multilocations or Business Units Many entities have operations in multiple locations or operate many business units. As part of the planning process, the auditor determines which locations or business units are to be audited and the extent of audit procedures to be performed at the selected locations or busi- ness units. The auditor then assesses the risks of material misstatement to the consolidated financial statements associated with the location or business unit and correlates the amount of audit attention devoted to the location or business unit with the level of risk present. In audit- ing a company with operations in multiple locations or business units, the auditor needs to determine the extent to which audit procedures should be performed at selected locations or business units. See AS9 and AU-C 600 for more guidance on auditing an entity with multilo- cations and business units.

Assess the Need for Specialists A major consideration in planning the audit is the need for specialists. Auditing standards define an auditor’s specialist as an individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor in obtaining sufficient appropriate audit evidence. Examples include specialists in finance, tax, valuation, pension, and information technology (IT). Such specialists may assist the auditor with valuing financial instruments, determining physical quantities, valuing environmental liabilities, or interpreting regulations or contracts. The use of an IT specialist is a significant aspect of most audit engagements. In deciding whether an IT specialist is to be used, a primary concern is the extent to which IT is used in processing accounting informa- tion. The presence of complex information technology may require the use of an IT specialist. Chapter 6 covers these IT issues in more detail.

The auditor is still ultimately responsible for work performed by the specialist. In relying on the specialist, the auditor should evaluate the competence and objectivity of the specialist, audit the inputs used by the specialist (e.g., census data for actuaries) and reconcile the output (e.g., an estimate should be found in the financial statements or disclosures), and review the specialist’s work for reasonableness, including the reasonableness of assumptions.

Consider Violations of Laws and Regulations Violations of laws or regulations are referred to as illegal acts. The effect on the financial statements of laws and regulations varies considerably. In some instances, fraud may also consist of illegal acts (see Chapter 4). Auditing standards distinguish between illegal acts that have direct and material effects on the financial statements and those that have mate- rial but indirect effects. The auditor should consider laws and regulations that are generally recognized as having a direct and material effect on the determination of financial statement amounts. For example, tax laws and laws and regulations that may affect the amount of rev- enue recognized under a government contract fall into this category. Auditing standards state that the auditor’s responsibility for detecting illegal acts having a direct and material effect on the financial statements is the same as that for errors or fraud.

Other illegal acts, such as violations of the securities acts, environmental protection, equal employment regulations, and price-fixing or other antitrust violations, may materially

2Overall materiality is also referred to as planning materiality. The ASB’s standards refer to tolerable misstatement as performance materiality.

Final PDF to printer

80 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 80 10/14/15 02:03 PM

but indirectly affect the financial statements. The auditor should be aware that such illegal acts may have occurred. If specific information comes to the auditor’s attention that pro- vides evidence concerning the existence of such material but indirect illegal acts, the auditor should apply audit procedures specifically directed at determining whether illegal acts have occurred. However, an audit conducted in accordance with auditing standards provides no assurance that illegal acts will be detected or that any contingent liability that may result will be disclosed.

Stop and Think: Suppose your client was involved in mining coal. What laws or regu- lations might be applicable?

When an entity’s business has direct impacts on the environment (e.g., mining, forestry, nuclear power) certainly the auditor would want to understand the potential implication on the audit of state and federal environmental regulations.

Table 3–3 presents some examples of specific information or circumstances that indi- cate the possibility of an illegal act. For example, the business world has seen a number of instances where payments of sales commissions or agent’s fees were really bribes to secure contracts. When the auditor becomes aware of such a possible illegal act, he or she should obtain an understanding of the nature of the act, the circumstances in which it occurred, and sufficient other information to evaluate its effects on the financial statements. The auditor should then discuss the matter with the appropriate level of management. If management does not provide satisfactory information, the auditor should consult with the entity’s legal counsel and apply additional audit procedures, if necessary.

If an illegal act has occurred or is likely to have occurred, the auditor should consider its implications for other aspects of the audit, particularly the reliability of management represen- tations. The auditor should ensure that the audit committee or those charged with governance are adequately informed about significant illegal acts. The auditor should also recognize that, under the circumstances noted previously, he or she may have a duty to notify parties outside the entity.

Identify Related Parties3

It is important for the auditor to evaluate the entity’s identification of, accounting for, and disclosure of transactions with related parties.4 Auditors should attempt to identify all related parties during the planning phase of the audit. It is important to identify related party trans- actions because the transaction may not be “at arm’s length.” For example, the entity may

3See E. A. Gordon, E. Henry, T. J. Louwers, and B. J. Reed, “Auditing Related Party Transactions: A Literature Overview and Research Synthesis,” Accounting Horizons (March 2007), pp. 81–102 for a review of research on related parties. 4See FASB ASC Topic 850, “Related Party Disclosures,” for a detailed definition of related parties.

Information or Circumstances That May Indicate an Illegal Act

Unauthorized transactions, improperly recorded transactions, or transactions not recorded in a complete or timely manner.

An investigation by a government agency, an enforcement proceeding, or payment of unusual fines or penalties. Violations of laws or regulations cited in reports of examinations by regulatory agencies. Large payments for unspecified services to consultants, affiliates, or employees. Sales commissions or agents’ fees that appear excessive. Large payments in cash or bank cashiers’ checks. Unexplained payments to government officials. Failure to file tax returns or pay government duties.

T A B L E 3 – 3

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 81

mes32502_ch03_067-097.indd 81 10/14/15 02:03 PM

buy or sell goods or services at prices that differ significantly from prevailing market prices. The auditor should understand the entity’s controls for identifying related parties, authoriz- ing and approving related party transactions, and accounting for and disclosing related party transactions. The auditor also needs to inquire of management about the names of related parties, the nature of the relationships, the types of transactions, and the reasons for entering into the transactions with the related parties. Some other sources of information on related parties include

∙ Minutes of the board of directors meetings. ∙ Conflict-of-interest statements from management and others. ∙ Financial and reporting information provided to creditors, investors, and regulators. ∙ Contracts or other agreements (including side agreements that may not be formally

documented between customers and vendors, and management). ∙ Contracts and other agreements representing significant unusual transactions.

Once related parties have been identified, audit personnel should be provided with their names so that transactions with such parties are identified and investigated.

Stop and Think: What are examples of additional related parties and how might the auditor identify them?

An example might be a partnership composed of management who own a building leased by the entity. The auditor might detect such a related party transaction by examining the lease agreement.

Consider Additional Value-Added Services As part of the planning process, the auditor should look for opportunities to recommend additional value-added services. Traditionally, value-added services have included tax planning, system design and integration, and internal reporting processes. With auditors taking a more global view of the entity and its environment, there are opportunities to provide valuable services for the entity. For example, the assurance services (introduced in Chapter 2 and discussed in more detail in Chapter 21) include risk assessment, busi- ness performance measurement (benchmarking), and electronic commerce. The auditor also can provide recommendations based on the assessment of the entity’s business risks. With the knowledge gathered through assessing business risks, the auditor can provide important feedback to management and the board of directors on the strengths and weak- nesses of business processes, strategic planning, and emerging trends. Proper consideration of value-added services during the planning process should alert the audit team to proac- tively identify opportunities to improve client service. Of course, auditors who audit public companies are limited in the types of consulting services they can offer their audit clients (see Chapter 19).

Document the Overall Audit Strategy, Audit Plan, and Prepare Audit Programs The auditor should document the audit strategy and audit plan. This involves documenting the decisions about the nature, timing, and extent of audit tests. At this stage, the auditor compiles his or her knowledge about the entity’s business objectives, strategies, and related business and audit risks. The auditor records how the entity is managing its risks (i.e., through internal control processes) and then documents the effect of the risks and controls on the planned audit procedures. Auditors ensure they have addressed the risks they identified in their understand- ing of the risk assessment process by documenting the linkage from the entity’s business

Final PDF to printer

82 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 82 10/14/15 02:03 PM

A Partial Audit Program for Substantive Procedures Testing of Accounts Receivable

Audit procedures W/P Ref. Completed by Date

1. Obtain the December 31, 2015, aged accounts receivable trial balance and ________________ ________________ ________________ a. Foot the trial balance and agree total to accounts receivable

control account. ________________ ________________ ________________

b. Randomly select 30 accounts from the aged trial balance; agree the information per the aged trial balance to the original sales invoice and determine if the invoice was included in the appropriate aging category.

________________ ________________ ________________

2. Confirm a sample of accounts receivable ________________ ________________ ________________ a. For all responses with exceptions, follow up on the cause

of the error. ________________ ________________ ________________

b. For all nonresponses, examine subsequent cash receipts and/or supporting documents.

________________ ________________ ________________

c. Summarize the sampling test results. ________________ ________________ ________________ d. Summarize the confirmation results. ________________ ________________ ________________ 3. Test sales cutoff by identifying the last shipping advice for the year

and examining five large sales for three days before and after year-end. ________________ ________________ ________________

4. Test the reasonableness of the allowance for doubtful accounts by the following:

________________ ________________ ________________

a. the reasonableness using past percentages on bad debts. ________________ ________________ ________________ b. For any large account in the aged trial balance greater than

90 days old, test for subsequent cash receipts. ________________ ________________ ________________

5. Prepare a memo summarizing the tests, results, and conclusions. ________________ ________________ ________________

E X H I B I T 3 – 2

objectives and strategy to audit plans. The form of documentation varies from firm to firm, but a simple illustration using EarthWear might look as follows:

Business Objectives and Strategy Business Risks Account(s): Assertions Audit Risks Controls Effect on Audit Plan

Increase market share through sales at new international locations (e.g., during the current year websites were developed for France, Italy, Ireland, and several eastern European countries).

Restrictive trade laws may affect sales tactics.

Strong consumer protection laws in European countries

Political instability in less developed countries (LDCs)

Revenue: accuracy and valuation.

Reserve for returns: completeness

Overstated due to pricing issues

Understated due to failure to properly track returns in new locations

EwC has installed a special group to track compliance with local and international laws.

EwC has placed more frequent review of returns in new locations.

Observe and test group’s policies and procedures (see workpaper R-11).

Extend audit work on EwC’s return tracking with emphasis on new locations (see workpaper R-15).

Foreign currency risks

Gains/losses from currency hedging: valuation and accuracy

Gains/losses not properly calculated or accrued on hedging activity

EwC has strong controls in the Treasury Department to account for hedging activities.

Increase the number of hedging contracts tested with particular emphasis on con- tracts in currencies from LDCs (see workpaper S-14).

Audit programs containing specific audit procedures are also prepared. Exhibit 3–2 pres- ents a partial audit program for substantive tests of accounts receivable. The types of audit tests are discussed in the next section.

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 83

mes32502_ch03_067-097.indd 83 10/14/15 02:03 PM

There are three general types of audit tests:

∙ Risk assessment procedures. ∙ Tests of controls. ∙ Substantive procedures.

Risk Assessment Procedures Auditor risk assessment procedures are used to obtain an understanding of the entity and its environment, including its internal control. Risk assessment procedures include inquiries of management and others, preliminary analytical procedures, and observation and inspection. Such procedures are used to assess the risks of material misstatement at the financial state- ment and assertion levels. Risk assessment procedures are covered in depth in Chapter 4.

Tests of Controls Tests of controls are audit procedures performed to test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the relevant assertion level. The following audit procedures are examples of tests of controls:

∙ Inquiries of appropriate management, supervisory, and staff personnel. ∙ Inspection of documents, reports, and electronic files. ∙ Observation of the application of specific controls. ∙ Walkthroughs, which involve tracing a transaction from its origination to its inclusion

in the financial statements through a combination of audit procedures, including inquiry, observation, and inspection.

∙ Reperformance of the application of the control by the auditor.

LO 3-9

Supervision of the Audit

An important part of the planning and conduct of the audit is appropriate supervision of audit personnel. The engagement partner has the overall responsibility for the engagement and its performance and should supervise the audit engagement team so that the work is performed as directed and supports the conclusions reached. The engagement partner and other engage- ment team members performing supervisory activities should

∙ Inform engagement team members of their responsibilities, including ∙ the objectives of the procedures that they are to perform; ∙ the nature, timing, and extent of procedures they are to perform; and ∙ matters that could affect the procedures to be performed or the evaluation of the

results of those procedures. ∙ Direct engagement team members to bring any significant accounting and auditing

issues they identify to the attention of the engagement partner or other engagement team members performing supervisory activities so they can evaluate those issues and determine appropriate actions.

∙ Review the work of engagement team members to evaluate whether ∙ the work was performed and documented; ∙ the objectives of the procedures were achieved; and ∙ the results of the work support the conclusions reached.

Proper supervision should help ensure that the audit is conducted in accordance with audit- ing standards.

LO 3-8

Types of Audit Tests

Final PDF to printer

84 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 84 10/14/15 02:03 PM

For example, in evaluating the design of an IT application control and determining whether it has been implemented, the auditor may make inquiries of entity personnel and inspect relevant systems documentation, reports, or other documents. Table 3–4 provides examples of controls that are normally present in the processing of revenue transactions and tests of controls that the auditor might use to test the operating effectiveness of the controls. Tests of controls are covered in more depth in Chapter 6.

Substantive Procedures Substantive procedures are designed to detect material misstatements (that is, monetary errors) in a class of transactions, account balance, and disclosure component of the finan- cial statements. There are two categories of substantive procedures: (1) tests of details and (2) substantive analytical procedures.

Tests of Details Tests of details are usually categorized into two types: (1) substantive tests of transactions and (2) tests of details of account balances and disclosures. Substantive tests of transactions test for errors or fraud in individual transactions. For example, an auditor may examine a large purchase of inventory by testing that the cost of the goods included on the vendor’s invoice for that purchase is properly recorded in the inventory and accounts pay- able accounts. Tests of details of account balances and disclosures focus on the items that are contained in the ending financial statement account balances and disclosures. For example, the auditor may want to test accounts receivable. To test the details of the balance of accounts receivable, the auditor will likely send confirmations to a sample of customers.

Substantive Analytical Procedures The term analytical procedures means evalua- tions of financial information through analysis of plausible relationships (e.g., examination of trends and ratios) among both financial and nonfinancial data. Analytical procedures also encompass the investigation, if necessary, of identified fluctuations or relationships that are inconsistent with other relevant information or that differ from expected values by a signifi- cant amount. Substantive analytical procedures are discussed in more detail in Chapter 5.

Dual-Purpose Tests Tests of controls check the operating effectiveness of controls, while substantive tests of transactions are concerned with monetary misstatements. However, it often makes sense to design audit procedures to conduct both a test of controls and a substantive test of transactions simultaneously on the same document. For example, in Table 3–4, the last control procedure shown is agreement of sales invoices to shipping documents and customer orders for product type, price, and quantity. The test of controls shown is to recompute the information on a sam- ple of sales invoices. While this test primarily checks the effectiveness of the control, it also provides evidence on whether the sales invoice contains the wrong quantity, product type, or price. Dual-purpose tests can also improve the efficiency of the audit.

Examples of Internal Controls and Tests of Controls

Internal Controls Tests of Controls

Create a separation of duties between the shipping function and the order entry and billing functions.

Observe and evaluate whether shipping personnel have access to the order entry or billing activities.

Credit Department personnel initial sales orders, indicating credit approval.

Inspect a sample of sales orders for presence of initials of Credit Department personnel.

Billing Department personnel account for the numerical sequence of sales invoices.

Inquire of Billing Department personnel about missing sales invoice numbers.

Agree sales invoices to shipping document and customer order for product types, price, and quantity.

Recompute the information on a sample of sales invoices.

T A B L E 3 – 4

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 85

mes32502_ch03_067-097.indd 85 10/14/15 02:03 PM

This text discusses tests of controls within each business process. We discuss substantive tests of transactions along with other substantive tests pertaining to each business process. You should remember, however, that in most audit situations substantive tests of transactions are conducted at the same time as tests of controls.

5See W. F. Messier, Jr., N. Martinov, and A. Eilifsen, “A Review and Integration of Empirical Research on Material- ity: Two Decades Later,” Auditing: A Journal of Theory & Practice (November 2005), pp. 153–87, for a discussion of materiality research.

Materiality5

An important part of audit planning is to determine overall materiality for the financial state- ments (also referred to as planning materiality) and to decide on tolerable misstatement (also referred to as performance materiality) for significant accounts or disclosures. These deter- minations are an important aspect of developing an overall audit strategy and a detailed audit plan. As mentioned in Chapter 1, it is not cost-efficient to perform an audit that catches every misstatement no matter how small. Thus, the auditor designs the audit to provide reasonable assurance of detecting misstatements that are of sufficient magnitude to affect the judgment of reasonable financial statement users.

The auditor’s consideration of materiality on an audit is a matter of professional judgment. Materiality is assessed in terms of the potential effect of a misstatement on decisions made by a reasonable user of the financial statements. Both the PCAOB and ASB follow a user per- spective in considering what is material. The PCAOB focuses mainly on protecting investors and uses the Supreme Court of the United States interpretation of the federal securities laws, which state that a fact is material if there is “a substantial likelihood that the . . . fact would have been viewed by the reasonable investor as having significantly altered the ‘total mix’ of information made available.” The PCAOB further notes that the Supreme Court has stated that the determination of materiality requires “delicate assessments of the inferences a ‘reasonable shareholder’ would draw from a given set of facts and the significance of those inferences to him . . .” (AS11 ¶ 2).”6 Both the PCAOB and ASB perspectives require that the auditor assess the amount of misstatement that could affect a reasonable user’s decisions. The ASB auditing standard on materiality (AU-C 320.04) provides further guidance to auditors in assessing the effects of a misstatement on the economic decisions of users. Users are assumed to

∙ Have a reasonable knowledge of business and economic activities and accounting and a willingness to study the information in the financial statements with a reasonable diligence.

∙ Understand that financial statements are prepared and audited to levels of materiality. ∙ Recognize the uncertainties inherent in the measurement of amounts based on the use

of estimates, judgment, and the consideration of future events. ∙ Make appropriate economic decisions on the basis of the information in the financial

statements.

The determination of materiality, therefore, takes into account how users with such charac- teristics could reasonably be expected to be influenced in making economic decisions. It is important to note that the opinion paragraph of the auditor’s report states that the financial statements present fairly, “in all material respects.” This phrase communicates to third parties that the audit report is limited to material information.

The following sections present an approach to assessing materiality that is based on auditing standards and current audit practice.7 The approach provides the reader with a basic framework for understanding the consideration of materiality in an audit.

LO 3-10

6 TSC Industries v. Northway, Inc., 426 U.S. 438, 449 (1976). 7See A. Eilifsen and W. F. Messier, Jr. “Materiality Guidance of the Major Public Accounting Firms.” Auditing: A Journal of Practice & Theory (May 2015), pp. 3–26.

Final PDF to printer

86 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 86 10/14/15 02:03 PM

Steps in Applying Materiality Figure 3–2 presents the three major steps in the application of materiality to an audit. Steps 1 and 2 are normally performed early in the engagement as part of planning the audit (see Figure 1–4 in Chapter 1). Step 3 is performed usually just prior to, or when the auditor evalu- ates the evidence at the completion of the audit to determine if it supports the fair presentation of the financial statements (again, refer to Figure 1–4).

Step 1: Determine Overall Materiality Auditing standards require the auditor to estab- lish a materiality amount for the financial statements as a whole, but they do not provide spe- cific guidance on how to determine overall materiality. The PCAOB’s guidance states that the auditor should consider “the company’s earnings and other relevant factors,” while the ASB provides additional benchmarks. Overall materiality is the maximum amount by which the auditor believes the financial statements could be misstated and still not affect the decisions of users. Materiality, however, is a relative, not an absolute, concept. For example, $5,000 might be considered highly material for a small sole proprietorship, but this amount would clearly be immaterial for a large multinational corporation. Thus, the relative size of the company being audited affects overall materiality.

Table 3–5 provides examples of benchmarks and relevant percentages to apply to those benchmarks based on current practice.

For public companies, firms typically use 2–5 percent of income before taxes. For non- public companies, income before taxes is also used for profit-oriented entities with stable

LO 3-11

Step 2

Step 1

Step 3 Evaluate

audit findings.

Determine overall materiality.

Determine tolerable misstatement.

Steps in Applying Materiality on an AuditF I G U R E 3 – 2

Common Quantitative Benchmarks and Relevant Percentages Used for Establishing Overall Materiality

Benchmark Relevant Percentages

Income (Loss) before income taxes 3–10

Total assets .25–2 Total revenues .5–5 Net assets 3–5 Total equity 1–5

T A B L E 3 – 5

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 87

mes32502_ch03_067-097.indd 87 10/14/15 02:03 PM

earnings, but other benchmarks might be appropriate. A common rule of thumb in practice is to use 5 percent of income before taxes. However, if current year pretax income is not stable, auditors might use “normalized earnings”—an average of the previous three years’ pretax income, or another benchmark (e.g., total assets or total revenues). Difficulties also arise in using income as a benchmark when the entity is close to breaking even or experiencing a loss. For example, suppose that an entity has income before taxes of $3,000,000 one year and the auditor decides that 5 percent of that amount, $150,000, would be material. The scope of the audit in that year would be based on a overall materiality of $150,000. Suppose, in the follow- ing year, the entity’s income before taxes falls to $250,000 due to a temporary decrease in sales prices for its products. If the auditor uses the 5 percent factor, the overall materiality would be $12,500 ($250,000 × .05), and a much more extensive audit would be required. Thus, with fluctuating net income, using an average of the prior three years’ income or another base such as total assets or total revenues may provide a more stable benchmark from year to year.

For not-for-profit entities, total revenues or total assets might be more appropriate bench- marks. Last, for asset-based entities (e.g., investment funds), the auditor might use net assets as a benchmark.

In deciding the appropriate percentage to apply to a selected benchmark, the auditor would chose a lower percentage within the range for qualitative factors such as:

∙ Material misstatements in prior years; ∙ High risk of fraud; ∙ The entity is close to violating a covenant in a loan agreement; ∙ Small amounts may cause the entity to miss forecasted revenues or earnings, or affect

the trend in earnings; ∙ The entity operates in a volatile business environment, has complex operations

(multilocations), or operates in a highly regulated industry.

Step 2: Determine Tolerable Misstatement The auditor should determine tolerable misstatement at an amount or amounts that reduce to an appropriately low level the prob- ability that the total of uncorrected and undetected misstatements would result in material misstatement of the financial statements. The purpose of setting tolerable misstatement is to establish a scope for the audit procedures for the individual account balance or disclosures. Because of the many factors involved, there is no required or optimal method for establishing materiality for an account balance or class of transactions.

In practice, auditors commonly set tolerable misstatement for each account at between 50 and 75 percent of overall materiality. The firms also provide guidance to assist their auditors in determining the appropriate percentage to use within the range. In addition to the factors men- tioned above for setting the percentage for overall materiality, firm guidance includes the fol- lowing factors that would cause the auditor to use a lower percentage for tolerable misstatement:

∙ High risk of misstatement within the account balance, class of transaction, or disclosure; ∙ Increased number of accounting issues that require significant judgment and/or more

estimates with high estimation uncertainty; ∙ A history of material weaknesses, significant deficiencies, and/or a high number of

deficiencies in internal control; ∙ High turnover of senior management or key financial reporting personnel.

Obviously, using 50 to 75 percent of overall materiality results in an amount of total com- bined tolerable misstatement that is greater than overall materiality. Some firms cap the size of combined or aggregated tolerable misstatement to a multiple of overall materiality. For exam- ple, combined tolerable misstatement can be up to a multiple of four times overall materiality.

There are a number of reasons why an amount of combined tolerable misstatement greater than materiality makes sense from an audit planning perspective:

∙ Not all accounts will be misstated by the full amount of their tolerable misstatement allocation.

Final PDF to printer

88 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 88 10/14/15 02:03 PM

∙ Audits of the individual accounts are conducted simultaneously (typically by different members of the audit team). If accounts were audited sequentially, unadjusted misstatements observed during testing would count against materiality and theoretically the auditor could carry the unused portion of materiality to the next account and so forth.

∙ Materiality as a percentage of large accounts, such as inventory; accounts receivable; revenues; or plant, property, and equipment, is often a very small fraction of the account (less than 2 percent), and the scope of planned auditor procedures will be sufficiently precise to identify significant misstatements.

∙ When errors are identified, the auditors typically perform additional procedures in that, and related, accounts.

∙ Overall financial statement materiality serves as a “safety net.” If individual unadjusted misstatements are less than tolerable misstatement, but aggregate to an amount greater than materiality, then (1) the audit client will need to make adjustments to decrease the unadjusted misstatements below materiality; (2) the auditor will need to perform more testing; and/or (3) the auditor will issue a qualified or adverse opinion.

Taken together, these points suggest that it would be inefficient for the auditor to simply subdivide materiality proportionally to each account. This would result in unnecessarily low tolerable misstatement levels. The lower the tolerable misstatement is, the more extensive is the required audit testing. In the extreme, if tolerable misstatement were very small or zero, the auditor would have to test every transaction making up an account. Imagine how a house inspector’s investigation and related costs would differ if she or he were asked to identify all potential problems greater than $2 versus a “tolerable damage” threshold of $2,000. Similarly, auditing standards recognize that an auditor works within economic limits, and for the audit opinion to be economically useful it must be completed in a reasonable length of time at rea- sonable costs.

Step 3: Evaluate Audit Findings Step 3 is completed near the end of the audit, when the auditor evaluates all the evidence that has been gathered. Based on the results of the audit pro- cedures conducted, the auditor aggregates misstatements from each account or disclosure. If the auditor’s judgment about materiality at the planning stage (Step 1) was based on the same information available at the evaluation stage (Step 3), materiality for both purposes would be the same. However, the auditor may identify factors or items during the course of the audit that cause a revision to the overall materiality. Thus, the overall materiality used to plan audit pro- cedures may differ from the materiality used in evaluating the audit findings. When this occurs, the auditor should carefully document the reasons for using a different materiality level.

When the aggregated misstatements are less than the overall materiality, the auditor can conclude that the financial statements are fairly presented. Conversely, when the aggregated misstatements are greater than overall materiality, the auditor should request that the entity adjust the financial statements. If the entity refuses to adjust the financial statements for the misstatements, the auditor should issue a qualified or adverse opinion because the financial statements do not present fairly in conformity with GAAP.

An Example In this example, the three steps for applying materiality are discussed using financial informa- tion for EarthWear Clothiers for the year ended December 31, 2015. This financial information is taken from the case illustration included in Chapter 1.

Step 1: Determine the Overall Materiality EarthWear Clothiers’ income before taxes is $36 million (rounded). Assume that the auditors, Willis & Adams, have decided that 5 percent of this benchmark is appropriate for overall materiality. Thus, they determine overall materi- ality to be $1,800,000 ($36,000,000 × .05). To determine the final amount for materiality, the

LO 3-12

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 89

mes32502_ch03_067-097.indd 89 10/14/15 02:03 PM

auditors should consider whether any qualitative factors (i.e., close to violating a covenant in a loan agreement) are relevant for the engagement. In our example, assume that the auditors have determined that no qualitative factors are relevant and that the $1,800,000 will be used for overall materiality. This is the amount that is used for determining tolerable misstatement for specific accounts or disclosures in Step 2.

Step 2: Determine Tolerable Misstatement We assume that EarthWear’s auditors determine tolerable misstatement by using 50 percent of overall materiality. Therefore, toler- able misstatement is $900,000 ($1,800,000 × .50).

Step 3: Evaluate Audit Findings Tolerable misstatement can be used for determining the fair presentation of the individual accounts after completion of the audit work. Assume that during the course of the audit the auditor identified four misstatements. The misstatements are compared to the tolerable misstatement allocated to each account. For example, the first mis- statement indicates a factual misstatement in the accrual of payroll expense and bonuses. The total misstatement of accrued payroll is $215,000. The second entry is based on the results of a statistical sampling application for inventory. The statistical results indicated there is a misstatement of $312,500. In this example, no error is larger than the tolerable misstatement amount of $900,000, and the total of the misstatements is also less than overall materiality. Before making a final decision, the auditor should consider the possibility of undetected mis- statements, further possible misstatements that may be due to sampling, and misstatements that carry forward from the prior year. The auditor should document his or her conclusion as to whether the aggregated misstatements cause the financial statements to be materially mis- stated (see Exhibit 3–3). If one of the entries were in excess of the tolerable misstatement for an account balance, or if the aggregated misstatements were greater than overall materiality, the entity would have to adjust the financial statements or the auditor would have to issue a qualified or adverse opinion.

Example Working Paper for Evaluating Detected Misstatements

EARTHWEAR CLOTHIERS

Schedule of Proposed Adjusting Entries 12/31/15

Workpaper Ref.

Proposed Adjusting Entry Assets Liabilities Equity Revenues Expenses

N10 Payroll expense 75,000 Bonuses 140,000 Accrued liabilities 215,000 To accrue payroll through 12/31

and recognize 2015 bonuses. F20 Cost of sales 312,500

Inventory (312,500) To adjust ending inventory

based on sample results. F22 Inventory 227,450

Accounts payable 227,450 To record inventory in transit

at 12/31. R15 Accounts receivable 79,850

Sales 79,850 To record sales cutoff errors

at 12/31. Total (5,200) 442,450 79,850 527,500

Tolerable Misstatement = $900,000 (50 percent of overall materiality). Conclusion: Based on the above analysis, the account balances for EarthWear Clothiers are fairly stated in accordance with GAAP.

E X H I B I T 3 – 3

Final PDF to printer

90 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 90 10/14/15 02:03 PM

KEY TERMS

Analytical procedures. Evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial data. Audit committee. A subcommittee of the board of directors that is responsible for the finan- cial reporting and disclosure process. Audit procedures. Specific acts performed as the auditor gathers evidence to determine if specific audit objectives are being met. Audit strategy. The auditor’s plan for the expected conduct, organization, and staffing of the audit. Auditor specialist. An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor in obtaining sufficient appropriate audit evidence. An auditor’s specialist may be either an audi- tor’s internal specialist (who is a partner or staff, including temporary staff, of the auditor’s firm or a network firm) or an auditor’s external specialist. Dual-purpose tests. Tests of transactions that both evaluate the effectiveness of controls and detect monetary errors. Engagement letter. A letter that formalizes the contract between the auditor and the entity and outlines the responsibilities of both parties. Illegal act. A violation of laws or government regulations. Internal audit function. An independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Overall materiality (Planning materiality). The maximum amount by which the auditor believes the financial statements could be misstated and still not affect the decisions of users. Substantive procedures. Audit procedures performed to test material misstatements in an account balance or disclosure component of the financial statements. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the relevant assertion level. Tests of details. Substantive tests that concentrate on the details of items contained in the account balance and disclosure. Tolerable misstatement (Performance materiality). The amount of the overall materiality that is used to establish a scope for the audit procedures for the individual account balance or disclosures.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 3-1 3-1 What types of inquiries about a prospective client should an auditor make to third parties?

LO 3-1 3-2 Who is responsible for initiating the communication between the predecessor and successor auditors? What type of information should be requested from the prede- cessor auditor?

LO 3-3, 3-4 3-3 What is the purpose of an engagement letter? List the important information that the engagement letter should contain.

LO 3-5 3-4 What factors should an external auditor use to assess the objectivity and competence of internal auditors?

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 91

mes32502_ch03_067-097.indd 91 10/14/15 02:03 PM

LO 3-6 3-5 What is an audit committee and what are its responsibilities? LO 3-7 3-6 List the matters an auditor should consider when developing an audit plan. LO 3-7 3-7 Distinguish between illegal acts that are “direct and material” and those that are

“material but indirect.” List five circumstances that may indicate that an illegal act has occurred.

LO 3-7 3-8 What are some of the sources of information that may be used to identify transac- tions with related parties?

LO 3-8 3-9 What actions should the engagement team members be informed of by the engage- ment partner and other engagement team members as part of their supervisory role?

LO 3-9 3-10 What are the three general types of audit tests? Define each type of audit test and give two examples.

LO 3-10, 3-11 3-11 Why is it important for CPA firms to develop policies and procedures for establish- ing materiality?

LO 3-10, 3-11 3-12 List and describe the three major steps in applying materiality to an audit. LO 3-10, 3-11 3-13 While net income before taxes is frequently used for calculating overall materiality,

discuss circumstances when total assets or revenues might be better bases for calcu- lating overall materiality.

LO 3-10, 3-11 3-14 Give three examples of qualitative factors that might affect the auditor’s choice of the percentage to apply to the benchmark used to establish overall materiality.

LO 3-10, 3-11 3-15 List four factors that would cause the auditor to use a lower percentage for establish- ing tolerable misstatement.

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 3-1 3-16 Before accepting an audit engagement, a successor auditor should make specific inquiries of the predecessor auditor regarding the predecessor’s

a. Awareness of the consistency in the application of generally accepted accounting principles between periods.

b. Evaluation of all matters of continuing accounting significance. c. Opinion of any subsequent events occurring since the predecessor’s audit report

was issued. d. Understanding as to the reasons for the change of auditors.

LO 3-4 3-17 A written understanding between the auditor and the entity concerning the auditor’s responsibility for fraud is usually set forth in a(n)

a. Internal control letter. b. Letter of audit inquiry. c. Management letter. d. Engagement letter.

LO 3-5 3-18 If the independent auditors decide that it is efficient to consider how the work per- formed by the internal auditors may affect the nature, timing, and extent of audit procedures, they should assess the internal auditors’

a. Competence and objectivity. b. Efficiency and experience. c. Independence and review skills. d. Training and supervisory skills.

LO 3-7 3-19 During the initial planning phase of an audit, a CPA most likely would a. Identify specific internal control activities that are likely to prevent fraud. b. Evaluate the reasonableness of the entity’s accounting estimates. c. Discuss the timing of the audit procedures with the entity’s management. d. Inquire of the entity’s attorney if it is probable that any unrecorded claims will

be asserted.

Final PDF to printer

92 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 92 10/14/15 02:03 PM

LO 3-6 3-20 As generally conceived, the audit committee of a publicly held company should be made up of

a. Representatives of the major equity interests (preferred stock, common stock). b. The audit partner, the chief financial officer, the legal counsel, and at least one

outsider. c. Representatives from the entity’s management, investors, suppliers, and

customers. d. Members of the board of directors who are not officers or employees.

LO 3-7 3-21 When planning an audit, an auditor should a. Consider whether the extent of substantive procedures may be reduced based on

the results of tests of controls. b. Determine overall materiality for audit purposes. c. Conclude whether changes in compliance with prescribed internal controls justify

reliance on them. d. Evaluate detected misstatements.

LO 3-7 3-22 Which of these statements concerning illegal acts by clients is correct? a. An auditor’s responsibility to detect illegal acts that have a direct and material

effect on the financial statements is the same as that for errors and fraud. b. An audit in accordance with generally accepted auditing standards normally

includes audit procedures specifically designed to detect illegal acts that have an indirect but material effect on the financial statements.

c. An auditor considers illegal acts from the perspective of the reliability of manage- ment’s representations rather than their relation to audit objectives derived from financial statement assertions.

d. An auditor has no responsibility to detect illegal acts by clients that have an indi- rect effect on the financial statements.

LO 3-8 3-23 The engagement partner and manager review the work of engagement team mem- bers to evaluate which of the following?

a. The work was performed and documented. b. The objectives of the procedures were achieved. c. The results of the work support the conclusions reached. d. All of the above are correct.

LO 3-10, 3-11 3-24 Tolerable misstatement is a. The amount of misstatement that management is willing to tolerate in the finan-

cial statements. b. Materiality for the balance sheet as a whole. c. Materiality for the income statement as a whole. d. Materiality used to establish a scope for the audit procedures for the individual

account balance or disclosures.

LO 3-11, 3-12 3-25 Which of the following would an auditor most likely use in determining overall materiality when planning the audit?

a. The anticipated sample size of the planned substantive tests. b. The entity’s income before taxes for the period-to-date (e.g., 6 months). c. The results of tests of controls. d. The contents of the engagement letter.

PROBLEMS All applicable problems are available with Connect.

LO 3-1 3-26 The audit committee of the board of directors of Rebel Corporation asked Tish & Field, CPAs, to audit Rebel’s financial statements for the year ended December 31, 2015.

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 93

mes32502_ch03_067-097.indd 93 10/14/15 02:03 PM

Tish & Field explained the need to make an inquiry of the predecessor auditor and requested permission to do so. Rebel’s management agreed and authorized the pre- decessor auditor to respond fully to Tish & Field’s inquiries.

Required: a. What information should Tish & Field obtain during its inquiry of the predeces-

sor auditor prior to accepting the engagement? b. What additional audit procedures should Tish & Field perform in evaluating

Rebel as a potential client?

(AICPA, adapted)

LO 3-2, 3-3, 3-7 3-27 Parker is the in-charge auditor for the upcoming annual audit of FGH Company, a continuing audit client. Parker will supervise two assistants on the engagement and will visit the entity before the fieldwork begins.

Parker has completed the engagement letter and established an understanding with the Chief Internal Auditor on the assistance to be provided by the internal audit function.

Required: List the preliminary engagement and planning activities that Parker needs to complete.

(AICPA, adapted)

LO 3-3, 3-4 3-28 A CPA has been asked to audit the financial statements of a publicly held company for the first time. All preliminary verbal discussions and inquiries among the CPA, the company, the predecessor auditor, and all other necessary parties have been com- pleted. The CPA is now preparing an engagement letter.

Required: a. List the items that should be included in the typical engagement letter in these

circumstances. b. Describe the benefits derived from preparing an engagement letter.

(AICPA, adapted)

LO 3-6 3-29 Section 301 of the Sarbanes-Oxley Act requires that public companies have an audit committee. Independent auditors are increasingly involved with audit committees.

Required: a. Describe what an audit committee is. b. Identify the reasons why audit committees have been formed and are currently in

operation. c. Describe the functions of an audit committee.

(AICPA, adapted)

LO 3-11, 3-12 3-30 Suppose that you are the auditor of a major retail client who has reported the fol- lowing income before taxes (IBT) for the first two quarters of the year: 1st quarter = $1,200,000 and 2nd quarter = $1,500,000. You are in the process of establishing overall materiality for the client. Based on prior years, the client has a 10% decline in IBT from the 2nd quarter to the 3rd quarter. You also know that IBT in the 4th quarter increases by 25% over the 3rd quarter.

Required: Determine the amount of overall materiality for the audit based on these preliminary amounts.

Final PDF to printer

94 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 94 10/14/15 02:03 PM

LO 3-11, 3-12 3-31 For each of the following scenarios, perform the three steps in the materiality pro- cess: (1) determine overall materiality, (2) determine tolerable misstatement, and (3) evaluate the audit findings.

Scenario 1: Murphy & Johnson is a privately owned manufacturer of small motors for lawn- mowers, tractors, and snowmobiles. The components of its financial statements are (1) income before taxes = $21 million, (2) total assets = $550 million, and (3) total revenues = $775 million.

a. Determine overall materiality, and determine tolerable misstatement. Justify your decisions.

b. During the course of the audit, Murphy & Johnson’s CPA firm detected two mis- statements that aggregated to an overstatement of income of $1.25 million. Evalu- ate the audit findings. Justify your decisions.

Scenario 2: Delta Investments provides a group of mutual funds for investors. The components of its financial statements are (1) income before taxes = $40 million, (2) total assets = $4.3 billion, and (3) total revenues = $900 million.

a. Determine overall materiality, and determine tolerable misstatement. Justify your decisions.

b. During the course of the audit, Delta’s CPA firm detected two misstatements that aggregated to an overstatement of income of $5.75 million. Evaluate the audit findings. Justify your decisions.

Scenario 3: Swell Computers is a public company that manufactures desktop and laptop com- puters. The components of the financial statements are (1) income before taxes = $500,000, (2) total assets = $2.2 billion, and (3) total revenues = $7 billion.

a. Determine overall materiality and tolerable misstatement. Justify your decisions. b. During the course of the audit, Swell’s CPA firm detected one misstatement that

resulted in an overstatement of income by $1.5 million. Evaluate the audit find- ings. Justify your decisions.

LO 3-11, 3-12 3-32 You are the audit manager for Ken-Ron Enterprises. Your firm has been the entity’s auditor for 15 years. Your firm normally uses a range of 3% to 5% of income before taxes to calculate overall materiality and 50–75% of overall materiality to calculate tolerable misstatement. Ken-Ron has reported the following financial statement data (in millions) for the last four years:

2015 2014 2013 2012

Income before taxes 105* 584 520 453

Total assets 23,422 16,137 13,239 11,966

Total revenues 20,272 13,289 9,189 8,984

*Note that the significant decline in income before taxes in 2015 is due to a large non- recurring charge.

Required: a. If you planned on using income before taxes as the benchmark to compute overall

materiality and tolerable misstatement, how would you compute those amounts for 2015? Prepare and justify your calculations.

Final PDF to printer

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality 95

mes32502_ch03_067-097.indd 95 10/14/15 02:03 PM

b. Determine overall materiality and tolerable misstatement using either total assets or total revenues as the benchmark. Make the calculations by utilizing both .25% and 2%, the endpoints of the range that your firm’s guidance provides.

c. Assume that during the course of the 2015 audit you discovered misstatements totaling $50 million (approximately 50% of the 2015 income before taxes of $105 million). Discuss whether this amount of misstatement is material given your benchmark calculations from parts a. and b. above.

DISCUSSION CASE

LO 3-7, 3-9 3-33 Forestcrest Woolen Mills is a closely held North Carolina company that has existed since 1920. The company manufactures high-quality woolen cloth for men’s and women’s outerwear. Your firm has audited Forestcrest for 15 years.

Five years ago, Forestcrest signed a consent decree with the North Carolina Environmental Protection Agency. The company had been convicted of dumping pollutants (such as bleaching and dyeing chemicals) into the local river. The con- sent decree provided that Forestcrest construct a water treatment facility within eight years.

You are conducting the current-year audit, and you notice that there has been vir- tually no activity in the water treatment facility construction account. Your discus- sion with the controller produces the following comment: “Because of increased competition and lower sales volume, our cash flow has decreased below normal lev- els. You had better talk to the president about the treatment facility.”

The president (and majority shareholder) tells you the following: “Given the cur- rent cash flow levels, we had two choices: lay off people or stop work on the facility. This is a poor rural area of North Carolina with few other job opportunities for our people. I decided to stop work on the water treatment facility. I don’t think that the state will fine us or close us down.” When you ask the president if the company will be able to comply with the consent decree, he informs you that he is uncertain.

Required: a. Discuss the implications of this situation for the audit and audit report. b. Would your answer change if these events occurred in the seventh year after the

signing of the consent decree?

INTERNET ASSIGNMENTS

LO 3-1 3-34 While it is a relatively rare event, companies do change auditors. Use the Internet to identify an auditor change? Pick one auditor change and investigate the information pro- vided by management and the auditor for the reasons for the change. Information may be found at www.auditanalytics.com/blog or www.auditorcarousel.wordpress.com and www.sec.org.

LO 3-5 3-35 Visit the Institute of Internal Auditors (IIA) home page (www.theiia.org) and famil- iarize yourself with the information contained there. Search the site for informa- tion about the IIA’s requirements for the objectivity and independence of internal auditors.

LO 3-7 3-36 EarthWear Clothiers makes high-quality clothing for outdoor sports. It sells most of its products through mail order. Use the Internet to obtain information about the retail mail-order industry.

Final PDF to printer

96 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch03_067-097.indd 96 10/14/15 02:03 PM

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

HANDS-ON CASES

Client Acceptance Willis and Adams’ staff partially completed the client acceptance/continuance forms for EarthWear, but there are a few more considerations that need to be made. After completing the remaining assessments using the background infor- mation provided, you will evaluate the continuance decision for EarthWear as an audit client.

Visit Connect for additional student resources to find a detailed description of the case and to download required materials.

Audit Planning Memo Willis and Adams is beginning to prepare the audit planning memo for the upcoming audit of EarthWear. You have been asked to research a few aspects of EarthWear’s business that will aid in the planning process. You will also evaluate the results of some of the preliminary analytical procedures that were calculated to aid in assessing risk.

Visit Connect to find a detailed description of the case and to download required materials.

Materiality and Tolerable Misstatement Using Willis and Adams’ guidelines and EarthWear’s unaudited financial statements, you will determine overall plan- ning materiality and then allocate tolerable misstatement to accounts.

Visit Connect to find a detailed description of the case and to download required materials.

EarthWear Online

Final PDF to printer

mes32502_ch03_067-097.indd 97 10/14/15 02:03 PM

Final PDF to printer

mes32502_ch04_098-127.indd 98 09/30/15 02:39 PM

CHAPTER

4 4-1 Understand the concept of audit risk. 4-2 Learn the form and components of the audit risk model. 4-3 Understand how to use the audit risk model. 4-4 Understand the auditor’s risk assessment process. 4-5 Learn how the auditor assesses the risk of material

misstatement. 4-6 Understand the fraud risk assessment process.

4-7 Learn how to respond to the results of the risk assessments.

4-8 Learn how to evaluate the results of the audit tests. 4-9 Understand the documentation requirements for risk

assessments and responses. 4-10 Learn the auditor’s communication requirements about

fraud to management, the audit committee, and others.

AU 240-C, Consideration of Fraud in a Financial Statement Audit AU 250-C, Consideration of Laws and Regulations in an Audit of Financial Statements AU 530-C, Audit Sampling AU 540-C, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU 580-C, Written Representations PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 8, Audit Risk (AU-C 200) PCAOB Auditing Standard No. 9, Audit Planning (AU-C 300) PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement

PCAOB Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit (AU-C 320) PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 14, Evaluating Audit Results (AU-C 450) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500) PCAOB Auditing Standard No. 16, Communications with Audit Committees Evaluating Audit Results (AU-C 260) PCAOB Auditing Standard No. 18, Related Parties (AU-C 550)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

mes32502_ch04_098-127.indd 99 09/30/15 02:39 PM

C hapter 1 discussed three fundamental concepts in conducting a finan- cial statement audit. Chapter 3 further explored the first important con- cept: materiality. This chapter goes into more depth with respect to

the second concept: audit risk. Chapter 5 will cover the third: audit evidence. Materiality and audit risk significantly impact the auditor’s evidence decisions. The auditor considers both concepts in planning the nature, timing, and extent of audit procedures and in evaluating the results of those procedures.

This chapter will help you understand the audit risk model and the audi- tor’s risk assessment process. The audit risk model serves as a framework for assessing audit risk. The auditor follows a risk assessment process to iden- tify the risk of material misstatement in the financial statement accounts. The risk of material misstatement is composed of two components of the audit risk model: inherent risk and control risk. The risk of material misstatement is used to determine the acceptable level of detection risk and to plan the auditing procedures to be performed. The auditor restricts audit risk at the account bal- ance or assertion level in such a way that, at the end of the engagement, he or she can express an opinion on the financial statements, taken as a whole, at an acceptably low level of audit risk.

Risk Assessment

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

100 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 100 09/30/15 02:39 PM

Audit risk is a fundamental concept that underlies the audit process. Because of the nature of audit evidence and the characteristics of management fraud, an auditor can only provide rea- sonable assurance, as opposed to absolute assurance, that the financial statements are free of material misstatement. Audit risk is defined as follows:

Audit risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated.

In simple terms, audit risk is the risk that an auditor will issue an unqualified opinion on materially misstated financial statements. The auditor should perform the audit to reduce audit risk to a sufficiently low level before expressing an opinion on the overall financial statements.

While the auditor is ultimately concerned with audit risk at the financial statement level, as a practical matter audit risk must be considered at the account balance and disclosure lev- els. We will use the term assertion to refer to consideration of audit risk at even lower levels.

LO 4-1

Audit Risk

Consideration of audit risk at the assertion level means that the auditor must consider the risk that he or she will conclude that an assertion for a particular account balance (e.g., existence of accounts receivable or inventory) or a particular disclosure (e.g., valuation of amounts disclosed in a footnote dealing with stock compensation) is fairly stated, when in fact it is materially misstated.

Thus, at the assertion level, audit risk consists of

1. The risk that the relevant assertions related to the account balances or disclosures contain misstatements that could be material to the financial statements (inherent risk and control risk).

2. The risk that the auditor will not detect such misstatements (detection risk).

In other words, audit risk is the combination of these components—that the entity’s finan- cial statements contain material misstatements and that the auditor fails to detect any such misstatements.

Achieved audit risk can be directly controlled by manipulating detection risk. The auditor manipulates detection risk by changing the scope (see Practice Insight) of the auditor’s test procedures. As the next section demonstrates, the audit risk model provides a framework for auditors to follow in planning audit procedures and evaluating audit results.

The Audit Risk Model The auditor considers audit risk at the relevant assertion level because this directly assists the auditor to plan the appropriate audit procedures for the accounts, transactions, or disclosures. The risk that the relevant assertions are misstated consists of two components:

∙ Inherent risk (IR). The susceptibility of an assertion in an account or disclosure to a misstatement due to error or fraud that could be material, either individually or when aggregated with other misstatements, before consideration of any related controls.

LO 4-2

Practice I N S I G H T

Assertions are expressed or implied representations by management regarding the recognition, measurement, presentation, and disclosure of information in the financial statements and related disclosures. For example, when the financial statements contain an account balance of $30 million for inventory, management is representing that the inventory exists and is properly valued

Practice I N S I G H T

When auditors use the term “scope” they are referring to the nature, timing, and extent of audit pro- cedures, where “nature” refers to the type of evidence; “timing” refers to when the evidence will be examined; and “extent” refers to how much of the type of evidence will be gathered.

Final PDF to printer

Chapter 4 Risk Assessment 101

mes32502_ch04_098-127.indd 101 09/30/15 02:39 PM

∙ Control risk (CR). The risk that a misstatement that could occur in an assertion about an account or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control.

The levels of inherent risk and control risk are functions of the entity and its environment. The auditor has little or no control over these risks. Auditing standards refer to the combina- tion of IR and CR as the risk of material misstatement (RMM). Some auditors refer to this combination as “client risk” because it stems from decisions made by the entity (e.g., what kinds of business transactions to engage in, how much to invest in internal controls, etc.).

∙ Detection risk (DR) is the risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will not detect a misstatement that exists and that could be material, either individually or when aggregated with other misstatements.

Detection risk is determined by the effectiveness of the audit procedures and how well the procedures are applied by the auditor. Detection risk is not reduced to zero because the auditor seldom examines 100 percent of the transactions in an account. As we discussed in Chapter 1 with the house inspector example, the auditor will examine a subset or sample of transactions. Furthermore, audit evidence is a collection of audit procedures, analysis, assess- ments, and professional judgment and such processes are subject to human error (sometimes referred to as nonsampling risk). In other words the auditor could reach an erroneous conclu- sion. Such professional judgment errors could be caused by the use of inappropriate audit procedures or misinterpretation of audit evidence and failure to recognize a misstatement or deviation. Of course, judgment errors can be reduced through adequate planning, proper assignment of audit staff to the engagement team, the application of professional skepticism, supervision and review of the audit work performed, and supervision and conduct of a firm’s audit practice in accordance with appropriate quality control standards.1

Stop and Think: How is detection risk related to inherent risk and control risk?

Detection risk has an inverse relationship to inherent risk and control risk. For example, if an auditor judges an entity’s inherent risk and control risk to be high, the auditor would accept a lower level of detection risk in order to achieve the planned level of audit risk. In the next section, you will learn that the auditor lowers achieved detection risk by performing additional audit procedures. Conversely, if inherent risk and control risk are low, the auditor can accept higher detection risk because there is a low likelihood that a material misstatement exists.

The audit risk model can be specified as

AR = RMM × DR

This model expresses the general relationship of audit risk to the auditor’s assessments of risk of material misstatement (inherent risk and control risk) and the risks that the auditor’s procedures will fail to detect a material misstatement in a relevant assertion (detection risk).

The determination of audit risk and the use of the audit risk model involve considerable judgment on the part of the auditor. The audit risk model assists the auditor in determining the scope of auditing procedures for an assertion in an account or disclosure. Auditing standards do not provide specific guidance on what is an acceptable level of audit risk.

At the completion of the audit, the actual or achieved level of audit risk is not known with certainty by the auditor. If the auditor assesses the achieved audit risk as being less than or equal to the planned level of audit risk, an unqualified report can be issued. If the assessment of the achieved level of audit risk is greater than the planned level, the auditor should either

1See T. B. Bell, M. E. Peecher, and I. Solomon, The 21st Century Public Company Audit: Conceptual Elements of KPMG's Global Audit Methodology (KPMG 2005) for a detailed discussion of the importance of recognizing the potential for such issues when conducting an audit.

Final PDF to printer

102 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 102 09/30/15 02:39 PM

conduct additional audit work or qualify/modify the audit report. In either case, the judgments involved are often highly subjective.

In addition to audit risk, an auditor is subject to engagement risk. Engagement risk is the risk that the auditor is exposed to financial loss or damage to his or her professional reputa- tion from litigation, adverse publicity, or other events arising in connection with the audited financial statements. For example, an auditor may conduct an audit in accordance with audit- ing standards and still be sued by the entity or a third party. Although the auditor has complied with professional standards and may ultimately win the lawsuit, his or her professional repu- tation may be damaged in the process by the negative publicity. Engagement risk cannot be directly controlled by the auditor, although some control can be exercised through the careful acceptance and continuance of clients.

Use of the Audit Risk Model The audit risk model is not intended to be a precise formula that includes all factors influenc- ing the assessment of audit risk. However, auditors find the logic that underlies the model useful when planning scoping decisions for audit procedures. The discussion that follows concerning the audit risk model is limited to its use as an audit planning tool. Three steps are involved in the auditor’s use of the audit risk model at the assertion level:

1. Setting a planned level of audit risk. 2. Assessing the risk of material misstatement. 3. Solving the audit risk equation for the appropriate level of detection risk.

In applying the audit risk model in this manner, the auditor assesses each component of the model using either quantitative or qualitative terms. In step 1, the auditor sets audit risk for each account balance or disclosure in such a way that, at the completion of the engagement, an opinion can be issued on the financial statements with an acceptably low level of audit risk. For publicly traded companies, auditors typically set planned audit risk at 5 percent or less. Step 2 requires that the auditor assess the risk of material misstatement (see Practice Insight above). To assess the risk of material misstatement, the auditor evaluates the entity’s business risks and how those business risks could lead to material misstatements. Figure 4–1 shows the relationship of the assessment of the entity’s business risks and risk of material misstatement to the audit risk model. The assessment of business risks is described in detail in the next two sections of the chapter. In step 3, the auditor determines the appropriate level of detection risk by solving the audit risk model as follows:

AR = RMM × DR

DR = AR/RMM

The auditor uses the planned level of detection risk to design the substantive audit procedures that will reduce audit risk to an acceptably low level. Consider the following numerical example:

Suppose that the auditor has determined that the planned audit risk for the accounts receivable bal- ance should be set at .05 based on the significance of the account to the financial statements. By establishing a relatively low level of audit risk, the auditor is minimizing the possibility that the account may contain a material misstatement. Assume further that the auditor assesses the risk of material misstatement for accounts receivable to be .60. Substituting the values for AR and RMM

LO 4-3

Practice I N S I G H T

Auditing standards allow the auditor to directly assess the risk of material misstatement (RMM) or to separately assess inherent risk (IR) and control risk (CR). This choice is typically built into each audit firm’s methodology.

Final PDF to printer

Chapter 4 Risk Assessment 103

mes32502_ch04_098-127.indd 103 09/30/15 02:39 PM

into the equation indicates that the auditor should set DR at approximately .08 (DR = .05/.60) for testing the accounts receivable balance. Thus, the auditor establishes the scope of the substantive audit procedures for accounts receivable so that there is only an 8 percent chance that a material misstatement, if present, is not detected.

Due to the subjectivity involved in judging the audit risk model’s components, many pub- lic accounting firms find it more appropriate to use qualitative terms, rather than percentages, in the model. For example, planned audit risk might be classified into two categories, very low and low. Auditing standards state that audit risk must be reduced to at least a low level. Likewise, the risk of material misstatement and detection risk might be classified into three categories (e.g., low, moderate, or high). The logic behind the audit risk model is the same whether the auditor uses percentages or qualitative terms. When using qualitative terms, audit risk is set using one of the category choices. Similarly, the auditor selects the category for the risk of material misstatement that is most appropriate under the circumstances. The specified combination of audit risk and risk of material misstatement is then used to determine the appropriate level of detection risk. Following are three examples of the use of a qualitative approach to the audit risk model.

Example AR RMM DR

1 Very low High Low 2 Low Moderate Moderate 3 Low Low High

Assess the entity’s business risks

Assess the risk of material misstatement (RMM)

Audit risk

RMM (Inherent risk × control risk)

Detection risk

= ×

Relate those risks to what can go wrong at the account balance or disclosure level

The Relationship of the Entity’s Business Risks to the Audit Risk ModelF I G U R E 4 – 1

In Example 1, the auditor has determined that a very low level of audit risk is appropriate for this account because of its importance to the financial statements. The auditor has assessed the risk of material misstatement as high, indicating that there is a high risk of a material mis- statement that was not prevented, or detected and corrected, by the internal control system. The auditor would then set detection risk as low. A low assessment for detection risk implies that the auditor will conduct a more careful or thorough investigation of this account than if the assessment of detection risk were high.

Final PDF to printer

104 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 104 09/30/15 02:39 PM

Stop and Think: For Example 3 in the table above, why is the auditor setting DR at high? What does a high assessment of DR mean in terms of the level of audit testing?

DR is set high because there is a low risk that a material misstatement is present in the financial statements and, as a result, the auditor needs to gather less evidence.

Standard setters developed the audit risk model as a planning and evaluation tool. How- ever, the model is only as good as the judgments and assessments used as inputs. In other words, when the model is used to revise an audit plan or to evaluate audit results, the actual or achieved level of audit risk may be smaller or larger than the audit risk indicated by the formula. This can occur because the auditor assesses the risk of material misstatement and such an assessment may be higher or lower than the actual risk of material misstatement that exists. Thus, the desired level of audit risk may not actually be achieved. While the audit risk model has limitations, it serves as an important tool that auditors can use for planning and evaluating an audit engagement.

The Auditor’s Risk Assessment Process

The auditor’s objective is to identify and assess the risks of material misstatement, whether due to fraud or error, at the financial statement and relevant assertion levels through under- standing the entity and its environment, including the entity’s internal control. To properly assess the risk of material misstatement and engagement risk, the auditor performs risk assessment procedures. The auditor needs to understand management’s objectives and strate- gies and the related business risks that may result in material misstatements. The following section discusses management’s strategies, objectives, and business risks. We then discuss the details of the auditor’s risk assessment process.

Management’s Strategies, Objectives, and Business Risks Strategies are the operational approaches used by management to achieve objectives. To achieve their business objectives, managers pursue strategies, such as being the low-cost or high-quality provider of a product. Typical business objectives include growth in market share, first-rate reputation, and excellent service. Business risks are threats from significant conditions, events, circumstances, actions, or inactions that could adversely affect the entity’s ability to achieve its objectives and execute its strategies. For example, risks arise from the development of a new product because the product may fail or because flaws in the product may result in lawsuits or damage to the company’s reputation. Management is responsible for identifying such risks and responding to them. Usually, management addresses business risks by implementing a risk assessment process.

Business risk is a broader concept than the risk of material misstatement. However, most business risks have the potential to affect the financial statements either immediately or in the long run. Auditors need to identify business risks and understand the potential misstatements that may result.

Stop and Think: Consider an entity that sells goods to a declining customer base. What risks does this entity face? How will these risks impact the audit?

If the entity faces pressure to maintain historical profit margins, this may increase the risk of misstatement associated with the valuation of assets such as receivables and inven- tory. A declining customer base may also have longer-term implications to the company’s overall health.

LO 4-4

Final PDF to printer

Chapter 4 Risk Assessment 105

mes32502_ch04_098-127.indd 105 09/30/15 02:39 PM

Auditor’s Risk Assessment Procedures The auditor obtains an understanding of the entity and its environment by performing the following risk assessment procedures: inquiries of management, other entity personnel, and others outside the entity; analytical procedures; and observation and inspection.

Inquiries of Management, Other Entity Personnel, and Others Outside the Entity The auditor obtains information about the entity and its environment through inquiry of man- agement, individuals responsible for financial reporting, and other personnel within the entity. Making inquiries of others within the entity may be useful in providing the auditor with a perspective different from that of management and those responsible for financial reporting. The auditor might make inquiries of

∙ Those charged with governance (e.g., board of directors or audit committee). ∙ Internal audit function. ∙ Employees involved in initiating, authorizing, processing, or recording complex or

unusual transactions. ∙ In-house legal counsel. ∙ Production, marketing, sales, and other personnel.

For example, inquiries directed to the internal audit function might relate to their activi- ties concerning the design and operating effectiveness of the entity’s internal controls. The auditor might also inquire of the in-house legal counsel about issues such as litigation, com- pliance with laws and regulations, and the meaning of contract terms.

Stop and Think: What information might be obtained from marketing or sales personnel?

The auditor might learn about changes in the entity’s marketing strategies, sales trends, or contractual arrangements with its customers.

The auditor might inquire of others outside the entity. For example, the auditor may consider it is appropriate to make inquiries of customers, suppliers, or valuation specialists. Such discussions may provide information that will assist the auditor in uncovering fraud. For example, customers may report that they received large quantities of unordered products from the audit client just before year-end. This would be an indicator of overstated revenues.

Analytical Procedures Analytical procedures are evaluations of financial information made through analysis of plausible relationships among both financial and nonfinancial data. Auditing standards require that the auditor perform analytical procedures as risk assessment procedures (sometimes referred to as planning or preliminary analytical procedures). Such procedures assist the auditor in understanding the entity and its environment and in identify- ing areas that may represent specific risks relevant to the audit. Analytical procedures can be helpful in identifying the existence of unusual transactions or events and amounts, ratios, and trends that might have implications for audit planning. In performing analytical procedures, the auditor should develop expectations about plausible relationships that are expected to exist, based on the understanding of the entity and its environment. Analytical procedures are discussed in more detail in Chapter 5.

Observation and Inspection Observation and inspection may support inquiries of man- agement and others and also may provide information about the entity and its environment. Examples of such audit procedures include

∙ Observation of entity activities and operations. ∙ Inspection of documents, records, and internal control manuals. ∙ Reading reports prepared by management, the audit committee or those charged with

governance, and the internal audit function.

Final PDF to printer

106 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 106 09/30/15 02:39 PM

∙ Visits to the entity’s premises and plant facilities. ∙ Tracing transactions through the information system relevant to financial reporting,

which may be performed as part of a walkthrough.

The auditor may also read about industry developments and trends, read the current year’s interim financial statements, and review regulatory or financial publications.

Stop and Think: What are some other sources of information that the auditor might examine to obtain a better understanding of the entity and it environment?

Examples include knowledge from previous audits, consulting and tax engagements performed for the entity, reports prepared by analysts and rating agencies, and other external sources.

Assessing Business Risks Obtaining an understanding of the entity and its environment is a continuous, dynamic pro- cess of gathering, updating, and analyzing information throughout the audit. The goal of this process is to assess the business risks faced by the entity and how those risks are controlled or not controlled by the entity. Based on this knowledge, the auditor assesses the risk of material misstatement at the assertion level. Figure 4–2 provides an overview of the auditor’s assess- ments of business risks and the risk of material misstatement (i.e., the auditor’s risk assessment process). Unless otherwise stated in the text, the risk of material misstatement refers to mis- statements caused by errors or fraud.

The auditor’s understanding of the entity and its environment includes knowledge about the following categories:

∙ Nature of the entity. ∙ Industry, regulatory, and other external factors. ∙ Objectives, strategies, and related business risks. ∙ Entity performance measures. ∙ Internal control.

In obtaining knowledge about each of these categories, the auditor should be particularly alert for the conditions and events that may indicate the existence of business risks.

Stop and Think: What are some conditions and events that might indicate that business risks exist?

Some examples include significant changes in the entity caused by large acquisitions or reor- ganizations, significant changes in the entity’s industry, new products or services, and opera- tions in unstable countries.

Nature of the Entity To understand the nature of the entity, the auditor should obtain information about the entity’s

∙ business operations (e.g., the nature of revenue sources, products or services, and markets; the conduct of operations; alliances, joint ventures, and outsourcing activities; location of production facilities, warehouses, and offices; and key customers and important suppliers of goods and services).

∙ investments and investment activities (e.g., planned or recent acquisitions or divestitures; investments and dispositions of securities and loans; capital investment activities; and investments in partnerships and joint ventures).

∙ financing and financing activities (e.g., major subsidiaries and associated entities; debt structure; leasing arrangements; related parties; and the use of derivative financial instruments).

Final PDF to printer

Chapter 4 Risk Assessment 107

mes32502_ch04_098-127.indd 107 09/30/15 02:39 PM

∙ financial reporting (e.g., accounting principles and industry-specific practices; revenue recognition practices; accounting for fair values; and accounting for unusual or complex transactions).

An understanding of the nature of an entity gives the auditor a better idea of what poten- tial misstatements might be found in the financial statements. For example, an entity with a complex structure may give rise to a risk of material misstatement as a result of the accounting for investments in joint ventures, subsidiaries, equity investments, or variable interest entities.

For public entities, the PCAOB states that the auditor should consider performing the following additional procedures as part of understanding the entity:

∙ Reading public information about the company relevant to the evaluation of the likelihood of material financial statement and the effectiveness of the company’s internal control over financial reporting.

An Overview of the Auditor’s Risk Assessment ProcessF I G U R E 4 – 2

Identify business risks that may result in material misstatements in the financial

statements.

Evaluate the entity’s risk assessment process (i.e., how management responds) to those business

risks and obtain evidence of its implementation.

Assess the risk of material misstatement at the financial statement and assertion

levels.

Perform risk assessment procedures: • Inquiries of management and others • Analytical procedures, and • Observation or inspection to obtain an understanding of the entity and its environment.

Industry, regulatory, & external

factors

Nature of the entity

Objectives, strategies, & business

risks

Entity performance

measures

Internal control

Final PDF to printer

108 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 108 09/30/15 02:39 PM

∙ Observing or reading transcripts of earnings calls conducted by management. ∙ Obtaining information about significant unusual developments regarding trading

activity in the company’s securities. ∙ Obtaining an understanding of compensation arrangements with senior management,

including incentive compensation arrangements, changes or adjustments to those arrangements, and special bonuses.

Industry, Regulatory, and Other External Factors Industry, regulatory, and other external factors are relevant to the auditor’s understanding of the entity and in identifying risks of material misstatements. Some industries are subject to risks of material misstatement as a result of unique accounting estimates. For example, a property and casualty insurance company needs to establish loss reserves based on historical data that may be subject to mis- statement. Table 4–1 presents examples of industry, regulatory, and other external factors that should be considered by the auditor.

Objectives, Strategies, and Related Business Risks As discussed previously, the auditor must identify and understand the entity’s objectives and strategies used to achieve its objectives and the business risks associated with those objectives and strategies. Examples of business risks the auditor considers when developing an understanding of the entity’s objec- tives and strategies include industry developments, new products, expansion of the business, and current and prospective financing arrangements.

Entity Performance Measures Internally generated information used by management to measure and review the entity’s financial performance may include key performance indi- cators, both financial and nonfinancial; budgets; variance analysis; subsidiary information and divisional, departmental, or other level performance reports; and comparisons of an enti- ty’s performance with that of competitors. External parties (e.g., analysts and credit rating agencies) may also measure and review the entity’s financial performance. Internal measures provide management with information about progress toward meeting the entity’s objec- tives. Thus, a deviation in the entity’s performance measures may indicate a risk of misstate- ment in the related financial statement information. When the auditor intends to make use of the entity’s performance measures for the purpose of the audit, the auditor should consider whether the information provided is reliable and trustworthy and whether it is sufficiently detailed or precise.

Industry, Regulatory, and Other External Factors

Industry conditions: • The market and competition, including demand, capacity, and price competition • Cyclical or seasonal activity • Product technology relating to the entity’s products • Energy supply cost

Regulatory environment: • Accounting principles and industry specific practices • Regulatory framework for a regulated industry • Legislation and regulation that significantly affect the entity’s operations • Taxation (corporate and other) • Government policies currently affecting the conduct of the entity’s business • Environmental requirements affecting the industry and the entity’s business

Other external factors: • General economic conditions (e.g., recession, growth) • Interest rates and availability of financing • Inflation and currency revaluation

T A B L E 4 – 1

Final PDF to printer

Chapter 4 Risk Assessment 109

mes32502_ch04_098-127.indd 109 09/30/15 02:39 PM

Internal Control Internal control is the label given to the entity’s policies and procedures designed to provide reasonable assurance about the achievement of the entity’s objectives. Internal control is implemented by the entity’s board of directors, management, and other personnel. Because of the significance of internal control to the financial statement audit, we cover it in great detail in Chapter 6. To provide you with an introduction to the concept of internal control, here are several examples of policies and procedures that may be a part of an entity’s internal control:

∙ Active and qualified board of directors and independent audit committee members. ∙ Effective risk assessment process. ∙ Competent and objective internal audit function. ∙ Proper authorization of transactions (e.g., a supervisor must approve all purchases

over $5,000). ∙ Procedures to ensure assets exist (e.g., inventory counts). ∙ Monitoring of controls (e.g., higher level supervisor reviews purchases over $5,000 to

ensure all such transactions were properly authorized).

The auditor needs to understand and assess the effectiveness of internal control in order to identify the types of potential misstatements and factors that affect the risks of material mis- statement. It also assists in designing appropriate audit procedures.

Evaluate the Entity’s Risk Assessment Process Management has a responsibility to identify, control, and mitigate business risks that may affect the entity’s ability to achieve its objectives. The auditor should obtain information on the entity’s risk assessment process and whether it is operating effectively. If the entity’s response to the identified risk is adequate, the risk of material misstatement may be reduced. However, if the entity’s response to the identified risk is inadequate, the auditor’s assessment of the risk of material misstatement may increase. If the entity does not respond adequately to business risks, the auditor will have to develop tests to determine if any misstatements are present in the related account balances and disclosures. Chapter 6 provides coverage of the entity’s risk assessment process.

Assessing the Risk of Material Misstatement2

Based on knowledge of the entity and its environment, the auditor assesses the risk of material misstatement at the assertion level and determines the audit procedures that are necessary based on that risk assessment (see Figure 4–2). At this point in the risk assessment process, the auditor has identified the entity’s business risks. To assess the risk of material misstate- ment, the auditor considers how the identified risks could result in a material misstatement in the financial statements. This includes considering how the entity’s risk assessment process may affect the likelihood and magnitude of potential misstatements. For example, the entity’s risk assessment process may have identified product obsolescence as a business risk that could result in a material misstatement to the inventory and cost-of-goods accounts. However, the entity’s response to the assessed risk was such that the auditor has determined that there is a low likelihood that such a misstatement could occur because the entity has installed strong controls that track inventory levels and market pricing.

This section will first review the types and causes of misstatements, and then focuses primarily on assessing the risk of material misstatement due to fraud, sometimes referred to as the fraud risk assessment.

LO 4-5

2See recent surveys by Ernst & Young (12th Global Fraud Survey, 2012:www.ey.com) and PwC (Global Economic Crime Survey, 2011: www.pwc.com) for information on the incidence of fraud.

Final PDF to printer

110 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 110 09/30/15 02:39 PM

Causes and Types of Misstatements3

Misstatements can result from errors or fraud. The term errors refers to unintentional mis- statements of amounts or disclosures in financial statements. The term fraud refers to an intentional act by one or more among management, those charged with governance, employ- ees, or third parties, involving the use of deception that results in a misstatement in the financial statements. Thus, the primary distinction between errors and fraud is whether the misstatement was intentional or unintentional. Unfortunately, it is often difficult to deter- mine intent. For example, the auditor detects a misstatement in an account that requires an estimate, such as bad debt expense; it may be difficult to determine whether the misstatement was intentional.

Misstatements due to errors or fraud include

∙ An inaccuracy in gathering or processing data from which financial statements are prepared.

∙ An omission of an amount or disclosure. ∙ A financial statement disclosure that is not presented in accordance with GAAP. ∙ An incorrect accounting estimate arising from overlooking or clear misinterpretation

of facts. ∙ Judgments of management concerning accounting estimates that the auditor considers

unreasonable or the selection or application of accounting policies that the auditor considers inappropriate.

Fraud can be classified into two types: (1) misstatements resulting from fraudulent finan- cial reporting and (2) misstatements resulting from misappropriation of assets. The previ- ous list of misstatements deals with fraudulent financial reporting. Misstatements arising from misappropriation of assets (sometimes referred to as defalcation) involve the theft of an entity’s assets where the theft causes the financial statements to be misstated. Examples of misappropriation include

∙ Embezzling cash received. ∙ Stealing physical assets and intellectual property. ∙ Causing the entity to pay for goods or services not received. ∙ Using an entity’s assets for personal use.

Stop and Think: What are some examples of intellectual property that might be stolen by a fraudster and how would it affect the value of the intellectual property?

Intellectual property includes intangible assets such as musical, literary, and artistic works. It also includes copyrights, trademarks, and patents. “Pirating” of music and movies results in lost revenues to entertainment companies.

3See A. Eilifsen and W. F. Messier, Jr., “Auditor Detection of Misstatements: A Review and Integration of Empirical Research,” Journal of Accounting Literature 2000 (19), pp. 1–43, for a detailed review of research studies that have examined auditor-detected misstatements.

Practice I N S I G H T

In a study conducted by the Association of Certified Fraud Examiners, Report to the Nations (2014), financial statements accounted for some 9 percent of fraud cases but they had the highest median loss, at $1 million. The CFE Study found that financial statement fraud generally involves the inten- tional misstatement or omission of material information from the organization’s financial reports. Asset misappropriation accounted for 85 percent with a median loss of $130,000. The major schemes that were used included check tampering, billing, and non-cash misappropriation.

Final PDF to printer

Chapter 4 Risk Assessment 111

mes32502_ch04_098-127.indd 111 09/30/15 02:39 PM

Auditors find it useful to distinguish between factual misstatements, judgmental mis- statements, and projected misstatements, described as follows:

∙ Factual Misstatements These are misstatements about which there is no doubt. For example, an auditor may test a sales invoice and determine that the prices applied to the products ordered are incorrect. Once the products are correctly priced, the amount of misstatement is known. In such cases, the auditor knows the exact amount of the misstatement.

∙ Judgmental Misstatements These are misstatements that arise from the judgments of management concerning accounting estimates that the auditor considers unreasonable or the selection or application of accounting policies that the auditor considers inappropriate.

∙ Projected Misstatements These are the auditor’s best estimate of misstatements in populations, involving the projection of misstatements identified in an audit sample to the entire population from which the sample was drawn.

The Fraud Risk Assessment Process As part of planning the audit, the auditor performs the following steps to assess fraud risks:

∙ Discussion among the audit team members regarding the risks of material misstatement due to fraud.

∙ Inquiries of management, audit committee, and others about their views on the risks of fraud and how it is addressed.

∙ Consideration of any unusual or unexpected relationships that have been identified in performing analytical procedures in planning the audit.

∙ Understanding of the entity’s period-end closing process and investigate unexpected period-end adjustments.

∙ Identification and assessment of fraud risk factors.

The following three sections address the first, second, and last bulleted items.

Discussion among the Audit Team4 The audit team is required to hold discussions (referred to as brainstorming sessions) about the entity’s financial statements’ susceptibility to fraud. The engagement partner or manager should communicate with members of the audit team regarding the potential for material misstatement due to fraud. This brainstorming ses- sion can be held separately, or concurrently, with the discussion required as part of under- standing the entity and its environment. The engagement partner or manager should determine which audit team members to include in the communication, how it should occur, and the extent of the communication. The objectives of the brainstorming meeting are to

∙ Share insights about the entity and its environment and the entity’s business risks. ∙ Provide an opportunity for the team members to discuss how and where the entity

might be susceptible to fraud. ∙ Emphasize the importance of maintaining professional skepticism throughout the

audit regarding the potential for material misstatement due to fraud.

Engagement team members should be encouraged to communicate and share information obtained throughout the audit that may affect the assessment of risks of material misstatement or the auditor’s responses to those risks.

LO 4-6

4See J. F. Brazel, T. D. Carpenter, and J. G. Jenkins, “Auditors' Use of Brainstorming in the Consideration of Fraud: Reports from the Field,” The Accounting Review (July 2010), pp. 1273–1301, for information on the conduct of brainstorming meetings in real settings.

Final PDF to printer

112 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 112 09/30/15 02:39 PM

The auditor should conduct the engagement assuming there is a possibility that a mate- rial misstatement due to fraud could be present, regardless of any prior beliefs or past expe- rience with the entity and regardless of the auditor’s belief about management’s honesty and integrity.

Inquiries of Management, Audit Committee, and Others The auditor should inquire about management’s knowledge of fraud within the entity. The auditor should also understand the programs and controls that management has established to mitigate specific risk factors and how well management monitors those programs and controls. Some of the inquiry would take place when the auditor obtains an understanding of the entity and its environment.

The entity’s audit committee should assume an active role in oversight of the assessment of the risk of fraud. The auditor should obtain an understanding of how the audit committee exercises its oversight activities, including direct inquiry of audit committee members. The auditor also should inquire of the internal audit function about its assessment of the risk of fraud, including whether management has satisfactorily responded to internal audit findings during the year.

The auditor should consider inquiries from others within the entity and third parties (e.g., vendors, customers, or regulators). It can be uncomfortable to inquire about potentially fraud- ulent activities; however, it is much more uncomfortable to fail to detect a material fraud.

Identification and Assessment of Fraud Risk Factors Three conditions are generally present when material misstatements due to fraud occur:

1. Management or other employees have an incentive or are under pressure that provides a reason to commit fraud.

2. Circumstances exist that provide an opportunity for a fraud to be carried out. 3. Those involved are able to rationalize committing a fraudulent act. Some individuals

possess an attitude, character, or set of ethical values that allow them to knowingly and intentionally commit a dishonest act.

These three conditions are sometimes referred to as the fraud risk triangle. Even honest individuals can commit fraud in an environment where sufficient pressure

is being exerted on them. The greater the incentive or pressure, the more likely an individual will be able to rationalize the acceptability of committing fraud. Withholding evidence or misrepresenting information through falsified documentation, including forgery, may conceal fraud. Fraud also may be concealed through collusion among management, employees, or third parties.

Management has the ability to perpetrate fraud because it is in a position to directly or indirectly manipulate the accounting records and prepare fraudulent financial reports. In most cases, fraudulent financial reporting also involves some management override of controls.

Because of the characteristics of fraud, particularly those involving concealment through collusion; withheld, misrepresented, or falsified documentation; and the ability of manage- ment to override or instruct others to override controls, an auditor may unknowingly rely on audit evidence that appears to be valid but in fact is false and fraudulent. Fraud risk fac- tors related to fraudulent financial reporting and misappropriation of assets can be classified among the three conditions listed above.

Tables 4–2 through 4–4 present the risk factors related to each category of conditions for the potential for fraudulent financial reporting. Table 4–2 contains numerous risk factors that, if present, may suggest that management and others have incentives to manipulate financial reporting. For example, the entity may be facing increased competition that results in declin- ing profit margins. Similarly, in the high-technology sector, rapid changes in technology can affect the profitability and the fair market value of products. Entities that have recurring oper- ating losses and negative cash flow from operations may face bankruptcy, foreclosure, or takeover. In each of these situations, management may have incentives to manipulate reported earnings. Management (or the board of directors) may also be facing pressures to maintain the

Final PDF to printer

Chapter 4 Risk Assessment 113

mes32502_ch04_098-127.indd 113 09/30/15 02:39 PM

Risk Factors Relating to Incentives/Pressures to Report Fraudulently

• Financial stability or profitability is threatened by economic, industry, or entity operating conditions, such as — High degree of competition or market saturation, accompanied by declining margins. — High vulnerability to rapid changes, such as changes in technology, product obsolescence, or interest rates. — Significant declines in customer demand and increasing business failures in either the industry or overall economy. — Operating losses making the threat of bankruptcy, foreclosure, or hostile takeover imminent. — Rapid growth or unusual profitability, especially compared with that of other companies in the same industry. — New accounting, statutory, or regulatory requirements. • Excessive pressure exists for management to meet requirements or expectations of third parties due to — Profitability or trend-level expectations of investment analysts, institutional investors, significant creditors, or

other external parties. — Need to obtain additional debt or equity financing to stay competitive. — Adverse effects of reporting poor financial results on significant pending transactions. • Management or the board of directors’ personal financial situations are threatened by the entity’s financial

performance.

T A B L E 4 – 2

Risk Factors Relating to Opportunities to Report Fraudulently

• The nature of the industry or the entity’s operations provide opportunities to engage in fraudulent financial report- ing due to

— Significant related party transactions. — Assets, liabilities, revenues, or expenses based on significant estimates that involve subjective judgments or

uncertainties that are difficult to corroborate. — Significant, unusual, or highly complex transactions. • There is ineffective monitoring of management. • There is a complex or unstable organizational structure. • Internal control components are deficient.

T A B L E 4 – 3

Risk Factors Relating to Attitudes/Rationalizations to Report Fraudulently

• Ineffective communication implementation, support, and enforcement of the entity’s values or ethical standards by management, or the communication of inappropriate values or ethical standards.

• Nonfinancial management’s excessive participation in, or preoccupation with, the selection of accounting principles or the determination of significant estimates.

• Known history of violations of securities laws or other laws and regulations, or claims against the entity, its senior management, or board members alleging fraud or violations of laws and regulations.

• Excessive interest by management in maintaining or increasing the entity’s stock price or earnings trend. • A practice by management of committing to analysts, creditors, and other third parties to achieve aggressive or

unrealistic forecasts. • Recurring attempts by management to justify marginal or inappropriate accounting on the basis of materiality.

T A B L E 4 – 4

entity’s reported earnings to meet analysts’ forecasts because bonuses or personal wealth is tied to the entity’s stock price (see Exhibit 4–1).

Stop and Think: Suppose that you are a member of the audit team assigned to the EarthWear audit participating in the fraud brainstorming session. What are one or two of the external/internal factors that might create pressure for EarthWear to commit fraud? (See Table 4–2.)

Management must also have the opportunity to commit the fraud. Table 4–3 lists the opportunities that may be available to management or the board of directors to perpetuate fraudulent financial reporting. For example, assets, liabilities, revenues, or expenses may be based on subjective estimates that may be difficult for the auditor to corroborate. Two exam- ples of such situations are the recognizing income on long-term contracts when the percent- age of completion method is used and establishing the amount of loan loss reserves for a financial institution. Another opportunity for fraudulent financial reporting is when a single

Final PDF to printer

114 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 114 09/30/15 02:39 PM

person or small group dominates management. Dominance by one individual may lead to pro- cessing accounting transactions that are not consistent with the entity’s controls.

Risk factors reflective of attitudes/rationalizations by board members, management, or employees may allow them to engage in and/or justify fraudulent financial reporting. Table 4–4 lists a number of attitudes or rationalizations that may be used to justify fraudulent financial reporting. For example, the entity may have weak ethical standards for management behavior or poor communication channels for reporting such behavior. Management may fail to correct weaknesses in internal control or use inappropriate accounting. Last, management may have strained relationships with its predecessor and current auditors.

Misappropriation of Assets Risk factors that relate to misstatements arising from mis- appropriation of assets also are classified along the three conditions generally present when fraud exists. Some of the risk factors related to misstatements arising from fraudulent finan- cial reporting also may be present when misstatements arising from misappropriation of assets exist (see Exhibit 4–2). Table 4–5 presents risk factors related to each category of conditions for the potential of misappropriation of assets. For example, an employee may have financial problems that create an incentive to misappropriate the cash.

Similarly, in order for the employee who has financial problems to misappropriate cash, he or she must have access to the cash. This is likely to occur only when there is inadequate segregation of duties or poor oversight by personnel responsible for the asset. Finally, an employee who has access to assets susceptible to misappropriation may have a change in behavior or lifestyle that may indicate he or she has misappropriated assets. See Koss Corpo- ration discussion case for an example of such activities.

Olympus Corporation—Hiding Investment Losses

Olympus Corporation is a major Japanese manufacturer of optical and reprography products listed on the Tokyo Stock Exchange. Olympus employs close to 40,000 people around the world. At March 31, 2011, Olympus had $13.3 billion in assets, including $2.2 billion of goodwill. The Olympus scandal was precipi- tated on October 14, 2011, when British-born Michael Woodford was suddenly ousted as chief executive after 2 weeks when he exposed “one of the biggest and longest-running loss-hiding arrangements in Japanese corporate history.”

Woodford alleged that his removal was related to several prior acquisitions he had been seek- ing answers to, particularly the $2.2 billion deal in 2008 to acquire British medical equipment maker Gyrus Group. The merger and acquisition (M&A) fee for this transaction was $687 million paid to a middleman as a fee (approximately 31 percent of the purchase price) and ranks as the highest ever M&A fee.

On November 8, 2011, the company admitted that the company’s accounting practice was “inappropri- ate” and that money had been used to cover losses on investments dating to the 1990s. The company blamed the inappropriate accounting on former senior management.

The loss scheme involved Olympus selling assets that incurred a loss to funds set up by Olympus itself. The Company later provided the financing needed to settle the loss under the cover of the Company’s acquisitions. More specifically, Olympus placed money into the funds by acquiring the entrepreneurial ventures owned by the funds at the substantially higher price than the real values, or by paying substan- tially high fees to a third party who acted as the intermediary in the acquisition. This resulted in recogni- tion of a large amount of goodwill, which later led to a goodwill impairment loss.

Since those losses were primarily hidden in goodwill according to the report, the loss constitutes approximately $1.8 billion of goodwill. Olympus stock incurred a significant drop in value.

Selected Sources: Olympus Corporation, The Third Party Committee, “Investigation Report—Summary,” December 6, 2011; “Olympus Scandal,” http://en.wikipedia.org/wiki/Olympus_scandal and related sites; M. Atkins, “The Olympus Controversy: A Snapshot Of Fraud,” www.financierworldwide.com/article.php?id=8798; P. Dvorak and K. Inagaki, “Olympus Auditors Face Scrutiny” The Wall Street Journal (December 8, 2011), and F. McKenna, “How Do You Hide a Multibillion Dollar Loss? Accounting for the Olympus Fraud,” http://retheauditors.com (January 2, 2012).

E X H I B I T 4 – 1

Final PDF to printer

Chapter 4 Risk Assessment 115

mes32502_ch04_098-127.indd 115 09/30/15 02:39 PM

Madoff’s $50 Billion Ponzi Scheme

In early December 2008, Bernie Madoff told his two sons that his investment advisory business, Bernard Madoff Investment Securities (BMIS), was basically a giant Ponzi scheme. Madoff had falsely represented to investors that returns were being earned on their accounts at BMIS and that he was investing their money in securities. Authorities believe that the fraud may date back at least three decades and estimated the losses at $17.3 billion. Madoff’s investors included many famous individuals and charities, some of whom lost their entire savings.

Epilogue: Madoff was found guilty and sentenced to 150 years in prison. Irving Pickard, the bank- ruptcy trustee, has made payments so far of $7.2 billion to individuals who were defrauded. Madoff’s son, Mark, committed suicide 2 years to the day after his father turned himself in. In 2014, Madoff’s other son, Andrew, died of cancer.

Selected Sources: Securities and Exchange Commission Complaint, United States District Court, Southern District of New York (December 11, 2008); J. Palank, “Madoff Trustee Seeks to Pay $322 Million to Investors,” The Wall Street Journal (December 22, 2014), online.

E X H I B I T 4 – 2

Risk Factors Relating to the Misappropriation of Assets

Incentives/pressures: • Personal financial obligations may create pressure for management or employees with access to cash or other

assets susceptible to theft to misappropriate those assets. • Adverse relationships between the entity and employees with access to cash or other assets susceptible to theft

may motivate those employees to misappropriate those assets.

Opportunities: • Certain characteristics or circumstances may increase the susceptibility of assets to misappropriation (for example,

large amounts of cash on hand or processed). • Inadequate internal control over assets may increase the susceptibility of misappropriation of those assets. For

example, misappropriation of assets may exist because there is inadequate management oversight of employees responsible for assets (for example, inadequate supervision or monitoring of remote locations).

Attitudes/rationalizations: • Disregard for the need for monitoring or reducing risks related to misappropriations of assets. • Disregard for internal control over misappropriation of assets by overriding existing controls or by failing to correct

known internal control deficiencies. • Changes in behavior or lifestyle that may indicate assets have been misappropriated.

T A B L E 4 – 5

The Auditor’s Response to the Results of the Risk Assessments

Figure 4–3 provides an overview of the process the auditor follows to respond to the results of the risk assessments. Once the risks of material misstatement have been identified, the auditor determines whether they relate more pervasively to the overall financial statements and poten- tially affect many relevant assertions or whether the identified risks relate to specific relevant assertions related to accounts and disclosures.

Financial statement level risks are pervasive risks; that is, they apply to multiple compo- nents on the financial statements. The auditor’s response to such risks may include

∙ Assigning more experienced personnel or those with specialized knowledge to assess the risks of material misstatement due to fraud.

∙ Evaluating whether the selection and application of accounting policies by the entity, particularly those related to subjective measurements and complex transactions, may be indicative of fraudulent financial reporting resulting from management’s effort to manage earnings, or a bias that may create a material misstatement.

∙ Incorporating an element of unpredictability in the selection of the nature, timing, and extent of audit procedures.

LO 4-7

Final PDF to printer

116 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 116 09/30/15 02:39 PM

The Process of Responding to the Risk of Material Misstatement and the Design and Performance of Audit Procedures

F I G U R E 4 – 3

Financial statement level risks

Develop an overall response.

Assertion level risks

Determine what might go wrong at the

assertion level.

Do these risks relate

pervasively to the financial statements?

Design audit procedures for assertion level

risks.

Yes

Assess the risk of material misstatement at the financial statement and assertion levels.

As part of the risk assessment process, the auditor should determine if any of the risks identified require special audit consideration. If the auditor determines that any of the risks are significant, the auditor must determine the nature of the risk, the likely magnitude of the potential misstatement, and the likelihood of the risk occurring. Examples of the types of items that may result in significant risks include

∙ Assertions identified with fraud risk factors. ∙ Nonroutine or unsystematically processed transactions. ∙ Significant accounting estimates and judgments. ∙ Highly complex transactions. ∙ Application of new accounting standards. ∙ Revenue recognition (see Practice Insight below). ∙ Industry specific issues.

When the auditor has determined that an assessed risk of material misstatement at a relevant assertion level is a significant risk, the auditor should perform tests of controls that mitigate the significant risk or substantive procedures that directly respond to the signifi- cant risk.

Final PDF to printer

Chapter 4 Risk Assessment 117

mes32502_ch04_098-127.indd 117 09/30/15 02:39 PM

The Relationships within the Audit Risk ModelF I G U R E 4 – 4

Assessed Inherent

Risk

Assessed Control

Risk

Reassessed Control

Risk

Planned Detection

Risk

Planned Audit

Evidence

Actual Audit

Evidence

Reassessed Inherent

Risk

Achieved Audit Risk

Achieved Detection

Risk

Acceptable Audit Risk

Note: Comparing acceptable audit risk to achieved audit risk determines whether the audit was e�ective.

I D

Risk Factors

* Level of reliance on the financial statements

by external users

* Probability of financial failure

* Nature of client’s industry/business

* Character or integrity of key personnel

* Results of prior audits and audit history

* Amount and types of related party relationships and transactions

* Client motivation and incentives

* Complexity and routineness of transactions

* Level of subjective judgment required by accounting standards

* Degree to which assets are susceptible to theft

* E�ectiveness of internal controls

* Planned reliance on internal controls

Risks Evidence Audit Outcome

D - Direct Relationship

(i.e., arrow indicates that an increase in one leads to an increase in the other)

I - Inverse Relationship

(i.e., arrow indicates that an increase in one leads to a decrease in the other)

Figure 4–4 provides a detailed overview of the audit risk model and the relationships of its components. It shows how planned levels for the components of the audit risk model (AR, IR, CR, and DR) relate to the assessed level of each component.

Evaluation of Audit Test Results

At the completion of the audit, the auditor should consider whether the accumulated results of audit procedures cause the financial statements to be materially misstated. If the auditor concludes that the total misstatements cause the financial statements to be materially mis- stated, the auditor should request that management eliminate the material misstatement. If management does not eliminate the material misstatement, the auditor should issue a quali- fied/modified or adverse opinion. On the other hand, if the uncorrected total misstatements do not cause the financial statements to be materially misstated, the auditor should issue an unqualified opinion.

If the auditor has determined that the misstatement is or may be the result of fraud, and either has determined that the effect could be material to the financial statements or has been unable to evaluate whether the effect is material, the auditor should

∙ Attempt to obtain audit evidence to determine whether, in fact, material fraud has occurred and, if so, its effect.

LO 4-8

Practice I N S I G H T

Auditing standards state that the auditor should presume that there is a fraud risk involving improper revenue recognition on every audit engagement. The auditor must evaluate the types of revenue or revenue transactions that are subject to such a risk.

Final PDF to printer

118 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 118 09/30/15 02:39 PM

∙ Consider the implications for other aspects of the audit. ∙ Discuss the matter and the approach to further investigation with an appropriate level

of management that is at least one level above those involved in committing the fraud and with senior management.

∙ Suggest that the appropriate level of management consult with legal counsel.

If the results of the audit tests indicate a significant risk of fraud, the auditor should con- sider withdrawing from the engagement and communicating the reasons for withdrawal to the audit committee or others with equivalent authority and responsibility.

Documentation of the Auditor’s Risk Assessment and Response

Standards require extensive documentation of the auditor’s risk assessment procedures (includ- ing fraud risk assessment) and audit responses to identified risks. For example, the auditor should document the risk of material misstatement for all material accounts and disclosures in terms of the related assertions. Other areas that require documentation include the following:

∙ The discussion among the engagement team, the significant decisions reached, how and when the discussion occurred, and the audit team members who participated.

∙ The steps performed in obtaining knowledge about the entity’s business and its environment, including documentation of

— The risks identified. — An evaluation of management’s response to such risks. — The auditor’s assessment of the risk of error or fraud after considering the entity’s

response. ∙ Fraud risks or other conditions that caused the auditor to believe that additional audit

procedures or other responses were required to address such risks or other conditions. ∙ The nature, timing, and extent of the procedures performed in response to the risks of

material misstatement due to fraud and the results of that work. ∙ The nature of the communications about error or fraud made to management, the

audit committee, and others.

Exhibit 4–3 shows the use of a questionnaire to document the nature of the entity.

Stop and Think: Briefly review this exhibit. After considering the responses listed on the document, how would this information guide the planning of your audit?

LO 4-9

Communications about Fraud to Management, the Audit Committee, and Others

Whenever the auditor has found evidence that a fraud may exist, that matter should be brought to the attention of an appropriate level of management. Fraud involving senior management and fraud that causes a material misstatement of the financial statements should be reported directly to the audit committee. In addition, the auditor should reach an understanding with the audit committee regarding the expected nature and extent of communications about mis- appropriations perpetrated by lower-level employees.

The disclosure of fraud to parties other than the entity’s senior management and its audit committee ordinarily is not part of the auditor’s responsibility and ordinarily would be

LO 4-10

Final PDF to printer

Chapter 4 Risk Assessment 119

mes32502_ch04_098-127.indd 119 09/30/15 02:39 PM

A Partial Questionnaire for Documenting the Understanding of EarthWear Clothiers and Its Environment

CLIENT NAME: EARTHWEAR CLOTHIERS Entity and Environment Category: Nature of the Entity Year ended: December 31, 2015

Completed by: _______ Reviewed by: ________

Risk Factors Description/Response Any Remaining Risk

What are the entity’s major sources of revenue, including the nature of its products and/or services?

EarthWear Clothiers generates revenue mainly through the sale of high-quality clothing for outdoor sports, such as hiking, skiing, fly-fishing, and white-water kayaking. The company’s product lines also include casual clothes, accessories, shoes, and soft luggage.

These sales are made mainly through the company’s toll- free number and over its Internet websites. In 2015, Internet sales accounted for 21 percent of total revenue.

No. The company uses conservative methods to record revenue and provides an adequate reserve for returned merchandise.

Who are the entity’s key customers? The company’s key customers are the 21.5 million persons on its mailing list, approximately 7 million of whom are viewed as “current customers” because they have purchased from the company in the last 24 months.

Market research as of January 2015 indicates that approximately 50 percent of customers are in the 35–54 age group and had a median income of $62,000. Almost two-thirds are in professional or managerial positions.

No.

Who are the entity’s key suppliers? During 2015, the company had purchase orders for merchandise from about 300 domestic and foreign manufacturers, including intermediaries (agents). One manufacturer and one intermediary accounted for about 14 and 29 percent of the company’s received merchandise dollars, respectively, in 2015. In 2015, about 80 percent of the merchandise was imported, mainly from Asia, Central America, Mexico, South America, and Europe. The remaining 20 percent was made in the United States. The company will con- tinue to take advantage of worldwide sourcing without sacrificing customer service or quality standards.

Yes. The company would be subject to some risk in finding alternative sourcing if this manufacturer and/or intermediary experiences prolonged work stoppages or economic problems. The availability and cost of certain foreign products may be affected by United States and other countries’ trade policies, economic events, and the value of the U.S. dollar relative to foreign currencies.

What is the entity’s organizational structure? The company has a well-developed organizational structure with clear lines of authority among the various operating departments and staff functions. The organizational structure is appropriate for EarthWear’s activities.

No.

Where are its major locations? Boise, Idaho, is the main corporate location. EarthWear also has phone and distribution centers in the United Kingdom, Germany, and Japan. During 2015, Earth- Wear expanded its global Internet presence by launch- ing sites in France, Italy, Ireland, and several eastern European countries.

Yes. France and Italy have restrictive trade laws where local companies get a certain degree of protection from the government when their markets are threatened. Political instability in the eastern European countries could affect EarthWear’s sales activities in these countries.

What are the entity’s major assets? The major assets of the company are inventory; property, plant, and equipment; and its customer mailing list.

No.

What are the entity’s major liabilities? The company has no long-term debt. However, it maintains a line of credit for financing purchases during the peak purchasing season.

No. The company has adequate cash flow to meet its current obligations.

What are the entity’s financial characteristics including financing sources and current and prospective financial condition?

The company uses its line of credit to meet its normal financing activities. Overall the company’s financial condition is good.

No.

Are there any potential related parties? No. No.

Are there any individually significant events and transactions such as acquisitions or disposals of subsidiaries, businesses, or product lines during the year?

The expansion of the company’s Internet presence to France, Italy, Ireland, and several eastern European countries.

Yes. Restrictive trade laws and the potential for political instability in the eastern European countries.

Does the entity have any major uncertainties or contingencies?

No. No.

E X H I B I T 4 – 3

Final PDF to printer

120 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 120 09/30/15 02:39 PM

precluded by the auditor’s ethical or legal obligations of confidentiality. The auditor should recognize, however, that in the following circumstances a duty to disclose outside the entity may exist:

∙ To comply with certain legal and regulatory requirements. ∙ To a successor auditor when the successor makes inquiries of the predecessor auditor

about the client. ∙ In response to a subpoena. ∙ To a funding agency or other specified agency in accordance with requirements for

the audits of entities that receive governmental financial assistance.

KEY TERMS

Analytical procedures. Evaluations of financial information made through analysis of plau- sible relationships among both financial and nonfinancial data. Audit procedures. Specific acts performed by the auditor in gathering evidence to determine if specific assertions are being met. Audit risk. The risk that the auditor expresses an inappropriate audit opinion when the finan- cial statements are materially misstated. Business risks. Risks resulting from significant conditions, events, circumstances, and actions or inactions that could adversely affect management’s ability to execute its strategies and to achieve its objectives, or through the setting of inappropriate objectives or strategies. Control risk. The risk that a misstatement that could occur in an assertion about an account or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control. Detection risk. The risk that the procedures performed by the auditor will not detect a mis- statement that exists and that could be material, either individually or when aggregated with other misstatements. Engagement risk. The risk that the auditor is exposed to financial loss or damage to his or her professional reputation from litigation, adverse publicity, or other events arising in con- nection with financial statements audited and reported on. Errors. Unintentional misstatements or omissions of amounts or disclosures. Factual misstatements. These are misstatements about which there is no doubt. For exam- ple, an auditor may test a sales invoice and determine that the prices applied to the products ordered are incorrect. Once the products are correctly priced, the amount of misstatement is known. In such cases, the auditor knows the exact amount of the misstatement. Fraud. An intentional act by one or more among management, those charged with gover- nance, employees, or third parties, involving the use of deception that results in a misstate- ment in the financial statements. Inherent risk. The susceptibility of an assertion in an account or disclosure to a misstatement due to error or fraud that could be material, either individually or when aggregated with other misstatements, before consideration of any related controls. Judgmental misstatements. These are misstatements that arise from the judgments of man- agement concerning accounting estimates that the auditor considers unreasonable or the selection or application of accounting policies that the auditor considers inappropriate. Nonsampling risk. The risk that auditors will make judgment errors caused by the use of inappropriate audit procedures or misinterpretation of audit evidence and failure to recognize a misstatement or deviation. Projected misstatements. These are the auditor’s best estimate of misstatements in popula- tions, involving the projection of misstatements identified in an audit sample to the entire population from which the sample was drawn.

Final PDF to printer

Chapter 4 Risk Assessment 121

mes32502_ch04_098-127.indd 121 09/30/15 02:39 PM

Risk assessment. The identification, analysis, and management of risks relevant to the prepa- ration of financial statements that are fairly presented in conformity with GAAP. Risk of material misstatement. The risk that the financial statements are materially mis- stated prior to the audit. It represents the combination of inherent risk and control risk. Scope of the audit. Refers to the nature, timing, and extent of audit procedures, where nature refers to the type of evidence; timing refers to when the evidence will be gathered; and extent refers to how much of the type of evidence will be evaluated. Significant risk. A risk of material misstatement that is important enough to require special audit consideration.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 4-1 4-1 Distinguish between audit risk and engagement risk. LO 4-1, 4-2 4-2 How do inherent risk and control risk differ from detection risk? LO 4-2 4-3 Distinguish between sampling risk and professional judgment errors (nonsampling)

risk. LO 4-3 4-4 What are some limitations of the audit risk model? LO 4-4, 4-5 4-5 In understanding the entity and its environment, the auditor gathers knowledge about

which categories of information? LO 4-4, 4-5 4-6 Give three examples of conditions and events that may indicate the existence of busi-

ness risks. LO 4-4, 4-5 4-7 Many entities are subject to regulations by state and federal regulatory bodies. For

example, the Environmental Protection Agency has a mission of protecting human health and the environment. What business risks would an entity face if it operated in the coal mining industry?

LO 4-4, 4-5 4-8 Distinguish between factual, judgmental, and projected misstatements. LO 4-5, 4-6 4-9 Distinguish between errors and fraud. Give three examples of each. LO 4-7 4-10 What steps should an auditor perform to identify the risk of material misstatement

due to fraud? LO 4-7 4-11 Why would a company institute a control policy that required mandatory vacations? LO 4-7 4-12 Marv Jackal, CPA, determines that a number of risks of material misstatement are

pervasive to the overall financial statements. How should Jackal respond to such pervasive risks?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 4-1 4-13 Which of the following concepts are pervasive in the application of generally accepted auditing standards, particularly the standards of field work and reporting?

a. Internal control. b. Expected misstatement. c. Control risk. d. Materiality and audit risk.

LO 4-1 4-14 The existence of audit risk is recognized by the statement in the auditor’s standard report that the auditor

a. Obtains reasonable assurance about whether the financial statements are free of material misstatement.

Final PDF to printer

122 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 122 09/30/15 02:39 PM

b. Assesses the accounting principles used and evaluates the overall financial state- ment presentation.

c. Realizes that some matters, either individually or in the aggregate, are important, while other matters are not important.

d. Is responsible for expressing an opinion on the financial statements, which are the responsibility of management.

LO 4-2 4-15 Risk of material misstatement refers to a combination of which two components of the audit risk model?

a. Audit risk and inherent risk. b. Audit risk and control risk. c. Inherent risk and control risk. d. Control risk and detection risk.

LO 4-3, 4-4 4-16 As lower acceptable levels of both audit risk and materiality are established, the auditor should plan more work on individual accounts to

a. Find smaller errors. b. Find larger errors. c. Increase the tolerable misstatements in the accounts. d. Decrease the risk of overreliance.

LO, 4-5, 4-6 4-17 Which of the following characteristics most likely would heighten an auditor’s con- cern about the risk of intentional manipulation of financial statements?

a. Turnover of senior accounting personnel is low. b. Insiders recently purchased additional shares of the entity’s stock. c. Management places substantial emphasis on meeting earnings projections. d. The rate of change in the entity’s industry is slow.

LO 4-5, 4-6 4-18 Which of the following is a misappropriation of assets? a. Classifying inventory held for resale as supplies. b. Investing cash and earning at a 3 percent rate of return as opposed to paying off a

loan with an interest rate of 7 percent. c. An employee of a consumer electronics store steals 12 CD players. d. Management estimates bad debt expense as 2 percent of sales when it actually

expects bad debts equal to 10 percent of sales.

LO 4-6 4-19 Auditing standards require auditors to make certain inquiries of management regard- ing fraud. Which of the following inquiries is required?

a. Whether management has ever intentionally violated the securities laws. b. Whether management has any knowledge of fraud that has been perpetrated on or

within the entity. c. Management’s attitudes toward regulatory authorities. d. Management’s attitude about hiring ethical employees.

LO 4-5, 4-6 4-20 Which of the following is an example of fraudulent financial reporting? a. Company management falsifies the inventory count, thereby overstating ending

inventory and understating cost of sales. b. An employee diverts customer payments to his personal use, concealing his

actions by debiting an expense account, thus overstating expenses. c. An employee steals inventory, and the shrinkage is recorded as a cost of goods

sold. d. An employee borrows small tools from the company and neglects to return them;

the cost is reported as a miscellaneous operating expense.

LO 4-10 4-21 When is a duty to disclose fraud to parties other than the entity’s senior management and its audit committee most likely to exist?

a. When the amount is material. b. When the fraud results from misappropriation of assets rather than fraudulent

financial reporting.

Final PDF to printer

Chapter 4 Risk Assessment 123

mes32502_ch04_098-127.indd 123 09/30/15 02:39 PM

c. In response to inquiries from a successor auditor. d. When a line manager rather than a lower-level employee commits the fraudu-

lent act.

LO 4-10 4-22 Which of the following is correct concerning required auditor communications about fraud?

a. Fraud that involves senior management should be reported directly by the auditor to the audit committee regardless of the amount involved.

b. Fraud with a material effect on the financial statements should be reported directly by the auditor to the Securities and Exchange Commission.

c. Any requirement to disclose fraud outside the entity is the responsibility of man- agement and not that of the auditor.

d. The professional standards provide no requirements related to the communication of fraud, but the auditor should use professional judgment in determining com- munication responsibilities.

PROBLEMS All applicable problems are available with Connect.

LO 4-1, 4-2, 4-3 4-23 The auditor should consider audit risk when planning and performing an audit of financial statements in accordance with generally accepted auditing standards. Audit risk should also be considered together in determining the nature, timing, and extent of auditing procedures and in evaluating the results of those procedures.

Required: a. Define audit risk. b. Describe the components of audit risk (e.g., inherent risk, control risk, and detec-

tion risk). c. Explain how these components are interrelated.

(AICPA, adapted)

LO 4-1, 4-2, 4-3 4-24 The CPA firm of Lumley & Lu uses a quantitative approach to implementing the audit risk model. Calculate detection risk for each of the following hypothetical clients.

Client No. Audit Risk Risk of Material Misstatement Detection Risk

1 5% 20%

2 5% 50%

3 10% 15%

4 10% 40%

LO 4-1, 4-2, 4-3 4-25 The CPA firm of Quigley & Associates uses a qualitative approach to implement- ing the audit risk model. Audit risk is categorized using two terms: very low and low. The risk of material misstatement and detection risk are categorized using three terms: low, moderate, and high. Calculate detection risk for each of the following hypothetical clients.

Client No. Audit Risk Risk of Material Misstatement Detection Risk

1 Low Moderate 2 Very Low High 3 Low Low 4 Very Low Moderate

Final PDF to printer

124 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 124 09/30/15 02:39 PM

LO 4-1, 4-2, 4-3 4-26 You are considering acceptable audit risk at the financial statement level. For each of the following independent scenarios, based only on the information provided, indicate the effect on acceptable audit risk compared to a typical private company audit.

a. LVD is a pharmaceutical company that has three successful drugs. They have recently decided to make a public offering of their stock.

b. Budd Co., a private company, has approached your audit firm to bid on their annual audit. During discussions with the CFO, you learn that the company is fil- ing for bankruptcy.

c. Stephens Inc., a private company, has recently installed a new accounting infor- mation system.

LO 4-1, 4-2, 4-3 4-27 When planning a financial statement audit, a CPA must understand audit risk and its components. The firm of Pack & Peck evaluates the risk of material misstate- ment (RMM) by disaggregating RMM into its two components: inherent risk and control risk.

Required: For each illustration, select the component of audit risk that is most directly illus- trated. The components of audit risk may be used once, more than once, or not at all.

Components of Audit Risk: a. Control risk b. Detection risk c. Inherent risk

Illustration Component of Audit Risk

1. A client fails to discover employee fraud on a timely basis because bank accounts are not reconciled monthly.

2. Cash is more susceptible to theft than an inventory of coal. 3. Confirmation of receivables by an auditor fails to detect a material misstatement. 4. Disbursements have occurred without proper approval. 5. There is inadequate segregation of duties. 6. A necessary substantive audit procedure is omitted. 7. Notes receivable are susceptible to material misstatement, assuming there are no

related internal controls. 8. Technological developments make a major product obsolete. 9. The client is very close to violating debt covenants. 10. XYZ Company, a client, lacks sufficient working capital to continue operations.

LO 4-3, 4-4, 4-5 4-28 For each of the following situations, explain how risk of material misstatement should be assessed and what effect that assessment will have on detection risk.

a. Johnson, Inc., is a fast-growing trucking company operating in the southeastern part of the United States. The company is publicly held, but Ivan Johnson and his sons control 55 percent of the stock. Ivan Johnson is chairman of the board and CEO. He personally makes all major decisions with little consultation with the board of directors. Most of the directors, however, are either members of the Johnson family or long-standing friends. The board basically rubber-stamps Ivan Johnson’s decisions.

b. MaxiWrite Corporation is one of several companies engaged in the manufacture of high-speed, high-capacity data storage devices. The industry is very competi- tive and subject to quick changes in technology. MaxiWrite’s operating results would place the company in the second quartile in terms of profitability and financial position. The company has never been the leader in the industry, with its products typically slightly behind the industry leader’s in terms of performance.

c. The First National Bank of Pond City has been your client for the past two years. During that period you have had numerous arguments with the president

Final PDF to printer

Chapter 4 Risk Assessment 125

mes32502_ch04_098-127.indd 125 09/30/15 02:39 PM

and the controller over a number of accounting issues. The major issue has related to the bank’s reserve for loan losses and the value of collateral. Your prior audits have indicated that a significant adjustment is required each year to the loan loss reserves.

LO 4-4, 4-5 4-29 In developing an understanding of the entity and its environment, the auditor can obtain information from numerous sources, such as knowledge from prior audits and discussions with management. List five additional potential sources (internal or external) of information about the entity and its environment.

LO 4-4, 4-5 4-30 Industry conditions can be a source of business risks for an entity. Describe how each of the following industry conditions can result in business risks.

a. The entity’s market characteristics (e.g., demand, capacity, etc.) and competition. b. The cyclical or seasonal activity in the entity’s industry. c. The speed of technology change related to the entity’s products. d. The supply availability and cost of the entity’s raw materials and components.

LO 4-6, 4-9 4-31 Management fraud (e.g., fraudulent financial reporting) is a relatively rare event. However, when it does occur, the frauds (e.g., Enron and WorldCom) can have a significant effect on shareholders, employees, and other parties. AU-C 240, Consid- eration of Fraud in a Financial Statement Audit, provides the relevant guidance for auditors.

Required: a. What is the auditor’s responsibility for detecting fraud? b. Describe the three conditions that are generally present when fraud occurs. c. What are the objectives of the “brainstorming” meeting that is held among the

engagement team members? d. What is the required documentation for identified risk factors?

LO 4-4, 4-5, 4-7, 4-8 4-32 Assume that your firm is considering accepting NewSkin Pharma as a new audit cli- ent. NewSkin is a start-up biotech firm that has publicly traded stock on NASDAQ. Your audit partner has asked you to perform some preliminary work for the firm’s client acceptance process.

Required: a. Prepare a list of business risks that NewSkin likely will face as a start-up biotech

firm. b. Choose two of these risks and consider how they might affect your decision to

accept NewSkin as a client.

DISCUSSION CASE

LO 4-4, 4-5 4-33 Koss Corporation: How $34 Million Disappeared. Koss Corporation is a pub- licly traded company that designs and sells stereo headphones. The Koss family controls a majority of the Company’s stock. On November 17, 2010, Sujata “Sue” Sachdeva, the former Vice-President of Finance was sentenced to 11 years in prison for embezzling $34 million from the Company. Her attorney claimed that she was a shopaholic. From 1992 to 2009, Sachdeva was the Principal Accounting Officer, Secretary, and Vice-President of Finance at Koss. As a result of the embezzlement, Koss Corporation was required to restate its financial statements for 2008, 2009, and the first quarter of 2010.

Sachdeva used the embezzled funds to sustain a lavish lifestyle including pur- chasing a vacation ownership interest in Hawaii, a Mercedes Benz, and other auto- mobiles. She also used the proceeds to pay for luxury travel and numerous personal items, including luxury clothing, furs, designer shoes, jewelry, and art. One neighbor

Final PDF to printer

126 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch04_098-127.indd 126 09/30/15 02:39 PM

stated that packages delivered to her front porch would sometimes reach 6 feet high! Sachdeva also maintained a large household staff. Such purchases were well beyond her Koss salary (approximately $175,000). She explained her life style by stating that her husband earned a couple of million dollars a year and that they both came from wealthy families.

The massive misappropriation was ultimately discovered when American Express notified the Company that funds were being wired from a Company bank account to pay for expenses on Sachdeva’s personal credit card. According to the SEC, Sachdeva authorized at least 206 wire transfers of funds from Koss bank accounts to pay for her American Express credit card bills and issued more than 500 cashier’s checks from company accounts to pay for personal expenses. Sachdeva used the cashier’s checks to make direct payments to retailers, such as Neiman Marcus and Saks Fifth Avenue. Sachdeva attempted to conceal the identities of the recipients of the checks by using acronyms on the checks such as “S.F.A. Inc.” for Saks Fifth Avenue, “N.M. Inc.” for Neiman Marcus, and others. Sachdeva was able to conceal the fraud by direct- ing other Koss employees to make numerous fraudulent entries in Koss’s books and records. Julie Mulvaney, the Company’s senior accountant who was responsible for making journal entries, reconciling accounts receivable, reconciling the Company’s bank statements, ordering cashier’s checks, processing wire transfers, and checking the daily bank account balances assisted Sachdeva in covering up the fraud.

Other information about the Company: ∙ Michael Koss simultaneously held 5 senior management positions: Vice

Chairman, Chief Executive, Chief Operating Officer, President, and Chief Finan- cial Officer. Koss had little or no educational background or experience in the areas of accounting or finance and allegedly delegated important responsibilities typically performed by the CFO to Sachdeva on a regular basis.

∙ Koss did not have an internal audit function. ∙ Koss Corporation’s control environment appears to have been remarkably relaxed

and its corporate board rarely changed. Excluding a member added in 2006 and founder John Koss, board members had an average tenure of 27 years.

∙ Unlike the proxy statements of typical public companies, Koss made no mention of any accounting expertise among audit committee members.

∙ Because it was a small company, Koss was not subject to a section of the Sarbanes-Oxley Act that requires outside auditors to evaluate a company’s inter- nal controls over financial reporting.

∙ During the embezzlement, Koss’s audit fees were reduced by half from $114,900 in 2007 to $63,600 in 2008.

∙ In 2006, Sachdeva co-chaired a fundraising gala for Big Brothers Big Sisters with one of Koss’s outside auditors.

Sources: SEC Complaint,US Securities and Exchange Commission v. Sujata Sachdeva, and Julie Mulvaney, August 31, 2010, SEC, Accounting and Auditing Enforcement Release No. 3330 / October 24, 2011, and SEC v. Koss Corporation and Michael J. Koss, Civil Case No. 2:11-cv-00991, USDC, E.D., Wisc. Mary Van de Kamp Nohl, “The Diva, Sue Sachdeva, Embezzled $50 Million from the Koss Company to Finance a 12 Year Shopping Spree” Milwaukee Magazine (November 2010), pp. 57–68.

Required: 1. Assume that you are a member of the audit team. Identify the fraud risk factors

for misappropriation of assets that were present at Koss Corporation. 2. Is it appropriate for one individual to hold 5 significant senior management posi-

tions all at the same time in a publicly traded company? Why or why not?

INTERNET ASSIGNMENT

LO 4-4, 4-5, 4-7 4-34 Auditors are required to obtain and support an understanding of the entity and its environment in order to identify business risks. Much of the information needed to identify the risks can be obtained from the company’s annual report, 10K, and proxy

Final PDF to printer

Chapter 4 Risk Assessment 127

mes32502_ch04_098-127.indd 127 10/22/15 10:59 AM

materials. Many companies publish these documents on their website. Additionally, industry information on these companies can be obtained from websites such as Yahoo (yahoo.marketguide.com).

In groups of two or three members, complete the questionnaire for a real-world company assigned by your instructor. The questionnaire can be downloaded by your instructor from Connect. There may be some questions asked on the questionnaire that you will be unable to answer. If you cannot answer a question, respond “infor- mation not available.” NOTE: See W. F. Messier, Jr. “An Approach to Learning Risk-Based Auditing,” Journal of Accounting Education (September 2014), pp. 276–287 for more discussion on how to use this Internet assignment.

HANDS-ON CASES

EarthWear Online

Understanding the Entity and Its Environment Exhibit 4–3 illustrated how auditors document their understanding of the entity and its environment using a questionnaire. Willis and Adams’s staff partially completed the questionnaire for the upcoming audit of EarthWear, and your task is to complete the remaining questions.

Visit Connect for additional student resources to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch05_128-176.indd 128 10/05/15 02:15 PM

CHAPTER

5 5-1 Understand the relationship between audit evidence and

the auditor’s report. 5-2 Know management assertions about classes of

transactions, account balances, and presentation and disclosure.

5-3 Learn the basic concepts of audit evidence. 5-4 Know the audit procedures used for obtaining audit

evidence.

5-5 Understand the reliability of the types of evidence. 5-6 Understand the audit testing hierarchy. 5-7 Understand the functions of audit documentation. 5-8 Develop an understanding of the content, types,

organization, and ownership of audit documentation. 5-9 Learn the purposes and types of analytical procedures. 5-10 Be familiar with financial ratios that are useful as

analytical procedures.

AU 240-C, Consideration of Fraud in a Financial Statement Audit AU 520-C, Analytical Procedures AU 530-C, Audit Sampling AU 540-C, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU 580-C, Written Representations PCAOB, Rule 3100: Compliance with Auditing and Related Professional Practice Standards PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 8, Audit Risk (AU-C 200)

PCAOB Auditing Standard No. 9, Audit Planning (AU-C 330) PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit (AU-C 320) PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 14, Evaluating Audit Results (AU-C 450) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

129

mes32502_ch05_128-176.indd 129 10/05/15 02:15 PM

Evidence and Documentation

T his chapter discusses in depth the third of the three fundamental audit concepts introduced in Chapter 1: audit evidence. Audit evidence is the information used by the auditor in arriving at the conclusions on which

the audit opinion is based, including the information contained in the account- ing records underlying the financial statements and other sources. In Chapter 1, we indicated that auditing is essentially a set of conceptual tools that guide an auditor in collecting and evaluating evidence regarding others’ assertions, and we assured you that these conceptual tools are extremely useful in a vari- ety of settings. We encourage you to keep this perspective in mind as you study Chapter 5. While this chapter does contain some lists you will likely want to commit to memory (e.g., management assertions and characteristics of audit evidence), remember that these are not just lists—they constitute powerful conceptual tools that can help you in almost any setting that requires you to collect and evaluate evidence. Understanding the nature and characteristics of evidence is fundamental to effective auditing and is a key part of the concep- tual tool kit we hope to help you acquire as you go through this book.

On a typical audit most of the auditor’s work involves obtaining and eval- uating evidence using procedures such as inspection of records and exter- nal confirmations to test the fair presentation of the financial statements. To perform this task effectively and efficiently, an auditor must thoroughly under- stand the important aspects of audit evidence. This includes understanding how audit evidence relates to financial statement assertions and the auditor’s report, the sufficiency and appropriateness of evidence, types of audit pro- cedures, and the documentation of evidence in the working papers. Each of these topics is covered in this chapter. In addition, this chapter contains two Advanced Modules that discuss the proper use of analytical procedures.

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

130 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 130 10/05/15 02:15 PM

The Relationship of Audit Evidence to the Audit Report

Auditing standards provide the basic framework for the auditor’s understanding of audit evi- dence and its use in supporting his or her opinion on the financial statements. The auditor gathers evidence by conducting audit procedures to test management assertions. Chapter 3 covers the types of audit procedures used to gather evidence. This evidence serves as the support for the auditor’s opinion about whether the financial statements are fairly presented. Figure 5–1 presents an overview of the relationships among the financial statements, manage- ment assertions about components of the financial statements, audit procedures, and the audit report. More specifically, the financial statements reflect management’s assertions about the various financial statement components. The auditor tests management’s assertions by con- ducting audit procedures that provide evidence on whether each relevant management asser- tion is supported. When the evidence supports management’s assertions, the auditor can issue an unqualified audit report.

Auditors typically divide financial statements into components or segments in order to manage the audit. A component can be a financial statement account (e.g., accounts receiv- able) or a business process (e.g., the revenue process). Sometimes business processes are referred to as transaction cycles. Business processes support functions such as sales and services, materials acquisition, production and distribution, human resource manage- ment, and treasury management. This text focuses on how auditors examine business processes and related transactions, and financial statement accounts. Examining business pro- cesses and their related accounts allows the auditor to gather evidence by understanding the processing of related transactions through the information system from their origin to their ultimate disposition in the accounting journals and ledgers. Later chapters in this text will help you understand each of the major business processes that auditors typically encounter on an engagement.

LO 5-1

Management assertions about components of financial statements

Audit procedures

Audit report

Provide evidence on the fairness of the

financial statements

Auditor reaches a conclusion based

on the evidence

Financial statements

An Overview of the Relationships among the Financial Statements, Management Assertions, Audit Procedures, and the Audit Report

F I G U R E 5 – 1

Final PDF to printer

Chapter 5 Evidence and Documentation 131

mes32502_ch05_128-176.indd 131 10/05/15 02:15 PM

Management is responsible for the fair presentation of the financial statements. Assertions are expressed or implied representations by management regarding the recognition, measure- ment, presentation, and disclosure of information in the financial statements and related dis- closures. For example, when the balance sheet contains a line item for accounts receivable of $5 million, management asserts that those receivables exist and have a net realizable value of $5 million. Management also asserts that the accounts receivable balance arose from selling goods or services on credit in the normal course of business.

Stop and Think: Take a moment and consider what the relevant management assertions are when the financial statements show a net sales amount of $100 million.

Under current auditing standards, management assertions fall into the following categories:

∙ Assertions about classes of transactions and events for the period under audit ∙ Assertions about account balances at the period end ∙ Assertions about presentation and disclosure

Management Assertions

LO 5-2

Practice I N S I G H T

Auditing standards allow the auditor to use the categories of assertions as shown here or to express them differently. For example, the PCAOB standards do not separate the assertions into the three categories presented here. Instead they just list five assertions (existence/occurrence, complete- ness, valuation/allocation, rights and obligations, and presentation and disclosure). We use the three categories presented here (consistent with ASB and IAASB standards) because we believe that tests of assertions are more easily understood when considered separately in terms of transactions, account balances, and disclosures.

Table 5–1 presents the definitions of each assertion by category, while Table 5–2 shows how the assertions are related across categories.

Pay close attention to the wording of the assertions as defined and described below. The way auditors use certain words as they relate to assertions may differ somewhat from your everyday usage of the terms, and part of mastering auditing is learning the language of auditors.

Assertions about Classes of Transactions and Events during the Period Assertions about classes of transactions and events relate to the transactions that flow through a particular business process and accumulate in one or more financial statement accounts. Transaction-related assertions help the auditor conceptualize, plan, and perform audit procedures.

Occurrence The occurrence assertion relates to whether all recorded transactions and events have occurred and pertain to the entity. For example, management asserts that all rev- enue transactions recorded during the period were valid transactions. The occurrence asser- tion is relevant for revenue transactions because the entity’s personnel might have incentives to record fictitious transactions. Occurrence is sometimes also referred to as validity.

Completeness The completeness assertion relates to whether all transactions and events that occurred during the period have been recorded. For example, if an entity fails to record

Final PDF to printer

132 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 132 10/05/15 02:15 PM

Definitions of Management Assertions by Category

Assertions about classes of transactions and events for the period under audit: • Occurrence—transactions and events that have been recorded have occurred and pertain to the entity (sometimes referred to as validity). • Completeness—all transactions and events that should have been recorded have been recorded. • Authorization—all transactions and events have been properly authorized. • Accuracy—amounts and other data relating to recorded transactions and events have been recorded appropriately. • Cutoff—transactions and events have been recorded in the correct accounting period. • Classification—transactions and events have been recorded in the proper accounts.

Assertions about account balances at the period end: • Existence—assets, liabilities, and equity interests exist. • Rights and obligations—the entity holds or controls the rights to assets, and liabilities are the obligations of the entity. • Completeness—all assets, liabilities, and equity interests that should have been recorded have been recorded. • Valuation and allocation—assets, liabilities, and equity interests are included in the financial statements at appropriate amounts, and any resulting valu-

ation or allocation adjustments are appropriately recorded.

Assertions about presentation and disclosure: • Occurrence and rights and obligations—disclosed events, transactions, and other matters have occurred and pertain to the entity. • Completeness—all disclosures that should have been included in the financial statements have been included. • Classification and understandability—financial information is appropriately presented and described, and disclosures are clearly expressed. • Accuracy and valuation—financial and other information is disclosed fairly and in appropriate amounts.

T A B L E 5 – 1

Summary of Management Assertions by Category

Categories of Assertions

Classes of Transactions and Events during the Period

Account Balances at the End of the Period Presentation and Disclosure

Occurrence/Existence Transactions and events that have been recorded have occurred and pertain to the entity.

Assets, liabilities, and equity interests exist.

Disclosed events and transactions have occurred and pertain to the entity.

Rights and Obligations — The entity holds or controls the rights to assets, and liabilities are the obli- gations of the entity.

—

Completeness All transactions and events that should have been recorded have been recorded.

All assets, liabilities, and equity inter- ests that should have been recorded have been recorded.

All disclosures that should have been included in the financial statements have been included.

Authorization All transactions and events that should have been recorded have been authorized.

— —

Accuracy/Valuation and Allocation

Amounts and other data relating to recorded transactions and events have been recorded appropriately.

Assets, liabilities, and equity inter- ests are included in the financial statements at appropriate amounts and any resulting valuation or allo- cation adjustments are recorded appropriately.

Financial and other information is disclosed fairly and in appropriate amounts.

Cutoff Transactions and events have been recorded in the correct accounting period.

— —

Classification and Understandability

Transactions and events have been recorded in the proper accounts.

— Financial information is appropriately presented and described, and disclo- sures are expressed clearly.

T A B L E 5 – 2

a valid revenue transaction, the revenue account will be understated. Note that the auditor’s concern with the completeness assertion is opposite the concern for occurrence. Failure to meet the completeness assertion results in an understatement in the related account, while failure to meet the occurrence assertion results in an overstatement in the account.

Authorization The authorization assertion relates to whether all transactions have been properly authorized. For example, the purchase of a new manufacturing facility should be approved by the board of directors. Auditing standards use the word “accuracy” to reflect that

Final PDF to printer

Chapter 5 Evidence and Documentation 133

mes32502_ch05_128-176.indd 133 10/05/15 02:15 PM

transactions and events have been both recorded accurately and properly authorized. Since an unauthorized transaction could be accurately recorded, we have found that it is easier to think of proper authorization and accurate recording as separate assertions.

Accuracy The accuracy assertion addresses whether amounts and other data relating to recorded transactions and events have been recorded appropriately. Generally accepted accounting principles establish the appropriate method for recording a transaction or event. For example, the amount recorded for the cost of a new machine includes its purchase price plus all reasonable costs to install it.

Cutoff The cutoff assertion relates to whether transactions and events have been recorded in the correct accounting period. For example, the auditor may want to test proper cutoff of revenue transactions at December 31, 2015. The auditor can examine a sample of shipping documents and sales invoices for a few days before and after year-end to test whether the sales transactions are recorded in the proper period. The objective is to determine that all 2015 sales and no 2016 sales have been recorded in 2015. Thus, the auditor examines the shipping documents to ensure that no 2016 sales have been recorded in 2015 and that no 2015 sales are recorded in 2016.

Classification The classification assertion is concerned with whether transactions and events have been recorded in the proper accounts. For example, management asserts that maintenance costs to repair a machine that do not add to its usefulness are properly charged to the repairs and maintenance expense account and not to the machine asset account.

Assertions about Account Balances at the Period End Assertions about account balances relate directly to the ending balances of the accounts included in the financial statements. Balance-related assertions help the auditor conceptual- ize, plan, and perform audit procedures.

Existence The assertion about existence addresses whether ending balances of assets, lia- bilities, and equity interests included in the financial statements actually exist at the date of the financial statements. For example, management asserts that inventory shown on the bal- ance sheet exists and is available for sale.

Rights and Obligations The assertions about rights and obligations address whether the entity holds or controls the rights to assets included on the financial statements, and that liabilities are the obligations of the entity. For example, amounts capitalized for leases reflect assertions that the entity has rights to leased property and that the corresponding lease liabil- ity represents an obligation of the entity.

Completeness The assertion about completeness addresses whether all assets, liabilities, and equity interests that should have been included as ending balances on the financial state- ments have been included. For example, management implicitly asserts that the ending bal- ance shown for accounts payable on the balance sheet includes all such liabilities as of the balance sheet date.

Valuation and Allocation Assertions about valuation or allocation address whether assets, liabilities, and equity interests included in the financial statements are at appropriate amounts and any resulting valuation or allocation adjustments are appropriately recorded. For example, management asserts that inventory is carried at the lower of cost or market value on the balance sheet. Similarly, management asserts that the cost of property, plant, and equip- ment is systematically allocated to appropriate accounting periods by recognizing deprecia- tion expense.

Final PDF to printer

134 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 134 10/05/15 02:15 PM

Assertions about Presentation and Disclosure This category of assertions relates to presentation of information in the financial statements and disclosures in the footnotes that are directly related to a specific transaction or account bal- ance (e.g., disclosures related to property and equipment) and those that apply to the financial statements in general (e.g., the footnote for the summary of significant accounting policies).

Occurrence and Rights and Obligations The assertions about occurrence and rights and obligations address whether disclosed events, transactions, and other matters have occurred and pertain to the entity. For example, when management presents capitalized lease transactions on the balance sheet as leased assets, the related liabilities as long-term debt, and the related footnote, it is asserting that a lease transaction occurred, it has a right to the leased asset, and it owes the related lease obligation to the lessor.

Completeness The completeness assertion in this category relates to whether all disclo- sures that should have been included in the financial statements have been included. There- fore, management asserts that no material disclosures have been omitted from the footnotes and other disclosures accompanying the financial statements.

Classification and Understandability The assertions related to classification and understandability address whether the financial information is appropriately presented and described, and disclosures are clearly expressed. For example, management asserts that the portion of long-term debt shown as a current liability will mature in the current year. Similarly, management asserts that all major restrictions on the entity resulting from debt covenants are disclosed in footnotes and are able to be understood by the users of the financial statements.

Accuracy and Valuation The accuracy and valuation assertions address whether finan- cial and other information is disclosed fairly and in appropriate amounts. For example, when management discloses the fair value of stock or bond investments, it is asserting that these financial instruments are properly valued in accordance with GAAP. In addition, management may disclose in a footnote other information related to financial instruments.

Stop and Think: Consider how auditors use the sets of management assertions we have just discussed.

The assertions collectively provide a road map for the auditor in determining what evi- dence to collect regarding various transactions, account balances, and required financial statement disclosures. The auditor determines the type of evidence to gather by considering what possible misstatements could occur. Table 5–3 shows the management assertions for

Management Assertions, Possible Misstatements, and Illustrative Audit Procedures

Management Assertions for the Accounts Receivable Component of the Financial Statements Possible Misstatement Example Audit Procedures for Accounts Receivable

Existence Fictitious customer. Confirm accounts receivable.

Rights and obligations Receivables have been sold or factored. Inquire of management whether receivables have been sold.

Completeness Customer accounts are not recorded. Agree total of accounts receivable subsidiary led- ger to accounts receivable control account.

Valuation or allocation Delinquent receivable carried at full amount. Test the adequacy of the allowance for doubtful accounts.

T A B L E 5 – 3

Final PDF to printer

Chapter 5 Evidence and Documentation 135

mes32502_ch05_128-176.indd 135 10/05/15 02:15 PM

the accounts receivable balance. It also shows some of the misstatements that might occur if management’s assertions are not correct. For example, the existence assertion might not be met if the accounts receivable balance includes fictitious customers. Management assertions also guide the auditor in designing audit procedures to collect the needed evidence, as well as assisting the auditor in evaluating the appropriateness and sufficiency of the evidence. For example, the management assertions help the auditor focus his or her attention on all the various aspects of transactions, account balances, and required disclosures that need to be considered—they help the auditor ensure that “all the bases are covered.” As such, the three sets of management assertions constitute a powerful conceptual tool in the auditor’s toolbox.

The Concepts of Audit Evidence

Audit evidence is the information used by the auditor in arriving at the conclusions on which the audit opinion is based, and it includes the information contained in the accounting records underlying the financial statements and other information. A solid understanding of the char- acteristics of evidence is obviously an important conceptual tool for auditors as well as for professionals in a variety of other settings. The following concepts of audit evidence are important to understanding the conduct of the audit:

∙ The nature of audit evidence. ∙ The sufficiency and appropriateness of audit evidence. ∙ The evaluation of audit evidence.

The Nature of Audit Evidence The nature of the evidence refers to the form or type of information, which includes account- ing records and other available information. Accounting records include the records of ini- tial entries and supporting records, such as checks and records of electronic fund transfers; invoices; contracts; the general and subsidiary ledgers, journal entries, and other adjustments to the financial statements that are not reflected in formal journal entries; and records such as work sheets and spreadsheets supporting cost allocations, computations, reconciliations, and disclosures. Other information that the auditor may use as audit evidence includes minutes of meetings; confirmations from third parties; industry analysts’ reports; comparable data about competitors (benchmarking); controls manuals; information obtained by the auditor from such audit procedures as inquiry, observation, and inspection; and other information developed by, or available to, the auditor that permits the auditor to reach conclusions through valid reasoning.

For some entities, accounting records and other information may be available only in electronic form. Thus, source documents such as purchase orders, bills of lading, invoices, and checks are replaced with electronic messages or electronic images. In such cases, electronic evidence may exist at only a certain point in time and may not be retrievable later. This may require the auditor to select sample items several times during the year rather than at year-end.

The Sufficiency and Appropriateness of Audit Evidence Sufficiency is the measure of the quantity of audit evidence. Appropriateness is a measure of the quality of audit evidence. Sufficiency and appropriateness of audit evidence are inter- related. The auditor must consider both concepts when assessing risks and designing audit procedures.

The quantity of audit evidence needed is affected by the risk of material misstatement and by the quality of the audit evidence gathered. Thus, the greater the risk of material mis- statement, the more audit evidence is likely to be required to meet the audit test. And the higher the quality of the evidence, the less evidence that may be required to meet the audit test. Accordingly, there is an inverse relationship between the sufficiency and appropriateness of audit evidence.

LO 5-3

Final PDF to printer

136 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 136 10/05/15 02:15 PM

In most instances, the auditor relies on evidence that is persuasive rather than convinc- ing in forming an opinion on a set of financial statements. This occurs for two reasons. First, because an audit must be completed in a reasonable amount of time and at a reasonable cost, the auditor examines only a sample of the transactions that compose the account balance. Thus, the auditor reaches a conclusion about the account based on a subset of the available evidence.

Second, due to the nature of evidence, auditors must often rely on evidence that is not perfectly reliable. As discussed in the next section, the types of audit evidence have differ- ent degrees of reliability, and even highly reliable evidence has weaknesses. For example, an auditor can physically examine inventory, but such evidence will not ensure that obsolescence is not a problem. Therefore, the nature of the evidence obtained by the auditor seldom pro- vides absolute assurance about an assertion.

Evidence is considered appropriate when it provides information that is both relevant and reliable.

Relevance The relevance of audit evidence refers to its relationship to the assertion being tested. If the auditor relies on evidence that is unrelated to the assertion, he or she may reach an incorrect conclusion about the assertion. For example, suppose the auditor wants to check the completeness assertion for recording sales transactions; that is, all goods shipped to cus- tomers are recorded in the sales journal. A normal audit procedure for testing this assertion is to trace a sample of shipping documents (such as bills of lading) to the related sales invoices and entries in the sales journal. If the auditor samples the population of sales invoices issued during the period, the evidence would not relate to the completeness assertion (that is, the auditor would not detect shipments made that are not billed or recorded). Any conclusion based on the population of sales invoices would not be based on evidence relevant to testing the completeness assertion.

Reliability The reliability of evidence refers to whether a particular type of evidence can be relied upon to signal the true state of an assertion. The reliability of evidence is influenced by its source and by its nature and is dependent on the individual circumstances under which it is obtained.

∙ Independent source outside the entity. Evidence obtained by the auditor from an independent source outside the entity is usually viewed as more reliable than evidence obtained solely from within the entity. Thus, an external confirmation of the entity’s bank balance received directly by the auditor would be viewed as more reliable than examination of the cash balance as recorded in the general ledger. Additionally, evidence that is obtained from the entity, but that has been subjected to verification by an independent source, is viewed as more reliable than evidence obtained solely from within the entity. For example, a check written by the entity that has cleared the bank and been returned (referred to as a “cancelled check”) would be more reliable than a duplicate copy of the check because the cancelled check would be endorsed by the payee and cleared through an independent source (the bank).

∙ Effectiveness of internal control. A major objective of an entity’s system of internal control is to generate reliable information to assist management decision making. As part of the audit, the effectiveness of internal control is assessed. When the auditor assesses internal control as effective (that is, low control risk), evidence generated by that accounting system is viewed as reliable. Conversely, if internal control is assessed as ineffective (that is, high control risk), the evidence from the accounting system would not be considered reliable. Thus, the more effective the entity’s internal control, the more assurance it provides about the reliability of audit evidence.

∙ Auditor’s direct personal knowledge. Evidence obtained directly by the auditor is generally considered to be more reliable. For example, an auditor’s physical inspection of the entity’s inventory is considered to be relatively reliable because the

Final PDF to printer

Chapter 5 Evidence and Documentation 137

mes32502_ch05_128-176.indd 137 10/05/15 02:15 PM

auditor has direct personal knowledge regarding the inventory. There are, of course, exceptions to this general rule. For example, if an auditor examined an inventory composed of diamonds or specialty computer chips, the auditor may lack the expertise to appropriately assess the validity and valuation of such inventory items. In such cases, the auditor may need the skill and knowledge of a specialist to assist with the inventory audit.

∙ Documentary evidence. Audit evidence is more reliable when it exists in documentary form, whether paper, electronic, or other medium. Thus, a written record of a board of directors meeting is more reliable than a subsequent oral representation of the matters discussed.

∙ Original documents. Audit evidence provided by original documents is more reliable than audit evidence provided by photocopies or facsimiles. An auditor’s examination of an original, signed copy of a lease agreement is more reliable than a photocopy.

Practice I N S I G H T

If audit evidence obtained from one source is inconsistent with that obtained from another, or if the auditor has doubts about the reliability of information to be used as audit evidence, the auditor should perform the audit procedures necessary to resolve the matter and should determine the possible effect on other aspects of the audit (AS15, ¶29). For example, if responses to inquiries of management, internal audit, and others are inconsistent, the auditor must take steps to resolve such inconsistencies.

Determining the sufficiency and appropriateness of evidence are two of the more critical decisions the auditor faces on an engagement.

Stop and Think: Which of the following sources of evidence are more reliable?

∙ Inquiry of an accounts receivable clerk regarding the accounts receivable balance or accounts receivable confirmations sent to a sample of customers.

∙ Physical examination of lumber inventory performed by the external auditor or physical examination of inventory performed by internal auditors.

The Evaluation of Audit Evidence The ability to evaluate evidence appropriately is another important skill an auditor must develop. Proper evaluation of evidence requires that the auditor understand the types of evi- dence that are available and their relative reliability or diagnosticity. The auditor must be capable of assessing when a sufficient amount of appropriate evidence has been obtained in order to determine the fairness of management’s assertions.

In evaluating evidence, an auditor should be thorough in searching for evidence and unbiased in its evaluation. For example, suppose an auditor decides to mail accounts receivable confirmations to 50 of the largest customers of an entity that has a total of 5,000 customer accounts receivable. Even if some of the 50 customers do not respond directly to the auditor, the auditor must gather sufficient evidence on each of the 50 accounts, which could include searching for subsequent cash receipts, shipping docu- ments, invoices, and so forth. In evaluating evidence, the auditor must remain objective and must not allow the evaluation of the evidence to be biased by other considerations. To illustrate, in evaluating a credit manager’s response to an audit inquiry, the auditor must not allow any personal factors (e.g., the credit manager is likeable and friendly) to influ- ence the evaluation of the response.

Final PDF to printer

138 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 138 10/05/15 02:15 PM

Audit Procedures for Obtaining Audit Evidence

Audit procedures are specific acts performed by the auditor to gather evidence about whether specific assertions are being met. As discussed in Chapter 3, there are three categories of audit procedures. Each serves the following purposes:

∙ Risk assessment procedures. Used to obtain an understanding of the entity and its environment, including its internal control, to assess the risks of material misstatement at the financial statement and relevant assertion levels.

∙ Tests of controls. Used to test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the relevant assertion level. Tests of controls are discussed in more detail in Chapter 6.

∙ Substantive procedures. Used to detect material misstatements at the relevant assertion level. Substantive procedures include tests of details and substantive analytical procedures.

A set of audit procedures prepared to test assertions for a component of the financial state- ments is usually referred to as an audit program. Table 5–3 illustrates an audit procedure for each assertion related to the audit of accounts receivable. The reader should note that there is not a one-to-one relationship between assertions and audit procedures. In some instances more than one audit procedure is required to test an assertion. Conversely, in some cases an audit procedure provides evidence for more than one assertion.

The following types of evidence may be gathered during the application of risk assess- ment procedures, tests of controls, or substantive procedures, depending on the context in which the auditor applies them.

∙ Inspection of records or documents. ∙ Inspection of tangible assets. ∙ Observation. ∙ Inquiry. ∙ Confirmation. ∙ Recalculation. ∙ Reperformance. ∙ Analytical procedures. ∙ Scanning.

Inspection of Records or Documents Inspection consists of examining internal or external records or documents that are in paper form, electronic form, or other media. On most audit engagements, inspection of records or documents makes up the bulk of the evidence gathered by the auditor. Two issues are impor- tant in discussing inspection of records or documents: the reliability of such evidence and its relationship to specific assertions.

Reliability of Records or Documents A previous section noted the independence of the source of evidence as a factor that affects the reliability of audit evidence. In particu- lar, evidence obtained from a source outside the entity is generally considered more reliable than evidence obtained solely from within the entity. Typically, a distinction is made between internal and external documents. Internal documents are generated and maintained within the entity; that is, these documents have not been seen by any party outside the entity’s organiza- tion. Examples include duplicate copies of sales invoices and shipping documents. External documents are of two forms: documents originating within the entity but circulated to inde- pendent sources outside the entity and documents generated outside the entity but included

LO 5-4

Final PDF to printer

Chapter 5 Evidence and Documentation 139

mes32502_ch05_128-176.indd 139 10/05/15 02:15 PM

in the entity’s accounting records. Examples of the first include remittance advices returned with cash receipts from customers and payroll checks, while examples of the second include bank statements and vendors’ invoices.

In general, external documentary evidence is viewed as more reliable than internal evi- dence because a third party either initiated or reviewed it. However, the difference in reliabil- ity between internal and external documents depends on a number of factors, including the reliability of controls over preparation and storage of internal documents, and various factors affecting the reliability of external documents.

Relationship of Documentary Evidence to Assertions The second issue concerning records or documents relates directly to the occurrence and completeness assertions and to the direction of testing taken when documentary evidence is examined. Figure 5–2 presents an overview of this relationship.

The direction of testing between the accounting records and source documents (such as sales invoices or shipping documents) is important when testing the occurrence and complete- ness assertions. Vouching refers to selecting an item for testing from the accounting journals or ledgers and then examining the underlying source document. Thus, the direction of testing is from the journals or ledgers back to the source documents. This approach provides evidence that items included in the accounting records have occurred (or are valid transactions). For example, an auditor may want to examine a sample of sales transactions from the sales journal to ensure that sales are not fictitious. If adequate source documents exist for each sales trans- action selected from the sales journal, the auditor can conclude that each sale was valid. Trac- ing refers to first selecting a source document and then following it into the journal or ledger. The direction of testing in this case is from the source documents to the journals or ledgers. Testing in this direction ensures that transactions that occurred are recorded (completeness) in the accounting records. For example, if the auditor selects a sample of shipping documents and traces them to the related sales invoices and then to the sales journal, he or she would have evidence on the completeness of sales.

Stop and Think: Think about how the direction of testing relates to the completeness and occurrence assertions and why this is an important concept for auditors to under- stand. Review the following two examples and determine (1) if you are vouching or tracing and (2) if the test relates to either the occurrence or completeness assertion:

∙ Select a sample of purchase transactions included in the purchases journal and ensure that they are supported by receiving documents.

∙ Select a sample of receiving documents for inventory received and ensure that the inventory is recorded in the perpetual inventory records.

Inspection of Tangible Assets Inspection of tangible assets consists of physical examination of the assets. Inspection is a relatively reliable type of evidence that involves the auditor inspecting or counting a tangible asset. An audit engagement includes many situations in which the auditor physically examines

Vouching (Occurrence)

Tracing (Completeness)

Source document

Journal or

ledger

Direction of Testing for Validity and CompletenessF I G U R E 5 – 2

Final PDF to printer

140 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 140 10/05/15 02:15 PM

an entity’s assets. Some examples might be counting cash on hand, examining inventory or marketable securities, and examining tangible fixed assets. This type of evidence primarily provides assurance that the asset exists. In some instances, such as examining inventory, phys- ical examination may provide evidence on valuation by identifying items that are obsolete or slow-moving. However, physical examination provides little or no assurance for the rights and obligations assertion.

Observation Observation consists of looking at a process or procedure being performed by others. The actions being observed typically do not leave an audit trail that can be tested by examining records or documents. Examples include observation of the performance of control activi- ties and the observation of the counting of inventories by the entity’s personnel. Observation provides audit evidence about the performance of a process or procedure but is limited to the point in time at which the observation takes place. It is also limited by the fact that the entity’s personnel may act differently when the auditor is not observing them. Observation is useful in helping auditors understand the entity’s processes but is generally not considered very reliable and thus generally requires additional corroboration by the auditor. Corroborating evidence includes data or documents from the accounting records and other documentary information (e.g., contracts and written confirmations).

Practice I N S I G H T

Do not confuse the technical auditing definition of the term observation with the common usage of the word. Students often use the term observation to describe such audit procedures as inspection of tangible assets or documents and records. However, “observation” in the auditing sense con- sists of looking at a process or procedure being performed by others. Technical terms, or jargon, serve an important role in efficient professional communication, and you will want to develop the proper vocabulary. Just as technical accounting terms such as revenue and income are not used interchangeably by professional accountants, professional auditors do not use observation and inspection interchangeably.

Inquiry Inquiry consists of seeking information of knowledgeable persons (both financial and nonfi- nancial) within the entity or outside the entity. Inquiry is an important audit procedure that is used extensively throughout the audit and often is complementary to performing other audit procedures. For example, much of the audit work conducted to understand the entity and its environment including internal control involves inquiry.

Inquiries may range from formal written inquiries to informal oral inquiries. Evaluating responses to inquiries is an integral part of the inquiry process. Table 5–4 provides guidance for conducting and evaluating inquiries.

Responses to inquiries may provide the auditor with information not previously possessed or with corroborative audit evidence. Alternatively, responses might provide information that differs significantly from other information that the auditor has obtained, for example, infor- mation regarding the possibility of management override of controls. The reliability of audit evidence obtained from responses to inquiries is also affected by the training, knowledge, and

Techniques for Conducting and Evaluating Inquiries

In conducting inquiry, the auditor should:

• Consider the knowledge, objectivity, experience, responsibility, and qualifications of the individual to be questioned. • Ask clear, concise, and relevant questions. • Use open or closed questions appropriately. • Listen actively and effectively. • Consider the reactions and responses and ask follow-up questions. • Evaluate the response.

T A B L E 5 – 4

Final PDF to printer

Chapter 5 Evidence and Documentation 141

mes32502_ch05_128-176.indd 141 10/05/15 02:15 PM

experience of the auditor performing the inquiry, because the auditor analyzes and assesses responses while performing the inquiry and refines subsequent inquiries according to the cir- cumstances. In some cases, the nature of the response may be so significant that the auditor requests a written representation from the source.

Inquiry alone ordinarily does not provide sufficient audit evidence, and the auditor will gather additional corroborative evidence to support the response.

Confirmation A confirmation represents audit evidence obtained by the auditor as a direct written response to the auditor from a third party (the confirming party) in paper form or by electronic or other medium. Confirmations also are used to obtain audit evidence about the absence of certain conditions, for example, the absence of a “side agreement” that may influence revenue rec- ognition. Auditors usually use the term inquiry to refer to unwritten questions asked of the entity’s personnel or of a third party, and the term confirmation to refer to written requests for a written response from a third party.

The reliability of evidence obtained through external confirmations may be affected by factors such as

∙ The form of the confirmation. ∙ Prior experience with the entity. ∙ The nature of the information being confirmed. ∙ The intended respondent.

Confirmations are used extensively on audits; they generally provide reliable evidence for the existence assertion and, in testing certain financial statement components (such as accounts payable), can provide evidence about the completeness assertion. Evidence about other assertions can also be obtained through the use of confirmations. For example, an audi- tor can send a confirmation to a consignee to verify that an entity’s inventory has been con- signed. The returned confirmation provides evidence that the entity owns the inventory (rights and obligations assertion). Table 5–5 lists selected amounts and information confirmed by auditors. Accounts receivable, accounts payable, and bank confirmations are discussed in more detail in later chapters.

Recalculation Recalculation consists of checking the mathematical accuracy of documents or records. Recalculation can be performed manually or through the use of information technology (e.g., by obtaining an electronic file from the entity and using computer-assisted audit techniques, or CAATs, to check the accuracy of the summarization of the file). Specific examples of this type of procedure include recalculation of depreciation expense on fixed assets and recalcula- tion of accrued interest. Recalculation also includes footing, crossfooting, reconciling subsid- iary ledgers to account balances, and testing postings from journals to ledgers. Because the auditor creates this type of evidence, it is normally viewed as highly reliable.

Amounts and Information Frequently Confirmed by Auditors

Amounts or Information Confirmed Source of Confirmation

Cash balance Accounts receivable Inventory on consignment Accounts payable Bonds payable Common stock outstanding Insurance coverage Collateral for loan

Bank Individual customers Consignee Individual vendors Bondholders/trustee Registrar/transfer agent Insurance company Creditor

T A B L E 5 – 5

Final PDF to printer

142 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 142 10/05/15 02:15 PM

Reperformance Reperformance involves the independent execution by the auditor of procedures or controls that were originally performed by company personnel. For example, the auditor may reper- form the aging of accounts receivable. Again, because the auditor creates this type of evi- dence, it is normally viewed as highly reliable.

Analytical Procedures Analytical procedures are an important type of evidence. They consist of evaluations of finan- cial information through analysis of plausible relationships among both financial and non- financial data. For example, the current-year accounts receivable balance can be compared to the prior-years’ balances after adjusting for any increase or decrease in sales and other economic factors. Similarly, the auditor might compare the current-year gross margin per- centage to the gross margin percentage for the previous five years. The auditor makes such comparisons either to identify accounts that may contain material misstatements and require more investigation or as a reasonableness test of the account balance. Analytical procedures are an effective and efficient form of evidence.

Analytical procedures can be used by an auditor to accomplish three purposes:

1. Risk assessment procedures to assist the auditor to better understand the business and to plan the nature, timing, and extent of audit procedures (sometimes referred to as planning or preliminary analytical procedures).

2. Substantive analytical procedures are used as a substantive procedure to obtain evidential matter about particular assertions related to account balances or classes of transactions.

3. Final analytical procedures are used as an overall review of the financial information in the final review stage of the audit.

The reliability of analytical procedures is a function of (1) the availability and reliability of the data used in the calculations, (2) the plausibility and predictability of the relation- ship being tested, and (3) the precision of the expectation and the rigor of the investigation. Because of the importance of this type of evidence in auditing, analytical procedures are cov- ered in greater detail in Advanced Module 1.

Scanning Scanning is the auditor’s exercise of professional judgment to review accounting data to iden- tify significant or unusual items to test. This includes searching for large and unusual items in the accounting records (e.g., nonstandard journal entries), as well as reviewing transaction data (e.g., expense accounts, adjusting journal entries) for indications of errors that have occurred. It might be used in conjunction with analytical procedures but also as a stand-alone procedure. Scanning can be performed either manually or through the use of CAATs.

Reliability of the Types of Evidence

Table 5–6 presents a hierarchy of the reliability of the types of evidence. Refer to the earlier discussion about the relevance and reliability of evidence to help you understand the distinc- tions being made here. Inspection of tangible assets, reperformance, and recalculation are generally considered of high reliability because the auditor has direct knowledge about them. Inspection of records and documents, confirmation, analytical procedures, and scanning are generally considered to be of medium reliability. The reliability of inspection of records and documents depends primarily on whether a document is internal or external, and the reliabil- ity of confirmation is affected by the four factors listed previously. The reliability of analytical procedures may be affected by the availability and reliability of the data. Finally, observation and inquiry are generally low-reliability types of evidence because both require further cor- roboration by the auditor.

LO 5-5

Final PDF to printer

Chapter 5 Evidence and Documentation 143

mes32502_ch05_128-176.indd 143 10/05/15 02:15 PM

General Guidelines for the Reliability Hierarchy by Evidence Type

General Reliability Relationship* Types of Evidence

Higher Inspection of tangible assets, reperformance, recalculation

Inspection of records and documents, confirmation, analytical proce- dures, scanning

Lower Observation, inquiry

*This figure illustrates general hierarchical guidelines. The reliability of the evidence will depend on the facts and circumstances. For example, confirmations may be highly reliable in some circumstances.

T A B L E 5 – 6

The reader should understand, however, that the levels of reliability shown in Table 5–6 are general guidelines. The reliability of the types of evidence may vary considerably across entities, and it may be subject to a number of exceptions. For example, in some circumstances, confirmations may be viewed as a highly reliable source of evidence. This may be true when a confirmation is sent to an independent third party who is highly qualified to respond to the auditor’s request for information. Inquiries of entity personnel or management provide another example.

The Audit Testing Hierarchy

Now that we’ve introduced you to the types of audit procedures and the types of evidence that these procedures are used to gather, you are ready to be introduced to the thought process auditors use in choosing audit tests and the order in which they are to be performed. The over- all decision approach used to gather evidence is depicted in Figure 5–3 and is referred to in later chapters as the audit testing hierarchy.

After the auditor has gathered sufficient evidence about the entity and its environment using risk assessment procedures, the audit testing hierarchy starts with tests of controls and substantive analytical procedures. Starting with tests of controls and substantive ana- lytical procedures is generally both more effective and more efficient than starting with tests of details.

∙ Applying the audit testing hierarchy is more effective. The auditor’s understanding and testing of controls influence the scope (nature, timing, and extent) of substantive testing and enhance the auditor’s ability to hone in on areas where misstatements are more likely to be found. If controls are highly effective, less extensive substantive procedures (i.e., substantive analytical procedures and tests of details) will need to be performed. Similarly, substantive analytical procedures can direct attention to higher- risk areas where the auditor can design and conduct focused tests of details.

∙ Applying the audit testing hierarchy is more efficient. Generally, tests of controls and substantive analytical procedures are less costly to perform than are tests of details. This is usually because tests of controls and substantive analytical procedures provide assurance on multiple transactions. In other words, by testing controls and related processes, the auditor generally gains a degree of assurance over thousands or even millions of transactions. Furthermore, substantive analytical procedures often provide evidence related to more than one assertion and often more than one balance or class of transactions. On the other hand, tests of details often only obtain assurance related to one or two specific assertions pertaining to the specific transaction(s) or balance tested.

Auditing standards require that auditors perform substantive procedures for significant account balances and classes of transactions regardless of the assessed risk of material mis- statement. In other words, assurance obtained solely from testing controls is not sufficient for significant balances and classes of transactions. For high-risk areas or highly material

LO 5-6

Final PDF to printer

144 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 144 10/05/15 02:15 PM

Is additional substantive evidence

needed?

After assessing the

potential e�ectiveness of internal controls, will tests

of controls be conducted? The answer is always yes

for most public companies.

Can e�ective* and

e�cient substantive analytical procedures be

performed?

Yes

Perform tests of controls.

Yes

Perform substantive analytical procedures.

Yes

Perform substantive tests of details on transactions and/or balances.

Document results.

*i.e., su�ciently precise to provide assurance about an assertion.

Audit Testing Hierarchy: An Evidence Decision Process for Testing Classes of Transactions or Significant Balances

F I G U R E 5 – 3

Final PDF to printer

Chapter 5 Evidence and Documentation 145

mes32502_ch05_128-176.indd 145 10/05/15 02:15 PM

accounts, the auditors will almost always perform some tests of details in addition to tests of controls and substantive analytical procedures.

The decision process depicted in Figure 5–3 recognizes that, for some assertions, tests of details may be the only form of substantive evidence used because in some cases it may be more efficient and effective to move directly to tests of details. Examples of situations where the auditor might move directly to tests of details include a low volume of large transactions (e.g., two large notes payable issued) and poor controls resulting in entity data that are unreli- able for use in substantive analytical procedures.

An “Assurance Bucket” Analogy We have found that an analogy often helps students understand and visualize how an audi- tor decides on the proper mix of testing and evidence. Figure 5–4 illustrates what we call the “assurance bucket.” The assurance bucket must be filled with sufficient appropriate evidence to obtain the level of assurance necessary to support the auditor’s opinion. Following the top-down audit testing hierarchy means that the auditor first begins to fill the bucket with evi- dence from the risk assessment procedures. In Figure 5–4, after completing risk assessment procedures, the auditor sees that the assurance bucket for a particular account and assertion is about 20 percent full. The auditor would next conduct control testing. In our example, control testing might add about another 30 percent to the bucket. How would the auditor know just how full the bucket is after testing controls? This is clearly a very subjective evaluation, and it is a matter of professional judgment.

The auditor next performs substantive analytical procedures and adds the assurance gained from these procedures to the bucket. In Figure 5–4 the bucket is now about 70 percent full. In this illustration, the auditor would need to top off the assurance bucket with evidence obtained through tests of details.

For lower-risk, well-controlled accounts, the assurance bucket may be entirely filled with tests of controls and substantive analytical procedures. For other accounts or assertions, the bucket may be filled primarily with tests of details.

The size of the assurance bucket can vary, depending on the auditor’s risk assessment and the assertion being tested. Obviously, certain assertions will be more important or present

Risk Assessment Procedures

20%

Substantive Analytical Procedures

20%

Remaining assurance needed from tests of details

30%

Tests of Controls 30%

A S S U R A N C E

D E S I R E D

EvidenceEvidence

Filling the Assurance BucketF I G U R E 5 – 4

Final PDF to printer

146 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 146 10/05/15 02:15 PM

Substantive analytical

procedures

Controls testing and risk assessment

procedures Test of details

Completeness Accuracy Cuto� Presentation and

disclosure

Existence or

occurrence

Valuation Rights and obligations

Accounts Payable Example of Filling the Assurance Buckets for Each Assertion

F I G U R E 5 – 5

bigger risks for some accounts than for others. For instance, existence (or validity) is typi- cally more important for accounts receivable than it is for accounts payable. After the auditor has determined the risks associated with the assertions for an account balance, she or he can determine the size of the assurance buckets (i.e., how much assurance is needed) and then begin filling the buckets by applying the audit testing hierarchy. Figure 5–5 illustrates these concepts for accounts payable. Note that the largest bucket is for the completeness assertion, because with liability accounts the auditor is primarily concerned with potential understate- ment errors; that is, unrecorded liabilities. The example in Figure 5–5 also illustrates that some assertions may be filled entirely with tests of details (e.g., rights and obligations) and that others may not require any tests of details (e.g., existence). Again, these are subjective matters that require considerable professional judgment.

Audit Documentation

Functions of Audit Documentation Now that we have covered evidence and the audit hierarchy, we discuss important issues related to audit documentation. Audit documentation is the record of audit procedures per- formed, relevant audit evidence obtained, and conclusions the auditor reached. Audit doc- umentation is also referred to as working papers or the audit file. You can think of audit documentation as the “story” of the audit.

Audit documentation has three functions: (1) to provide principal support for the rep- resentation in the auditor’s report that the audit was conducted in accordance with GAAS; (2) to aid in the planning, performance, and supervision of the audit; and (3) to provide the basis for the review of the quality of the work by providing a written documentation of the evidence supporting the auditor’s significant conclusions. The form and content of the audit documentation are a function of the circumstances of the specific engagement.

LO 5-7

Final PDF to printer

Chapter 5 Evidence and Documentation 147

mes32502_ch05_128-176.indd 147 10/05/15 02:15 PM

Support for the Audit Report When the engagement is complete, the auditor must decide on the appropriate type of report to issue. The basis for this decision rests in the audit evidence gath- ered and the conclusions reached and documented in the working papers. The working papers also document that the scope of the audit was adequate for the report issued. Information on the correspondence of the financial statements with GAAP is also included in the working papers.

Planning, Performance, and Supervision of the Audit The working papers document the auditor’s compliance with auditing standards. In particular, working papers document the auditor’s compliance with the standards of fieldwork. The planning of the engagement, along with the execution of the audit plan, is contained in the working papers.

Working Paper Review The working papers are also the focal point for reviewing the work of subordinates and for quality control reviewers.

Content of Audit Documentation Audit documentation is the principal record of the audit. Because audit documentation pro- vides the principal support for the representations in the auditor’s report, it should

∙ Demonstrate how the audit complied with auditing and related professional practice standards.

∙ Support the basis for the auditor’s conclusions concerning each material financial statement assertion.

∙ Demonstrate that the underlying accounting records agreed or reconciled with the financial statements.

Audit documentation should include an audit program (or set of audit programs) for the engagement. The audit program should set forth in reasonable detail the auditing procedures that the auditor believed necessary to accomplish the objectives of the audit. Audit documen- tation should be sufficient to show that standards of fieldwork have been followed.

Audit documentation should enable a reviewer with relevant knowledge and experience to

∙ Understand the nature, timing, extent, and results of the procedures performed, evidence obtained, and conclusions reached.

∙ Determine who performed the work and the date such work was completed, as well as the person who reviewed the work and the date of such review.

The form, content, and extent of audit documentation depend on factors such as the size and complexity of the entity, the identified risks of material misstatement, the nature of the audit procedures to be performed, and other factors.

For audits of public companies, the PCAOB adds additional documentation requirements for “significant findings or issues,” actions taken to address them, and the basis for the con- clusions reached. Examples of significant findings or issues are shown in Table 5–7. The PCAOB also requires the auditor to identify all significant findings or issues in an engage- ment completion memorandum. This memorandum should be specific enough for a reviewer to gain a thorough understanding of the significant findings or issues.

When documenting the quantity of evidence gathered through inspection of documents or confirmation of balances, the auditor should identify the items tested. Where appropri- ate, the audit files should contain abstracts or copies of documents such as significant con- tracts or agreements. Table 5–8 presents the documentation requirements for items tested by the auditor.

LO 5-8

Practice I N S I G H T

Most firms use standard templates (e.g., for sampling applications) to record the results of their audit procedures, thus providing consistency in the manner in which evidence is recorded in the working papers.

Final PDF to printer

148 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 148 10/05/15 02:15 PM

Examples of Significant Findings or Issues That Require Documentation under PCAOB Auditing Standard No. 3

• Significant matters involving the selection, application, and consistency of accounting principles, including related disclosures (e.g., accounting for complex or unusual transactions and accounting estimates).

• Results of auditing procedures that indicate a need for significant modification of planned auditing procedures. • Audit adjustments and the ultimate resolution of these items. • Disagreements among members of the engagement team or with others consulted on the engagement about con-

clusions reached on significant accounting or auditing matters. • Significant changes in the assessed level of audit risk for particular audit areas and the auditor’s response to those

changes.

T A B L E 5 – 7

Documentation Requirements for Items Tested

The identification of the items tested may be satisfied by indicating the source from which the items were selected and the specific selection criteria:

• If an audit sample is selected from a population of documents, the documentation should include identifying char- acteristics (e.g., the specific check numbers of the items included in the sample).

• If all items over a specific dollar amount are selected from a population of documents, the documentation need describe only the scope and the identification of the population (e.g., all checks over $10,000 from the July cash disbursements journal).

• If a systematic sample is selected from a population of documents, the documentation need only provide an iden- tification of the source of the documents and an indication of the starting point and the sampling interval (e.g., a systematic sample of sales invoices was selected from the sales journal for the period from January 1 to October 1, starting with invoice number 375 and selecting every 50th invoice).

T A B L E 5 – 8

Examples of Information Included in Permanent and Current Files

Permanent File: Copies of, or excerpts from, the corporate charter Chart of accounts Organizational chart Copies of important contracts (pension contracts, union contracts, leases, etc.) Documentation of internal control (e.g., flowcharts) Terms of stock and bond issues Prior years’ analytical procedure results

Current File: Copy of financial statements and auditor’s report Audit plan and audit programs Copies of, or excerpts from, minutes of important committee meetings Working trial balance Adjusting and reclassification journal entries Working papers supporting financial statement accounts

T A B L E 5 – 9

Most public accounting firms maintain audit documentation in two types of files: perma- nent and current. Permanent files contain historical data about the entity that are of continuing relevance to the audit. Current files, on the other hand, include information and data related specifically to the current year’s engagement. Table 5–9 contains examples of the types of information included in each type of file.

Examples of Audit Documentation Audit documentation comes in a variety of types. The more common audit documentation includes the audit plan and programs, working trial balance, account analysis and listings, audit memoranda, and adjusting and reclassification entries.

LO 5-8

Final PDF to printer

Chapter 5 Evidence and Documentation 149

mes32502_ch05_128-176.indd 149 10/05/15 02:15 PM

Audit Plan and Programs The audit plan contains the strategy to be followed by the audi- tor in conducting the audit. This document outlines the auditor’s understanding of the entity and the potential audit risks. It contains the basic framework for how the audit resources (bud- geted audit hours) are to be allocated to various parts of the engagement. The audit programs contain the audit procedures that will be conducted by the auditor. Generally, each business process and account balance has a separate audit program.

Working Trial Balance The working trial balance links the amounts in the financial state- ments to the audit working papers. Exhibit 5–1 illustrates a partial working trial balance for EarthWear Clothiers. In addition to a column for account name, the trial balance contains columns for working paper references, the prior-year balances, the unadjusted current-year balances, and columns for adjusting and reclassification entries. The last column would agree to the amounts contained in the financial statements after combining common account bal- ances. A lead schedule is then used to show the detailed general ledger accounts that make up a financial statement category (cash, accounts receivable, and so on). For example, the trial balance would contain only one line for “cash and cash equivalents” and the “C lead” sched- ule would list all general ledger cash accounts. This approach is described in more detail later in the chapter.

Account Analysis and Listings Account analysis working papers generally include the activity in a particular account for the period. For example, Exhibit 5–2 shows the analysis of legal and audit expense for EarthWear Clothiers for the year ended December 31, 2015. Listings represent a schedule of items remaining in the ending balance of an account and are often called trial balances. For example, the auditor may obtain a listing of all amounts owed to vendors that make up the accounts payable balance as of the end of the year. This listing would represent a trial balance of unpaid vendors’ invoices.

Audit Memoranda Much of the auditor’s work is documented in written memoranda. These include discussions of items such as internal controls, inventory observation, errors identified, and problems encountered during the audit.

Adjusting and Reclassification Entries The audit documentation should also include the adjusting and reclassification entries identified by the auditor or the entity. Adjusting entries are made to correct misstatements in the entity’s records. For example, if the auditor discovered that certain inventory items were improperly valued, an adjusting entry would be proposed to correct the dollar misstatement. Adjusting entries are posted in both the entity’s records and the working trial balance.

Reclassification entries are made to properly present information on the financial state- ments. A reclassification entry affects income statement accounts or balance sheet accounts, but not both. For example, a reclassification entry might be necessary to present as a current liability the current portion of long-term debt.

An Example of a Partial Working Trial BalanceE X H I B I T 5 – 1

EARTHWEAR CLOTHIERS Partial Working Trial Balance

December 31, 2015

Account Description W/P Ref.

Balance 12/31/14

Balance 12/31/15

Adjustments Adjusted T/B

Reclassification Financial StatementsDR CR DR CR

Cash and cash equivalents Receivables Inventory Prepaid advertising

C lead E lead F lead G lead

$ 49,668 11,539

105,425 10,772

$ 48,978 12,875

122,337 11,458

Final PDF to printer

150 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 150 10/05/15 02:15 PM

Example of an Account Analysis Working PaperE X H I B I T 5 – 2

T20 GMP

2/4/16 EARTHWEAR CLOTHIERS

Analysis of Legal and Audit Expense 12/31/15

Date Payee Amount Explanation

Feb. 1 Katz & Fritz $ 28,500.00V For services related to a patent infringement suit by Gough Mfg. Co. Lawsuit was dismissed.

April 10 Willis & Adams 2,250,000.00V Annual audit fee.

Oct. 1 Katz & Fritz 26,200.00V Legal fee for patent infringement suit against Weshant, Inc.

Oct. 20 Smoothe, Sylk, Fiels, Goode & Associates

2,100.00V Legal services for a purchase contract with McDonald Merchandise, Inc.

2,306,800.00

F T/B

Tick Mark Legend V = Examined payees’ bills for amount and description. F = Footed. T/B = Agreed to trial balance. Conclusion: Based on the audit work performed, EarthWear’s legal and audit expense account is not materially misstated.

Format of Audit Documentation Audit documentation may be prepared in both hard copy and electronically. Whether the doc- umentation is prepared manually or electronically, the manner in which it is formatted usually contains three general characteristics.

Heading All audit documentation should have a proper heading. The heading should include the name of the entity, the title of the working paper, and the entity’s year-end date. Exhibit 5–2 shows a working paper with a proper heading.

Indexing and Cross-Referencing The audit documents must be organized so that mem- bers of the audit team or firm can find relevant audit evidence. Some firms use a lettering sys- tem; other firms use some type of numbering system. For example, the general working papers may be labeled “A,” internal control systems working papers “B,” cash working papers “C,” and so on. When the auditor performs audit work on one working paper and supporting information is obtained from another working paper, the auditor cross-references (it can be “linked” in audit software) the information on each working paper. This process of indexing and cross-referencing provides a trail from the financial statements to the individual audit documents that a reviewer can easily follow. Indexing and cross-referencing are discussed further in the next section.

Tick Marks Auditors use tick marks to document work performed. Tick marks are simply notations that are made by the auditor near, or next to, an item or amount on an audit docu- ment. The tick mark symbol is typically explained or defined at the bottom of the audit docu- ment, although many firms use a standard set of tick marks. Exhibit 5–2 shows some examples of tick marks. In this example of documentation, the tick mark “V” indicates that the auditor examined the bills sent to the entity by the payee for proper amount and description.

Many public accounting firms document their conclusions about individual accounts or components of the financial statements. Exhibit 5–2 shows an example of how an auditor might document a conclusion about an individual account.

LO 5-8

Final PDF to printer

Chapter 5 Evidence and Documentation 151

mes32502_ch05_128-176.indd 151 10/05/15 02:15 PM

Organization of Audit Documentation The audit documentation needs to be organized so that any member of the audit team (and reviewers) can find the audit evidence that supports each financial statement account. While auditing standards do not dictate how this should be accomplished, the following discussion presents a general approach that is commonly used.

The financial statements contain the accounts and amounts covered by the auditor’s report. These accounts come from the working trial balance, which summarizes the general ledger accounts contained on each lead schedule. Each lead schedule includes the general ledger accounts that make up the financial statement account. Different types of audit docu- mentation (account analysis, listings, confirmations, and so on) are then used to support each of the general ledger accounts. Each of these audit documents is indexed, and all important amounts are cross-referenced between audit documents.

Figure 5–6 presents an example of how audit documents could be organized to support the cash account. Note that the $15,000 shown on the balance sheet agrees to the working trial balance. The “A lead” schedule in turn contains the three general ledger accounts that are included in the $15,000 balance. Audit documents then support each of the general ledger accounts. For example, the audit documents indexed “A2” provide the audit evidence sup- porting the general cash balance of $12,000. Also note that each important amount is cross- referenced. For example, the balance per bank of $14,000 on “A2” is referenced to “A2.1” and the cash balance on “A2.1” is referenced back to “A2.”

LO 5-8

Practice I N S I G H T

Whether hard copy or electronic, never leave an unanswered question in the working papers. Con- sider the third general auditing standard, due professional care: could the auditor claim that due care was exercised if the auditor had a question but did not exercise sufficient due diligence to answer the question? Probably not, so it’s important to answer all questions and document all conclusions.

Ownership of Audit Documentation Audit documentation is the property of the auditor. This includes not only audit documents prepared by the auditor but also documents prepared by the entity at the request of the auditor. The auditor should retain audit documents for a reasonable period of time in order to meet the needs of his or her practice and legal record retention requirements.

Although the auditor owns the audit documents, they cannot be shown, except under cer- tain circumstances, to outside parties without the entity’s consent. Chapter 19 discusses the confidentiality of audit documentation.

Audit Document Archiving and Retention Legal and auditing standards have long required auditors to retain their audit files for a number of years after an audit report is filed. However, the events leading up to the Sarbanes-Oxley Act focused the spotlight on the practice of archiving and retaining audit documentation. Exhibit 5–3 describes Arthur Andersen’s federal indictment and conviction on obstruction of justice charges for deletions and alterations of audit documentation related to the Enron audit. The indictment and conviction ultimately led to the failure of Arthur Andersen. In the wake of the Enron-Andersen scandal, the Sarbanes-Oxley Act imposed new guidelines for audit file archiving and retention.

The Sarbanes-Oxley Act and the PCAOB standards require that audit documentation be retained for seven years from the date of completion of the engagement, as indicated by the date of the auditor’s report (or the date that fieldwork is substantially completed), unless a longer period of time is required by law (e.g., in cases involving pending or threatened law- suit, investigation, or subpoena). All documents that “form the basis of the audit or review” are required to be retained. Prior to Sarbanes, public accounting firms would not typically include in their working papers documentation that was inconsistent with the final conclu- sion of the audit team regarding a matter, nor would they include all internal correspondence

LO 5-8

Final PDF to printer

152 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 152 10/05/15 02:15 PM

Cash Accounts receivable * *

$15,000 42,000 * *

XYZ, Inc. Balance Sheet

12/31/15

Account No.

101 102 103

W/P Ref

A1 A2 A3

Petty cash Cash—General Cash—Payroll

Adjusted Balance

$ 500 12,000 2,500

$15,000

XYZ, Inc. Cash Lead Schedule

A lead

Balance per bank Add: Deposits in transit Less: Outstanding checks Balance per books

$14,000 2,000 4,000

$12,000

A2.1

To A lead

A2.2

XYZ, Inc. Bank Reconciliation

Cash * *

$15,000 * *

XYZ, Inc. Working Trial Balance

T/B

To T/B

Check No. 754

* *

Amount

* *

$ 246

$4,000

To A2

Listing of Outstanding Checks A2.2

Cash balance at bank $14,000 To A2

Bank Confirmation A2.1

An Example of the Organization of Audit DocumentsF I G U R E 5 – 6

leading up to a final decision. PCAOB standards also require that any document created, sent, or received, including documents that are inconsistent with a final conclusion, be included in the audit files for all significant matters.

Some states (e.g., New York and California) have adopted similar archiving and retention policies for all audits, including audits of nonpublic companies.

Final PDF to printer

Chapter 5 Evidence and Documentation 153

mes32502_ch05_128-176.indd 153 10/05/15 02:15 PM

Advanced Module 1: Analytical Procedures1

Auditing standards define analytical procedures as evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial data. Analytical pro- cedures can facilitate an effective audit by helping the auditor understand the entity’s busi- ness, directing attention to high-risk areas, identifying audit issues that might not be otherwise apparent, providing audit evidence, and assisting in the evaluation of audit results. Analytical procedures are also commonly used to gather substantive evidence because they are effective at detecting misstatements.2 Analytical procedures are also relatively inexpensive tests to perform.

The objectives of the analytical procedures and the facts and circumstances will dictate the type of analytical procedure used to form an expectation and the techniques involved in investigating a significant difference. Analytical procedures may range from the use of simple trend analysis to the use of complex regression models. The discussion of analytical proce- dures in this module is limited to the following three types of analytical procedures:

1. Trend analysis. 2. Ratio analysis. 3. Reasonableness analysis.

Table 5–10 provides definitions of the types of analytical procedures.

1See W. F. Messier, Jr., C. A. Simon, and J. L. Smith, “Two Decades of Behavioral Research on Analytical Proce- dures: What Have We Learned?” Auditing: A Journal of Practice & Theory (February 2013), pp. 139–182, for a discussion of current research on analytical procedures and for PCAOB criticisms of firms’ application of the various steps in the analytical review process. 2A. Eilifsen and W. F. Messier, Jr., “Auditor Detection of Misstatements: A Review and Integration of Empirical Research,” Journal of Accounting Literature 2000 (19), pp. 1–43, reviews the audit research on this issue.

LO 5-9

The Wholesale Destruction of Documents and the Indictment of Arthur Andersen

On March 14, 2002, a federal grand jury indicted Arthur Andersen, initiating the first criminal charge in the Enron bankruptcy. The one-count indictment, alleging obstruction of justice, read that for a one-month span in October and early November 2001, “Andersen . . . did knowingly, intentionally, and corruptly per- suade” employees to “alter, destroy, mutilate, and conceal.” The indictment charged that Arthur Andersen employees “were instructed by Andersen partners and others to destroy immediately documentation relating to Enron and told to work overtime if necessary to accomplish the destruction.” The indictment also called the destruction an “unparalleled initiative to shred physical documentation and delete com- puter files. Tons of paper relating to the Enron audit was promptly shredded as part of the orchestrated document destruction. The shredder at the Andersen office at the Enron building was used virtually con- stantly and, to handle the overload, dozens of large trunks filled with Enron documents were sent to Andersen’s main Houston office to be shredded.”

In November 2001, the SEC served Andersen with the anticipated subpoena relating to its work for Enron. In response, members of the Andersen team on the Enron audit were alerted finally that there could be “no more shredding” because the firm had been “officially served” for documents. During the trial, the only major issue of dispute between the government and defense was whether anyone at Arthur Andersen acted with intent to impede the regulatory proceeding prior to being “officially served.” The fate of Arthur Andersen hung on this single issue. Arthur Andersen’s specialists on securities regulation maintained that the firm never considered the possibility of a federal inquiry in fall 2001 at a time others in the firm were destroying documents related to Enron.

In June 2002, the federal jury convicted Arthur Andersen of obstruction of justice after 10 days of deliberation. Ironically, in interviews, jurors said that they reached their decision because an Arthur Andersen lawyer had ordered critical deletions to an internal memorandum, rather than because of the firm’s wholesale destruction of Enron-related documents (The New York Times, June 15, 2002).

On May 31, 2005, the Supreme Court overturned Arthur Andersen’s conviction. The court ruled unani- mously that the Houston jury that found Arthur Andersen LLP guilty of obstruction of justice was given overly broad instructions by the federal judge who presided at the trial. However, this ruling came too late to save Arthur Andersen.

E X H I B I T 5 – 3

Final PDF to printer

154 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 154 10/05/15 02:15 PM

Definitions of the Types of Analytical Procedures Used to Form Expectations*

Trend analysis is the analysis of changes in an account over time. Simple trend analyses compare last year’s account balance (the “expectation”) with the current balance. Trend analysis can also encompass multiple time periods and includes comparing recorded trends with budget amounts and with com- petitor and industry information. The number of time periods used is a function of predictability and desired precision.

Ratio analysis is the comparison, across time or to a benchmark, of relationships between financial statement accounts (e.g., return on equity) or between an account and nonfinancial data (e.g., cost per square foot or sales per item). Ratio analysis also includes “common-size” analysis, which is the conver- sion of financial statement amounts to percentages. Industry or competitor ratios are often used to benchmark the entity’s performance. Ratio analysis is often more effective at identifying risks and potential misstatements than trend analysis because comparisons of relationships between accounts and operating data are more likely to identify unusual patterns than is an analysis only focused on an individual account.

Reasonableness analysis involves forming an expectation using a model. For example, ticket revenue can be modeled by taking average attendance by average ticket price. Similarly, depreciation expense can be modeled by taking book value divided by average useful life for a class of assets. Because it forms an explicit expectation, reasonableness analysis typically forms a more precise expectation than trend or ratio analysis.

*Regression analysis is another type of analytical procedure. Because it involves relatively complex statistical modeling in audit settings, we do not discuss it in this text.

T A B L E 5 – 1 0

Substantive Analytical Procedures Figure 5–7 presents an overview of the auditor’s decision process when using substantive analytical procedures to collect audit evidence.

Develop an Expectation The first step in the decision process is to develop an expecta- tion for the amount or account balance. This is the most important step in performing ana- lytical procedures. Auditing standards require the auditor to have an expectation whenever analytical procedures are used. An expectation can be developed for an analytical procedure from a variety of sources, such as

∙ Financial and operating data ∙ Budgets and forecasts. ∙ Industry publications. ∙ Competitor information. ∙ Management’s analyses. ∙ Analysts’ reports.

The quality of an expectation is referred to as the precision of the expectation. Preci- sion is a measure of the potential effectiveness of an analytical procedure; it represents the degree of reliance that can be placed on the procedure. Precision is a measure of how closely the expectation approximates the “correct” but unknown amount. The degree of desired precision will differ with the specific purpose of the analytical procedure. The precision of the expectation is a function of the materiality and required detection risk for the assertion being tested. If the assertion being tested requires a low level of detection risk, the expecta- tion needs to be very precise. However, the more precise the expectation, the more extensive and expensive the audit procedures used to develop the expectation, which results in a cost- benefit trade-off.

Four factors (Disaggregation, The Plausibility and Predictability of the Relationship Being Studied, Data Reliability, and Type of Analytical Procedure Used to Form an Expecta- tion) affect the precision of analytical procedures.

Practice I N S I G H T

The PCAOB inspection teams have identified audit deficiencies, many of which had to do with ana- lytical procedures. In one audit, the firm failed to develop expectations that were precise enough to identify material misstatements, whether individually or in the aggregate. In another audit, the firm developed its expectation using the same data from which the actual account balance was formed. The firm failed to test the data before using these data to create its expectation (PCAOB Release 104-2009-064, 104-2008-069, and 104-2008-146).

Final PDF to printer

Chapter 5 Evidence and Documentation 155

mes32502_ch05_128-176.indd 155 10/05/15 02:15 PM

Is the di�erence

greater than the tolerable

di�erence?

Develop an expectation.

Define a tolerable di�erence.

Compare the expectation to recorded amount.

Investigate di�erence. Consider patterns, trends, relationships, and possible

causes. Make inquiries of management and obtain corroborative evidence.

Yes

Conduct other audit procedures or propose

an audit adjustment.

Document results.Accept amount.

Are explanation(s)

and corroborative evidence

adequate?

Overview of the Auditor’s Decision Process for Substantive Analytical Procedures

F I G U R E 5 – 7

Disaggregation The more detailed the level at which an expectation is formed, the greater the precision. For example, expectations formed using monthly data will be more precise than expectations formed using annual data. Analytical procedures conducted to provide substantive evidence normally cannot be performed at aggregated levels (e.g., annual data, total revenues). Misstatements are difficult to detect when analyzing data at aggregate levels, due to offsetting trends or activities that can mask risks and misstatements. Examples later in the chapter illustrate this concept.

The Plausibility and Predictability of the Relationship Being Studied The primary concern with plausibility is simply whether the relationship used to test the asser- tion makes sense. For example, it is usually plausible to expect that an increase in sales should lead to an increase in accounts receivable. Many factors, including changes in the business or industry, influence the predictability of relationships among financial and nonfinancial data.

Final PDF to printer

156 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 156 10/05/15 02:15 PM

Income statement items tend to be more predictable than balance sheet items because income statement accounts involve transactions over a period of time, whereas balance sheet accounts represent amounts at a specific point in time. The more plausible and predictable the relation- ship, the more precise the expectation.

Data Reliability The ability to develop precise expectations is influenced by the reliability of the available data. The reliability of data for developing expectations depends on the independence of the source of the evidence, the effectiveness of internal controls, and the auditor’s direct personal knowledge. In addition, data for analytical procedures are more reliable when the data are subjected to audit in the current or prior periods and when the expectation is developed from multiple sources of data.

Type of Analytical Procedure Used to Form an Expectation The three types of analytical procedures discussed earlier (trend, ratio, and reasonableness analysis) represent different ways to form an expectation. In general, trend analysis is the least precise method used and reasonableness analysis is the most precise. All three types are used for substantive analytical procedures, but reasonableness analysis is not commonly used for preliminary or final analytical procedures.

Examples of Expectations Formed by Analytical Procedures Proper application of analytical procedures requires that the auditor have knowledge of the entity’s business and industry. Without such knowledge, the auditor may be unable to develop appropriate expecta- tions or properly evaluate the results of the procedures. The auditor can use a number of differ- ent analytical procedures to form expectations. Some common examples include the following:

Comparison of Current-Year Financial Information with Comparable Prior Period(s) after Consideration of Known Changes. This is perhaps the most commonly used analytical pro- cedure. The comparison of financial statement amounts can be done using absolute amounts (i.e., trend analysis) or by converting the financial statement amounts to “common-size” financial statements (ratio analysis). Exhibit 5–4 presents an example of a common-size income statement for EarthWear for 2015–2013. An auditor may compare the amounts shown for the three years and investigate those amounts that are out of line by some predetermined cutoff percentage or absolute amount.

Stop and Think: Examine the financial data presented in Exhibit 5–4. Using your developing skills as an auditor, consider one or two trends or ratios that would cause you as an auditor to pause and want to investigate further.

For example, the auditor can compare the current-year gross profit balance with the prior year’s balance. Referring to Exhibit 5–4, we see that gross profit has increased in abso- lute amounts from $385.1 million to $404.1 million but decreased in percentage terms from 44.89 to 42.51 percent. Because this type of analytical procedure is typically performed on the aggregated companywide financial statements, the expectation that the current-year gross profit percentage will be the same as the prior year is relatively imprecise. Thus, it is typi- cally not considered particularly useful for providing substantive evidence about a particular account balance or class of transactions. To illustrate the effect of conducting analytical pro- cedures at aggregated companywide levels, consider what effect this decline in gross profit percentage has on income from operations. Recall from Chapter 3 that planning materiality for EarthWear was set at $1,800,000 and tolerable misstatement was set at $900,000. Income from operations declined from $51.3 million to $40.1 million. The 2.38 percentage point (44.89 to 42.51) decrease in gross profit resulted in income from operations being approxi- mately $22.62 million lower than expected (sales = $950.4 × .0238). However, this analysis does not provide appropriate evidence to explain the increase in cost of sales. The auditor

Final PDF to printer

Chapter 5 Evidence and Documentation 157

mes32502_ch05_128-176.indd 157 10/05/15 02:15 PM

would have to perform additional procedures to corroborate the increase in cost of sales. This simple example highlights that it is difficult to obtain useful audit evidence from high-level companywide analytical procedures because the expectations are typically not sufficiently precise. In other words, whether or not the auditor observes a significant difference using a year-to-year comparison may be useful for planning purposes, but it would provide little or no audit evidence because of the imprecision of the expectation.

Comparison of Current-Year Financial Information with Budgets, Projections, and Forecasts. This technique is usually performed using trend analysis and is similar to the previous example except that the current-year budget, projection, or forecast represents the expectation (rather than the expectation being provided by prior-year data). For example, the auditor can test the fairness of advertising expense by comparing the current-year amount to the entity’s budget and investigating differences.

Relationships among Elements of Financial Information within the Current Period. There are many examples of one element in the financial statements directly relating to another ele- ment. This is particularly true for the association between certain balance sheet accounts and their related income or expense accounts. In these situations, reasonableness analysis is typi- cally used to model the association.

Stop and Think: Taking this information into account, consider some of the relation- ships between income statement and balance sheet accounts you would expect to see in a growing company. Ask yourself what the relationship would normally be between sales and accounts receivable. What about the relationship between the balance for long-term debt and interest expense?

Later in the module we present a comprehensive example of an interest expense reason- ableness test for EarthWear Clothiers.

Comparison of the Entity’s Financial Information with Industry Data. The auditor can compare the entity’s financial ratios (receivable turnover, inventory turnover, and so on)

Common-Size Income Statement for EarthWear Clothiers (in thousands)E X H I B I T 5 – 4

December 31

2015 2014 2013

Net Sales $950,484 100.00% $857,885 100.00% $891,394 100.00% Cost of sales 546,393 57.49% 472,739 55.11% 490,530 55.03% Gross Profit 404,091 42.51% 385,146 44.89% 400,864 44.97% Selling, general, and administrative expenses 364,012 38.30% 334,994 39.05% 353,890 39.70% Nonrecurring charge (credit) — ________ (1,153) -0.13% 8,190 0.92% Income from operations 40,079 4.22% 51,305 5.98% 38,784 4.35% Other income (expense): Interest expense (983) -0.10% (1,229) -0.14% (5,027) -0.56% Interest income 1,459 0.15% 573 0.07% 10 0.00% Other (4,798) -0.50% (1,091) -0.13% (1,593) -0.18% Total other income (expense), net (4,322) -0.45% (1,747) -0.20% (6,610) -0.74% Income before income taxes 35,757 3.76% 49,558 5.78% 32,174 3.61% Income tax provision 13,230 1.39% 18,337 2.14% 11,905 1.34% Net income $22,527 2.37% $31,221 3.64% $20,269 2.27%

Basic earnings per share 1.15 1.60 1.02 Diluted earnings per share 1.14 1.56 1.01 Basic weighted average shares outstanding 19,531 19,555 19,806 Diluted weighted average shares outstanding 19,774 20,055 19,996

Final PDF to printer

158 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 158 10/05/15 02:15 PM

to industry averages. The industry information can serve as a benchmark for assessing how well the entity’s financial position and performance compare with other companies in the industry. Advanced Module 2 in this chapter illustrates several ratios used in ratio analysis.

Relationships of Financial Information to Nonfinancial Information. The auditor may have relevant nonfinancial information available for comparison purposes or for develop- ing estimates of the entity’s financial information. This might include such items as cost per employee, sales per square foot, utility expense per hour, and so on. For example, in a telecom company, the auditor can multiply the number of cell phone subscribers by the average billing rate to test an entity’s total revenue. Other examples include computing the average number of days a product is in inventory or developing an expectation for commission expense by multiplying commissioned sales by the average commission rate and comparing this estimate to the entity’s recorded commission expense.

105 100 95 90 85 80 75 70 65 60 55 50 45

6 12 6 12

Month

6 12

In ve

nt or

y in

$ (m

ill io

ns )

Year 1 Year 2 Year 3

Practice I N S I G H T

Using nonfinancial information in analytical procedures can be an effective way to identify potential frauds because, while perpetrators of fraud can manage financial numbers, it is difficult or impossible to manage nonfinancial data (e.g., square feet, days in the calendar year, number of employees). For example, auditors could compare an entity’s actual square footage of warehouse space with the amount of square footage that would be required to store the inventory as listed on the books.

Plotting Trends over Multiple Periods. It can be very beneficial to plot or graph trends over several periods. Figure 5–8 provides a monthly plot of ending inventory for a three-year period. Suppose the auditor is auditing year-ending inventory for year 3 and that years 1 and 2 have been previously audited. The pattern of previously audited financial information suggests some inventory “spikes” every six months. These spikes may be due to inventory buildup around busy seasons (e.g., holidays). The star at the end of year 3 indicates the audi- tor’s expectation based on the past trends. The auditor would investigate the cause of the large increase in ending inventory at the end of year 3. Note that the potentially problematic spikes would not have shown up at all if the auditor had just plotted year-end inventory balances rather than monthly balances!

An Illustration of a Monthly Plot of Ending Inventory (in millions)F I G U R E 5 – 8

Final PDF to printer

Chapter 5 Evidence and Documentation 159

mes32502_ch05_128-176.indd 159 10/05/15 02:15 PM

The foregoing discussion and examples have all related to the first step in the analytical procedures decision process (see Figure 5–7). The first step is the most important step in per- forming effective substantive analytical procedures.

Define a Tolerable Difference The second step in the analytical procedures decision process (see Figure 5–7) is to define a tolerable difference. The size of the tolerable dif- ference depends on the significance of the account, the desired degree of reliance on the substantive analytical procedure, the level of disaggregation in the amount being tested, and the precision of the expectation. The amount of difference that can be tolerated will gener- ally always be lower than tolerable misstatement, and when testing an entire account with a substantive analytical procedure, tolerable difference will usually be equal to the account’s tolerable misstatement. Sometimes, to achieve the desired level of assurance with a substan- tive analytical procedure, the auditor will use a tolerable difference that is less than tolerable misstatement for the account. In these instances, the auditor may use a rule of thumb such as “tolerable difference is 5 percent of the entity’s recorded amount, but not to exceed tolerable misstatement.”

Practice I N S I G H T

The PCAOB inspection team identified audit deficiencies that had to do with the tolerable difference used in analytical procedures. In one audit, the firm used analytical procedures as the primary sub- stantive test of the existence of revenue, but the tolerable difference set by the firm allowed some differences to go uninvestigated even though they exceeded materiality as set by the firm during the planning stage (PCAOB Release 104-2009-064).

Compare the Expectation to the Recorded Amount The next step in the analytical procedures decision process (Figure 5–7) is to determine if the amount of difference between the auditor’s expectation and the recorded amount exceeds the auditor’s tolerable difference. If the observed difference is less than the tolerable difference, the auditor accepts the account. If not, the auditor must investigate the difference using other audit procedures.

Investigate Differences Greater Than the Tolerable Difference The fourth step in the analytical procedures decision process (Figure 5–7) is the investigation of significant dif- ferences. Differences identified by substantive analytical procedures indicate an increased likelihood of misstatements. The more precise the expectation, the greater the likelihood that the difference is actually a misstatement. Inquiry of the entity’s personnel is frequently an important aspect of the investigation of differences. Nevertheless, inquiry of the entity’s per- sonnel should not be the sole support for an explanation without quantification and corrobora- tion (discussed below). There are four possible causes of significant differences—accounting changes, economic conditions or events, error, and fraud. In most instances, the cause of an identified difference involves a legitimate accounting change or an economic condition or event. However, even when a significant difference is due to error or fraud, the entity’s personnel may provide a plausible, yet ultimately untrue, business explanation. Thus, the effectiveness of substantive analytical procedures in identifying material misstatements is enhanced when auditors develop potential explanations before obtaining the entity person- nel’s explanation. By doing this, the auditor is better able to exercise appropriate professional skepticism and challenge the entity personnel’s explanation, if necessary.

The development of potential explanations need not be time-consuming. Auditors typi- cally reexamine and understand the various relationships in the financial and nonfinancial data. Then, based on their previous experience with the entity, other audit work performed, and discussions with other members of the audit team, they develop potential explanations for the observed difference. The independent consideration of potential explanations is more important for more significant accounts and when a higher degree of assurance is desired from substantive analytical procedures.

Final PDF to printer

160 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 160 10/05/15 02:15 PM

Explanations for significant differences observed for substantive analytical procedures must be followed up and resolved through quantification, corroboration, and evaluation.

Quantification. Quantification involves determining whether the explanation or error can explain the observed difference. While it may not be possible to quantify the exact amount of a difference between an analytical procedure’s expectation and the entity’s recorded amount, the auditor should quantify the portion of the difference that can be explained. This may require the recalculation of the expectation after considering the additional information. For example, an entity employee may offer the explanation that the significant increase in inventory over the prior year is due to a 12 percent increase in raw materials prices. The auditor should compute the effects of the raw materials price increase and determine the extent to which the price increase explains (or does not explain) the increase in the overall inventory account.

Corroboration. Auditors must corroborate explanations for unexpected differences by obtaining sufficient appropriate audit evidence linking the explanation to the difference and substantiating that the information supporting the explanation is reliable. This evidence should be of the same quality as the evidence obtained to support tests of details. Such evi- dence could vary from simply comparing the explanation to the auditor’s knowledge from other areas, to employing other detailed tests to confirm or refute the explanation. Common corroborating procedures include examination of supporting evidence, inquiries of indepen- dent persons, and evaluating evidence obtained from other auditing procedures.

Practice I N S I G H T

During an inspection, a PCAOB inspection team identified audit deficiencies, one of which had to do with the lack of corroboration when investigating differences found through analytical procedures. In one audit, the firm failed to test almost half of the issuer’s total revenue beyond confirming certain accounts receivable and performing analytical procedures. In some cases, the firm failed to corrobo- rate management’s explanations of significant differences observed by these analytical procedures (PCAOB Release 104-2008-069).

Evaluation. The key mind-set behind effectively performing substantive analytical pro- cedures is one of appropriate professional skepticism, and obtaining a sufficient amount of appropriate audit evidence. The auditor should evaluate the results of the substantive analyti- cal procedures to conclude whether the desired level of assurance has been achieved. If the auditor obtains evidence that a misstatement exists and can be sufficiently quantified, the auditor makes note of his or her proposed adjustment to the entity’s financial statements.

If the auditor concludes that the substantive analytical procedure performed did not pro- vide the desired level of assurance, tests of details should be performed to achieve the desired assurance.

The Investigation of Differences for Analytical Procedures Used as Risk Assess- ment Procedures (Planning) and as Final Analytical Procedures The way in which differences are investigated diverges in important ways for planning and final analytical pro- cedures. At planning, the auditor is not required to obtain corroborative evidence because planning analytical procedures are not intended to provide substantive audit evidence regard- ing specific assertions. Rather, the auditor normally determines whether the planned audit procedures need to be revised in light of the results of preliminary analytical procedures. For example, to address the increased risk posed by the spike in inventory, the auditor may decide to expand the number of items tested during the observation of the year-end physical inven- tory count (see Figure 5–3).

When conducting final analytical procedures, the auditor investigates unexpected differ- ences by first going to the working papers to determine if sufficient appropriate evidence has already been gathered to explain the difference (rather than going to the entity’s personnel for an explanation). If the auditor cannot find sufficient evidence within the working papers, then the auditor would formulate possible explanations, conduct additional testing, and seek an explanation from the entity’s personnel.

Final PDF to printer

Chapter 5 Evidence and Documentation 161

mes32502_ch05_128-176.indd 161 10/05/15 02:15 PM

Comprehensive EarthWear Example Suppose we want to use substantive analytical procedures to test the reasonableness of interest expense reported by EarthWear Clothiers (i.e., a “reasonableness test”). Consider the following example:

EarthWear’s 2015 income statement shows $983,000 of interest expense. To conduct a sub- stantive analytical procedure on this account, the auditor could develop an expectation using

reasonableness analysis by building a model in the following manner. Obtain the ending monthly balance for the short-term line of credit from the monthly bank loan statement and calculate the average monthly ending balance. Trace the monthly loan balances to the general ledger. Determine the average interest rate for the year for the short-term line of credit based on the bank’s published rate in the monthly bank loan statement. Multiply the average monthly balance previously calcu- lated by the average interest rate, and compare the result to the recorded interest expense. Suppose that the auditor obtained the following information from EarthWear’s general ledger:

Month Balance (in thousands)

January February March April May June July August September October November December Total Average

$ 21,500 18,600 18,100 17,900 16,100 15,500 14,200 20,200 34,500 28,100 15,200

11,000 $230,900

$ 19,242

Further, assume that interest rates recorded on the loan statements have remained stable over the year, fluctuating between 5 and 5.5 percent. If the auditor uses 5.25 percent as the average interest rate, the expectation for interest expense is $1,010,000 ($19,242,000 × 0.0525).

As shown in Figure 5–7, once an expectation is developed, the next step is to determine the tolerable difference. Because interest expense is a predictable account, the information used to form the expectation is deemed reliable, and the substantive analytical procedure will be the primary substantive test. Assume the auditor has set tolerable difference at 5 percent of recorded interest expense, or $49,150 (.05 × $983,000). The next step is to compare the expec- tation of $1,010,000 to the recorded value of $983,000. Because the difference between the auditor’s expectation and the recorded amount, $27,000, is less than the tolerable difference, the auditor would accept the interest expense account as fairly stated. However, if the differ- ence between the recorded amount and the expectation is greater than the tolerable difference, the auditor will need to investigate the difference. In the example above, the auditor would likely examine loan activity within each month to determine if there was significant variation in the balance that was not accounted for by the month-end model used to form the expecta- tion. If the difference could still not be explained, the auditor would inquire of management about the cause of the difference. If the entity’s personnel provide a plausible explanation (e.g., interest expense reported in the financial statements also includes interest paid for other short- term loans that were only outstanding for a few days at a time), auditing standards require the auditor to obtain corroborating evidence. If the entity personnel’s explanation and the corrobo- rating evidence are not adequate, or if no corroborative evidence is available, the auditor will need to conduct additional audit procedures. If the explanation and evidence are adequate for resolving the difference, the auditor can accept the amount as being fairly presented.

Substantive analytical procedures can be used to test all transactions and balance asser- tions except rights and obligations. However, they may be more effective at identifying certain types of misstatements than testing individual transactions. For example, they may be more

Final PDF to printer

162 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 162 10/05/15 02:15 PM

effective at detecting omissions (completeness assertion) than providing detailed documen- tary evidence. The key points are that (1) some assertions are more amenable to examination through analytical procedures than others, and (2) the auditor must ensure that the analytical procedure performed is appropriate for the assertion being examined.

Documentation Requirements When a substantive analytical procedure is used as the principal substantive procedure for a significant financial statement assertion, the auditor should document all of the following:

∙ The expectation and how it was developed. ∙ Results of the comparison of the expectation to the recorded amounts or ratios

developed from recorded amounts. ∙ Any additional auditing procedures performed in response to any significant

differences identified.

Final Analytical Procedures The objective of analytical procedures at the overall review stage of an audit is to assist the auditor in assessing the conclusions reached and evaluating the overall financial statement presentation. This requires reviewing the trial balance, financial statements, and footnotes in order to (1) judge the adequacy of the evidence gathered to support any unusual or unexpected balances investigated during the audit and (2) determine if any other unusual balances or rela- tionships have not been investigated.

In the first instance, appropriate evidence in the working papers should support any dif- ferences from the auditor’s expectations. For example, the auditor can compare the audited balances from the current year with the audited balances from the prior year. If there is a material difference, the auditor’s working papers should explain the difference. In the second instance, this comparison of audited values may reveal some unusual items that have not been investigated and explained. Assuming that the difference between the auditor’s expectation and the recorded amount is material, the auditor will have to perform additional audit work before an audit report can be issued.

Advanced Module 2: Selected Financial Ratios Useful as Analytical Procedures

A number of financial ratios are used by auditors as analytical procedures. These ratios are broken down into four categories: short-term liquidity, activity, profitability, and cover- age ratios. Although the ratios discussed apply to most entities, auditors may also use other industry-specific ratios. As follows, each ratio is calculated for EarthWear Clothiers for the year ended December 31, 2015.

A few points are worth mentioning before the financial ratios are discussed. First, in many instances, the auditor may compare the entity’s ratios with industry averages. While the industry averages serve as useful benchmarks, certain limitations should be recognized. Because the industry ratios are averages, they may not capture operating or geographical fac- tors that may be specific to the entity. The use of different accounting principles for valuing inventory or calculating depreciation may also result in differences from industry averages for certain ratios. Finally, the industry data may not be available in sufficient detail for a particu- lar entity. For example, if the auditor is looking for industry information on a company that solely operates in the wireless industry, such industry ratio data might be combined with other companies within the telecommunications industry.

Second, audit research has shown that material misstatements may not significantly affect certain ratios.3 This is particularly true for activity ratios. Third, the auditor must be

LO 5-10

3See W. R. Kinney, Jr., “Attention-Directing Analytical Review Using Accounting Ratios: A Case Study,” Auditing: A Journal of Practice and Theory (Spring 1987), pp. 59–73, for a discussion of this limitation of analytical procedures.

Final PDF to printer

Chapter 5 Evidence and Documentation 163

mes32502_ch05_128-176.indd 163 10/05/15 02:15 PM

careful not to evaluate a financial ratio in isolation. In certain cases, a ratio may be favor- able because its components are unfavorable. If related ratios are not examined, the auditor may draw an incorrect conclusion. For example, suppose that an entity’s days outstanding in accounts receivable is getting larger and the inventory turnover ratio is getting smaller. The negative trend in these ratios may indicate that accounts receivable are getting older and that some inventory may be obsolete. However, both of these factors positively affect the current ratio. If the auditor calculates only the current ratio, he or she may reach an incorrect conclusion about the entity’s ability to meet current obligations.

Short-Term Liquidity Ratios Short-term liquidity ratios indicate the entity’s ability to meet its current obligations. Three ratios commonly used for this purpose are the current ratio, the quick ratio, and the operating cash flow ratio.

Current Ratio The current ratio is calculated as follows:

Current ratio = Current assets _______________ Current liabilities

= 209, 095

________ 116, 268

= 1.80

It includes all current assets and current liabilities and is usually considered acceptable if it is 2 to 1 or better. Generally, a high current ratio indicates an entity’s ability to pay current obligations. However, if current assets include old accounts receivable or obsolete inventory, this ratio can be distorted.

Quick Ratio The quick ratio includes only assets that are most readily convertible to cash and is calculated as follows:

Quick ratio = Liquid assets

_______________ Current liabilities

= 48, 978 + 12, 875

_______________ 116, 268

= .53

Thus, inventories and prepaid items are not included in the numerator of the quick ratio. The quick ratio may provide a better picture of the entity’s liquidity position if inventory contains obsolete or slow-moving items. A ratio greater than 1 generally indicates that the entity’s liq- uid assets are sufficient to meet the cash requirements for paying current liabilities.

Operating Cash Flow Ratio The operating cash flow ratio measures the entity’s abil- ity to cover its current liabilities with cash generated from operations and is calculated as follows:

Operating cash flow ratio = Cash flow from operations

______________________ Current liabilities

= 39, 367

_______ 116, 268

= .34

The operating cash flow ratio uses the cash flows as opposed to assets to measure short- term liquidity. It provides a longer-term measure of the entity’s ability to meet its current liabilities. If cash flow from operations is small or negative, the entity will likely need alternative sources of cash, such as additional borrowings or sales of assets, to meet its obligations.

Activity Ratios Activity ratios indicate how effectively the entity’s assets are managed. Only ratios related to accounts receivable and inventory are discussed here because for most wholesale, retail, or manufacturing companies these two accounts represent the assets that have high activity. Activity ratios may also be effective in helping the auditor determine if these accounts contain material misstatements.

Final PDF to printer

164 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 164 10/05/15 02:15 PM

Receivables Turnover and Days Outstanding in Accounts Receivable These two ratios provide information on the activity and age of accounts receivable. The receivables turnover ratio and days outstanding in accounts receivable are calculated as follows:

Receivables turnover = Credit sales ___________ Receivables

= 950, 484

_______ 12, 875

= 73.8

Days outstanding in accounts receivable = 365 days

__________________ Receivables turnover

= 4.94 days

The receivables turnover ratio indicates how many times accounts receivable are turned over during a year. However, the days outstanding in accounts receivable may be easier to interpret because this ratio can be compared to the entity’s terms of trade. For example, if an entity’s terms of trade are 2/10, net/30, the auditor would expect that if management were doing a good job of managing receivables, the value for this ratio would be 30 days or less. If the auditor calculates the days outstanding to be 43 days, he or she might suspect that the account contains a material amount of bad debts. Comparing the days outstanding to industry data may be helpful in detecting a slowdown in payments by customers that is affecting the entire industry. EarthWear’s ratio is 4.94 days because most sales are paid by credit card.

Inventory Turnover and Days of Inventory on Hand These activity ratios provide information on the inventory and are calculated as follows:

Inventory turnover = Cost of goods sold

________________ Inventory

= 546, 398

_______ 122, 337

= 4.47

Days of inventory on hand = 365 days

________________ Inventory turnover

= 81.7 days

Inventory turnover indicates the frequency with which inventory is consumed in a year. The higher the ratio, the better the entity is at liquidating inventory. This ratio can be easily com- pared to industry standards. Suppose that the auditor calculates the inventory turnover to be 4.7 times a year. If the industry average is 8.2 times a year, the auditor might suspect that inventory contains obsolete or slow-moving goods. The days of inventory on hand measures how much inventory the entity has available for sale to customers.

Profitability Ratios Profitability ratios indicate the entity’s success or failure for a given period. A number of ratios measure the profitability of an entity, and each ratio should be interpreted by compari- son to industry data.

Gross Profit Percentage The gross margin percentage ratio is generally a good indicator of potential misstatements and is calculated as follows:

Gross profit percentage = Gross profit

__________ Net sales

= 404, 091

________ 950, 484

= 42.5%

If this ratio varies significantly from previous years or differs significantly from industry data, the entity’s financial data may contain errors. Numerous errors can affect this ratio. For example, if the entity has failed to record sales, the gross profit percentage will be less than in previous years. Similarly, any errors that affect the inventory account can distort this ratio. For example, if the entity has omitted goods from the ending inventory, this ratio will be smaller than in previous years.

Profit Margin The profit margin ratio is calculated as follows:

Profit margin = Net in come __________ Net sales

= 22, 257

_______ 950, 484

= 2.4%

While the gross profit percentage ratio measures profitability after cost of goods sold is deducted, the profit margin ratio measures the entity’s profitability after all expenses are

Final PDF to printer

Chapter 5 Evidence and Documentation 165

mes32502_ch05_128-176.indd 165 10/05/15 02:15 PM

considered. Significant fluctuations in this ratio may indicate that misstatements exist in the selling, general, or administrative expense accounts.

Return on Assets This ratio is calculated as follows:

Return on assets = Net income __________ Total assets

= 22, 527

________ 329, 959

= 6.8%

This ratio indicates the return earned on the resources invested by both the stockholders and the creditors.

Return on Equity The return on equity ratio is calculated as follows:

Return on equity = Net income _________________ Stockholders’equity

= 22, 527

_______ 204, 222

= 11.0%

This ratio is similar to the return on assets ratio except that it shows only the return on the resources contributed by the stockholders.

Coverage Ratios Coverage ratios provide information on the long-term solvency of the entity. These ratios give the auditor important information on the ability of the entity to continue as a going concern.

Debt to Equity This ratio is calculated as follows:

Debt to equity = Short-term debt + Long-term debt

_____________________________ Stockholders’ equity

= (116, 668 + 0)

_____________ 204, 222

= .571

This ratio indicates what portion of the entity’s capital comes from debt. The lower the ratio, the less debt pressure on the entity. If the entity’s debt to equity ratio is large relative to the industry’s, it may indicate that the entity is too highly leveraged and may not be able to meet its debt obligations on a long-term basis.

Times Interest Earned This ratio is calculated as follows:

Times interest earned = Net income + Interest expense

__________________________ Interest expense

= (22, 527 + 983)

______________ 983

= 23.9

The times interest earned ratio indicates the ability of current operations to pay the interest that is due on the entity’s debt obligations. The more times that interest is earned, the better the entity’s ability to service the interest on long-term debt.

KEY TERMS

Accounting records. The records of initial entries and supporting records, such as checks and records of electronic fund transfers; invoices; contracts; the general and subsidiary led- gers, journal entries, and other adjustments to the financial statements that are not reflected in formal journal entries; and records such as work sheets and spreadsheets supporting cost allocations, computations, reconciliations, and disclosures. Analytical procedures. Evaluations of financial information made through analysis of plau- sible relationships among both financial and nonfinancial data. Assertions. Expressed or implied representations by management regarding the recognition, measurement, presentation, and disclosure of information in the financial statements and related disclosures.

Final PDF to printer

166 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 166 10/05/15 02:15 PM

Audit documentation (working papers). The auditor’s principal record of the work per- formed and the basis for the conclusions in the auditor’s report. It also facilitates the planning, performance, and supervision of the engagement and provides the basis for the review of the quality of the work by providing the reviewer with written documentation of the evidence supporting the auditor’s significant conclusions. Audit evidence. Information used by the auditor in arriving at the conclusions on which the auditor’s opinion is based. Audit evidence includes both information contained in the accounting records underlying the financial statements and other information. Audit procedures. Specific acts performed by the auditor in gathering evidence to determine if specific assertions are being met. Confirmation. A confirmation represents audit evidence obtained by the auditor as a direct written response to the auditor from a third party (the confirming party) in paper form or by electronic or other media. Inquiry. Seeking information of knowledgeable persons, both financial and nonfinancial, within the entity or outside the entity. Inspection of records and documents. Examination of internal or external records or docu- ments that are in paper form, electronic form, or other media. Inspection of tangible assets. Physical examination of the tangible assets. Observation. Watching a process or procedure being performed by others. Other information. Audit evidence that includes minutes of meetings; confirmations from third parties; industry analysts’ reports; comparable data about competitors (benchmarking); controls manuals; information obtained by the auditor from such audit procedures as inquiry, observation, and inspection; and other information developed by, or available to, the auditor that permits the auditor to reach conclusions through valid reasoning. Recalculation. The auditor’s checking the mathematical accuracy of documents or records either manually or electronically. Relevance of evidence. The relevance of audit evidence refers to its relationship to the asser- tion or to the objective of the control being tested. Reliability of evidence. The diagnosticity of evidence—that is, whether the type of evidence can be relied on to signal the true state of the assertion. Reperformance. The auditor’s independent execution of procedures or controls that were originally performed as part of the entity’s internal control, either manually or through the use of computer-assisted audit techniques. Scanning. The auditor’s exercise of professional judgment to review accounting data to iden- tify significant or unusual items to test.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 5-1 5-1 Explain why the auditor divides the financial statements into components or seg- ments in order to test management’s assertions.

LO 5-1 5-2 How do management assertions relate to the financial statements? LO 5-2 5-3 List and define the assertions about classes of transactions and events for the period

under audit. LO 5-2 5-4 List and define the assertions about account balances at the period end. LO 5-3 5-5 Define audit evidence. Provide an example of evidence from accounting records and

other information. LO 5-3 5-6 Explain why in most instances audit evidence is persuasive rather than convincing. LO 5-4 5-7 List and define the audit procedures for obtaining audit evidence.

Final PDF to printer

Chapter 5 Evidence and Documentation 167

mes32502_ch05_128-176.indd 167 10/05/15 02:15 PM

LO 5-4, 5-5 5-8 In a situation that uses inspection of records and documents as a type of evidence, distinguish between vouching and tracing in terms of the direction of testing and the assertions being tested.

LO 5-4, 5-5 5-9 Why is it necessary to obtain corroborating evidence for inquiry and for observation? LO 5-5 5-10 Discuss the relative reliability of the different types of audit procedures. LO 5-6 5-11 Why does the “audit testing hierarchy” begin with tests of controls and substantive

analytical procedures? LO 5-6 5-12 Consider the “assurance bucket” analogy. Why are some of the buckets larger than

others for particular assertions or accounts? LO 5-8 5-13 Why are indexing and cross-referencing important to the documentation of audit

working papers? LO 5-9 5-14 When discussing the use of analytical procedures, what is meant by the “precision of

the expectation”? In applying this notion to an analytical procedure, how might an auditor calculate a tolerable difference?

LO 5-9 5-15 Significant differences between the auditor’s expectation and the entity’s book value require explanation through quantification, corroboration, and evaluation. Explain each of these terms.

LO 5-10 5-16 List and discuss the four categories of financial ratios that are presented in the chapter.

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 5-2, 5-4 5-17 Which of the following procedures would an auditor most likely rely on to verify management’s assertion of completeness?

a. Reviewing standard bank confirmations for indications of cash manipulations. b. Comparing a sample of shipping documents to related sales invoices. c. Observing the entity’s distribution of payroll checks. d. Confirming a sample of recorded receivables by direct communication with the

debtors.

LO 5-2, 5-4 5-18 In testing the existence assertion for an asset, an auditor ordinarily works from the a. Financial statements to the potentially unrecorded items. b. Potentially unrecorded items to the financial statements. c. Accounting records to the supporting documents. d. Supporting documents to the accounting records.

LO 5-3, 5-4 5-19 Which of the following statements concerning audit evidence is correct? a. To be appropriate, audit evidence should be either persuasive or relevant but need

not be both. b. The measure of the reliability of audit evidence lies in the auditor’s judgment. c. The difficulty and expense of obtaining audit evidence concerning an account

balance are a valid basis for omitting the test. d. An entity’s general ledger may be sufficient audit evidence to support the finan-

cial statements.

LO 5-4, 5-5 5-20 Which of the following presumptions is least likely to relate to the reliability of audit evidence?

a. The more effective internal control, the more assurance it provides about the accounting data and financial statements.

b. An auditor’s opinion is formed within a reasonable time to achieve a balance between benefit and cost.

c. Evidence obtained from independent sources outside the entity is more reliable than evidence secured solely within the entity

d. The independent auditor’s direct personal knowledge obtained through observa- tion and inspection is more persuasive than information obtained indirectly.

Final PDF to printer

168 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 168 10/05/15 02:15 PM

LO 5-4, 5-5 5-21 Which of the following types of audit evidence is the least reliable? a. Prenumbered purchase order forms prepared by the entity. b. Bank statements obtained from the entity. c. Test counts of inventory performed by the auditor. d. Correspondence from the entity’s attorney about litigation.

LO 5-4, 5-5 5-22 Audit evidence can come in different forms with different degrees of reliability. Which of the following is the most persuasive type of evidence?

a. Bank statements obtained from the entity. b. Computations made by the auditor. c. Prenumbered entity sales invoices. d. Vendors’ invoices included in the entity’s files.

LO 5-4, 5-5 5-23 An auditor would be least likely to use confirmations in connection with the exami- nation of

a. Inventory held in a third-party warehouse. b. Refundable income taxes. c. Long-term debt. d. Stockholders’ equity.

LO 5-6 5-24 The assurance bucket is filled with all of the following types of evidence except a. Test of controls. b. The audit report. c. Substantive analytical procedures. d. Tests of details.

LO 5-8 5-25 The current file of the auditor’s working papers should generally include a. A flowchart of the accounting system. b. Organization charts. c. A copy of the financial statements. d. Copies of bond and note indentures.

LO 5-8 5-26 The permanent file section of the working papers that is kept for each audit client most likely contains

a. Review notes pertaining to questions and comments regarding the audit work performed.

b. A schedule of time spent on the engagement by each individual auditor. c. Correspondence with the entity’s legal counsel concerning pending litigation. d. Narrative descriptions of the entity’s accounting system and control

procedures.

LO 5-8 5-27 An audit document that reflects the major components of an amount reported in the financial statements is referred to as a(n)

a. Lead schedule. b. Supporting schedule. c. Audit control account. d. Working trial balance.

LO 5-9 5-28 The primary objective of final analytical procedures is to a. Obtain evidence from details tested to corroborate particular assertions. b. Identify areas that represent specific risks relevant to the audit. c. Assist the auditor in assessing the validity of the conclusions reached on the

audit. d. Satisfy doubts when questions arise about an entity’s ability to continue in

existence.

LO 5-10 5-29 The substantive analytical procedure known as trend analysis is best described by a. The comparison, across time or to a benchmark, of relationships between finan-

cial statement accounts or between an account and nonfinancial data.

Final PDF to printer

Chapter 5 Evidence and Documentation 169

mes32502_ch05_128-176.indd 169 10/05/15 02:15 PM

b. Development of a model to form an expectation using financial data, nonfinancial data, or both to test account balances or changes in account balances between accounting periods.

c. The examination of changes in an account over time. d. The comparison of common-size financial statements over time.

PROBLEMS All applicable problems are available with Connect.

LO 5-2 5-30 Management makes assertions about components of the financial statements. Match the management assertions shown in the left-hand column with the proper descrip- tion of the assertion shown in the right-hand column.

Management Assertion Description

a. Existence or occurrence b. Rights and obligations c. Completeness d. Valuation or allocation

1. The accounts and transactions that should be included are included; thus, the financial statements are complete.

2. Assets, liabilities, equity, revenues, and expenses are appropri- ately valued and are allocated to the proper accounting period.

3. The assets are the rights of the entity, and the liabilities are its obligations.

4. The assets and liabilities exist, and the recorded transactions have occurred.

LO 5-2 5-31 Management assertions about classes of transactions are a. Occurrence. b. Completeness. c. Authorization. d. Accuracy. e. Cutoff. f. Classification. For each management assertion, indicate an example of a misstatement that could

occur for revenue transactions.

LO 5-4 5-32 For each of the following specific audit procedures, indicate the type of audit proce- dure it represents: (1) inspection of records or documents, (2) inspection of tangible assets, (3) observation, (4) inquiry, (5) confirmation, (6) recalculation, (7) reperfor- mance, (8) analytical procedures, and (9) scanning.

a. Sending a written request to the entity’s customers requesting that they report the amount owed to the entity.

b. Examining large sales invoices for a period of two days before and after year-end to determine if sales are recorded in the proper period.

c. Agreeing the total of the accounts receivable subsidiary ledger to the accounts receivable general ledger account.

d. Discussing the adequacy of the allowance for doubtful accounts with the credit manager.

e. Comparing the current-year gross profit percentage with the gross profit percent- age for the last four years.

f. Examining a new plastic extrusion machine to ensure that this major acquisition was received.

g. Watching the entity’s warehouse personnel count the raw materials inventory. h. Performing test counts of the warehouse personnel’s count of the raw material. i. Obtaining a letter from the entity’s attorney indicating that there were no lawsuits

in progress against the entity. j. Tracing the prices used by the entity’s billing program for pricing sales invoices

to the entity’s approved price list. k. Reviewing the general ledger for unusual adjusting entries.

Final PDF to printer

170 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 170 10/05/15 02:15 PM

LO 5-2 5-33 For each of the audit procedures listed in Problem 5-32, identify the category (asser- tions about classes of transactions and events or assertions about account balances) and the primary assertion being tested.

LO 5-4, 5-5 5-34 Evidence comes in various types and has different degrees of reliability. Following are some statements that compare various types of evidence.

a. A bank confirmation versus observation of the segregation of duties between cash receipts and recording payment in the accounts receivable subsidiary ledger.

b. An auditor’s recalculation of depreciation versus examination of raw material requisitions.

c. A bank statement included in the entity’s records versus shipping documents. d. Physical inspection of common stock certificates held for investment versus phys-

ical examination of inventory components for a personal computer.

Required: For each situation, indicate whether the first or second type of evidence is more reli- able. Provide a rationale for your choice.

LO 5-4, 5-5 5-35 Inspection of records and documents relates to the auditor’s examination of entity accounting records and other information. One issue that affects the reliability of documentary evidence is whether the documents are internal or external. Following are examples of documentary evidence:

1. Duplicate copies of sales invoices. 2. Purchase orders. 3. Bank statements. 4. Remittance advices. 5. Vendors’ invoices. 6. Materials requisition forms. 7. Overhead cost allocation sheets. 8. Shipping documents. 9. Payroll checks. 10. Long-term debt agreements.

Required: a. Classify each document as internal or external evidence. b. Classify each document as to its reliability (high, moderate, or low).

LO 5-4, 5-5 5-36 The confirmation process is defined as the process of obtaining and evaluating a direct communication from a third party in response to a request for information about a particular item affecting financial statement assertions.

Required: a. List the factors that affect the reliability of confirmations. b. One of the allegations in a recent fraud was that confirmations of account bal-

ances to various banks were determined to be forgeries. Auditing standards state that “an audit rarely involves the authentication of documentation, nor is the auditor trained as or expected to be an expert in such authentication.” What steps could the auditors have taken to ensure that bank confirmations were reliable?

c. Refer back to EarthWear Clothiers’ financial statements included after Chapter 1. Identify any information on EarthWear’s financial statements that might be veri- fied through the use of confirmations.

LO 5-7, 5-8 5-37 Audit documentation is the auditor’s record of work performed and conclusions reached on an audit engagement.

Final PDF to printer

Chapter 5 Evidence and Documentation 171

mes32502_ch05_128-176.indd 171 10/05/15 02:15 PM

Required: a. What are the functions of audit documentation? b. List and describe the various types of audit documents. c. What factors affect the auditor’s judgment about the form, content, and extent of

audit documentation for a particular engagement?

LO 5-9 5-38 At December 31, 2015, EarthWear has $5,890,000 in a liability account labeled “Reserve for returns.” The footnotes to the financial statements contain the following policy: “At the time of sale, the company provides a reserve equal to the gross profit on projected merchandise returns, based on prior returns experience.” The entity has indicated that returns for sales that are six months old are negligible, and gross profit percentage for the year is 42.5 percent. The entity has also provided the following information on sales for the last six months of the year:

Month Monthly Sales (000s) Historical Return Rate

July $ 73,300 .004 August 82,800 .006 September 93,500 .010 October 110,200 .015 November 158,200 .025 December 202,500 .032

Required: a. Using the information given, develop an expectation for the reserve for returns

account. Because the rate of return varies based on the time that has passed since the date of sale, do not use an average historical return rate.

b. Determine a tolerable difference for your analytical procedure. c. Compare your expectation to the book value and determine if it is greater than

tolerable difference. d. Independent of your answer in part (c), what procedures should the auditor per-

form if the difference between the expectation and the book value is greater than tolerable misstatement?

LO 5-9, 5-10 5-39 Arthur, CPA, is auditing The Home Improvement Store as of December 31, 2016. As with all audit engagements, Arthur’s initial procedures are to analyze the entity’s financial data by reviewing trends in significant ratios and comparing the company’s performance with the industry so that he better understands the business and can determine where to concentrate his audit efforts. As part of Arthur’s audit of The Home Improvement Store, he performed analytical procedures by calculating the following ratios and obtaining related industry data.

The Home Improvement Store Industry

2012 2013 2014 2015 2016 2012 2013 2014 2015 2016

Quick ratio 0.67 0.73 1.38 0.45 0.29 0.79 0.81 0.87 0.91 1.08 Days of inventory on hand 62.73 75.15 82.40 84.02 80.52 82.26 79.89 86.86 84.13 75.04 Inventory/current assets 53.48% 45.51% 48.42% 62.28% 80.81% 58.04% 56.44% 60.19% 60.92% 50.33% Return on assets 16.10% 9.75% 5.70% 2.16% 6.05% 6.98% 8.87% 7.05% 5.06% 11.73% Debt to equity 0.02 0.07 1.47 2.36 0.72 0.44 0.31 0.56 0.53 0.57

Required: Compare The Home Improvement Store’s ratios with those of its industry. You may want to reference the advanced module in this chapter for more information regarding the ratios used in the analytical procedure. For each ratio provided in the table above

a. Indicate the potential risks the ratio and/or historical patterns may present. b. Indicate one or two plausible explanations for why The Home Improvement

Store’s ratios or historical patterns differ from those of the industry.

Final PDF to printer

172 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 172 10/05/15 02:15 PM

DISCUSSION CASES

LO 5-3, 5-4, 5-5 5-40 Part I. Lernout & Hauspie (L&H) was the world’s leading provider of speech and language technology products, solutions, and services to businesses and individuals worldwide. Both Microsoft and Intel invested millions in L&H. However, account- ing scandals and fraud allegations sent the company’s stock crashing and forced the firm to seek bankruptcy protection in Belgium and the United States. The following selected information pertains to L&H’s sales and accounts receivable:

∙ Consolidated revenue increased 184 percent from the 1997 fiscal year to the 1998 fiscal year.

∙ Revenue in South Korea, which has a reputation as a difficult market for foreign companies to enter, increased from $97,000 in the first quarter of 1999 to approx- imately $59 million in the first quarter of 2000.

∙ In the second quarter of 2000, sales grew by 104 percent but accounts receivable grew by 128 percent.

∙ Average days outstanding increased from 138 days in 1998 to 160 days for the six-month period ended June 30, 2000.

Required: a. Based on the above information, which assertion(s) for sales should the auditor be

most concerned with? Why? b. Based on the above information, which assertion(s) for accounts receivable

should the auditor be most concerned with? Why? c. What audit evidence should the auditor gather to verify the assertion(s) for sales

and accounts receivable? Be specific as to how each type of evidence relates to the assertions you mentioned in parts (a) and (b) of this question.

Part II. L&H’s auditor did not confirm accounts receivable from customers in South Korea. However, The Wall Street Journal contacted 18 of L&H’s South Korean cus- tomers and learned the following:

∙ Three out of 18 customers listed by L&H stated that they were not L&H customers. ∙ Three others indicated that their purchases from L&H were smaller than those

reported by L&H.

Required: a. If L&H’s auditor had confirmed these receivables and received such responses,

what additional evidence could he or she have gathered to try to obtain an accu- rate figure for sales to and accounts receivable from customers in South Korea?

b. If you were L&H’s auditor and you had received such responses from South Korean customers, how likely would you be to use inquiry of the entity’s person- nel as an audit procedure? Why?

Sources: M. Maremont, J. Eisinger, and J. Carreyrou, “How High-Tech Dream at Lernout & Hauspie Crumbled in a Scandal,” The Wall Street Journal (December 7, 2000), pp. A1, A18; J. Carreyrou and M. Maremont, “Lernout Unit Engaged in Massive Fraud to Fool Auditors, New Inquiry Concludes,” The Wall Street Journal (April 6, 2001), p. A3; and J. Carreyrou, “Lernout Unit Booked Fictitious Sales, Says Probe,” The Wall Street Journal (April 9, 2001), p. B2.

LO 5-9 5-41 The auditors for Weston University are conducting their audit for the fiscal year ended December 31, 2015. Specifically, the audit firm is now focusing on the audit of revenue from this season’s home football games. While planning the audit of sales of football tickets, one of their newer staff people observed that, in prior years, many hours were spent auditing revenue. This staff associate pointed out that perhaps the firm could apply analytical procedures to evaluate whether it appears that the rev- enue account is properly stated.

The staff associate noted that information for a typical home game could be used to estimate revenues for the entire season. The home football season consisted of seven home games—one against a nationally ranked powerhouse, Bloomington

Final PDF to printer

Chapter 5 Evidence and Documentation 173

mes32502_ch05_128-176.indd 173 10/05/15 02:15 PM

University, and six games against conference opponents. One of these conference games is Weston’s in-state archrival, Norwalk University. All of these games were day games except for the game against a conference opponent, Westport University.

The auditors will base their estimate on the game played against Kramer College, a conference opponent. This game is considered to be an average home game for Weston University. The following information concerning that game is available:

Ticket prices Box seats $12 per ticket End-zone seats 8 per ticket Upper-deck seats 5 per ticket

Box seats 70% End-zone seats 20% Upper-deck seats 10%

Total attendance 24,000 (stadium capacity is 40,000)

This attendance figure includes the 500 free seats described below, and the 24,000 figure should be used as a basis for all further calculations.

At the game against Kramer College, total attendance was allocated among the dif- ferent seats as follows:

Based on information obtained in prior year audits, the following assumptions are made to assist in estimating revenue for all other games:

∙ Attendance for the Bloomington University game was expected to be 30 per- cent higher than total attendance for an average game, with the mix of seats pur- chased expected to be the same as for a regular game; however, tickets are priced 20 percent higher than for a normal game.

∙ The game against Norwalk University was expected to draw 20 percent more fans than a normal game, with 75 percent of these extra fans buying box seats and the other 25 percent purchasing upper-deck seats.

∙ To make up for extra costs associated with the night game, ticket prices were increased by 10 percent each; however, attendance was also expected to be 5 percent lower than for a normal game, with each type of seating suffering a 5 percent decline.

∙ At every game, 500 box seats are given away free to players’ family and friends. This number is expected to be the same for all home games.

Required: 1. Based on the information above, develop an expectation for ticket revenue for the

seven home football games. 2. Reported ticket revenue was $2,200,000. Is the difference between your estimate

and reported ticket revenue large enough to prompt further consideration? Why or why not? If further consideration is warranted, provide possible explanations for the difference between estimated and actual football ticket revenue. What evi- dence could you gather to verify each of your explanations?

3. Under what conditions are substantive analytical procedures likely to be effective in a situation such as that described in this problem?

LO 5-3, 5-4, 5-5 5-42 Bentley Bros. Book Company publishes more than 250 fiction and nonfiction titles. Most of the company’s books are written by southern authors and typically focus on subjects popular in the region. The company sells most of its books to major retail stores such as Waldenbooks and B. Dalton.

Your firm was just selected as the new auditors for Bentley Bros., and you have been appointed as the audit manager for the engagement based on your prior industry experience. The prior auditors were removed because the entity felt that it was not receiving adequate service. The prior auditors have indicated to you that the change in auditors did not result from any disagreements over accounting or auditing issues.

Final PDF to printer

174 Part 2 Audit Planning and Basic Auditing Concepts

mes32502_ch05_128-176.indd 174 10/05/15 02:15 PM

Your preliminary review of the company’s financial statements indicates that the allowance for return of unsold books represents an important account (that is, high risk) because it may contain material misstatements. Consistent with industry prac- tice, retailers are allowed to return unsold books for full credit. You know from your prior experience with other book publishers that the return rate for individual book titles can range from 30 to 50 percent. The entity develops its allowance for return of unsold books based on internally generated records; that is, it maintains detailed records of all book returns by title.

Required: a. Discuss how you would assess the reliability of the entity’s records for developing

the allowance for return of unsold books. b. Discuss how you would determine the return rate for relatively new titles. c. Consider whether any external evidence can be obtained that would provide addi-

tional evidence on the reasonableness of the account.

INTERNET ASSIGNMENT

LO 5-3, 5-4, 5-5 5-43 Use an Internet browser to search for the following terms: ∙ Electronic data interchange (EDI). ∙ Image-processing systems. Prepare a memo describing EDI and image-processing systems. Discuss the implica-

tions of each for the auditor’s consideration of audit evidence.

HANDS-ON CASES

EarthWear Online

Preliminary Analytical Procedures Willis and Adams’ staff prepared detailed ratio analysis, trends, and common size balance sheet and income statements based on EarthWear’s unaudited financial statements. The procedures you perform will analyze the results of the computations and assess the overall financial condition of EarthWear.

Visit Connect’s additional student resources to find a detailed description of the case and to download required material

Evaluation of Inventory Audit Evidence Willis and Adams’ staff observed inventory counts at two warehouse locations for EarthWear . Your task is to evaluate the inventory count tags and inventory status sheet for accuracy, completeness, and existence.

Visit Connect’s additional student resources to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch05_128-176.indd 175 10/05/15 02:15 PM

Final PDF to printer

mes32502_ch05_128-176.indd 176 10/05/15 02:15 PM

Final PDF to printer

177

mes32502_ch06_177-219.indd 177 09/30/15 02:51 PM

PART THREE

Understanding and Auditing Internal Control

CHAPTER 6 Internal Control in a Financial Statement Audit

CHAPTER 7 Auditing Internal Control over Financial Reporting

Final PDF to printer

mes32502_ch06_177-219.indd 178 09/30/15 02:51 PM

CHAPTER

6 6-1 Understand the importance of internal control to

management and auditors. 6-2 Know the definition of internal control. 6-3 Know what controls are relevant to the audit. 6-4 Understand the effect of information technology on

internal control. 6-5 Be familiar with the components of internal control

together with the principles associated with each component.

6-6 Understand how to plan an audit strategy based on assessments and decisions about internal control.

6-7 Know how to develop an understanding of an entity’s internal control.

6-8 Be familiar with the tools available for documenting the understanding of internal control.

6-9 Know how to assess the level of control risk. 6-10 Know how auditors perform tests of controls. 6-11 Understand audit strategies for the nature, timing, and

extent of substantive procedures based on different levels of detection risk.

6-12 Understand the considerations for the timing of audit procedures.

6-13 Be familiar with how to assess control risk when an entity’s accounting transactions are processed by a service organization.

6-14 Understand the auditor’s communication of internal control–related matters.

6-15 Be familiar with general and application controls. 6-16 Understand how to flowchart a business process.

COSO, Internal Control—Integrated Framework (New York: AICPA, 2013) COSO, Enterprise Risk Management—Integrated Framework (New York: AICPA, 2004) COSO, Guidance on Monitoring Internal Control Systems (New York: AICPA, 2009) AU 240, Consideration of Fraud in a Financial Statement Audit AU 250, Consideration of Laws and Regulations in an Audit of Financial Statements AU 260, The Auditor’s Communication with Those Charged with Governance AU 265, Communicating Internal Control Related Matters Identified in an Audit AU 402, Audit Considerations Relating to an Entity Using a Service Organization AU 580, Written Representations AU 610, Using the Work of Internal Auditors

AU 620, Using the Work of an Auditor’s Specialist AT 801, Reporting on Controls at a Service Organization PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements PCAOB Auditing Standard No. 8, Audit Risk (AU-C 200) PCAOB Auditing Standard No. 9, Audit Planning (AU-C 300) PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Major Phases of an Audit

179

mes32502_ch06_177-219.indd 179 09/30/15 02:51 PM

Internal Control in a Financial Statement Audit

I n Chapter 4, we noted that a major part of the auditor’s understanding of the entity and its environment involves knowledge about the entity’s internal con- trol. In Chapter 5, we introduced you to the concepts of the assurance testing

hierarchy and the “assurance bucket,” which indicate that the auditor typically obtains assurance from tests of controls before performing substantive pro- cedures. This chapter provides detailed coverage of the auditor’s assessment of control risk. It addresses the importance of internal control and its compo- nents, as well as how evaluating internal control relates to substantive testing. This chapter covers the COSO framework, basic concepts that apply to audit- ing internal control, and how the auditor’s consideration of an entity’s internal control impacts the financial statement audit. The approach and techniques discussed in this chapter are equally applicable for an audit of internal control over financial reporting as required by the Sarbanes-Oxley Act of 2002 and discussed in Chapter 7. This chapter also discusses the timing of audit pro- cedures, service organizations, and the required communications of internal control–related matters. Advanced Modules cover the types of controls in an IT environment and flowcharting techniques.

Final PDF to printer

180 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 180 09/30/15 02:51 PM

Introduction

Internal control plays an important role in how management meets its stewardship or agency responsibilities. Management has the responsibility to design and maintain a system of internal control that provides reasonable assurance that assets and records are properly safe- guarded, and that the entity’s information system generates information that is reliable for decision making. If the information system does not generate reliable information, manage- ment may be unable to make informed decisions about issues such as product pricing, cost of production, and profit information, and external reports may not be useful to investors and other stakeholders.

An entity’s system of internal control is management’s responsibility but it is important to the auditor because the auditor needs assurance about how well the assets and records of the entity are safeguarded and about the reliability of the data generated by the information system. The auditor uses risk assessment procedures to obtain an understanding of the entity’s inter- nal control. These procedures help the auditor to identify key controls, recognize the types of potential misstatements that are relatively likely to arise, and design tests of controls and sub- stantive procedures. As we discussed previously, there is an inverse relationship between the reliability of internal control and the amount of substantive evidence required of the auditor. In other words, when filling the assurance bucket for an assertion (see Figure 5–4), if the auditor obtains more controls evidence, then less substantive evidence is needed to top off the bucket.

As we shall see in this chapter, the auditor’s understanding and assessment of internal control is a major factor in determining the overall audit strategy. After providing an overview of internal control and the COSO Internal Control—Integrated Framework, we discuss the auditor’s responsibilities for internal control under two major topics: (1) obtaining an under- standing of internal control and (2) assessing control risk.

Definition of Internal Control According to COSO’s Internal Control—Integrated Framework, a system of internal control is designed and carried out by an entity’s board of directors, management, and other per- sonnel to provide reasonable assurance about the achievement of the entity’s objectives in the following categories: (1) reliability, timeliness, and transparency of internal and external, nonfinancial and financial reporting; (2) effectiveness and efficiency of operations, including safeguarding of assets; and (3) compliance with applicable laws and regulations. According to COSO, the purpose of its Framework is to help management better control the organization and to provide boards of directors an added ability to oversee internal control. An effective system of internal control allows management to focus on operations and financial perfor- mance goals while maintaining compliance with relevant laws and minimizing surprises.

Controls Relevant to the Audit The controls that are of most direct relevance to a financial statement audit are those that con- tribute to the reliability, timeliness, and transparency of external financial reporting. These controls are relevant to an audit because they help to prevent, or detect and correct, material misstatements in the entity’s financial statements. In addition, larger public companies are required to engage an external auditor to express an opinion as to the effectiveness of their systems of internal control over financial reporting. Controls relating to operations, compli- ance, and other types of reporting may be relevant when they have an impact on data the audi- tor uses to apply audit procedures. For example, the internal controls that relate to operating statistics may be important because such data may be utilized by the auditor for performing analytical procedures. However, many controls that relate to management’s planning or oper- ating decisions may not be relevant to the auditor.

LO 6-1

Internal Control—an Overview

LO 6-2

LO 6-3

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 181

mes32502_ch06_177-219.indd 181 09/30/15 02:51 PM

The Effect of Information Technology on Internal Control The extent of an entity’s use of information technology (IT) can affect internal control because IT affects the way transactions are initiated, authorized, recorded, processed, and reported.

Controls in most information systems consist of a combination of sometimes interdepen- dent automated and manual controls. Manual controls often use information produced by IT, and they are often used to monitor the functioning of, and errors and exceptions identified by, automated controls. An entity’s mix of manual and automated controls varies with the nature and complexity of the entity’s use of IT. For example, “cloud computing” and storage of data in the “cloud” bring specific risks and the need for corresponding controls.

Table 6–1 lists some of the benefits and risks of using IT for an entity’s internal control. The risks to internal control vary depending on the nature and characteristics of the entity’s infor- mation system. For example, where multiple users may access a common database, a lack of control at a single user entry point may compromise the security of the entire database. This may result in improper changes to or destruction of data. When IT personnel or users can gain access to privileges beyond those necessary to perform their assigned duties, a breakdown in segrega- tion of duties can occur, resulting in unauthorized transactions or changes to programs or data.

The COSO Framework

Components of Internal Control Internal control as defined by the COSO Framework consists of five components:

∙ Control Environment. ∙ Entity’s Risk Assessment. ∙ Control Activities. ∙ Information and Communication. ∙ Monitoring Activities.

Table 6–2 defines each of the components, while Figure 6–1 shows how the categories of objectives of internal control, including safeguarding of assets, relate to the five components. A direct relationship exists between objectives (which reflect what an entity is striving to achieve), components (which represent what the entity needs to do in order to achieve the objectives), and the structure of the entity (the operating units, legal entities, and other). The relationship can be depicted in the form of a cube, as illustrated in Figure 6–1. As mentioned previously, the auditor is mainly concerned with how the five components, evaluated individu- ally and in terms of how they operate together, affect the external financial reporting objective.

LO 6-4

LO 6-5

Potential Benefits and Risks to an Entity’s Internal Control from IT

Benefits • Consistent application of predefined business rules and performance of complex calculations in processing large volumes of transactions or data. • Greater timeliness, availability, and accuracy of information. • Facilitation of additional analysis of information for enhanced internal decision making. • Greater ability to monitor the entity’s activities, policies, and procedures on a timely basis. • Greater ability to prevent or detect circumvention of controls. • Enhanced segregation of duties through security controls in applications, databases, and operating systems.

Risks • Reliance on systems or programs that, unknown to management, inaccurately process data, process inaccurate data, or both. • Unauthorized access to data that may result in destruction of data or improper changes to data, including the recording of unauthorized or nonexistent

transactions or inaccurate recording of transactions. • Unauthorized changes to data in master files. • Unauthorized changes to systems or programs. • Failure to make necessary changes to systems or programs. • Inappropriate manual intervention. • Potential loss of data.

T A B L E 6 – 1

Final PDF to printer

182 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 182 09/30/15 02:51 PM

Components of Internal Control

Control environment The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control and expected standards of conduct.

The entity’s risk assessment process Risk assessment involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity’s objectives, thereby forming a basis for determining how risks should be managed. Management considers possible changes in the external environment and within its own business model that may impede its ability to achieve its objectives.

Information and communication Information is necessary for the entity to carry out internal control responsibilities in support of achievement of its objec- tives. Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day internal con- trol activities. Communication enables personnel to understand internal control responsibilities and their importance to the achievement of objectives.

Control activities Control activities are the actions established by policies and procedures to help ensure that management directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity and at various stages within business processes, and over the technology environment.

Monitoring of controls Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five com- ponents of internal control, including controls to effect the principles within each component, are present and functioning. Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board.

T A B L E 6 – 2

En ti

ty L

ev el

D iv

is io

n O

pe ra

ti ng

U ni

t Fu

nc ti

Co m

pl ia

nc e

Re po

rti ng

Op er

at ion

Control Environment

Risk Assessment

Information & Communication

Monitoring Activities

Control Activities

The Relationship of the Objectives of Internal Control to the Five Components of Internal Control

F I G U R E 6 – 1

In the new COSO Framework (revised in 2013), each component includes principles that represent fundamental concepts underlying the effectiveness of each component. An entity can achieve effective internal control by applying all 17 principles. The principles are sum- marized in Table 6–3, grouped by component.

The Framework sets forth the requirements for an effective system of internal control. An effective system provides reasonable assurance that the risk of not achieving an entity objec- tive is reduced to an acceptable level. For a control system to be considered effective, each of the five components and relevant principles must be present and functioning, and the five components must operate together in an integrated manner.

Control Environment The control environment sets the tone of an organization, influencing the control conscious- ness of its people. The importance of control to an entity is reflected in the overall attitude, awareness, and actions of the board of directors, management, and owners regarding internal control. The control environment establishes the foundation for implementing the entity’s system of internal control.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 183

mes32502_ch06_177-219.indd 183 09/30/15 02:51 PM

The 17 Principles Underlying the Components of Internal Control

Control Environment 1. The organization demonstrates a commitment to integrity and ethical values. 2. The board of directors demonstrates independence from management and exercises oversight of the develop-

ment and performance of internal control. 3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and

responsibilities in the pursuit of objectives. 4. The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment

with objectives. 5. The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Risk Assessment 6. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks

relating to objectives. 7. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis

for determining how the risks should be managed. 8. The organization considers the potential for fraud in assessing risks to the achievement of objectives. 9. The organization identifies and assesses changes that could significantly impact the system of internal control.

Control Activities 10. The organization selects and develops control activities that contribute to the mitigation of risks to the achieve-

ment of objectives to acceptable levels. 11. The organization selects and develops general control activities over technology to support the achievement of

objectives. 12. The organization deploys control activities through policies that establish what is expected and procedures that

put policies into action.

Information and Communication 13. The organization obtains or generates and uses relevant, quality information to support the functioning of other

components of internal control. 14. The organization internally communicates information, including objectives and responsibilities for internal control,

necessary to support the functioning of other components of internal control. 15. The organization communicates with external parties regarding matters affecting the functioning of other compo-

nents of internal control.

Monitoring Activities 16. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the

components of internal control are present and functioning. 17. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties

responsible for taking corrective action, including senior management and the board of directors, as appropriate.

T A B L E 6 – 3

Principle 1: The organization demonstrates a commitment to integrity and ethical values. The effectiveness of an entity’s internal controls is heavily influenced by the integ- rity and ethical values of management personnel, who are responsible to create, administer, and monitor the entity’s system of controls. Management’s philosophy and operating style can significantly affect the quality of internal control through the establishment of an appropriate “tone at the top.”

A well-controlled entity establishes and evaluates adherence to ethical and behavioral standards that are communicated to employees and reinforced by day-to-day practice. For example, management should remove incentives and opportunities that might lead personnel to engage in dishonest, illegal, or unethical acts. Examples of such incentives are pressures to meet unrealistic performance targets and performance-dependent rewards. Examples of opportunities include an ineffective board of directors, a weak internal audit function, and lack of control activities that might detect improper behavior. Management can best commu- nicate integrity and ethical behavior within an entity by example and through the use of policy statements, codes of conduct, and training. Management must promptly address deviations from standards of conduct.

Characteristics that may signal important information to the auditor about management’s integrity and ethical values include management’s approach to taking and monitoring busi- ness risks and management’s attitudes and actions toward financial reporting—for example, whether management tends to be conservative or aggressive when selecting from alternative accounting principles.

Final PDF to printer

184 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 184 09/30/15 02:51 PM

Principle 2: The board of directors demonstrates independence from manage- ment and exercises oversight of the development and performance of internal control.1 The board of directors and the audit committee significantly influence the control consciousness of the entity. The board of directors and the audit committee must take their fiduciary responsibilities seriously and actively oversee the entity’s accounting and reporting policies and procedures. Factors that can impact the effectiveness of the board or audit com- mittee include the following:

∙ Experience and stature of members and independence from management. ∙ Extent of involvement with and scrutiny of the entity’s activities. ∙ Information availability and willingness/ability to act on information. ∙ Extent to which difficult questions are raised and pursued with management. ∙ Nature and extent of interactions with internal and external auditors.

Principle 3: Management establishes, with board oversight, structures, report- ing lines, and appropriate authorities and responsibilities in the pursuit of objectives. An entity’s organizational structure defines how authority and responsibility are delegated and monitored. It provides the framework within which the entity’s activities for achieving entity-wide objectives are planned, executed, controlled, and reviewed. The appro- priateness of an entity’s organizational structure depends on its size and the nature of its activities, as well as such external influences as regulation.

This control environment principle includes assignment of authority and responsibility for operating activities and establishment of reporting relationships and authorization hierar- chies, as well as setting of policies regarding acceptable business practices, knowledge and experience of key personnel, and resources provided for carrying out duties. It also includes policies and communications directed at ensuring that all personnel understand the entity’s objectives, know how their individual actions interrelate with and contribute to those objec- tives, and recognize how and for what they will be held accountable.

An entity can use a number of controls to meet the requirements of this control environ- ment principle. For example, the entity can have a well-specified organizational chart that indicates lines of authority and responsibility. Further, management and supervisory person- nel should have job descriptions that include their control-related responsibilities.

Principle 4: The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives. The quality of internal control is directly related to the quality of the personnel operating the system. The entity should have sound personnel policies for hiring, orienting, training, evaluating, counseling, promot- ing, compensating, planning for succession, and taking remedial action. For example, an entity can demonstrate its commitment to hiring competent and trustworthy people by establishing standards that emphasize seeking the most qualified individuals, with emphasis on educational background, prior work experience, and evidence of integrity and ethical behavior. Compe- tence relates to the knowledge and skills necessary to accomplish the tasks that define an indi- vidual’s job. Management should specify the competence level for a particular job and translate it into a job description that details the specific knowledge and skills required. Research has shown personnel-related issues to be a major cause of accounting error.2

1See PricewaterhouseCoopers, 2012 Current Developments for Directors (New York: PricewaterhouseCoopers, 2012), for a discussion of audit committees and corporate governance. Also see information published by KPMG’s Audit Committee Institute (www.kpmginstitutes.com/aci). 2A. Eilifsen and W. F. Messier, Jr., “Auditor Detection of Misstatements: A Review and Integration of Empirical Research,” Journal of Accounting Literature 2000 (19), pp. 1–43, reviews research studies that have examined the causes of auditor-detected misstatements. For example, A. Wright and R. H. Ashton, “Identifying Audit Adjustments with Attention-Directing Procedures,” The Accounting Review (October 1989), pp. 710–28, find that approximately 55 percent of the errors detected by auditors resulted from personnel problems, insufficient accounting knowledge, and judgment errors.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 185

mes32502_ch06_177-219.indd 185 09/30/15 02:51 PM

Principle 5: The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives. Management and the board of directors are responsible for establishing mechanisms to communicate and hold individuals accountable for performance of internal control responsibilities across the organization and for implementing corrective action as necessary. Management and the board of directors also establish performance measures, incentives, and rewards appropriate for responsibilities at all levels of the entity, reflecting reasonable expectations for performance and standards of con- duct in light of both short-term and longer-term objectives. It is also important that incentives and rewards be aligned with the fulfillment of internal control responsibilities. Finally, man- agement and the board of directors should evaluate performance of internal control responsi- bilities, including adherence to standards of conduct and expected levels of competence, and provide rewards or exercise disciplinary action as appropriate.

The Entity’s Risk Assessment Process3

An entity’s risk assessment process identifies and responds to business risks in relation to achieving business objectives. Thus, a precondition to risk assessment is the establishment of objectives. The aspect of an entity’s risk assessment process that is most directly rele- vant to auditors is how management identifies risks relevant to the preparation of financial statements, and then estimates their significance, assesses the likelihood of their occurrence, and decides on how to manage them. For example, the entity’s risk assessment process may address risks involved in significant estimates recorded in the financial statements.

The risk assessment process, as it relates to the external financial reporting objective, should consider external and internal events and circumstances that may arise and adversely affect the entity’s ability to initiate, authorize, record, process, and report financial data con- sistent with management’s financial statement assertions. Once risks have been identified, management should consider their significance, the likelihood of their occurrence, and how they should be managed. In some instances, management may decide to accept the conse- quences of a possible risk because the costs to remediate may exceed the benefit.

Principle 6: The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives. As discussed above, internal control objectives are organized into three categories in the COSO Framework: operations, compliance, and reporting. Objectives specific to external financial reporting include the preparation of financial statements for external purposes. In the area of external financial reporting, management must ensure that specified objectives include reporting that is consistent with generally accepted accounting principles that are appropriate in the circum- stances. Management establishes external financial reporting objectives in light of material- ity considerations. Finally, external financial reporting objectives include faithful reflection of underlying transactions and events, including important qualitative characteristics. Fun- damental qualitative characteristics include (a) relevance—information that is capable of making a difference in user decisions—and (b) faithful representation— information that is complete, neutral, and free from error. Other important qualitative characteristics include comparability, verifiability, timeliness, and understandability.

Principle 7: The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. An entity’s risk assessment process should consider the possibility of events that threaten the achievement of objectives. This process is supported by a variety of activities, techniques, and mechanisms. As part of its system of internal control, manage- ment develops and implements controls relating to the conduct of risk identification activities.

3In recent years, COSO has provided a significant amount of guidance in the area of enterprise risk management (ERM). For example, see COSO, Enterprise Risk Management—Integrated Framework (New York: AICPA, 2004) and COSO, Strengthening Enterprise Risk Management for Strategic Advantage (www.coso.org).

Final PDF to printer

186 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 186 09/30/15 02:51 PM

Management considers risks at all levels of the entity and takes the necessary actions to respond. An entity’s risk assessment considers factors that influence the severity, velocity, and persistence of the risk; likelihood of the loss of assets; and related impacts on opera- tions, reporting, and compliance activities. The entity also needs to establish its tolerance for accepting risks and its ability to operate within those risk levels.

Principle 8: The organization considers the potential for fraud in assessing risks to the achievement of objectives. The assessment of fraud risk considers the possibility of fraudulent reporting, loss of assets, and corruption resulting from various types of fraud and misconduct. The assessment of fraud risk includes consideration of incentives and pres- sures; opportunities for unauthorized acquisition, use, or disposal of assets, altering of the entity’s reporting records, or other inappropriate acts; and how management and other person- nel might rationalize or justify inappropriate actions.

Principle 9: The organization identifies and assesses changes that could signifi- cantly impact the system of internal control. The risk identification process includes consideration of possible changes in the internal or external environment because changes can introduce or change the risks to the entity’s objectives. Thus, the entity considers the impact of changes to the regulatory, economic, and physical environment in which the entity oper- ates, as well as new or dramatically altered business lines, rapid growth, changing reliance on foreign geographies, and new technologies. The organization also considers changes in management and resulting changes in attitudes and philosophies with respect to the system of internal control.

Control Activities Control activities are the policies and procedures that help ensure that management’s direc- tives are carried out and implemented to address risks identified in the risk assessment process. Control activities include a range of activities, such as approvals, authorizations, verifications, reconciliations, reviews of operating performance, and segregation of duties. They occur throughout the organization, at all levels and in all functions.

Principle 10: The organization selects and develops control activities that con- tribute to the mitigation of risks to the achievement of objectives to acceptable levels. Control activities help ensure that risk responses that are intended to address and mitigate risks are carried out. Management considers how the environment, complexity, nature, and scope of its operations, as well as the specific characteristics of its organiza- tion, affect the selection and development of control activities. Based on its risk assessment, management determines which relevant business processes require control activities. Control activities may include a mix of manual and automated controls, as well as a mix of preven- tive and detective controls. Management considers control activities at various levels in the entity and segregates incompatible duties. Where such segregation is not practical, alternative control activities are implemented to compensate to the extent possible. Control activities are commonly categorized into the following four types:

∙ Performance reviews (sometimes called “independent checks”). ∙ Physical controls. ∙ Segregation of duties. ∙ Information processing controls, including authorization and document-based

controls.

Performance Reviews A strong accounting system should have controls that independently check the performance of the individuals or processes in the system. For example, senior management should review actual performance versus budgets, forecasts, prior periods, and competitors. Similarly, managers running functions or activities should periodically check the

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 187

mes32502_ch06_177-219.indd 187 09/30/15 02:51 PM

quality of subordinates’ work and review performance reports for units and personnel under their supervision. A manager might periodically review or reperform a subordinate’s account reconciliation. Lastly, personnel with management or oversight responsibility should review and analyze relationships among both financial and nonfinancial data (e.g., key performance indicators), investigate any unusual items, and take corrective actions when necessary.

Physical Controls These controls include

∙ Physical security of assets, including adequate safeguards, such as secure facilities to protect against theft of assets or records.

∙ Authorization requirements for access to computer programs and data files. ∙ Periodic counting and comparison with amounts shown on control records (e.g.,

comparing the results of cash, security, and inventory counts with accounting records).

Stop and Think: Why are the physical controls listed above relevant from an auditor’s perspective, especially with respect to access to records and data?

If physical controls over access to records and data are weak or suspect, this has a direct impact on the auditor’s assessment of control risk. The implications of an increased control risk assessment on the financial statement audit are discussed later in this chapter.

Segregation of Duties It is important for an entity to segregate the custody of assets, authorization of transactions, and recording of transactions. (Tip: To help you remember the important aspects of segregation of duties, use the acronym CAR—C for Custody, A for Authorization, and R for Recording). Performance of each of these functions by differ- ent people reduces the opportunity for any one person to be in a position to perpetrate and conceal errors or fraud in the normal course of his or her duties, and at the same time benefit by obtaining an asset. For example, if an employee receives cash payments on account from customers and has access to the accounts receivable subsidiary ledger, it is possible for that employee to misappropriate the cash and cover the shortage in the accounting records.

Stop and Think: Why is it important that different individuals perform the duties of custody, authorization, and recording? What could happen, for example, if an individ- ual were responsible for authorizing sales returns and for recording the receipt of the returned inventory?

Such a situation would clearly violate segregation of duties principles. An employee with both duties could, for example, issue a sales return memorandum to a friend or relative and then write off the receivable balance and record receipt of the inventory, even if the inventory were never returned.

Information Processing Controls The two broad categories of information systems controls are general controls and application controls. Note that general IT controls are addressed in the second control principle of the control activities component, which reads as follows:

Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives. General controls relate to the overall information processing environment and include controls over data center and network operations; system software acquisition, change, and maintenance; access security; and appli- cation system acquisition, development, and maintenance. For example, an entity’s controls for developing new programs for existing accounting systems should include adequate docu- mentation and testing before implementation. In addition, development of new systems and changes to existing ones are controlled, as is access to data, files, and programs.

Final PDF to printer

188 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 188 09/30/15 02:51 PM

Application controls apply to the processing of individual applications and help ensure the occurrence (validity), completeness, and accuracy of transaction processing. Data entered are subject to online edit checks or matching to approved control files. For example, a cus- tomer’s order is accepted only after reference to an approved customer file and credit limit. General and application controls are covered in more detail in Advanced Module 1 at the end of this chapter.

Control activities involve policies and procedures that help mitigate risks that endanger the achievement of objectives. This concept is articulated in the third principle underlying the Control Activities component of the COSO cube:

Principle 12: The organization deploys control activities through policies that establish what is expected and procedures that put policies into action. A policy is a rule or guideline that calls for certain activities to take place in certain circumstances. For instance, a policy might call for a manager to review all purchases over $1,500. The procedure is the review itself, performed in a timely manner and with attention given to factors set forth in the policy, such as the nature and volume of purchases, and their relation to furthering the entity’s objectives.

Information and Communication Information is necessary for the entity to carry out internal control responsibilities that support the achievement of its objectives. The acquisition, use, and sharing of relevant, high-quality information from both internal and external sources is necessary to support the functioning of internal control. Thus, the Information and Communication component of the COSO Frame- work supports the functioning of the other four components of internal control.

Principle 13: The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. An information system consists of infrastructure (physical and hardware components), software, people, procedures (manual and automated), and data. The information system relevant to the financial reporting objective includes the accounting system and consists of the procedures (automated or manual) and records established to initiate, authorize, record, process, and report an entity’s transac- tions and to maintain accountability for the related assets and liabilities. An effective account- ing system gives appropriate consideration to establishing methods and records that will

∙ Identify and record all valid transactions. ∙ Describe on a timely basis the transactions in sufficient detail to permit proper

classification for financial reporting. ∙ Measure the value of transactions in a manner that permits recording their proper

monetary value in the financial statements. ∙ Determine the time period in which transactions occurred to permit recording of

transactions in the proper accounting period. ∙ Properly present the transactions and related disclosures in the financial statements.

Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the func- tioning of internal control. Internal communication enables personnel to receive clear messages from senior management about the importance of control responsibilities and how they are to be performed. Communication involves providing an understanding of individual roles and responsibilities pertaining to internal control over financial reporting. It includes the extent to which personnel understand how their activities in the financial reporting informa- tion system relate to the work of others and the means of reporting exceptions to an appro- priate higher level within the entity. Policy manuals, accounting and reporting manuals, and memoranda communicate policies and procedures to the entity’s personnel. Communications can also be made electronically, orally, or through the actions of management.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 189

mes32502_ch06_177-219.indd 189 09/30/15 02:51 PM

Principle 15: The organization communicates with external parties regarding matters affecting the functioning of internal control. External communication both enables inbound receipt of relevant information and provides internal control–related infor- mation to external parties in response to outside requirements and expectations.

Monitoring of Controls The monitoring component has received increased attention in recent years. In 2009, COSO issued a document titled Guidance on Monitoring Internal Control Systems. Monitoring of controls is intended to assess the quality of internal control performance over time. To provide reasonable assurance that an entity’s objectives will be achieved, management should monitor controls to determine whether they are operating effectively. Since risks change over time, management should monitor whether controls need to be redesigned when risks change.

Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. Monitoring can be done through ongoing activities or separate evaluations. Ongoing monitoring procedures are built into the normal, recurring activities of the entity and include regular management and supervisory activities. Management can use internal auditors or personnel performing similar functions in other areas to monitor the oper- ating effectiveness of internal control. For example, management might review whether bank reconciliations are being prepared on a timely basis and are reviewed by internal auditors.

Principle 17: The organization evaluates and communicates internal control defi- ciencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. In many entities, the information system produces much of the information used in monitoring. If management assumes that data used for monitoring are accurate, errors may exist in the information, potentially leading management to incorrect conclusions. Further, monitoring is unlikely to be effective if identified control deficiencies are not communicated in a timely way to those with management or oversight responsibilities.

Planning an Audit Strategy

The audit risk model states that AR = RMM × DR where RMM = IR × CR. In this defini- tion, the auditor’s assessment of RMM must consider the level of CR in applying the audit risk model. How the auditor determines the appropriate level of CR is described in the remainder of this chapter. Figure 6–2 presents a flowchart of the auditor’s decision process when con- sidering internal control. As we discussed in Chapter 4, the auditor must assess the risk of material misstatement (refer to Figure 4–1). The information gathered by performing risk assessment procedures is used to evaluate the design of controls and to determine whether the controls have been implemented. This is the first step in Figure 6–2. The auditor then docu- ments this understanding of the entity’s internal controls. With a recurring engagement, the auditor is likely to possess substantial knowledge about the entity’s internal controls and may be able to choose an audit strategy after only updating the understanding of the entity’s inter- nal control. For a first-year audit, the auditor may delay making a judgment about an audit strategy until a more detailed understanding of internal control is obtained.

LO 6-6

Practice I N S I G H T

A common challenge that increases control risk is the fact that many entities have a large variety of technological platforms, software, and hardware. Companies that have grown through merger and acquisition frequently band the legacy systems together rather than replace one or both systems. The resulting montage of servers, computers, off-the-shelf and custom-programmed software, and so on creates a complex and potentially risk-prone IT environment.

Final PDF to printer

190 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 190 09/30/15 02:51 PM

Set control risk at the maximum.

Does the auditor intend

to rely on controls?

Does the achieved level of

control risk support the planned level of

control risk?

Substantive strategy

Reliance strategy

Plan and perform tests of controls.

Set control risk based on tests of controls.

Yes

Develop an understanding of internal control by: • Evaluating the design of controls. • Determining if the controls have been implemented.

Document the understanding of internal control.

Revise planned level of substantive procedures.

Document the level of control risk.

Perform substantive procedures based on level of assessed control risk.

Flowchart of the Auditor’s Consideration of Internal Control and Its Relation to Substantive Procedures

F I G U R E 6 – 2

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 191

mes32502_ch06_177-219.indd 191 09/30/15 02:51 PM

The next step for the auditor is to decide whether or not to rely on the entity’s controls for assurance about management’s financial statement assertions. When the auditor’s risk assess- ment procedures indicate that the controls are not properly designed or not implemented, the auditor will not rely on the controls. In this instance, the auditor will set control risk at high and use substantive procedures to reduce the risk of material misstatement to an acceptably low level (i.e., the assurance bucket is filled almost entirely with substantive evidence). When the auditor’s risk assessment procedures suggest that the controls are properly designed and implemented, the auditor will likely rely on the controls. If the auditor intends to rely on the controls, tests of controls are required to be performed to obtain audit evidence that the con- trols are operating effectively. The auditor will make an assessment of control risk based on the results of the tests of controls.

To assist your comprehension of how the auditor uses the understanding and assessment of internal control to determine the nature, timing, and extent of audit procedures, we describe only two audit strategies: a substantive strategy and a reliance strategy. However, keep in mind that there is no single strategy for the entire audit; rather, the auditor establishes a strategy for individual business processes (such as revenue or purchasing) or by specific assertion (occur- rence, completeness, and so on) within a business process. Furthermore, even when auditors follow a reliance strategy, the amount of assurance obtained by controls testing will vary from assertion to assertion. In other words, a reliance strategy just means the auditor intends to begin filling the assurance bucket with tests of controls evidence, but the percentage of the bucket filled with controls evidence will differ between assertions and across accounts in the various business processes. Finally, it is important to understand that auditing standards require some substantive evidence for all significant accounts and assertions. Thus, a reliance strategy reduces but does not eliminate the need to gather substantive evidence.

Practice I N S I G H T

In some situations, the auditor may find it necessary to rely on evidence stored by the entity in elec- tronic form. In such situations, a reliance strategy may be required due to the importance of controls in maintaining the integrity of the electronic evidence. For example, suppose an entity that provides electronic services to customers, such as an Internet service provider, uses IT to log services pro- vided to users, initiate bills for the services, process the billing transactions, and automatically record such amounts in electronic accounting records. The auditor’s substantive tests will rely on the integ- rity of the stored data, and tests of controls over data integrity may be the only way for the auditor to rely on subsequent substantive tests.

As we discuss in more detail in the next chapter, the Sarbanes-Oxley Act of 2002 as implemented by AS5 requires public company auditors to test and report on the design and effectiveness of most public companies’ internal control over financial reporting. Thus, it is expected that every public company audit will follow a reliance strategy for significant account balances or assertions.

Substantive Strategy A substantive audit strategy means that the auditor has decided not to rely on the entity’s controls and instead use substantive procedures as the main source of evidence about the assertions in the financial statements. However, as Figure 6–2 shows, a substantive strategy still requires the auditor to have a sufficient understanding of the entity’s internal controls to know whether they are properly designed and implemented. This knowledge includes an understanding of the five components of internal control (discussed previously).

The auditor may decide to follow a substantive strategy for some or all assertions because of one or all of the following factors:

∙ The implemented controls do not pertain to the assertion the auditor is considering. ∙ The implemented controls are assessed as ineffective. ∙ Testing the operating effectiveness of the controls would be inefficient.

Final PDF to printer

192 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 192 09/30/15 02:51 PM

The auditor next documents the level of control risk as being set at high, and finally, substantive procedures are designed and performed based on the assessment of a high level of control risk. Therefore, when the auditor follows a substantive strategy, the assurance bucket (refer to Figure 5–4) is filled with some evidence from the risk assessment procedures and an extensive amount of evidence from substantive procedures (i.e., substantive analytical proce- dures and tests of details).

Auditing standards point out that the auditor needs to be satisfied that performing only substantive procedures would be effective in restricting detection risk to an acceptable level. For example, the auditor may determine that performing only substantive procedures would be effective and more efficient than performing tests of controls for an entity that has a limited number of long-term debt transactions because corroborating substantive evidence can easily be obtained by examining the loan agreements and confirming relevant information.

Reliance Strategy A reliance strategy means that the auditor intends to rely on the entity’s controls. If a reli- ance strategy is followed, the auditor may need a more detailed understanding of inter- nal control to develop a preliminary or “planned” assessment of control risk. The auditor will then plan and perform tests of controls. The auditor uses the test results to assess the “achieved” level of control risk. If the test results indicate that achieved control risk is higher than planned, the auditor will normally increase the planned substantive procedures and document the revised control risk assessment. If tests of controls support the planned level of control risk, no revisions of the planned substantive procedures are required. The level of control risk is documented, and substantive procedures are then performed. Keep in mind that there may be different degrees of control reliance for different business processes or assertions within a process.

From a practical standpoint, the level of control risk is normally set in terms of the assertions about classes of transactions and events for the period under audit. Table 6–4 presents the asser- tions related to transactions and events that were discussed in Chapter 5 and control activities that are normally in place for each assertion to protect against material misstatements. For example, the use and tracking of prenumbered documents is a control procedure typically found in each business process to ensure occurrence and completeness. In a revenue process, accounting for prenumbered shipping documents provides reasonable assurance that all revenue is recorded (completeness). Similarly, reconciliation of the accounts receivable subledger to the general led- ger accounts receivable account provides a control to help ensure that the occurrence assertion is met. Later chapters show relevant control activities in detail for each business process.

Assertions about Classes of Transactions and Events and Related Control Procedures

Assertion Control Activities

Occurrence • Segregation of duties. • Prenumbered documents that are accounted for. • Daily or monthly reconciliation of subsidiary records with independent review.

Completeness • Prenumbered documents that are accounted for. • Segregation of duties. • Daily or monthly reconciliation of subsidiary records with independent review.

Accuracy • Internal verification of amounts and calculations. • Monthly reconciliation of subsidiary records by an independent person.

Authorization • General and specific authorization of transactions at important control points. Cutoff • Procedures for prompt recording of transactions.

• Internal review and verification. Classification • Chart of accounts.

• Internal review and verification.

T A B L E 6 – 4

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 193

mes32502_ch06_177-219.indd 193 09/30/15 02:51 PM

Obtain an Understanding of Internal Control

Overview Auditing standards require the auditor to obtain an understanding of each of the five compo- nents of internal control in order to plan the audit. This understanding includes knowledge about the design of relevant controls and whether they have been placed in operation by the entity. The auditor uses this knowledge to

∙ Identify the types of potential misstatement. ∙ Pinpoint the factors that affect the risk of material misstatement. ∙ Design tests of controls and substantive procedures.

In deciding on the nature and extent of the understanding of internal control needed for the audit, the auditor should consider the complexity and sophistication of the entity’s operations and systems, including the extent to which the entity relies on manual controls or on auto- mated controls. The auditor may determine that the engagement team needs an IT specialist. In determining whether an IT specialist is needed, the following factors should be considered:

∙ The complexity of the entity’s IT systems and controls and the manner in which they are used in conducting the entity’s business.

∙ The significance of changes made to existing systems, or the implementation of new systems.

∙ The extent to which data are shared among systems. ∙ The extent of the entity’s participation in electronic commerce. ∙ The entity’s use of emerging technologies. ∙ The significance of audit evidence that is available only in electronic form.

The IT specialist can be used to assist the engagement team in a number of ways. For exam- ple, the IT specialist can inquire of the entity’s IT personnel about how data and transac- tions are initiated, authorized, recorded, processed, and reported, and how IT controls are designed; inspect the system’s documentation; observe the operation of IT controls; and plan and perform tests of IT controls. The auditor should have sufficient IT-related knowledge to communicate the assertions to the IT specialist, to evaluate whether the specified procedures meet the auditor’s objectives, and to evaluate the results of the audit procedures completed by the IT specialist.

To properly understand an entity’s internal control, an auditor must understand the five components of internal control. The auditor may use the following audit procedures to obtain an understanding of an entity’s internal control:

∙ Inquiry of appropriate management, supervisory, and staff personnel. ∙ Inspection of entity documents and reports. ∙ Observation of entity activities and operations.

Understanding the Control Environment The auditor should gain sufficient knowledge about the control environment to understand management’s and the board of directors’ attitudes, awareness, and actions concerning the control environment. This includes knowledge of the factors contained in Table 6–3. Exhibit 6–1 presents a questionnaire that includes the type of information the auditor would document about EarthWear’s control environment (see the EarthWear online case at the end of this chapter for additional information).4

LO 6-7

4Exhibit 6–1 shows how the understanding of internal control can be developed and documented using a separate internal control questionnaire. Some or all of the information on the components of the entity’s internal control may be captured as part of the auditor’s understanding of the entity and its environment (see Chapter 3).

Final PDF to printer

194 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 194 09/30/15 02:51 PM

An Excerpt from Questionnaire for Documenting the Auditor’s Understanding of the Control Environment

E X H I B I T 6 – 1

CONTROL ENVIRONMENT QUESTIONNAIRE

Entity: EarthWear Clothiers Balance Sheet Date: 12/31/2015

Completed by: SAA Date: 9/30/15 Reviewed by: DRM Date: 10/15/15

COMMUNICATION AND ENFORCEMENT OF INTEGRITY AND ETHICAL VALUES

The effectiveness of controls cannot rise above the integrity and ethical values of the people who create, adminis- ter, and monitor them. Integrity and ethical values are essential elements of the control environment, affecting the design, administration, and monitoring of other components. Integrity and ethical behavior are the product of the entity’s ethical and behavioral standards, how they are communicated, and how they are reinforced in practice.

Yes, No, N/A Comments

Have appropriate entity policies regarding matters such as acceptable business practices, conflicts of interest, and codes of conduct been established, and are they adequately communicated?

Yes The permanent work papers contain a copy of EarthWear’s conflict-of-interest policy.

Does management demonstrate the appropriate “tone at the top,” including explicit moral guid- ance about what is right or wrong?

Yes EarthWear’s management maintains high moral and ethical standards and expects employees to act accordingly.

Are everyday dealings with customers, sup- pliers, employees, and other parties based on honesty and fairness?

Yes EarthWear’s management maintains a high degree of integrity in dealing with custom- ers, suppliers, employees, and other parties; it requires employees and agents to act accordingly.

Does management document or investigate deviations from established controls?

Yes To our knowledge, management has not attempted to override controls. Employees are encouraged to report attempts to bypass controls to appropriate individuals within the organization.

COMMITMENT TO COMPETENCE Competence is the knowledge and skills necessary to accomplish tasks that define the individual’s job. Commit- ment to competence includes management’s consideration of the competence levels for particular jobs and how those levels translate into requisite skills and knowledge.

Does the company maintain formal or informal job descriptions or other means of defining tasks that comprise particular jobs?

Yes EarthWear has formal written job descriptions for all supervisory personnel, and job duties for nonsupervisory personnel are clearly communicated.

Does management determine to an adequate extent the knowledge and skills needed to per- form particular jobs?

Yes The job descriptions specify the knowledge and skills needed. The Human Resources Department uses this information in hiring, training, and promotion decisions.

Does evidence exist that employees have the requisite knowledge and skills to perform their job?

Yes Our prior experiences with EarthWear personnel indicate that they have the necessary knowledge and skills.

Understanding the Entity’s Risk Assessment Process The auditor should obtain sufficient information about the entity’s risk assessment process to understand how management considers risks relevant to financial reporting objectives and decides on appropriate actions to address those risks. For example, suppose an entity operates in the oil industry, where there is always some risk of environmental damage. The auditor should obtain sufficient knowledge about how the entity manages its environmental risks, because environmental accidents can result in costly litigation against the entity, as illustrated by the British Petroleum spill in the Gulf of Mexico in 2010.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 195

mes32502_ch06_177-219.indd 195 09/30/15 02:51 PM

Understanding the Information System and Communications The auditor should obtain sufficient knowledge of the information system to understand the following:

∙ The classes of transactions in the entity’s operations that are significant to the financial statements.

∙ The control procedures by which transactions are initiated, authorized, recorded, processed, and reported, from their occurrence to their inclusion in the financial statements.

∙ The related accounting records, whether electronic or manual, supporting information, and specific accounts in the financial statements that are involved in initiating, recording, processing, and reporting transactions.

∙ How the information system captures other events and conditions that are significant to the financial statements.

∙ The financial reporting process used to prepare the entity’s financial statements, including significant accounting estimates and disclosures.

The auditor must learn about each business process that affects significant account balances in the financial statements. This includes understanding how transactions are initiated and authorized, how documents and records are generated, and how the documents and records flow to the general ledger and financial statements. Understanding the information system also requires knowing how IT is involved in data processing.

The auditor should understand the control procedures used by the entity to provide assur- ance that financial statements and related disclosures are properly prepared and presented. Such procedures include

∙ The procedures used to enter transaction totals into the general ledger. ∙ The procedures used to initiate, authorize, record, and process journal entries in the

general ledger. ∙ Other procedures used to record recurring and nonrecurring adjustments to the

financial statements.

Understanding Control Activities As the auditor learns about the other components of internal control, he or she is also likely to obtain information about control activities. For example, in examining the information system that pertains to accounts receivable, the auditor is likely to see how the entity grants credit to customers. The extent of the auditor’s understanding of control activities is a function of the audit strategy adopted. When the auditor decides to follow a substantive strategy, little work is done on understanding specific control activities. When a reliance strategy is followed, the auditor has to understand the control activities that relate to assertions for which a lower level of control risk is expected. Auditors normally use walkthroughs to develop an understanding of control activities.

Practice I N S I G H T

Auditors use walkthroughs extensively to review a business process or activity. The purpose of the walkthrough is to confirm if a documented process is in use and is accurately reflecting cur- rent workflow. The walkthrough can also be used to test the accuracy of current or previously used control activities.

Understanding Monitoring of Controls The auditor should obtain an understanding of the major types of activities that the entity uses to monitor internal control, including the sources of the information related to those activities, and how those activities are used to initiate corrective actions to its controls.

Final PDF to printer

196 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 196 09/30/15 02:51 PM

Documenting the Understanding of Internal Control Auditing standards require that the auditor document his or her understanding of the entity’s internal control components. A number of tools are available to the auditor for documenting the understanding of internal control. These include

∙ The entity’s procedures manuals and organizational charts. ∙ Internal control questionnaires. ∙ Flowcharts. ∙ Narrative description.

Procedures Manuals and Organizational Charts Many organizations prepare proce- dures manuals that document the entity’s policies and procedures. Portions of such manu- als may include documentation of the accounting systems and related control activities. The entity’s organizational chart presents the designated lines of authority and responsibility. Cop- ies of both of these documents can help the auditor document his or her understanding of the internal control system.

Internal Control Questionnaires Internal control questionnaires are one of many types of questionnaires used by auditors. Questionnaires provide a systematic means for the auditor to investigate various areas such as internal control. An internal control questionnaire is generally used for entities with a relatively complex internal control structure. It contains questions about the important factors or characteristics of the five internal control components. Such question- naires are often embedded as templates within a firm’s audit software. Exhibit 6–1 provides an example of the use of such questionnaires. The auditor’s responses to the questions included in the internal control questionnaire provide the documentation for his or her understanding.

Flowcharts Flowcharts provide a diagrammatic representation, or “picture,” of the entity’s accounting system. The flowchart outlines the configuration of the system in terms of func- tions, documents, processes, and reports. This documentation facilitates an auditor’s analysis of the system’s strengths and weaknesses. Figure 6–3 presents a simple example of a flow- chart for the order entry portion of a revenue process. Flowcharts are also used to document the auditor’s understanding of an entity’s internal control over financial reporting. Subsequent chapters go into more depth on the processes, controls, and documentation of business pro- cesses, such as the revenue process, the acquisition and payment process, and so on. Module 2 to this chapter provides detailed coverage of flowcharting techniques. Flowcharts are used extensively in this book to represent accounting systems.

On many engagements, auditors use a combination of these tools to document their understanding of the components of internal control, depending on the complexity of the entity’s internal control system. For example, in a complex information system where a large volume of transactions occur electronically, the auditor may document the control environ- ment, the entity’s risk assessment process, and monitoring activities using a memorandum and internal control questionnaire. Documentation of the information system and communi- cation component, as well as control activities, may be accomplished through the use of an internal control questionnaire and a flowchart.

Narrative Description The understanding of internal control may be documented in a memorandum. This documentation approach is most appropriate when the entity has a simple internal control system.

The Effect of Entity Size on Internal Control The size of an entity may affect how the various components of internal control are imple- mented. While large entities may be able to implement the components in the fashion just described, small to midsize entities sometimes use alternative approaches and still achieve effective internal control. For example, a large entity may have a written code of conduct,

LO 6-8

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 197

mes32502_ch06_177-219.indd 197 09/30/15 02:51 PM

Order Entry Department IT Department Shipping Department

Approved shipping

order

Approved shipping

order

By phone, mail, or e-mail from customer service representative

Correct errors

Ship goods

To customer

Data validation program

Shipping program

Inventory Open orders

Price

Customer

Inventory

Open orders

InputCustomer order

Error report

Order acknowledgment

An Example of a Flowchart for the Order Entry Portion of the Revenue Process

F I G U R E 6 – 3

while a small or midsize entity may not. However, a small entity may achieve a similar objec- tive by developing a culture that emphasizes integrity and ethical behavior through oral com- munication and the example of the owner-manager.

While the basic concepts of the five components should be present in all entities, they are likely to be less formal in a small or midsize entity than in a large entity. For example, in a small entity, the owner-manager’s involvement in day-to-day activities can provide a highly effective control that identifies and monitors risks that may affect the entity. A small entity can also have effective communication channels due to its size, the fact that there are fewer levels in the organizational hierarchy, and management’s greater visibility. The monitoring component can also be effective in a small to midsize entity as a result of management’s close involvement in operations. For example, the owner may review all daily cash disbursements to ensure that only authorized payments are made to vendors. By being involved in day-to-day operations, management may be better able to identify variances from expectations and inac- curacies in financial data. See the Koss Corporation and Dixon Illinois discussion cases for issues related to smaller organizations.

The Limitations of an Entity’s Internal Control An internal control system should be designed and operated to provide reasonable assurance that an entity’s objectives are being achieved. The concept of reasonable assurance recognizes that the cost of an entity’s internal control system should not exceed the benefits that are expected to be derived. Balancing the cost of controls with the related benefits requires con- siderable estimation and judgment on the part of management. The effectiveness of any inter- nal control system is subject to certain inherent limitations, including management override of internal control, personnel errors or mistakes, and collusion. For example, a recent survey by the Association of Certified Fraud Examiners (Figure 6–4) shows that a “lack of internal controls,” “lack of management review,” and “override of existing internal controls” are some of the primary sources of internal control weaknesses related to fraud.

Final PDF to printer

198 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 198 09/30/15 02:51 PM

Lack of Internal Controls 32.2%

20.0% 18.1%

17.9%

8.4% 9.1%

8.4%

7.1% 7.3%

6.9%

4.9% 2.2%

3.5% 3.3%

5.6%

2.9% 2.5%

1.9%

1.5% 1.8% 1.8%

0.7% 0.3%

0.6%

35.5% 37.8%

Lack of Management Review

Override of Existing Internal Controls

Poor Tone at the Top

Lack of Competent Personnel in Oversight Roles

Other*

Lack of Independent Checks/Audits

Lack of Employee Fraud Education

Lack of Clear Lines of Authority

Lack of Reporting Mechanism

*”Other” category was not included in the 2010 Report.

0% 5% 10% 15% 20%

PERCENT OF CASES

M O

ST IM

P O

R TA

N T

C O

N TR

IB U

TI N

G F

A C

TO R

25% 30% 35% 40%

2014

2012

2010

18.9% 19.4%

19.2%

Primary Internal Control Weakness Observed by CFE

Source: 2014 Report to the Nations on Occupational Fraud and Abuse, Association of Certified Fraud Examiners, Inc. Reprinted with permission.

F I G U R E 6 – 4

Management Override of Internal Control In some cases, an entity’s controls may be overridden by management. For example, a senior-level manager can require a lower-level employee to record entries in the accounting records that are not consistent with the substance of the transactions and that violate the entity’s controls. The lower-level employee may record the transaction, even though it violates the entity’s control policies, out of fear of losing his or her job. In another example, management may enter into concealed side agreements with customers that alter the terms and conditions of the entity’s standard sales contract in ways that should preclude revenue recognition.

The auditor is particularly concerned when senior management is involved in such activi- ties because it raises serious questions about management’s integrity. Violations of control activities by senior management, however, are often particularly difficult to detect with nor- mal audit procedures.

Human Errors or Mistakes The internal control system is only as effective as the per- sonnel who implement and perform the controls. Breakdowns in internal control can occur because of human failures such as simple errors or mistakes. For example, errors may occur in designing, maintaining, or monitoring automated controls. If IT personnel do not completely understand how a revenue system should process sales transactions, they may make software programming errors in modifying or updating the system.

Collusion The effectiveness of segregation of duties lies in individuals’ performing only their assigned tasks or in the performance of one person being checked by another. There is

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 199

mes32502_ch06_177-219.indd 199 09/30/15 02:51 PM

always a risk that collusion between individuals will destroy the effectiveness of segregation of duties. Collusion is cited many times as a source of fraud within companies. For exam- ple, an individual who receives cash receipts from customers can collude with the one who records those receipts in the customers’ records to steal cash from the entity.

Assessing Control Risk

Assessing control risk is the process of evaluating the effectiveness of an entity’s internal control in preventing, or detecting and correcting, material misstatements in the financial statements. As discussed earlier, the auditor can set control risk at high (a substantive strat- egy) or at a lower level (a reliance strategy). As shown in Figure 6–2, when the auditor sets control risk at high, he or she documents that control risk assessment and performs substan- tive procedures. The discussion in this section focuses on the situation where the auditor plans to follow a reliance strategy. To set control risk below high (e.g., at moderate or low), the auditor must

∙ Identify specific controls that will be relied upon. ∙ Perform tests of the identified controls. ∙ Conclude on the achieved level of control risk given results of testing.

Identifying Specific Controls That Will Be Relied Upon The auditor’s understanding of internal control is used to identify the controls that are likely to prevent, or detect and correct, material misstatement in specific assertions. Some of the controls the auditor will rely on can have a pervasive effect on many assertions. For example, the conclusion that an entity’s control environment is highly effective may influence the audi- tor’s decision about the number of an entity’s locations at which auditing procedures are to be performed. Alternatively, some controls only affect an individual assertion contained in a single financial statement account. For example, a credit check might be performed on a cus- tomer’s order. Such a control is specifically related to the valuation assertion for the accounts receivable balance.

Performing Tests of Controls Tests of controls are performed in order to provide evidence to support the lower level of control risk when using a relaince strategy. Tests of controls directed toward the effective- ness of the design of a control are concerned with evaluating whether that control is suitably designed to prevent, or detect and correct, material misstatements. Tests of controls directed toward operating effectiveness are concerned with assessing how the control was applied, the consistency with which it was applied during the audit period, and by whom it was applied. Procedures that are used for tests of controls are listed below with examples of how the audi- tor might apply each. These four categories represent the four types of tests of controls that auditors choose from in designing a program for testing controls—you would be wise to com- mit them to memory.

Types of Tests of Controls Examples

Inquiry of appropriate entity personnel. Inquiry of credit manager about the policies for writing off uncollectible accounts.

Inspection of documents, reports, or electronic files indicating the performance of the control.

Inspect bank reconciliations prepared by the internal auditors.

Observation of the application of the control. Observe how controls are applied to the handling of cash to ensure that there is proper segregation of duties.

Reperformance of the application of the control by the auditor.

Reperform the authorization control used for granting credit.

LO 6-9

LO 6-10

Final PDF to printer

200 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 200 09/30/15 02:51 PM

A combination of these procedures may be necessary to evaluate the effectiveness of the design or operation of a control. For example, auditors perform walkthroughs of an enti- ty’s business process (e.g., revenue) where they “walk” a sales transaction from its origi- nation (customer order) to its inclusion in the financial statements. While performing the walkthrough, the auditor will inquire of, and observe, entity personnel and inspect relevant documents.

The operating effectiveness of the control can be affected by whether the control is per- formed manually or is automated. If the control is performed manually, it may be subject to human errors or mistakes in its application. If properly designed, automated controls should operate more consistently, and the auditor usually does not need to test as many instances of an automated control’s operation because automated application controls should function consistently unless the program is changed. To test automated controls, the auditor may need to use techniques that are different from those used to test manual controls. For example, computer-assisted audit techniques may be used to test automated controls. The Advanced Module in Chapter 7 discusses computer-assisted audit techniques.

Concluding on the Achieved Level of Control Risk After the planned tests of controls have been completed, the auditor should reach a conclusion on the achieved level of control risk. The auditor uses the combination of the achieved level of control risk and the assessed level of inherent risk to determine the level of detection risk that is needed in order to bring audit risk to an acceptably low level. In turn, the level of detection risk is used to determine the nature, timing, and extent of substantive tests.

Figure 6–2 shows the decision process followed by the auditor upon completing the planned tests of controls. If the tests of controls are consistent with the auditor’s planned assessment of control risk, no revision in the nature, timing, or extent of substantive proce- dures is necessary. On the other hand, if the tests of controls indicate that the controls are not operating as preliminarily assessed, this means that the achieved level of control risk is higher than the planned level and that thus the nature, timing, and extent of planned substantive pro- cedures will have to be modified.

Documenting the Achieved Level of Control Risk The auditor should document the achieved level of control risk for the controls evaluated. The auditor’s assessment of the level of control risk can be documented using a structured working paper, an internal control questionnaire, or a memorandum.

An Example Table 6–5 presents two account balances from EarthWear Clothiers’ financial statements that differ in terms of their nature, size, and complexity. The differences in these characteris- tics result in different levels of understanding of internal control and different control risk assessments.

Stop and Think: Review Table 6–5 and its information. Why would an auditor decide to follow a substantive strategy for the Prepaid Advertising account but a reliance strat- egy for the Inventory account?

In this example, inventory is a material account balance that is composed of numerous products. This account also contains significant inherent risk, and the data for this account are generated by a complex computer system. For inventory, the auditor must understand the con- trol environment factors, risk assessment factors, monitoring activities, significant classes of transactions, inventory pricing policies, the flow of transactions, and what control activities will be relied upon. The auditor will use the audit procedures discussed earlier in the chapter to obtain an understanding of internal control for inventory. In contrast, while Prepaid Advertising

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 201

mes32502_ch06_177-219.indd 201 09/30/15 02:51 PM

An Example of How Account Characteristics Affect the Auditor’s Understanding of Internal Control, Control Risk Assessment, and Planned Substantive Procedures

EarthWear Account Balance

Account Characteristics

Extent of Understanding Needed to Plan the Audit

Control Risk Assessment

Planned Substantive Procedures

Inventory ($122,337,000)

• Material balance. • Numerous transactions

from a large product base. • Significant inherent risk

related to overstock and out-of-style products.

• Complex computer processing.

• Entity control environment factors.

• Entity risk assessment process.

• Monitoring activities. • Significant classes of

transactions. • Inventory pricing policies. • Initiation, processing, and

recording of transactions. • Control procedures to be

relied upon.

• Control risk is assessed to be low because tests of con- trols conducted on relevant controls in the purchasing and inventory cycles were consistent with the planned assessment of control risk.

Substantive procedures will include

• Physical examination of inventory.

• Information technology– assisted audit techniques to audit the inventory compilation.

Prepaid Advertising ($11,458,000)

• Significant balance. • Few transactions. • Little or no inherent risk. • Simple accounting

procedures.

• Entity control environment factors.

• Nature of the account balance.

• Monitoring activities.

• Control risk is assessed at high because there are few transac- tions and the procedures for amortizing advertising expen- ditures are simple, a substan- tive strategy is selected.

• Substantive procedures will recalculate the amor- tization of the advertising expenditures.

T A B L E 6 – 5

is a significant account, it contains few transactions. There is little or no inherent risk and the accounting records are simple, so the knowledge needed about the entity’s risk assessment pro- cess, information system and communication, and monitoring regarding this account is minimal. In this instance, the auditor only needs to understand the control environment factors, the nature of the account balance, and the entity’s monitoring activities. Audit procedures for the Prepaid Advertising account would likely be limited to recalculation of amortization of the account.

Substantive Procedures

The last step in the decision process under either strategy is performing substantive proce- dures. Note that auditing standards require some substantive testing for all significant account balances or classes of transactions. As discussed in Chapter 5, substantive procedures include substantive analytical procedures and tests of details.

Table 6–6 presents two examples of how the nature, timing, and extent of substantive procedures may vary for two different entities as a function of the detection risk level for the inventory account, which is part of the purchasing process. Assume that audit risk is set low for both entities but that entity 1 has a high level of risk of material misstatement (inherent risk and control risk), while entity 2 has a low level of risk of material misstatement. The use of the audit risk model results in setting detection risk at low for entity 1 and high for entity 2. For entity 1, to achieve a low detection risk the auditor must (1) obtain more reliable types of substantive evidence, such as confirmation and reperformance; (2) conduct most of the substantive audit work at year-end (as such tests are usually considered to be stronger than tests done at an interim date); and (3) make the tests more extensive (larger sample size). This is because the auditor must fill the assurance bucket almost entirely with substantive evidence. In contrast, entity 2 has a high detection risk, which means that (1) less reliable types of evidence, such as analytical procedures, can be obtained; (2) most of the audit work can be conducted at an interim date; and (3) tests of the inventory account would involve a smaller sample size. Another major difference between the two strategies involves the physi- cal examination of the inventory on hand. For the low-detection-risk strategy, physical inven- tory would be examined at year-end because the control risk was assessed to be high. For the high-detection-risk strategy, the auditor can examine the physical inventory at an interim date because the control risk assessment indicates little risk of material misstatement.

LO 6-11

Final PDF to printer

202 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 202 09/30/15 02:51 PM

Audit Strategies for the Nature, Timing, and Extent of Substantive Procedures Based on Different Levels of Detection Risk for Inventory

Low-Detection-Risk Strategy—Entity 1 Nature Audit tests for all significant audit assertions using the following types of audit procedures:

• Physical examination (conducted at year-end). • Review of external documents. • Confirmation. • Reperformance.

Timing All significant work completed at year-end. Extent Extensive testing of significant accounts or transactions.

High-Detection-Risk Strategy—Entity 2 Nature Corroborative audit tests using the following types of audit tests:

• Physical examination (conducted at an interim date). • Analytical procedures. • Substantive tests of transactions and balances.

Timing Interim and year-end. Extent Limited testing of accounts or transactions.

T A B L E 6 – 6

Timing of Audit Procedures

Audit procedures may be conducted at an interim date or at year-end. Figure 6–5 presents a timeline for planning and performing a midsize to large audit for an entity such as EarthWear Clothiers with a 12/31/15 year-end. In this example, the auditor develops an understanding of the entity and its environment and plans the audit around 5/31/15. The interim tests of controls are conducted sometime during the time frame 7/31/15 to 11/30/15. Substantive pro- cedures are planned for the time frame 11/30/15 to 2/15/16, after which the audit report is to be issued. The auditor’s considerations of conducting tests of controls and substantive tests at an interim date are discussed in turn.

Interim Tests of Controls An auditor might test controls at an interim date because the assertion being tested may not be significant, the control has been effective in prior audits, or it may be more efficient to conduct the tests at that time. A reason why it may be more efficient to conduct interim tests of controls is that staff accountants may be less busy than at year-end. Additionally, if the con- trols are found not to be operating effectively, testing them at an interim date gives the auditor more time to reassess the control risk and modify the audit plan. It also gives the auditor time to inform management so that likely misstatements can be located and corrected before the rest of the audit is performed, and so that deficiencies in the controls can be identified and remediated before year-end.

An important question the auditor must address is the need for additional audit work in the period following the interim testing period. For example, suppose the auditor examines

LO 6-12

1/1/15

Beginning of the year

Understand the entity and its environment and plan the audit

Financial statement

date

Issue audit report

Conduct interim tests of controls

Conduct substantive tests

5/31/15 7/31/15 11/30/15 12/31/15 2/15/16

A Timeline for Planning and Performing the Audit of EarthWear ClothiersF I G U R E 6 – 5

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 203

mes32502_ch06_177-219.indd 203 09/30/15 02:51 PM

controls over a sample of sales transactions for the period 1/1/15 to 8/31/15. What testing, if any, should the auditor conduct for the period 9/1/15 to 12/31/15? In determining the nature and extent of audit work for the remaining period, the auditor should consider factors such as the significance of the assertion, the evaluation of the design and operation of the relevant controls, the results of tests of controls, the length of the remaining period, and the planned substantive procedures. At a minimum, the auditor would inquire about the nature and extent of changes in policies, procedures, or personnel that occurred subsequent to the interim period. An audit of internal control over financial reporting is required if the entity is a public company. Significant testing of controls around year-end is necessary in such circumstances (see Chapter 7).

Interim Substantive Procedures Conducting substantive procedures only at an interim date may increase the risk that material misstatements are present in the financial statements. The auditor can control for this potential problem by considering when it is appropriate to examine an account at an interim date and by performing selected audit procedures for the period between the interim date and year-end.

The auditor should consider the following factors when deciding whether substantive procedures are to be performed at an interim date:

∙ The control environment and other relevant controls. ∙ The availability of information at a later date that is necessary for the auditor’s

procedures (e.g., information stored electronically for a limited period of time). ∙ The purpose of the substantive procedure. ∙ The assessed risk of material misstatement. ∙ The nature of the class of transactions or account balance and relevant assertions. ∙ The ability of the auditor to perform appropriate substantive procedures or

substantive procedures combined with tests of controls to cover the remaining period in order to reduce the risk that misstatement that may exist at the period-end will not be detected.

For example, if the entity’s accounting system has control weaknesses that result in a high level of assessed control risk, it is unlikely that the auditor would conduct substantive proce- dures at an interim date. In this instance, the auditor has little assurance that the accounting system will generate accurate information during the remaining period.

When the auditor conducts substantive procedures of an account at an interim date, some additional substantive procedures are ordinarily conducted in the remaining period. Gener- ally, this would include comparing the year-end account balance with the interim account balance. It might also involve conducting analytical procedures or reviewing related journals and ledgers for large or unusual transactions during the remaining period. If misstatements are detected during interim testing, the auditor will have to revise the planned substantive proce- dures for the remaining period or perform some additional substantive procedures at year-end.

In some instances, an entity may contract to have some or all of its accounting transactions processed by an outside service organization. Examples of such service organizations include mortgage bankers that service mortgages for others and trust departments that invest or hold assets for employee benefit plans. More commonly, however, service organizations are IT service centers that process transactions such as payroll and the related accounting reports. Auditing standards provide guidance to the auditor when an entity uses a service organization to process certain transactions.

When a service organization provides accounting services to an entity, those services are considered part of the entity’s information system and relevant to financial reporting if these

Auditing Accounting Applications Processed by Service Organizations

LO 6-13

Final PDF to printer

204 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 204 09/30/15 02:51 PM

services affect the entity’s accounting records. The significance of the controls of the service organization to those of the entity depends primarily on the nature and materiality of the transactions it processes for the entity and the degree of interaction between its activities and those of the entity. For example, if the entity initiates transactions and the service organization executes and does the accounting processing of those transactions, there is a high degree of interaction.

Because the entity’s transactions are subjected to the controls of the service organiza- tion, one of the auditor’s concerns is the internal control system in place at the service orga- nization. Thus, the auditor’s understanding of the entity’s internal control components may include controls placed in operation by the entity and the service organization.

After obtaining an understanding of internal control, the auditor identifies controls that are applied by the entity or the service organization that might allow an assessment of reduced control risk. The auditor may obtain evidence to support the lower assessment of control risk by testing the entity’s controls over the activities performed by the service organization or by testing controls at the service organization.

Because service organizations process data for many customers, they commonly engage an auditor to issue an attestation report regarding the controls they have in place over transac- tions that might materially impact their customers’ financial reports. Such a report is called a Service Organization Controls 1 (or “SOC 1”) report.5 The SOC 1 report can be relied on by the auditors of all of the service organization’s customers, making a separate audit by each of those auditors unnecessary.

A service organization’s auditor can issue one of two types of SOC 1 reports. The first is a report on management’s description of a service organization’s system and the suitability of the design of controls (referred to as a Type 1 report). Such a report includes management’s description of the service organization’s system, a written assertion by management stating that the description fairly presents the system, and the auditor’s opinion as to whether the service organization’s controls are suitably designed to achieve management’s control objectives as of the end of the period. A Type 2 report includes not only the auditor’s opinion on the suitability of the design of the service organization’s controls, but also on the operating effectiveness of those controls. Thus, a Type 2 report includes all of the requirements of a Type 1 report and provides assurance on the operating effectiveness of the service organization’s controls based on the auditor’s tests of those controls. An auditor may reduce control risk below high for a client that uses a service organization on the basis of a service auditor’s SOC 1, Type 2 report.

5SOC 1 reports on controls at a service organization used to be known as “SAS 70 Reports.” SOC 1 reports are now issued under the standards for attestation engagements, AT 801, Reporting on Controls at a Service Organization. See Chapter 21 for a discussion of the attestation standards and also of SOC 2 and SOC 3 reports. These latter reports involve a much broader range of controls than does a SOC 1 report, which focuses only on service organizations’ controls over financial reporting.

Practice I N S I G H T

During an inspection of one of the Big 4 firms, the PCAOB inspection team identified matters that it considered to be audit deficiencies, one of which had to do with using information provided by a service organization to estimate a significant contingency. In this audit, the firm failed to test the completeness of information provided by a service organization used to calculate this contingent liability. The firm also failed to test controls regarding this information and thus failed to obtain suf- ficient evidence to support the firm’s opinion on the issuer’s internal control over financial reporting.

Communication of Internal Control–Related Matters

Standards for reporting internal control deficiencies differ for public versus private entities (referred to as “nonissuers”). Under the Sarbanes-Oxley Act of 2002, management of public companies must prepare an assertion on internal control effectiveness and their registered auditors must issue an opinion on the effectiveness of internal control. These requirements are covered in Chapter 7.

LO 6-14

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 205

mes32502_ch06_177-219.indd 205 09/30/15 02:51 PM

Although a financial statement audit for private companies does not include an audit of the entity’s system of internal control, the auditor may discover deficiencies in the entity’s internal controls during the audit. A control deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance. Significant deficiencies and material weaknesses may be identified as part of the auditor’s consideration of the five components of internal control or through a root cause analysis of accounting misstate- ments discovered by the auditor’s substantive procedures. Table 6–7 presents examples of circumstances that might indicate a control deficiency, significant deficiency, or material weakness.

The auditor must communicate, in writing, any discovered significant deficiencies and material weaknesses to management and those charged with governance.

Advanced Module 1: Types of Controls in an IT Environment

As discussed in the chapter, there are two broad categories of information systems control activities: general controls and application controls. General controls relate to the overall information processing environment and have a pervasive effect on the entity’s computer operations. General controls are sometimes referred to as supervisory, management, or infor- mation technology controls. Application controls apply to the processing of specific com- puter applications and are part of the computer programs used in the accounting system (for example, revenues or purchasing).

LO 6-15

Examples of Circumstances That May Be Control Deficiencies, Significant Deficiencies, or Material Weaknesses

Deficiencies in the Design of Controls • Inadequate design of internal control over the preparation of the financial statements being audited. • Inadequate design of internal control over a significant account or process. • Inadequate documentation of the components of internal control. • Insufficient control consciousness within the organization, for example, the tone at the top and the control environment. • Absent or inadequate segregation of duties within a significant account or process. • Absent or inadequate controls over the safeguarding of assets. • Inadequate design of information technology (IT) general and application controls. • Employees or management who lack the qualifications and training to fulfill their assigned functions. • Inadequate design of monitoring controls. • The absence of an internal process to report deficiencies in internal control to management on a timely basis.

Failures in the Operation of Internal Control • Failure in the operation of effectively designed controls over a significant account or process. • Failure of the information and communication component of internal control to provide complete and accurate output because of deficiencies in timeli-

ness, completeness, or accuracy. • Failure of controls designed to safeguard assets from loss, damage, or misappropriation. • Failure to perform reconciliations of significant accounts. • Undue bias or lack of objectivity by those responsible for accounting decisions. • Misrepresentation by entity personnel to the auditor (an indicator of fraud). • Management override of controls. • Failure of an application control caused by a deficiency in the design or operation of an IT general control. • An observed deviation rate that exceeds the number of deviations expected by the auditor in a test of operating effectiveness of a control.

Source: AU 265-C, Appendix.

T A B L E 6 – 7

Final PDF to printer

206 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 206 09/30/15 02:51 PM

General Controls General controls include controls over

∙ Data center and network operations. ∙ System software acquisition, change, and maintenance. ∙ Access security. ∙ Application system acquisition, development, and maintenance.

Data Center and Network Operations Controls Data center and network operations controls include controls over computer and network operations, data preparation, work flow control, and library functions. Important controls over computer and network operations should prevent unauthorized access to the network programs, files, and systems documenta- tion by computer operators. In IT systems, traditional controls such as rotation of operator duties and mandatory vacations should be implemented. The operating systems log, which documents all program and operator activities, should be regularly reviewed to ensure that operators have not performed any unauthorized activities.

Controls over data preparation include proper entry of data into an application system and proper oversight of error correction. Controls over work flow include scheduling of appli- cation programs, proper setup for programs, and use of the correct data files. The library func- tion needs controls to ensure that (1) the correct files are provided for specific applications, (2) files are properly maintained, and (3) backup and recovery procedures exist.

Systems Software Acquisition, Change, and Maintenance Controls Systems soft- ware are computer programs that control the computer functions and allow the application programs to run. These programs include operating systems, library and security packages, and database management systems. For example, the operating system controls the operations of the computer and allocates computer resources among the application programs. The oper- ating system also detects and corrects processing errors. The entity should have strong con- trols that ensure proper approval for purchases of new system software and adequate controls over changes and maintenance of existing systems software. Generally, an approval process similar to the one described below for application systems can accomplish this.

Access and Security Controls These general controls are concerned with (1) physical protection of computer equipment, software, and data and (2) loss of assets and information through theft or unauthorized use. Security controls include locating the computer facilities in a separate building or in a secure part of a building. They also include limiting access to the computer facilities through the use of locked doors with authorized personnel being admitted through use of a conventional key, an authorization card, or physical recognition. Security must also be maintained within the computer facility. For example, programmers must not be allowed access to the computer room; this restriction will prevent them from making unau- thorized modifications to systems and application programs.

There must also be adequate protection against events such as fire and water damage, electrical problems, and sabotage. Proper construction of computer facilities can minimize the damage from such events. In order to ensure that the entity’s operations are not inter- rupted by such events, the entity should have an operational disaster recovery plan, which may include an off-site backup location for processing critical applications.

Unauthorized access to programs or data can cause loss of assets and information. Physi- cal control over programs and data can be maintained by a separate library function that controls access and use of files. In IT systems with online, real-time database systems and telecommunications technologies, programs and data can be accessed from outside the com- puter facility. Access controls in IT systems should thus include physical security over remote terminals, authorization controls that limit access to only authorized information, firewalls, user identification controls such as passwords, and data communication controls such as encryption of data. Without such controls, an unauthorized user could access the system, with a resulting loss of assets or a decrease in the reliability of data.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 207

mes32502_ch06_177-219.indd 207 09/30/15 02:51 PM

Application Systems Acquisition, Development, and Maintenance Controls These controls are critical for ensuring the reliability of information processing. The ability to audit accounting systems is greatly improved if (1) the entity follows common policies and proce- dures for systems acquisition or development; (2) the internal and/or external auditors are involved in the acquisition or development process; and (3) proper user, system operator, and program documentation is provided for each application.6 For example, having internal or external auditors involved early in the design of the system can ensure that proper controls are built into the system.

The entity should establish written policies and procedures for planning, acquiring or devel- oping, and implementing new systems. Normally, a request for a new system is submitted by the user department to the IT department or an information services committee. A feasibility study may be conducted that includes cost-benefit analysis, hardware and software needs, and the sys- tem’s impact on current applications and operations. Next, the system is acquired or designed, programmed, tested, and implemented. Last, the entity should prepare good documentation, including flowcharts, file layouts, source code listings, and operator instructions. This level of documentation is necessary not only for the entity’s ability to manage its system and controls but also for the auditors to understand the accounting systems, including application controls, so that tests of controls and substantive testing can be properly planned and conducted.

The entity must also have strong controls to ensure that once programs are placed into operation, all authorized changes are properly made and unauthorized changes are prevented. Although not as detailed, the controls for program changes are similar to those followed for new systems development. From the auditor’s perspective, the important issue here is whether changes to programs are properly authorized, tested, and implemented.

Application Controls Application controls apply to the processing of individual accounting applications, such as sales or payroll, and help ensure the completeness and accuracy of transaction processing, authorization, and validity. Although application controls are typically discussed under the categories of input, processing, and output controls, changes in technology have blurred the distinctions among input, processing, and output. For example, many of the data validation checks that were once performed as part of production programs are now accomplished with sophisticated editing routines and intelligent data-entry equipment. As a result, application controls are discussed under the following categories:

∙ Data capture controls. ∙ Data validation controls. ∙ Processing controls. ∙ Output controls. ∙ Error controls.

Data Capture Controls Data capture controls must ensure that (1) all transactions are recorded in the application system; (2) transactions are recorded only once; and (3) rejected transactions are identified, controlled, corrected, and reentered into the system. Thus, data capture controls are concerned primarily with occurrence, completeness, and accuracy asser- tions. For example, checking that all transactions are recorded in the system relates to the completeness objective.

There are three ways of capturing data in an information system: (1) source documenta- tion, (2) direct data entry, or (3) a combination of the two. When source documents are pres- ent, batch processing is an effective way of controlling data capture. Batching is simply the process of grouping similar transactions for data entry. It is important that each batch be well controlled. This can be accomplished by assigning each batch a unique number and recording

6Note that external auditor involvement in the information systems acquisition and development process is severely limited when the entity is a public company. See Chapter 19 for further details.

Final PDF to printer

208 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 208 09/30/15 02:51 PM

it in a batch register or log. A cover sheet should also be attached to each batch with spaces for recording the batch number, the date, the signatures of various persons who processed the batch, and information on errors detected. To ensure complete processing of all transactions in a batch, some type of batch total should be used.

Direct data entry, on the other hand, involves online processing of the data with no source documents. The combination method may involve entry of the data from source documents directly through online processing. If direct data entry or a combination of source documents and direct data entry is used, the system should create a transaction log. The log should con- tain a detailed record of each transaction, including date and time of entry, terminal and oper- ator identification, and a unique number (such as customer order number).

Data Validation Controls These controls can be applied at various stages, depending on the entity’s IT capabilities, and are mainly concerned with the accuracy assertion. When source documents are batch-processed, the data are taken from source documents and tran- scribed to tape or disk. The data are then validated by an edit program or by routines that are part of the production programs. When the data are entered directly into offline storage through an intelligent terminal or directly into a validation program with subsequent (delayed or real-time) processing into the application system, each individual transaction should be subjected to a number of programmed edit checks. Table 6–8 lists common validation tests. For example, a payroll application program may have a limit test that subjects any employee payroll transaction involving more than 80 hours worked to review before processing.

Some entities use turnaround documents to improve data accuracy. Turnaround docu- ments are output documents from the application that are used as source documents in later processing. For example, a monthly statement sent to a customer may contain two parts; one part of the monthly statement is kept by the customer, while the other part is returned with the payment. The latter part of the statement contains encoded information that can be processed using various input devices. By using a turnaround document, the entity does not have to reenter the data, thus avoiding data capture and data validation errors.

With direct data (online) entry, accuracy can be improved by special validation routines that may be programmed to prompt the data entry personnel. Here the system requests the desired input data and then waits for an acceptable response before requesting the next piece of input data. In many cases, the screen displays the document format with blanks that are completed by data entry personnel. The validation routine can include a completeness test to ensure that all data items are completed before processing. Airline reservation systems and catalog retailers (like EarthWear ) that take phone orders use this type of entry system. Enter- ing data over an entity’s website can be controlled in a similar manner.

Processing Controls These are controls that ensure proper processing of transactions. In some information systems, many of the controls discussed under data validation may be performed as part of data processing. General controls play an important role in providing assurance about the

Common Data Validation Controls

Data Validation Control Description

Limit test A test to ensure that a numerical value does not exceed some predetermined value. Range test A check to ensure that the value in a field falls within an allowable range of values. Sequence check A check to determine if input data are in proper numerical or alphabetical sequence. Existence (validity) test A test of an ID number or code by comparison to a file or table containing valid

ID numbers or codes. Field test A check on a field to ensure that it contains either all numeric or all alphabetic

characters. Sign test A check to ensure that the data in a field have the proper arithmetic sign. Check-digit verification A numerical value computed to provide assurance that the original value was not

altered.

T A B L E 6 – 8

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 209

mes32502_ch06_177-219.indd 209 09/30/15 02:51 PM

quality of processing controls. If the entity has strong general controls (such as application sys- tems acquisition, development, and maintenance controls; library controls; personnel practices; and separation of duties), it is likely that programs will be properly written and tested, correct files will be used for processing, and unauthorized access to the system will be limited.

Output Controls Output includes reports, checks, documents, and other printed or dis- played (on terminal screens) information. Controls over output from computer systems are important application controls. The main concern here is that computer output may be dis- tributed or displayed to unauthorized users. A number of controls should be present to mini- mize the unauthorized use of output. A report distribution log should contain a schedule of when reports are prepared, the names of individuals who are to receive the report, and the date of distribution. Some type of transmittal sheet indicating the intended recipients’ names and addresses should be attached to each copy of the output. A release form may be part of the transmittal sheet and should be signed by the individual acknowledging receipt of the report.

The data control group should be responsible for reviewing the output for reasonableness and reconciling the control or batch totals to the output. The user departments should also review the output for completeness and accuracy because they may be the only ones with suf- ficient knowledge to recognize certain types of errors.

Error Controls Errors can be identified at any point in the system. While most transaction errors should be identified by data capture and data validation controls, some errors may be identified by processing controls or output controls. After identification, errors must be cor- rected and resubmitted to the application system at the correct point in processing. Error con- trols help ensure that errors are handled appropriately. For example, if a transaction is entered with an incorrect customer number, it should be rejected by a validity test. After the customer number is corrected, it should be resubmitted into the system. Errors that result from process- ing transactions (such as data entry errors) should be corrected and resubmitted by the data center control group. Errors that occur outside the IT department (such as omitted or invalid data) should be corrected by the appropriate user department and resubmitted. This segrega- tion of duties prevents the data center control group from processing invalid transactions.

Advanced Module 2: Flowcharting Techniques

From the auditor’s perspective, a flowchart is a diagrammatic representation of the entity’s accounting system. The information systems literature typically discusses three types of flow- charts: document flowcharts, systems flowcharts, and program flowcharts. A document flow- chart (or data flow diagramming) represents the flow of documents among departments in the entity. A systems flowchart extends this approach by including the processing steps, including computer processing, in the flowchart. A program flowchart illustrates the operations per- formed by the computer in executing a program. Flowcharts that are typically used by public accounting firms combine document and systems flowcharting techniques. Such flowcharts show the path from the origination of the transactions to their recording in the accounting jour- nals and ledgers. While there are some general guidelines on preparing flowcharts for docu- menting accounting systems, the reader should understand that public accounting firms often modify these techniques to correspond with their firm’s audit approaches and technologies.

Following are a number of common guidelines that are used in preparing flowcharts.

Symbols A standard set of symbols is used to represent documents and processes. Figure 6–6 presents examples of the more commonly used symbols. Note that the symbols are divided into three groups: input/output symbols, processing symbols, and data flow and storage symbols.

LO 6-16

Final PDF to printer

210 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 210 09/30/15 02:51 PM

Magnetic tape Processing function

Magnetic disk

Diskette

Online storage

Input through online device

Display

Punched tape

Transmittal tape

Document

Input/Output Symbols Processing Symbols Data Flow and Storage Symbols

Annotation

O�-page connector

On-page connector

O�-line storage

Communication link

Flow arrow

Auxiliary operation

Keying operation

Decision operation

Manual operation

Flowcharting SymbolsF I G U R E 6 – 6

Organization and Flow A well-designed flowchart typically starts in the upper left part of the page and proceeds to the lower right part of the page. When it is necessary to show the movement of a docu- ment or report back to a previous function, an on-page connector should be used. When the flowchart continues to a subsequent page, the movement of documents or reports can be handled by using an off-page connector. Flow arrows show the movement of documents, records, or information. When processes or activities cannot be fully represented by flow- chart symbols, the auditor should supplement the flowchart with written comments. This can be accomplished by using the annotation symbol or just writing the comment directly on the flowchart.

A flowchart is typically designed along the lines of the entity’s departments or functions. It is thus important to indicate the delineation of activities between the depart- ments or functions. As shown in Figure 6–3, this can be accomplished by using a vertical dashed line.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 211

mes32502_ch06_177-219.indd 211 09/30/15 02:51 PM

KEY TERMS

Application controls. Controls that apply to the processing of specific computer applications and are part of the computer programs used in the accounting system. Computer-assisted audit techniques (CAATs). Computer programs that allow auditors to test computer files and databases. Control activities. The policies and procedures that help ensure that management’s directives are carried out. Control deficiency. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. Control environment. The tone of an organization, which reflects the overall attitude, aware- ness, and actions of the board of directors, management, and owners influencing the control consciousness of its people. Control risk. The risk that a misstatement that could occur in an assertion about an account or disclosure and that could be material, either individually or when aggregated with other misstatements, will not be prevented, or detected and corrected, on a timely basis by the entity’s internal control. Electronic (Internet) commerce. Business transactions between individuals and organiza- tions that occur without paper documents, using computers and telecommunication networks. Electronic data interchange. The transmission of business transactions over telecommuni- cations networks. General controls. Controls that relate to the overall information processing environment and have a pervasive effect on the entity’s computer operations. Internal control. The method by which an entity’s board of directors, management, and other personnel provide reasonable assurance about the achievement of objectives in the following categories: (1) reliability of financial reporting, (2) effectiveness and efficiency of operations, and (3) compliance with applicable laws and regulations. Material weakness. A deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. Monitoring of controls. A process that assesses the quality of internal control performance over time. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Significant deficiency. A deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance. Substantive strategy. The auditor’s decision not to rely on the entity’s controls and to audit the related financial statement accounts by relying more on substantive procedures. Walkthrough. A transaction being traced by an auditor from origination through the entity’s information system until it is reflected in the entity’s financial reports. It encompasses the entire process of initiating, authorizing, recording, processing, and reporting individual trans- actions and controls for each of the significant processes identified.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 6-1 6-1 What are management’s incentives for establishing and maintaining strong internal control? What are the auditor’s main concerns with internal control?

Final PDF to printer

212 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 212 09/30/15 02:51 PM

LO 6-4 6-2 What are the potential benefits and risks to an entity’s internal control from informa- tion technology?

LO 6-5 6-3 Describe the five components of internal control. LO 6-5 6-4 What are the factors that affect the control environment? LO 6-6 6-5 What are the major differences between a substantive strategy and a reliance strategy

when the auditor considers internal control in planning an audit? LO 6-7 6-6 Why must the auditor obtain an understanding of internal control? LO 6-7 6-7 What is meant by the concept of reasonable assurance in terms of internal control?

What are the inherent limitations of internal control? LO 6-8 6-8 List the tools that can document the understanding of internal control. LO 6-8, 6-9 6-9 What are the requirements under auditing standards for documenting the assessed

level of control risk? LO 6-11, 6-12 6-10 What factors should the auditor consider when substantive procedures are to be com-

pleted at an interim date? If the auditor conducts substantive procedures at an interim date, what audit procedures would normally be completed for the remaining period?

LO 6-14 6-11 What is the auditor’s responsibility for communicating control deficiencies that are severe enough to be considered significant deficiencies or material weaknesses?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 6-1 6-12 An auditor’s primary consideration regarding an entity’s internal controls is whether they a. Prevent management override. b. Relate to the control environment. c. Reflect management’s philosophy and operating style. d. Affect the financial statement assertions.

LO 6-1, 6-7 6-13 Which of the following statements about internal control is correct? a. A properly maintained internal control system reasonably ensures that collusion

among employees cannot occur. b. The establishment and maintenance of internal control is an important responsi-

bility of the internal auditor. c. An exceptionally strong internal control system is enough for the auditor to elimi-

nate substantive procedures on a significant account balance. d. The cost-benefit relationship is a primary criterion that should be considered in

designing an internal control system.

LO 6-2, 6-3 6-14 Internal control is a process designed to provide reasonable assurance regarding the achievement of which objective?

a. Effectiveness and efficiency of operations. b. Reliability of financial reporting. c. Compliance with applicable laws and regulations. d. All of the above are correct.

LO 6-5 6-15 Monitoring is a major component of the COSO Internal Control— Integrated Frame- work. Which of the following is not correct in how the company can implement the monitoring component?

a. Monitoring can be an ongoing process. b. Monitoring can be conducted as a separate evaluation. c. Monitoring and other audit work conducted by internal audit staff can reduce

external audit costs. d. The independent auditor can serve as part of the entity’s control environment and

continuous monitoring.

LO 6-6 6-16 After obtaining an understanding of an entity’s internal control system, an auditor may set control risk at high for some assertions because he or she

a. Believes the internal controls are unlikely to be effective.

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 213

mes32502_ch06_177-219.indd 213 09/30/15 02:51 PM

b. Determines that the pertinent internal control components are not well documented. c. Performs tests of controls to restrict detection risk to an acceptable level. d. Identifies internal controls that are likely to prevent material misstatements.

LO 6-6, 6-10 6-17 Regardless of the assessed level of control risk, an auditor would perform some a. Tests of controls to determine the effectiveness of internal controls. b. Analytical procedures to verify the design of internal controls. c. Substantive procedures to restrict detection risk for significant transaction classes. d. Dual-purpose tests to evaluate both the risk of monetary misstatement and pre-

liminary control risk.

LO 6-9 6-18 Assessing control risk below high involves all of the following except a. Identifying specific controls to rely on. b. Concluding that controls are ineffective. c. Performing tests of controls. d. Analyzing the achieved level of control risk after performing tests of controls.

LO 6-10 6-19 Which of the following audit techniques would most likely provide an auditor with the most assurance about the effectiveness of the operation of a control?

a. Inquiry of entity personnel. b. Reperformance of the control by the auditor. c. Observation of entity personnel. d. Walkthrough.

LO 6-10 6-20 The highest-quality and most reliable audit evidence that segregation of duties is properly implemented is obtained by

a. Inspection of documents prepared by a third party but which contain the initials of those applying entity controls.

b. Observation by the auditor of the employees performing control activities. c. Inspection of a flowchart of duties performed and available personnel. d. Inquiries of employees who apply control activities.

LO 6-13 6-21 SOC 1, Type 2 reports by the service organization’s auditor typically a. Provide reasonable assurance that their financial statements are free of material

misstatements. b. Ensure that the entity will not have any misstatements in areas related to the ser-

vice organization’s activities. c. Ensure that the entity is billed correctly. d. Assess whether the service organization’s controls are suitably designed and

operating effectively.

LO 6-14 6-22 Significant deficiencies are matters that come to an auditor’s attention that should be communicated to an entity’s audit committee because they represent

a. Disclosures of information that significantly contradict the auditor’s going con- cern assumption.

b. Material fraud or illegal acts perpetrated by high-level management. c. Significant deficiencies in the design or operation of the internal control. d. Manipulation or falsification of accounting records or documents from which

financial statements are prepared.

LO 6-15 6-23 An auditor anticipates assessing control risk at a low level in an IT environment. Under these circumstances, on which of the following controls would the auditor initially focus?

a. Data capture controls. b. Application controls. c. Output controls. d. General controls.

Final PDF to printer

214 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 214 09/30/15 02:51 PM

LO 6-16 6-24 An auditor’s flowchart of an entity’s accounting system is a diagrammatic represen- tation that depicts the auditor’s

a. Program for tests of controls. b. Understanding of the system. c. Understanding of the types of fraud that are probable, given the present system. d. Documentation of the study and evaluation of the system.

PROBLEMS All applicable problems are available with Connect.

LO 6-2, 6-5, 6-6, 6-8 6-25 An auditor is required to obtain sufficient understanding of each component of an entity’s internal control system to plan the audit of the entity’s financial statements and to assess control risk for the assertions embodied in the account balance, trans- action class, and disclosure components of the financial statements.

Required: a. Define internal control. b. For what purpose should an auditor’s understanding of the internal control com-

ponents be used in planning an audit? c. What are an auditor’s documentation requirements concerning an entity’s internal

control system and the assessed level of control risk?

LO 6-5, 6-6 6-26 Johnson, CPA, has been engaged to audit the financial statements of Rose, Inc., a publicly held retailing company. Before assessing control risk, Johnson is required to obtain an understanding of Rose’s control environment.

Required: a. Identify additional control environment factors (excluding the factors illustrated

in the following example) that set the tone of an organization, influencing the control consciousness of its people.

b. For each control environment factor identified in part (a), describe the compo- nents and why each component would be of interest to the auditor. Use the follow- ing format:

Integrity and Ethical Values The effectiveness of controls cannot rise above the integrity and ethical values of the people who create, administer, and monitor them. Integrity and ethical values are essential elements of the control environment, affecting the design, administration, and monitoring of other components. Integrity and ethical behavior are the products of the entity’s ethical and behavioral standards, how they are communicated, and how they are reinforced in practice.

LO 6-4, 6-6 6-27 Assume that you are an audit senior in charge of planning the audit of an entity that your firm has audited for the previous four years. During the audit planning meeting with the manager and partner in charge of the engagement, the partner noted that the entity recently adopted an IT-based accounting system to replace its manual system. The manager and partner have limited experience with IT-based accounting systems and are relying on you to help them understand the audit implications of the entity’s change. Consequently, they have asked you to respond to a few concerns regarding automated accounting systems.

Required: a. In previous years, the audit firm has relied heavily on substantive procedures as a

source of audit evidence for this entity. Given that the entity now has changed its

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 215

mes32502_ch06_177-219.indd 215 09/30/15 02:51 PM

accounting system, what are some of the factors that you should consider when deciding whether to move to a reliance strategy?

b. Under what conditions should the audit firm consider engaging an IT specialist to assist in the evaluation? If the firm hires an IT specialist, what information should the auditors ask the specialist to provide?

c. How are the five components of the entity’s internal control affected by the enti- ty’s change to an IT-based accounting system?

LO 6-8 6-28 Auditors use various tools to document their understanding of an entity’s internal control system, including narrative descriptions, internal control questionnaires, and flowcharts.

Required: a. Identify the relative strengths of each tool. b. Briefly describe how the complexity of an entity’s internal control system affects

the use of the various tools.

LO 6-5, 6-6, 6-9 6-29 The Audit Committee of a small manufacturing company that sells its products glob- ally has directed internal audit to perform specific annual reviews to monitor manual journal entries, with a particular focus on potential management override activities. Internal audit’s review includes basic information such as the number, dollar amount, preparer, business unit, and timing relative to month- and quarter-end.

Required: a. What specific issues should the internal auditor be concerned about with respect

to individual entries? b. Could the external auditor rely on the internal audit’s work related to manual jour-

nal entries to reduce control risk?

LO 6-11, 6-12 6-30 Cook, CPA, has been engaged to audit the financial statements of General Depart- ment Stores, Inc., a continuing audit entity, which is a chain of medium-sized retail stores. General’s fiscal year will end on June 30, 2015, and General’s management has asked Cook to issue the auditor’s report by August 1, 2015. Cook will not have sufficient time to perform all of the necessary fieldwork in July 2015 but will have time to perform most of the fieldwork as of an interim date, April 30, 2015.

After the accounts are tested at the interim date, Cook will also perform substan- tive procedures covering the transactions of the final two months of the year. This will be necessary to extend Cook’s conclusions to the balance sheet date.

Required: a. Describe the factors Cook should consider before applying substantive proce-

dures to General’s balance sheet accounts at April 30, 2015. b. For accounts tested at April 30, 2015, describe how Cook should design the sub-

stantive procedures covering the balances as of June 30, 2015, and the transac- tions of the final two months of the year.

(AICPA, adapted)

LO 6-14 6-31 Ken Smith, the partner in charge of the audit of Houghton Enterprises, identified the following significant deficiencies during the audit of the December 31, 2015, finan- cial statements:

1. Controls for granting credit to new customers were not adequate. In particular, the credit department did not adequately check the credit-worthiness of customers with an outside credit agency.

2. There were inadequate physical safeguards over the company’s inventory. No safeguards prevented employees from stealing high-value inventory parts.

Final PDF to printer

216 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 216 09/30/15 02:51 PM

Required: a. Draft the required communications to the management of Houghton Enterprises,

assuming that both items are significant deficiencies. b. Assume that Smith determined that the second item was a material weakness.

How would the required communication change?

DISCUSSION CASES

LO 6-5, 6-6 6-32 Koss Corporation: Where were the internal controls? (Refer back to Problem 4-33 for the basic facts on the Koss Corporation embezzlement.) On September 2, 2010, the Securities & Exchange Commission brought an action against Sujata Sachdeva, vice president of finance, and Koss senior accountant and subordinate, Julie Mulvaney, who allegedly helped her cover up the fraudulent scheme. The SEC alleged that Sachdeva and Mulvaney caused Koss to submit false and misleading financial statements. Sachdeva regularly relied on Mulvaney to reconcile the cash shortfalls and to balance the books.

Sachdeva and Mulvaney primarily hid the embezzlement by making false entries on the Company’s general journal. For example, the false journal entries disguised the theft by overstating assets, expenses, and cost of sales, and understating liabili- ties and sales. Mulvaney maintained binders that detailed numerous false journal entries that were made to the Company’s accounting books and records. With those entries, Mulvaney reclassified Company funds—with no supporting documentation and no legitimate explanation. Mulvaney also maintained a series of folders that included documentation of over 100 fraudulent transactions that were included in the Company’s accounting books and records.

Sachdeva and Mulvaney were able to hide the substantial embezzlements in part because the Company did not adequately maintain internal controls to reasonably assure the accuracy and reliability of financial reporting. Koss’s internal controls policy required Michael Koss to approve invoices of $5,000 or more for payment. However, Koss allegedly delegated duties typically done by the CFO to Sachdeva on a regular basis. Koss also had little or no educational background or experience in accounting or finance. Many of the cashier’s checks exceeded $5,000, and some exceeded $100,000. However, its controls did not prevent Sachdeva and Mulvaney from processing large wire transfers and cashier’s checks outside of the accounts payable system to pay for Sachdeva’s personal purchases without seeking or obtain- ing Michael Koss’s approval. In addition, many account reconciliations were not prepared, maintained, or reviewed as part of Koss’s accounting records. Koss’s com- puterized accounting system was almost 30 years old. Sources: SEC Complaint, US Securities and Exchange Commission v. Sujata Sachdeva, and Julie Mulvaney, August 31, 2010, SEC, Accounting and Auditing Enforcement Release No. 3330 / October 24, 2011, and SEC v. Koss Corporation and Michael J. Koss, Civil Case No. 2:11-cv-00991, USDC, E.D., Wisc.

Required: a. List the major internal controls that were absent within Koss Corporation’s inter-

nal control system. b. What internal controls should have been implemented or applied to ensure proper

controls over the Company’s recorded transactions?

LO 6-5, 6-6 6-33 Dixon, Illinois: Using Public Funds to Support a Show Horse Operation. On February 14, 2013, former city comptroller and treasurer of Dixon, IL, Rita Crundwell was sentenced to 1912̸ years in prison for diverting $53 million from city funds for her own benefit. It appears that the fraud began in 1990 at a relatively small amount, but the level of her embezzlements increased significantly in the last years of the embezzlement (e.g., in 2008 she embezzled $5.8 million). Crundwell used the

Final PDF to printer

Chapter 6 Internal Control in a Financial Statement Audit 217

mes32502_ch06_177-219.indd 217 09/30/15 02:51 PM

proceeds to finance her horse breeding business and her lavish lifestyle. She pur- chased 400 horses, farms, trucks, a $2 million RV, and jewelry. Her position as city treasurer paid about $80,000 a year at the time of her arrest.

Rita Crundwell was one of the most trusted people in Dixon, IL’s city govern- ment. She started working for the finance department for the city while still in high school in 1970. In 1983, she was appointed as the comptroller/treasurer. As comp- troller, Crundwell handled all of the finances for the city of Dixon. Crundwell par- ticipated in budget meetings for the city with other city council members and voiced a need for Dixon to make spending cuts due to a lack of sufficient funds. Many of the city officials who held elected position were not full-time employees of the city.

The process by which Crundwell was able to obtain the funds was not extremely complicated. According to the indictment, Crundwell opened a bank account at Fifth Third Bank in 1990 in the name of the city of Dixon and RSCDA (Reserve Sewer Development Account). That account appeared to be for the benefit of the city of Dixon, but Crundwell was the only signatory and the only person who wrote checks from that account. Crundwell was able to deposit city funds from other sources into the Capital Development Fund account. After she created false invoices, Crundwell would write checks from that fund payable to “Treasurer.” She then deposited those checks directly into the RSCDA account. The Fifth Third Bank assumed the money in the RSCDA account was for the city. Crundwell repeatedly transferred city funds into the RSCDA account and used the money to pay for her own personal and private business expenses.

In October 2011, when Crundwell was away from work, another individual employed by the city of Dixon, requested Fifth Third Bank to forward all of the city’s bank statements. This employee realized that the account appeared to be inappro- priate and informed Mayor James Burke of the account. Burke determined that the account did not relate to any legitimate business of the city. Burke then notified the Federal Bureau of Investigation.

In September 2013, the city announced it settled its lawsuit against the auditors and bank for $40 million. During the time of the fraud, Dixon’s financial statements were audited by CliftonLarsonAllen (formerly Clifton Gunderson LLP). The firm agreed to pay $35.15 million and Fifth Third Bank agreed to pay $3.85 million. Clif- tonLarsonAllen conceded it shared in the “responsibility for the fact that the fraud was not detected.” The attorney for the city stated Mayor Bruce also faulted Fifth Third Bank for violating banking standards by allowing Crundwell to open a city account in 1990 without proper documentation, even if employees knew she worked for the city. Sources: W. Pavlo, “Fmr Dixon, IL Comptroller, Rita Crundwell, Sentenced to 19 ½ Years In Prison.” This article is available online at: http://onforb.es/Yb217S. M. Jenco, “Dixon blames phony invoices, lax auditors for $54M fraud,” Chicago Tribune (September 27, 2013). United States District Court Northern District of Illinois Western Division, United States of America v. Rita A. Crundwell, Criminal Complaint, April 13, 2012. S. R. Strahler, “How Dixon’s auditors missed the biggest embezzler of all time,” (February 02, 2013), ChicagoBusiness.com.

Required: a. Identify the internal control deficiencies that allowed the fraud to occur and to

continue for such a long period of time. b. Speculate on why the auditors did not detect the fraud.

Final PDF to printer

218 Part 3 Understanding and Auditing Internal Control

mes32502_ch06_177-219.indd 218 09/30/15 02:51 PM

HANDS-ON CASES

EarthWear Online

Control Environment and Internal Control Documentation Exhibit 6–1 illustrated how auditors document their understanding of the client’s control environment. The chapter also explains that a questionnaire can be used to document the assessment of control risk. Willis and Adams’ staff partially completed questionnaires to document their understanding of the client’s control environment and their assessment of control risk for the upcoming audit of EarthWear. Your task is to complete the remaining questions on these questionnaires.

Visit Connect for additional student resources to find a detailed description of the case and to download required materials.

Tests of Controls (Part A) Willis and Adams’ staff partially completed their control testing on a random sample of voucher packets. Your task is to complete the testing on the remaining four voucher packets and then evaluate the results of the tests of controls (Part B of this case is outlined in Chapter 8 and includes a statistical approach to quantifying and evaluating the results of the test of controls).

Visit Connect to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch06_177-219.indd 219 09/30/15 02:51 PM

Final PDF to printer

mes32502_ch07_220-260.indd 220 09/30/15 02:50 PM

CHAPTER

7 7-1 Understand management’s responsibilities for reporting

on internal control under Section 404 of the Sarbanes- Oxley Act.

7-2 Understand the auditor’s responsibilities for reporting on internal control under Section 404 of the Sarbanes- Oxley Act.

7-3 Know the definition of internal control over financial reporting (ICFR).

7-4 Be able to explain the differences between a control deficiency, a significant deficiency, and a material weakness.

7-5 Understand management’s process for assessing ICFR. 7-6 Know how auditors conduct an audit of ICFR. 7-7 Understand how the auditor plans the audit of ICFR. 7-8 Be able to describe the top-down, risk-based approach

that auditors use to identify controls to test.

7-9 Understand how to test the design and operating effectiveness of controls.

7-10 Understand how to evaluate identified control deficiencies. 7-11 Understand how remediation affects audit reporting. 7-12 Know the written representations that the auditor must

obtain from management. 7-13 Be familiar with the auditor’s documentation requirements. 7-14 Understand auditor reporting for the audit of ICFR. 7-15 Know the auditor’s communication responsibilities on an

audit of ICFR. 7-16 Understand how to obtain assurance on controls at a service

organization that processes transactions for the entity. 7-17 Know management’s and the auditor’s responsibilities

for controls that provide reasonable assurance for safeguarding entity assets.

7-18 Be familiar with computer-assisted audit techniques.

AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 402, Audit Considerations Relating to a Client Using a Service Organization AU-C 610, Using the Work of Internal Auditors COSO, Internal Control—Integrated Framework (New York: AICPA, 2013) COSO, Enterprise Risk Management—Integrated Framework (New York: AICPA, 2004) COSO, Guidance on Monitoring Internal Control Systems (New York: AICPA, 2009) PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

PCAOB, Auditing Standard No. 8, Audit Risk (AU-C 200) PCAOB, Auditing Standard No. 9, Audit Planning (AU-C 300) PCAOB, Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB, Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB, Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB, Auditing Standard No. 15, Audit Evidence (AU-C 500) PCAOB, Auditing Standard No. 16, Communications with Audit Committees (AU-C 260) Securities and Exchange Commission, Commission Guidance Regarding Management’s Report on Internal Control over Financial Reporting under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (SEC 2007)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Major Phases of an Audit

221

mes32502_ch07_220-260.indd 221 09/30/15 02:50 PM

Auditing Internal Control over Financial Reporting

T he Sarbanes-Oxley Act of 2002 imposed significant requirements on both management and auditors of public companies. In particular, Sec- tion 404 of the Act requires that management report on the effective-

ness of its internal control over financial reporting (ICFR) and that the auditor also provide an attestation on the effectiveness of ICFR based on standards issued by the Public Company Accounting Oversight Board (PCAOB).

In 2007, the SEC issued guidance for management and the PCAOB issued Auditing Standard No. 5, An Audit of Internal Control over Financial Report- ing That Is Integrated with an Audit of Financial Statements (AS5), for auditors. These documents require that management and the auditor follow a top-down, risk-based approach to evaluating ICFR. While the cost of compliance has been high, evidence suggests that the audit of ICFR has produced significant benefits. These include a reemphasis on corporate governance and controls and higher-quality financial reporting.

This chapter covers what management must do in order to issue a report that the entity’s ICFR is effective and how the auditor performs an audit regard- ing the effectiveness of ICFR.1 The material covered in this chapter applies to companies subject to the reporting requirements of Section 404 of the Sarbanes-Oxley Act of 2002. The Dodd-Frank Act of 2010 amended Section 404 of the Sarbanes-Oxley Act by exempting certain smaller companies, known as “non-accelerated filers,” from the requirement for an external audit of inter- nal control over financial reporting. However, these smaller companies, which typically have common equity held by noninsiders of less than $75 million, must still provide management’s annual assessment of internal controls.

1As of the writing of this edition of the textbook, the AICPA’s Auditing Standards Board is drafting a proposed audit- ing standard entitled, “An Audit of Internal Control Over Financial Reporting That is Integrated With an Audit of Financial Statements,” to establish requirements and provide guidance that applies only when an auditor is engaged to perform an audit of ICFR that is integrated with an audit of financial statements. Integrated audits are required by certain regulatory bodies. The new standard may be effective as soon as December 2016.

Final PDF to printer

222 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 222 09/30/15 02:50 PM

Management Responsibilities under Section 404

Section 404 of the Sarbanes-Oxley Act requires managements of publicly traded companies to issue a report that accepts responsibility for establishing and maintaining adequate ICFR and to assert whether ICFR is effective as of the end of the fiscal year. This assessment is to be made as of a specific point in time—that is, “as of” the end of the fiscal year. Thus, man- agement’s assessment does not cover the entire year. This has implications for any control deficiencies discovered during the year. The “as-of” nature of the assessment in many cases allows management to remediate deficiencies discovered prior to year-end and still receive an unqualified opinion on ICFR.

Management must comply with the following requirements in order for the external audi- tor to complete an audit of ICFR:

∙ Accept responsibility for the effectiveness of the entity’s ICFR. ∙ Evaluate the effectiveness of the entity’s ICFR using suitable control criteria. ∙ Support the evaluation with sufficient evidence, including documentation. ∙ Present a written assessment regarding the effectiveness of the entity’s ICFR as of the

end of the entity’s most recent fiscal year.

Each of these steps is discussed below. Recognize, however, that the second and third bullets require a substantial investment of time, energy, and money on the part of the entity.

Auditor Responsibilities under Section 404 and AS5

Section 404 requires the auditor to audit management’s assertion about the effectiveness of ICFR. AS5 states that the auditor must conduct the audits of financial statements and ICFR in an integrated way because each audit provides the auditor with information relevant to the evaluation of the results of the other. The auditor’s objective in an audit of ICFR is “to express an opinion on the effectiveness of the company’s internal control over financial reporting” (AS5, ¶3), while the objective in a financial statement audit is to express an opin- ion on whether the financial statements are fairly stated in accordance with generally accepted accounting principles (GAAP).

To form a basis for expressing an opinion on the effectiveness of ICFR, the auditor must plan and perform the audit to obtain reasonable assurance about whether the entity maintained, in all material respects, effective internal control as of the date specified in management’s assessment. Reasonable assurance in this context recognizes that no system of internal control is perfect and that there is a remote likelihood that material misstate- ments will not be prevented or detected on a timely basis, even if controls are, in fact, effective. Like the financial statement audit, reasonable assurance indicates a high level of assurance.

Internal Control over Financial Reporting Defined

Chapter 6 presented the COSO definition of internal control. For purposes of both manage- ment’s assessment and the audit of internal control, the PCAOB defines ICFR as

A process designed by, or under the supervision of, the company’s principal executive and prin- cipal financial officers, or persons performing similar functions, and effected by the company’s board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external pur- poses in accordance with GAAP, and includes those policies and procedures that

(1) Pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company;

LO 7-1

LO 7-2

LO 7-3

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 223

mes32502_ch07_220-260.indd 223 09/30/15 02:50 PM

(2) Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authoriza- tions of management and directors of the company; and

(3) Provide reasonable assurance regarding prevention or timely detection of unauthorized acqui- sition, use or disposition of the company’s assets that could have a material effect on the finan- cial statements (AS5, ¶A5).

This definition makes it clear that the CEO and CFO are responsible for the reliability of ICFR and the preparation of the financial statements. It is the responsibility of the board of directors and management to implement an effective internal control system. You will note that the objectives of internal control in the PCAOB’s definition are more specific than the objectives listed in the COSO definition. Items (1) and (2) relate directly to controls for initi- ating, authorizing, recording, processing, and reporting significant accounts and disclosures and related assertions embodied in the financial statements. Item (3) concerns controls over safeguarding of assets.

Internal Control Deficiencies Defined

Control Deficiency For management and the auditor to assess whether ICFR is effective, it is necessary to define what constitutes a control deficiency and to define different levels of severity. While the PCAOB’s definitions in this area are somewhat technical, it is important that you invest the time and energy to understand them.

A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis. A design deficiency exists when (1) a control necessary to meet the relevant control objective is missing or (2) an exist- ing control is not properly designed so that, even if the control operates as designed, the control objective would not be met. A deficiency in operation exists when a properly designed control does not operate as designed or when the person performing the con- trol does not possess the necessary authority or qualifications to perform the control effectively (AS5, ¶A3).

Material Weakness The focus of the audit of ICFR is on deficiencies that are serious enough that there is a reasonable possibility that a material misstatement of the financial statements could result. Accordingly, the PCAOB defines a material weakness as a deficiency, or combination of defi- ciencies, in ICFR, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis (AS5, ¶A7).

Significant Deficiency A significant deficiency is a control deficiency, or combination of control deficiencies, in ICFR that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight of the entity’s financial reporting (AS5, ¶A11).

Likelihood and Magnitude According to the above definitions, in judging the significance of a control deficiency, man- agement and the auditor must consider two dimensions of the control deficiency: likelihood and magnitude of misstatements that could result from the control deficiency. The definition of material weakness includes the phrase “reasonable possibility” and is to be interpreted using the guidance in FASB ASC Topic 450, “Contingencies.” Accordingly, the likelihood

LO 7-4

Final PDF to printer

224 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 224 09/30/15 02:50 PM

of an event is a “reasonable possibility” if it is either reasonably possible or probable. While this guidance is helpful, these concepts are clearly subjective and require the application of considerable professional judgment.

Determining the magnitude of a financial statement misstatement that might result from a control deficiency also requires a great deal of professional judgment. In making such judg- ments, the auditor should be satisfied that a “prudent official” would be likely to concur. In determining whether it is reasonably possible that a financial statement misstatement result- ing from a control deficiency is material, the auditor relies on the same concept of materiality as is used in determining financial statement materiality.

Note that if likelihood is assessed as “remote,” an identified control issue does not even rise to the level of control deficiency. However, if likelihood is assessed as more than remote, the control issue will be considered a deficiency, a significant deficiency, or a material weak- ness depending on the magnitude of the deficiency. Thus, the difference between a control deficiency and a significant deficiency, and between a significant deficiency and a material weakness, is determined solely by magnitude. Figure 7–1 represents how likelihood and mag- nitude relate to each other in the determination of whether a control deficiency rises to the level of a significant deficiency or a material weakness.

Later in the chapter we discuss how the auditor applies the concepts of likelihood and materiality in an audit of ICFR as well as the auditor’s reporting responsibilities described in Figure 7–1.

Practice I N S I G H T

Before deciding whether a significant deficiency or material weakness exists, AS5 requires the auditor to evaluate the effectiveness of any compensating controls. To have a mitigating effect, the compensating control should operate at a level of precision that would prevent or detect a misstate- ment that could be material (AS5, ¶68).

Remote Reasonably possible or probable

Control deficiency

Report to management

Significant deficiency

Report to audit committee and to

management

Material weakness

M A G N I T U D E

LIKELIHOOD

Not material or significant

Not material but significant

Material Report externally,

to audit committee, and to management

The Relationship of Likelihood and Magnitude in Determining the Materiality of a Control Deficiency

F I G U R E 7 – 1

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 225

mes32502_ch07_220-260.indd 225 09/30/15 02:50 PM

Management’s Assessment Process

In order to issue a report on the effectiveness of internal control, management needs to first design and implement an effective system of ICFR and then develop an ongoing assessment process. To assist management, the SEC issued guidance for evaluating and assessing ICFR that provides for a top-down, risk-based approach for management to fol- low in evaluating and assessing ICFR. The purpose of management’s evaluation of ICFR is to provide management with a reasonable basis for its assessment as to whether any material weaknesses in ICFR exist as of the end of the period. The evaluation process has three steps:

1. Identify financial reporting risks and related controls. 2. Consider which locations to include in the evaluation. 3. Evaluate evidence about the operating effectiveness of ICFR.

Once the evaluation process is complete, management must address its reporting responsibilities.

Management is required to base its assessment of the entity’s ICFR on a suitable, rec- ognized control framework established by a body of experts that follows due-process pro- cedures. In the United States, most entities use the framework developed by COSO (COSO, Internal Control—Integrated Framework). Other suitable frameworks have been published in other countries. Review Chapter 6 for a discussion of the COSO framework.

Identify Financial Reporting Risks and Related Controls Management must first identify and assess financial reporting risks— that is, the risk that a misstatement could result in a material misstatement of the financial statements. How man- agement identifies financial reporting risks will vary based on the characteristics of the entity such as the size, complexity, and organizational structure of the entity and its processes and financial reporting environment.

Management then identifies controls that are in place to address the financial report- ing risks. In addition to specific controls that address financial reporting risks, manage- ment also evaluates whether there are controls in place to address entity-level controls and other pervasive elements of ICFR. Entity-level controls can have a pervasive effect on the entity’s ability to meet the COSO control criteria. Table 7–1 presents examples of entity- level controls.

Management should then consider the effect of information technology (IT) general con- trols that are necessary for proper and consistent operation of other technology-based controls designed to address financial reporting risks. Lastly, management must obtain and document reasonable evidential support for its assessment.

LO 7-5

Examples of Entity-Level Controls

• Controls within the control environment (e.g., tone at the top, assignment of authority and responsibility, consistent policies and procedures, and entitywide programs, such as codes of conduct and fraud prevention, that apply to all locations and business units).

• Controls over management override. • The entity’s risk assessment process. • Centralized processing and controls, including shared service environments. • Controls to monitor results of operations. • Controls to monitor other controls, including activities of the internal audit function, the audit committee,

and self-assessment programs. • Controls over period-end financial reporting process. • Policies that address significant business control and risk management practices.

Source: AS5, ¶24.

T A B L E 7 – 1

Final PDF to printer

226 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 226 09/30/15 02:50 PM

Consider Which Locations to Include in the Evaluation Management should generally include all of its locations and business units when consider- ing financial reporting risks. However, the approach followed by management in choosing which locations to include in its assessment of internal control is a function of the presence of entity-level controls and the financial reporting risk at the individual locations or business units. If financial reporting risks are adequately addressed by entity-level controls, then the evaluation approach for the locations and business units would focus on those entity-level controls. When controls that are necessary to address financial reporting risks operate at more than one location or business unit, management needs to evaluate evidence of the operation of the controls at the individual locations or business units.

If management determines that financial reporting risks for the controls that operate at indi- vidual locations or business units are low, management may rely on self-assessment processes in conjunction with entity-level controls for their assessment. When management determines that the financial reporting risks for the controls at an individual location are high, management will normally need to directly test the design and operation of the controls at that location.

Stop and Think: Take a moment and think about how a large, multinational corpora- tion such as IBM or Coca-Cola would accomplish such a task. Later in the chapter we will present an approach to selecting locations.

Evaluate Evidence about the Operating Effectiveness of ICFR The evaluation of the operating effectiveness of a control considers whether the control is operating as designed and whether the person performing the control possesses the necessary authority and competence to perform the control effectively. Management should focus its evaluation on areas that pose the highest risk to ICFR. As the risk of control failure increases, management will need more evidence to support its conclusion about the operating effective- ness of the control. Table 7–2 shows controls that are typically included for testing.

Evidence on the operating effectiveness of a control may be obtained from direct testing of the control, ongoing monitoring, or both. Direct tests of controls are usually performed on a periodic basis by individuals with a high degree of objectivity (e.g., internal auditors) with respect to the control being tested. Ongoing monitoring includes self-assessment procedures and procedures to analyze performance measures (key performance indicators) designed to track the performance of the control.

Management’s assessment must be supported by evidence that provides reasonable sup- port for its assessment. The nature and extent of this evidence will vary based on the assessed level of ICFR risk for controls over each of its financial reporting elements.

Reporting Considerations In determining its reporting responsibilities, management first evaluates the severity of the con- trol deficiencies identified. Similar to the approach taken by the auditor, management considers the likelihood of and magnitude to which the financial statements could be misstated by the control failure. If management determines that no material weaknesses exist, they can conclude that the entity’s ICFR was effective. Exhibit 7–1 provides an example management report.

Controls Typically Included for Testing

• Entity-level controls (see Table 7–1). • Controls over initiating, authorizing, recording, processing, and reporting significant accounts and disclosures and

related assertions embodied in the financial statements. • Controls over the selection and application of accounting policies that are in conformity with GAAP. • Antifraud programs and controls. • Controls, including IT general controls, on which other controls are dependent. • Controls over significant nonroutine and nonsystematic transactions, such as accounts involving judgments and

estimates.

T A B L E 7 – 2

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 227

mes32502_ch07_220-260.indd 227 09/30/15 02:50 PM

An Example of Management’s Report on Internal Control over Financial Reporting

Management is responsible for establishing and maintaining adequate internal control over financial report- ing of the entity. Internal control over financial reporting is a process designed to provide reasonable assur- ance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with accounting principles generally accepted in the United States of America.

The entity’s internal control over financial reporting includes those policies and procedures that (i) per- tain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the entity; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with accounting principles gener- ally accepted in the United States of America, and that receipts and expenditures of the entity are being made only in accordance with authorizations of management and directors of the entity; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposi- tion of the entity’s assets that could have a material effect on the financial statements.

Management conducted an evaluation of the effectiveness of internal control over financial reporting based on the framework in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Based on this evaluation, management concluded that the entity’s internal control over financial reporting was effective as of December 31, 2014.

PricewaterhouseCoopers LLP, an independent registered public accounting firm, is retained to audit IBM’s Consolidated Financial Statements and the effectiveness of the internal control over financial reporting. Its accompanying report is based on audits conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States).

Virginia M. Rometty Chairman, President and Chief Executive Officer February 24, 2015

Matin J. Schroeter Senior Vice President and Chief Financial Officer February 24, 2015

Source: IBM’s Form 10K

E X H I B I T 7 – 1

If a control deficiency is determined to be a material weakness, management must dis- close the material weakness in its assessment of the effectiveness of ICFR on an annual basis. The disclosure about the material weakness(es) should include the following:

∙ The nature of the material weakness(es). ∙ Its impact on the entity’s financial reporting and its ICFR. ∙ Management’s current plans, if any, for remediating the material weakness.

Exhibit 7–2 presents an example of management’s disclosure of a material weakness. Any control deficiency that is considered a significant deficiency or material weakness should be reported to the audit committee and the external auditor.

Management’s assessment process involves special consideration of two topics: (1) ser- vice organizations and (2) safeguarding assets. These topics must also be considered by the auditor during the audit of ICFR. Advanced Module 1 at the end of the chapter discusses each of these topics.

Management’s Documentation The SEC’s guidance allows considerable flexibility to management in how it documents rea- sonable support for its assessment. However, reasonable support should include the basis for management’s assessment and conclusion. Such documentation should include the design of

Final PDF to printer

228 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 228 09/30/15 02:50 PM

Disclosure and Remediation of a Material Weakness by Groupon Inc.’s Management

In connection with the preparation of our financial statements for the year ended December 31, 2011, we concluded there is a material weakness in the design and operating effectiveness of our internal control over financial reporting as defined in SEC Regulation S-X. A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. The primary factors contributing to the material weakness, which relates to our financial statement close process, were:

• We did not maintain financial close process and procedures that were adequately designed, docu- mented and executed to support the accurate and timely reporting of our financial results. As a result, we made a number of manual post-close adjustments necessary in order to prepare the financial statements included in this Form 10-K.

• We did not maintain effective controls to provide reasonable assurance that accounts were com- plete and accurate and agreed to detailed support, and that account reconciliations were prop- erly performed, reviewed and approved. While these activities should be performed in the ordinary course of our preparing our financial statements, we instead needed to undertake significant efforts to complete reconciliations and investigate items identified in those reconciliations during the course of our financial statement audit.

• We did not have adequate policies and procedures in place to ensure the timely, effective review of estimates, assumptions and related reconciliations and analyses, including those related to cus- tomer refund reserves. As noted previously, our original estimate disclosed on February 8 of the reserve for customer refunds proved to be inadequate after we performed additional analysis.

Groupon reported the following information at December 31, 2012, on the remediation of these mate- rial weaknesses:

During the year ended December 31, 2012, we implemented internal control procedures to address a previously identified material weakness related to our financial statement close process. These internal controls included (a) procedures required to be performed during the financial close process that support the accurate and timely reporting of our financial results, (b) the preparation of timely account reconcilia- tions that agree to detailed support and are properly reviewed and approved, and (c) the timely and effec- tive review of estimates, assumptions and related reconciliations and analyses, including those related to the customer refund reserve and non-routine transactions, by appropriate levels of management. After completing our testing of the design and operating effectiveness of these new procedures, we concluded that we have remediated the previously identified material weakness as of December 31, 2012.

Source: 2011 and 2012 Groupon, Inc. 10k.

E X H I B I T 7 – 2

the controls management has placed in operation to adequately address identified financial reporting risks, including the entity-level controls and other pervasive elements necessary for effective ICFR. The guidance does not require management to identify and document every control in a process or to document the business processes impacting ICFR. Instead, docu- mentation should focus on those controls management concludes are adequate to address the entity’s financial reporting risks.

Documentation of ICFR may take many forms, such as paper, electronic files, or other media. It also includes a variety of information, such as policy manuals, process models, flowcharts, job descriptions, documents, and forms.

Performing an Audit of ICFR

While the audit of ICFR and the audit of financial statements have different objectives, the auditor must plan and perform the audit work to achieve the objectives of both audits as an integrated audit. In planning the integrated audit, the auditor should design tests of controls to accomplish the objectives of both audits simultaneously. The auditor should incorporate the results of tests of controls from the audit of ICFR to support the control risk assessment for

LO 7-6

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 229

mes32502_ch07_220-260.indd 229 09/30/15 02:50 PM

Steps in Performing an Audit of ICFRF I G U R E 7 – 2

Identify controls to test. (Identify)

Plan the audit of ICFR. (Plan)

Evaluate the design and test the operating e�ectiveness of selected controls.

(Scope)

Evaluate identified control deficiencies.

(Evaluate)

Form an opinion on the e�ectiveness of ICFR.

(Report)

the audit of the financial statements and should use those results for determining the nature, timing, and extent of substantive procedures. Similarly, the auditor should consider the results of substantive procedures on the conclusions about the effectiveness of ICFR. For example, if a misstatement is detected by substantive procedures, the auditor should consider how and why (i.e., root cause analysis) the controls failed to detect the misstatement and whether the control deficiency might affect the opinion on the audit of ICFR.

Figure 7–2 shows the steps involved in performing an audit of ICFR. We have placed key terms in parentheses to help you remember the process. While Figure 7–2 suggests a sequential process, the audit of ICFR involves an iterative process of gathering, updating, and analyzing information.

Plan the Audit of ICFR

Planning for the audit of ICFR typically is performed in conjunction with the financial state- ment audit as discussed in Chapter 3. Table 7–3 contains some of the factors that are relevant to planning an audit of ICFR.

In planning an audit of ICFR, the auditor considers the following activities:

∙ The role of risk assessment and the risk of fraud. ∙ Scaling the audit. ∙ Using the work of others.

The Role of Risk Assessment and the Risk of Fraud A major premise of AS5 is that risk assessment underlies the entire audit of ICFR. In other words, there should be a direct relationship between the risk that a material weakness could exist in a particular area of the internal controls of the entity and the amount of audit work that

LO 7-7

Final PDF to printer

230 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 230 09/30/15 02:50 PM

is devoted to that area. Thus, the auditor should devote more attention to areas that have a high risk of a material weakness.

A major part of risk assessment is assessing the risk of fraud. The auditor should evaluate the risk of material misstatement due to fraud and the risk of management override of con- trols. The following controls should also be considered:

∙ Controls over significant, unusual transactions, particularly those that result in late or unusual journal entries.

∙ Controls over journal entries and adjustments made in the period-end financial reporting process.

∙ Controls over related party transactions. ∙ Controls related to significant management estimates. ∙ Controls that mitigate incentives for, and pressures on, management to falsify or

inappropriately manage financial results.

Scaling the Audit AS5 (¶13) specifies that the “size and complexity of the company, its business processes, and business units, may affect the way in which the company achieves many of its control objec- tives.” The auditor should recognize that the concepts behind achieving effective internal control can be scaled for companies of different size and complexity consistent with the risk- based approach. AS5 explicitly recognizes and allows for the idea that a small, less-complex entity might achieve its control objectives differently from a large, complex entity.

Using the Work of Others AS5 allows the auditor to use the work performed by, or receive direct assistance from, inter- nal auditors, entity personnel, and third parties hired by management or the audit committee.

If the work of others is to be used, the auditor should assess the objectivity and com- petence of the persons whose work will be used. AS5 refers to the relevant guidance for assessing competence and objectivity that was previously discussed in Chapter 3. Table 3–2 provides the factors for assessing competence and objectivity.

The risk associated with the control being tested also plays a role in using the work of others. As the risk associated with the control increases, the auditor should perform more of the work. For example, the auditor will rely less on the work of others for a control relating to transactions that involve subjective judgments or that are highly susceptible to manipulation than for a control that relates to routine, objective transactions.

Factors That May Affect Planning an Audit of ICFR

• Knowledge of the entity’s ICFR obtained during other engagements. • Matters affecting the industry in which the entity operates, such as financial reporting practices, economic

conditions, laws and regulations, and technological changes. • Matters relating to the entity’s business, including its organization, operating characteristics, and capital structure. • The extent of recent changes in the entity, its operations, or its ICFR. • Preliminary judgments about materiality, risk, and other factors relating to the determination of material

weaknesses. • Control deficiencies previously communicated to the audit committee or management. • Legal or regulatory matters of which the entity is aware. • The type and extent of available evidence related to the effectiveness of the entity’s ICFR. • Preliminary judgments about the effectiveness of ICFR. • Public information about the entity relevant to the evaluation of the likelihood of material financial statement

misstatements and the effectiveness of the entity’s ICFR. • Knowledge about risks related to the entity evaluated as part of the auditor’s client acceptance and retention

evaluation. • The relative complexity of the entity’s operations.

Source: AS5, ¶9.

T A B L E 7 – 3

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 231

mes32502_ch07_220-260.indd 231 09/30/15 02:50 PM

Identify Controls to Test

The next step in the process is to identify the controls to be tested. The auditor should use a top-down, risk-based approach to accomplish this step. As outlined in Figure 7–3, the auditor first identifies the entity-level controls. Next the auditor identifies the significant accounts and disclosures and understands where the likely sources of misstatements occur. Based on this information, the auditor selects which controls to test.

Identify Entity-Level Controls Table 7–1 contains a list of entity-level controls. Entity-level controls can have a pervasive effect on the entity’s ability to meet the COSO control criteria, and thus the auditor must test their effectiveness. The auditor’s evaluation of the entity-level controls can affect the extent of testing performed on other controls.

Two entity-level controls require specific evaluation by the auditor: (1) the control envi- ronment and (2) the period-end financial reporting process.

Control Environment Because of its importance to effective ICFR, the auditor must eval- uate the control environment. In particular, the auditor should assess whether

∙ Management’s philosophy and operating style promote effective ICFR. ∙ Sound integrity and ethical values, particularly of top management, are developed and

understood. ∙ The Board or audit committee understands and exercises oversight responsibility over

financial reporting and internal control.

Chapter 6 discusses how the auditor evaluates the control environment.

Period-End Financial Reporting Process The period-end financial reporting process is important to the auditor’s opinion on ICFR and to financial statement reporting. The period- end financial reporting process controls include procedures used to enter transaction totals into

LO 7-8

Identifying the Controls to TestF I G U R E 7 – 3

Identify significant accounts and disclosures and their relevant assertions.

Identify entity-level controls.

Understand likely sources of misstatement.

Select controls to test.

Final PDF to printer

232 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 232 09/30/15 02:50 PM

the general ledger; select and apply accounting policies; initiate, authorize, record, and process period-end journal entries in the general ledger; record recurring and nonrecurring adjustments to the annual and quarterly financial statements; and prepare annual and quarterly financial statements and related disclosures. Even though these controls operate after the “as of” year- end reporting date, they are used to support the auditor’s “as of” date opinion (see Exhibit 7–2).

The auditor’s evaluation of the period-end financial reporting process includes the inputs, procedures performed, and outputs of the processes the entity uses to produce its annual and quarterly financial statements. The auditor should also consider the extent of IT involvement in each period-end financial reporting process, who participates from management, the num- ber of locations involved, the types of adjusting and consolidating entries, and the nature and extent of the oversight of the process by management, the board of directors, and the audit committee. The auditor’s understanding of the entity’s period-end financial reporting process and how it interrelates with the entity’s other significant processes helps the auditor identify and test controls that are most relevant to financial statement risks. For example, sometimes entities compile summary information for financial reporting purposes based on detailed financial information taken from separate accounting information systems used in different parts of the entity. In some cases, entities use dozens or even hundreds of electronic spread- sheets to summarize and consolidate detailed data into financial statement accounts. Due to the nature of spreadsheets, there is a heightened risk that controls over spreadsheets will not be effective. The external auditor should determine the risks associated with the entity’s use of spreadsheets. Spreadsheets are subject to increased inherent risk (input errors, logic errors, interface errors, etc.). The level of control over a spreadsheet should be relative to its use, complexity, and required reliability of the information.

Identifying Significant Accounts and Disclosures and Their Relevant Assertions The auditor should identify significant accounts and disclosures and their relevant assertions. Relevant assertions are financial statement assertions (see Chapter 5) that have a reasonable possibility of containing a misstatement that would cause the financial statements to be mate- rially misstated. To identify significant accounts and disclosures and their relevant assertions, the auditor assesses the following risk factors:

∙ Size and composition of the account. ∙ Susceptibility to misstatement due to errors or fraud. ∙ Volume of activity, complexity, and homogeneity of the individual transactions

processed through the account or reflected in the disclosure. ∙ Nature of the account or disclosure. ∙ Accounting and reporting complexities associated with the account or disclosure. ∙ Exposure to losses in the account. ∙ Possibility of significant contingent liabilities arising from the activities reflected in

the account or disclosure. ∙ Existence of related party transactions in the account. ∙ Changes from the prior period in account or disclosure characteristics.

The risk factors that the auditor evaluates for an audit of ICFR are essentially the same as those used in the audit of financial statements.

Understanding Likely Sources of Misstatements To understand the likely sources of potential misstatements, the auditor needs to do the following:

∙ Understand the flow of transactions related to the relevant assertions. ∙ Identify the points within the entity’s processes at which a misstatement—including a

misstatement due to fraud—could arise that would be material.

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 233

mes32502_ch07_220-260.indd 233 09/30/15 02:50 PM

∙ Identify the controls that management has implemented to address these potential misstatements.

∙ Identify the controls that management has implemented over the prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could result in a material misstatement of the financial statements.

Performing walkthroughs is often the best way to identify potential sources of misstate- ments. To perform a walkthrough, the auditor traces a transaction from origination through the entity’s processes and information system until it is reflected in the entity’s financial reports.

Stop and Think: How do walkthroughs help the auditor in confirming his or her under- standing of control design and transaction process flow?

In performing the walkthrough, the auditor should make inquiries of relevant personnel involved in significant aspects of the process or controls. The auditor should use probing questions to determine entity personnel’s understanding of what is required by the controls and determine whether the processing procedures are performed as understood and on a timely basis. These questions typically include inquiries on how exceptions are handled, how “hand-offs” are properly accomplished between previous and succeeding processes, and who performs the control when an employee is sick or absent. These questions help corroborate the entity’s design and transaction flow documentation. Walkthrough inquiries should include questions designed to identify abuse of controls (i.e., inappropriate management override) or indicators of fraud.

Select Controls to Test The auditor does not need to test all controls—only those controls that are important to the auditor’s conclusion about whether the entity’s controls sufficiently address the assessed risk of misstatement to each relevant assertion, often referred to as “key” controls. Identifying the controls to be tested is a subjective task that requires professional judgment. Table 7–4 provides a list of factors that the auditor considers when deciding which controls to test. The auditor should evaluate whether to test preventive controls, detective controls, or a com- bination of both. For example, a monthly reconciliation (a detective control) might detect an out-of-balance situation resulting from an unauthorized transaction being initiated due to an ineffective authorization procedure (a preventive control). When determining whether the detective control is effective, the auditor should evaluate whether the detective control is suf- ficient to achieve the control objective to which the preventive control relates.

The auditor must make decisions similar to management in deciding which locations or business units to include for testing based on the presence of entity-level controls and the financial reporting risk at each individual location or business unit.

Factors to Consider When Identifying Controls to Test

• Points at which errors or fraud could occur. • The nature of the controls implemented by management. • The significance of each control in achieving the objectives of the control criteria and whether more than one con-

trol achieves a particular objective or whether more than one control is necessary to achieve a particular objective. • The risk that the controls might not be operating effectively. Factors that affect whether the control might not be

operating effectively include the following: – Whether there have been changes in the volume or nature of transactions that might adversely affect control

design or operating effectiveness; – Whether there have been changes in the design of controls; – The degree to which the control relies on the effectiveness of other controls (e.g., the control environment or IT

general controls); – Whether there have been changes in key personnel who perform the control or monitor its performance; – Whether the control relies on performance by an individual or is automated; and – The complexity of the control.

T A B L E 7 – 4

Final PDF to printer

234 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 234 09/30/15 02:50 PM

Evaluate the Design and Test the Operating Effectiveness of Controls

Evaluating Design Effectiveness of Controls Controls are effectively designed when they prevent or detect errors or fraud that could result in material misstatements in the financial statements. Once key controls are identified, the auditor evaluates design effectiveness through inquiry, observation, walkthroughs, inspection of relevant documentation, and subjective evaluations of whether the controls are likely to prevent or detect errors or fraud that could result in misstatements assuming they are oper- ated as prescribed by qualified persons. The procedures performed by the auditor to test and evaluate design effectiveness might in some cases also provide some evidence about operat- ing effectiveness.

Testing and Evaluating Operating Effectiveness of Controls An auditor evaluates the operating effectiveness of a control by determining whether the con- trol is operating as designed and whether the person performing the control possesses the nec- essary authority and competence to perform the control effectively. In testing the operating effectiveness of controls, the auditor needs to consider the scope (nature, timing, and extent) of testing. For each control selected for testing, the evidence necessary to persuade the auditor that the control is effective depends on the risk that a material weakness would result. As the risk associated with the control being tested increases, the quality and/or quantity of the evi- dence that the auditor should obtain also increases. Table 7–5 presents the factors that affect the risk associated with a control.

Nature of Testing Tests of controls for operating effectiveness include such procedures as inquiry of appropriate personnel, inspection of relevant documentation, observation of the entity’s operations, and reperformance of the application of the control. In many instances, a combination of these procedures is necessary to ensure that a control is operating effectively.

Inquiry is used extensively throughout the audit of internal control. Because inquiry alone does not provide sufficient evidence to support the operating effectiveness of a control, the auditor should perform additional tests of controls.

Stop and Think: Suppose an entity implements a control whereby its sales manager reviews and investigates a report listing sales invoices with unusually high or low gross margins. Would inquiry of the sales manager as to whether he or she investigates dis- crepancies be sufficient evidence to ensure that the control is working effectively?

LO 7-9

Factors That Affect the Risk Associated with a Control

• The nature and materiality of misstatements that the control is intended to prevent or detect. • The inherent risk associated with the related account(s) and assertion(s). • Whether there have been changes in the volume or nature of transactions that might adversely affect control

design or operating effectiveness. • Whether the account has a history of errors. • The effectiveness of entity-level controls, especially controls that monitor other controls. • The nature of the control and the frequency with which it operates. • The degree to which the control relies on the effectiveness of other controls. • The competence of the personnel who perform the control or monitor its performance and whether there have

been changes in key personnel who perform the control or monitor its performance. • Whether the control relies on performance by an individual or is automated. • The complexity of the control and the significance of the judgments that must be made in connection with its

operation.

T A B L E 7 – 5

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 235

mes32502_ch07_220-260.indd 235 09/30/15 02:50 PM

No. The auditor should corroborate the sales manager’s responses by performing other procedures, such as inspecting reports generated by the performance of the control and evalu- ating whether appropriate actions were taken.

The type of control often affects the nature of control testing the auditor can perform. For example, an entity may have a control that requires a signature (manual or digital) on a voucher package to indicate that the signer approved it. However, the presence of a signature does not necessarily mean that the person carefully reviewed the package before signing. As a result, the quality of the evidence regarding the effective operation of the control might not be sufficiently persuasive. In order to gain more persuasive evidence, the auditor could reperform the control by checking the voucher package for accuracy and completeness, essentially repeating the steps taken to initially perform the control. The auditor might also inquire of the person responsible for approving voucher packages regarding what he or she looks for when approving packages and ask to see documentation of the errors that have been found and rectified in the recent past.

Timing of Tests of Controls The auditor must perform tests of controls over a period of time that is adequate to determine whether the significant controls were operating effectively as of the date indicated in management’s report. The period of time over which the auditor performs tests of controls will vary with the nature of the controls and the frequency with which they are applied. Some controls operate continuously (e.g., controls over the processing of routine sales transactions), while other controls operate only occasionally (e.g., monthly bank reconciliations). Routine transactions typically involve routine processing controls, such as verification of data entry, edit checks and validation controls, completeness controls, and so forth. For nonroutine transactions, especially those involving estimation, review and approval controls are usually considered more critical. In some cases, controls may operate after the “as of” date specified in management’s report. For example, controls over a December 31 period-end financial reporting process normally operate in January of the following year.

In many instances, the auditor obtains evidence about the operating effectiveness of con- trols at an interim date for reporting on internal control even though the auditor’s report on the effectiveness of internal control is for an “as of” date. For example, the auditor might test controls over the revenue process for the first nine months of the year. The auditor will then need to determine what additional evidence is needed concerning the operating effectiveness of the controls for the remaining three-month period. In deciding what additional evidence is needed, the auditor considers the specific controls tested prior to the “as of” date and the results of those tests, the sufficiency of the evidence of effectiveness obtained, the length of the remaining period, and the possibility that there have been significant changes in internal control subsequent to the interim date. For controls over significant nonroutine transactions, controls over accounts or processes with a high degree of subjectivity or judgment in mea- surement, or controls over the recording of period-end adjustments, the auditor should per- form tests closer to the “as of” date.

If management implements changes to the entity’s controls to make them more effective or efficient prior to the date specified in management’s report, the auditor might not need to evaluate the superseded controls for purposes of the audit of ICFR.

Extent of Tests of Controls AS5 does not provide any detailed guidance on what consti- tutes a sufficient sample for testing the operating effectiveness of the control. This is left to the auditor as a matter of professional judgment.

The auditor should consider the following factors when deciding on the extent of testing:

∙ Nature of the control. Manual controls should be subjected to more extensive testing than automated controls in view of the greater variability inherent in controls involving people.

∙ Frequency of operation. Generally, the more frequently a manual control operates, the greater the number of operations of the control the auditor should test.

∙ Importance of the control. The more important the control, the more extensively it should be tested.

Final PDF to printer

236 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 236 09/30/15 02:50 PM

Most public accounting firms have developed firm-wide guidance for the sample sizes used to test for various types of controls. Chapter 8 provides guidance on using statistical and nonstatistical sampling for tests of controls.

AS5 provides guidance on incorporating knowledge obtained from prior years’ audits into the decision-making process for determining the nature, timing, and extent of testing for the current year audit. For example, if the results for testing a particular control were favorable in the prior year, and no changes were made to the control, the auditor might assess the risk for the control lower and reduce the extent of testing in the current year. If the controls are auto- mated, the auditor might consider using a benchmarking strategy.2 A benchmarking strategy is an approach that allows the auditor to conclude that a previously tested automated control continues to be effective based on indicators of whether there has been any change in the operation of the control rather than on repeating the full extent of the prior detail-testing work.

Advanced Module 2 offers a brief discussion of computer-assisted audit techniques avail- able to the auditor in testing the operating effectiveness of controls.

2For a discussion of how the auditor might use a benchmarking strategy, refer to AS5, ¶B28–B33.

Practice I N S I G H T

The PCAOB issued a report about the nature and frequency of deficiencies in firms’ audits of ICFR detected during the 2010 inspections of eight domestic registered firms. Some of the deficiencies identified include

• Failure to identify and sufficiently test controls that are intended to address the risks of material misstatement.

• Insufficient tests of the design and operating effectiveness of management review controls that are used to monitor the results of operations.

• Failure to obtain sufficient evidence to update the results of testing of controls from an interim date to the entity’s year-end (i.e., the roll-forward period).

Source: PCAOB Release No. 2012-006.

Evaluating Identified Control Deficiencies

The auditor is required to evaluate the severity of each control deficiency. The assessment of the significance of a control deficiency depends on the potential for a misstatement, not on whether a misstatement actually has occurred. As discussed earlier, the severity of a control deficiency depends on two factors:

∙ Whether there is a reasonable possibility that the company’s controls will fail to prevent or detect a misstatement of an account balance or disclosure (Likelihood).

∙ The magnitude of the potential misstatement resulting from the deficiency or deficiencies (Magnitude).

Table 7–6 presents the risk factors that affect whether there is a reasonable possibility that a control deficiency, or a combination of control deficiencies, will result in a misstatement of an account balance or disclosure.

Factors that affect whether the magnitude of the misstatement might result in a material weakness include (1) the financial statement amounts or total of transactions exposed to the deficiency and (2) the volume of activity in the account balance or class of transactions exposed to the deficiency that has occurred in the current period or that is expected in future periods.

Table 7–7 presents indicators of material weaknesses in ICFR. AS5 (¶70) provides the following guidance on assessing the severity of a control deficiency:

When evaluating the severity of a deficiency, or combination of deficiencies, the auditor also should determine the level of detail and degree of assurance that would satisfy prudent officials in the conduct of their own affairs that they have reasonable assurance that transactions are recorded as necessary to permit the preparation of financial statements in conformity with generally accepted

LO 7-10

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 237

mes32502_ch07_220-260.indd 237 09/30/15 02:50 PM

accounting principles. If the auditor determines that a deficiency, or combination of deficien- cies, might prevent prudent officials in the conduct of their own affairs from concluding that they have reasonable assurance that transactions are recorded as necessary to permit the preparation of financial statements in conformity with generally accepted accounting principles, then the auditor should treat the deficiency, or combination of deficiencies, as an indicator of a material weakness.

You will note that applying this guidance requires a good deal of judgment on the part of the auditor.

Examples of Control Deficiency Evaluation Exhibit 7–3 presents a detailed example of an auditor’s test of the design and operating effec- tiveness for a daily IT-dependent manual control. This example explains the nature, timing, and extent of procedures and the auditor's conclusion on effectiveness of the control.

These are important and complex concepts—let’s practice. Following are examples of control deficiencies that may represent significant deficiencies or material weaknesses. For each control deficiency, indicate whether it is a significant deficiency or material weakness. Justify your decision.3 After you have tried on your own to assess the scenario, look at the solution to see how well you did!

Scenario 1 Murray Company processes a significant number of routine intercompany transactions on a monthly basis. Individual intercompany transactions are not material and primarily relate to balance sheet activity; for example, cash transfers between business units to finance normal operations.

A formal management policy requires monthly reconciliation of intercompany accounts and confirmation of balances between business units. However, there is no process in place to ensure performance of these procedures. As a result, detailed reconciliations of intercompany accounts are not performed on a timely basis. Management does perform monthly procedures to investi- gate selected large-dollar intercompany account differences. In addition, management prepares a detailed monthly variance analysis of operating expenses to assess their reasonableness.

3See the Willis & Adams Policy Statement on Evaluating Control Deficiencies (located in Connect) for more detailed guidance on evaluating deficiencies.

Risk Factors That Affect the Likelihood That a Control Deficiency Will Result in a Misstatement of an Account Balance or Disclosure

• The nature of the financial statement accounts, disclosures, and assertions involved. • The susceptibility of the related asset or liability to loss or fraud. • The subjectivity, complexity, or extent of judgment required to determine the amount involved. • The interaction or relationship of the control with other controls, including whether they are interdependent or

redundant. • The interaction of the deficiencies. • The possible future consequences of the deficiency.

Source: AS5, ¶65.

T A B L E 7 – 6

Indicators of Material Weaknesses

• Identification of fraud, whether or not material, committed by senior management. • Restatement of previously issued financial statements to reflect the correction of a material misstatement. • Identification by the auditor of a material misstatement of financial statements in the current period in circum-

stances that indicate that the misstatement would not have been detected by the entity’s ICFR. • Ineffective oversight of the entity’s external financial reporting and ICFR by the entity’s audit committee.

Source: AS5, ¶69.

T A B L E 7 – 7

Final PDF to printer

238 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 238 09/30/15 02:50 PM

An Example of an Auditor’s Tests of a Daily Information Technology–Dependent Manual Control

E X H I B I T 7 – 3

Bill Boyd is manager for Emets & Shinn, the independent registered public accounting firm for Petheridge Packing Company (PPC). Based on discussions with PPC personnel and review of entity documentation, the auditor learns that PPC had the following procedures in place over the entire period to account for cash received in the bank lockbox: • The entity receives from the bank an electronic file listing cash received from customers. • The IT system applies cash received in the lockbox to individual customer accounts. • Any cash received in the lockbox and not applied to a customer’s account is listed on an exception report called the “unapplied cash

exception report.”

The application of cash to a customer’s account is a programmed application control, while the review and follow-up of unapplied cash from the exception report is a manual control.

Boyd wants to determine whether misstatements in cash (primarily relating to the existence assertion) and accounts receivable (exis- tence, valuation, and completeness) would be prevented or detected on a timely basis. In order to test these objectives, Boyd decides to test the manual control. Nature, Timing, and Extent of Procedures Objective of Test To determine whether there is a listing of nonmatching cash items on the exception report.

Boyd decides to perform the following tests of controls to ensure the operating effectiveness of the control for the review and follow- up on the daily unapplied cash exception report.

1. Inquired of entity personnel about the procedures in place to ensure that all unapplied items are resolved, the time frame in which such resolution takes place, and whether unapplied items are handled properly within the system.

Findings: Boyd discussed these matters with the employee responsible for reviewing and resolving the daily unapplied cash excep- tion reports. Boyd learned that items appearing on the daily unapplied cash exception report must be manually entered into the system. The employee typically performs the resolution procedures the next business day. In most cases, items that appear on the daily unapplied cash exception report relate to payments made by a customer who failed to reference an invoice number or purchase order number, or to underpayments of an invoice due to quantity or pricing discrepancies.

2. Reperformed the control.

Findings: Boyd selected 25 daily unapplied cash exception reports from the period January to September and reperformed the follow-up procedures that the employee performed. Boyd inspected the documents and sources of information used in the follow- up and determined that the transaction was properly corrected in the system. He also scanned other daily unapplied cash excep- tion reports to determine that the control was performed throughout the period of intended reliance.

3. Follow-up tests: Because the tests were performed at an interim date, Boyd asked entity personnel about the procedures in place at year-end. The procedures had not changed from the interim period; therefore, Boyd observed that the controls were still in place by scanning daily unapplied cash exception reports to determine the control was performed on a timely basis during the period from September to year-end. No exceptions were noted.

Based on the audit procedures, Boyd concluded that the employee was clearing exceptions in a timely manner and that the control was operating effectively as of year-end.

Scenario 2 Ragunandan Company processes a significant number of intercompany trans- actions on a monthly basis. Intercompany transactions relate to a wide range of activities, including transfers of inventory with intercompany profit between business units, allocation of research and development costs to business units, and corporate charges. Individual inter- company transactions are frequently material.

A formal management policy requires monthly reconciliation of intercompany accounts and confirmation of balances between business units. However, there is no process in place to ensure that these procedures are performed on a consistent basis. As a result, reconciliations of intercompany accounts are not performed on a timely basis, and differences in intercom- pany accounts are frequent and significant. Management does not perform any alternative controls to investigate significant intercompany account differences.

Solution: Scenario 1 Based only on these facts, the auditor should determine that this control deficiency represents a significant deficiency. The magnitude of a financial statement misstatement resulting from this deficiency would reasonably be expected to be significant, though not material because individual intercompany transactions are not material, and the compensating controls operating monthly should detect a material misstatement. However,

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 239

mes32502_ch07_220-260.indd 239 09/30/15 02:50 PM

the compensating detective controls are designed only to detect material misstatements. The controls do not address the detection of misstatements that are significant but not material. Furthermore, the transactions are primarily restricted to balance sheet accounts. Therefore, it is reasonably possible that a misstatement could occur.

Solution: Scenario 2 Based only on these facts, the auditor should determine that this deficiency represents a material weakness. The magnitude of a financial statement misstate- ment resulting from this deficiency would reasonably be expected to be material, because individual intercompany transactions are frequently material and relate to a wide range of activities. Additionally, actual unreconciled differences in intercompany accounts have been, and are, material. The likelihood of such a misstatement is reasonably possible because such misstatements have frequently occurred and compensating controls are not effective, either because they are not properly designed or because they are not operating effectively. Taken together, the magnitude and likelihood of misstatement of the financial statements resulting from this internal control deficiency meet the definition of a material weakness.

Remediation of a Material Weakness

When an entity determines that it has a material weakness, it should take steps to correct it. This is referred to as remediation. If the material weakness cannot be corrected and/or prop- erly tested before the “as of” date, management and the auditor should each issue a report that the ICFR is not operating effectively. If management corrects a material weakness before the “as of” date, there must be sufficient time for both management and the auditor to adequately test the operating effectiveness of the control. If there is not sufficient time, then neither management nor the auditor can conclude that ICFR is effective. If there is sufficient time to remediate the material weakness and test the operating effectiveness of the remediated con- trol, the testing shows that the new control is operating effectively, management and the audi- tor can issue a report that ICFR is operating effectively. See the last paragraph of Exhibit 7–2 to see how Groupon reported the remediation of its material weaknesses.

Written Representations

In addition to the management representations obtained as part of a financial statement audit (see Chapter 17), the auditor obtains written representations from management related to the audit of ICFR. Table 7–8 presents a typical set of management representations made to the auditor related to the audit of internal control. Failure to obtain written representations from management, including management’s refusal to furnish them, constitutes a limitation on the

LO 7-11

LO 7-12

Written Representations Made by Management to the Auditor

• Management is responsible for establishing and maintaining effective ICFR. • Management has performed an evaluation and made an assessment of the effectiveness of the entity’s ICFR and

specifying the control criteria. • Management did not rely on work performed by the auditor in forming its assessment of the effectiveness of ICFR. • Management’s conclusion about the effectiveness of the entity’s ICFR based on the control criteria as of a specified date. • Management has disclosed to the auditor all deficiencies in the design or operation of ICFR identified as part of

management’s evaluation and has identified all such deficiencies that it believes to be significant deficiencies or material weaknesses.

• Descriptions of any material fraud and any other fraud that, although not material, involves senior management or management or other employees who have a significant role in the entity’s ICFR.

• Control deficiencies identified and communicated to the audit committee during previous engagements have (or have not) been resolved (and specifically identifying any that have not).

• Descriptions of any changes in ICFR or other factors that might significantly affect ICFR, including any corrective actions taken by management with regard to significant deficiencies and material weaknesses.

Source: AS5, ¶75.

T A B L E 7 – 8

Final PDF to printer

240 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 240 09/30/15 02:50 PM

scope of the audit sufficient to preclude an unqualified opinion on ICFR. While the required representations are typically drafted by the auditor, they are addressed to the auditor and are signed (and worded as if written) by the CEO and CFO.

Auditor Documentation Requirements

The auditor should document the processes, procedures, judgments, and results relating to the audit of internal control consistent with the PCAOB's documentation standards. The auditor’s documentation must include the auditor’s understanding and evaluation of the design of each of the components of the entity’s ICFR, documentation of the process used to determine the points at which misstatements could occur within significant accounts and disclosures, the extent to which he or she relied on work performed by others, and the scope of testing. Finally, the auditor must describe the evaluation of any deficiencies discovered, as well as any other findings, that could result in a modification to the auditor’s report.

Auditor Reporting on ICFR

After auditing the effectiveness of an entity’s internal control, an auditor issues an unquali- fied opinion if the entity’s internal control is designed and operating effectively in all mate- rial respects. Significant deficiencies do not require a departure from an unqualified opinion because, though they are deemed to be significant enough to be brought to the attention of the audit committee, they relate to possible financial statement misstatements that are less than material. Figure 7–1 shows the auditor’s reporting responsibilities for deficiencies, significant deficiencies, and material weaknesses. Figure 7–4 gives an overview of the types of audit reports relating to the effectiveness of ICFR. If the scope of the auditor’s work is limited, a disclaimer of opinion is issued on the effectiveness of ICFR. If one or more unremediated material weaknesses is identified, the auditor issues an adverse opinion.

LO 7-13

LO 7-14

Unqualified opinion

Adverse opinionMaterial weakness

Type of Deficiency Type of Audit Report Reason for/Seriousness of

Scope Limitation Type of Audit Report

Control deficiency or significant deficiency Minor e�ect

More than minor e�ect

Disclaim opinion or withdraw

Report Modification Based on Type of Deficiency Report Modification Based on Scope Limitation

Overview of Reporting for the Audit of ICFRF I G U R E 7 – 4

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 241

mes32502_ch07_220-260.indd 241 09/30/15 02:50 PM

Elements of the Auditor’s Report The auditor’s report on the effectiveness of internal control has a number of required ele- ments. The report identifies management’s conclusion about the effectiveness of the enti- ty’s ICFR and states that the assessment on which management’s conclusion is based is the responsibility of management. The report defines ICFR and indicates that the standards of the PCAOB require that the auditor plan and perform the audit to obtain reasonable assur- ance about whether effective ICFR was maintained in all material respects. The report goes on to explain in general terms what an audit of ICFR entails and explicitly addresses the fact that even effective internal control cannot guarantee that misstatements will be prevented, or detected and corrected. Finally, the report concludes with the auditor’s opinion on whether the company maintained, in all material respects, effective ICFR as of the end of the period.

The auditor may choose to issue separate reports on the entity’s financial statements and ICFR or may issue a combined report. Under either approach, the date of the two reports should be the same. The following sections explain the unqualified report, the adverse report for material weaknesses, and the disclaimer of opinion for a scope limitation.

Unqualified Report An unqualified opinion regarding the effectiveness of the entity’s ICFR provides reason- able assurance that the entity’s controls are designed and operating effectively in all mate- rial respects as of the balance sheet date. The phrase “all material respects” means that the entity’s ICFR is free of any material weakness. Exhibit 7–4 presents an example of an audi- tor’s unqualified report that is presented separately from the auditor’s report on the financial statements for EarthWear Clothiers. Note that the report includes an explanatory paragraph referring to the financial statement audit report. Exhibit 1–1 in Chapter 1 presents a separate report on the financial statement audit for EarthWear Clothiers. Note that the last paragraph of that report refers to the audit of ICFR and indicates that an unqualified opinion was issued with respect to the effectiveness of internal control.

Exhibit 7–5 presents an example of a combined report for EarthWear Clothiers that gives an unqualified opinion on both the financial statement audit and the audit of ICFR. When the auditor elects to issue a combined report, the report may address multiple reporting periods for the financial statements presented but will address only the end of the most recent fiscal year for the effectiveness of internal control.

Adverse Report for a Material Weakness The presence of a material weakness at the end of the period necessitates an adverse assess- ment by management and an adverse opinion by the auditor. An adverse report includes the definition of a material weakness and a description of the particular material weakness iden- tified in the entity’s system of internal control, along with the auditor’s opinion that the entity has not maintained effective ICFR as of the report date. See Exhibit 7–6 for an example of an adverse report.

It is possible for the auditor to issue an adverse opinion on internal control while at the same time issuing an unqualified opinion on the financial statement audit. Such a conclusion is reached when an entity’s internal control is not effective at preventing or detecting material errors, but the auditor concludes (based on substantive procedures) that the entity’s finan- cial statements do not contain material misstatements. Such circumstances can arise when an identified material weakness does not actually result in a misstatement in the financial statements or when a material weakness does result in a material misstatement but the entity corrects the misstatement prior to issuing the financial statements.

Disclosure is also important when the auditor’s opinion on the financial statements is affected by the adverse opinion on the effectiveness of internal control. In such a circum- stance, the report on ICFR (or the combined report) should similarly indicate that the mate- rial weakness was considered in determining the nature, timing, and extent of procedures performed as part of the financial statement audit. Such disclosure is important to ensure that

Final PDF to printer

242 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 242 09/30/15 02:50 PM

An Example of a Separate Report Giving an Unqualified Opinion on the Effectiveness of ICFR

Report of Independent Registered Public Accounting Firm

[Introductory Paragraph]

We have audited EarthWear Clothiers’ internal control over financial reporting as of December 31, 2015, based on criteria established in Internal Control—Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). EarthWear Clothiers’ management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on the company’s internal control over financial reporting based on our audit.

[Scope Paragraph]

We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those stan- dards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial report- ing, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we consid- ered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

[Definition Paragraph]

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) pro- vide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detec- tion of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

[Inherent Limitations Paragraph]

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in condi- tions or that the degree of compliance with the policies or procedures may deteriorate.

[Opinion Paragraph]

In our opinion, EarthWear Clothiers maintained, in all material respects, effective internal control over financial reporting as of December 31, 2015, based on criteria established in Internal Control—Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

[Explanatory Paragraph]

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consoli- dated financial statements of EarthWear Clothiers, and our report dated February 15, 2016, expressed an unqualified opinion.

Willis & Adams Boise, Idaho February 15, 2016

E X H I B I T 7 – 4

users of the auditor’s report on the financial statements understand why the auditor issued an unqualified opinion on those statements.

Disclaimer for Scope Limitation The auditor can express an unqualified opinion on the effectiveness of ICFR only if the audi- tor has been able to apply all the procedures necessary in the circumstances. If the scope of the auditor’s work is limited because of circumstances beyond the control of management or the auditor, the auditor should disclaim an opinion or withdraw from the engagement. The auditor’s decision depends on an assessment of the importance of the omitted procedure(s) to his or her ability to form an opinion.

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 243

mes32502_ch07_220-260.indd 243 09/30/15 02:50 PM

Practice I N S I G H T

In 2004, the first year of compliance with Section 404 of the Sarbanes-Oxley Act, auditors reported some 629 material weaknesses (15.9 percent). According to Audit Analytics, that figure has declined every year since, and only 141 were reported in 2011. One SEC official has questioned the low level of reported material weaknesses.

An Example of a Combined Report Expressing an Unqualified Opinion on Financial Statements and an Unqualified Opinion on the Effectiveness of ICFR

Report of Independent Registered Public Accounting Firm

[Introductory paragraph]

We have audited the accompanying balance sheets of EarthWear Clothiers as of December 31, 2015 and 2014, and the related statements of income, stockholders’ equity and comprehensive income, and cash flows for each of the years in the three-year period ended December 31, 2015. We also have audited EarthWear Clothiers’ internal control over financial reporting as of December 31, 2015, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). EarthWear Clothiers’ management is responsible for these financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management Report on the Financial Statements and Internal Control. Our responsibility is to express an opinion on these financial state- ments and an opinion on the effectiveness of the company’s internal control over financial reporting based on our audits.

[Scope paragraph]

We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the financial statements are free of material misstatement and whether effective internal control over financial reporting was maintained in all material respects. Our audit of financial statements included examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, and evaluating the overall financial statement presentation. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

[Definition paragraph]

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) pro- vide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detec- tion of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

[Inherent limitations paragraph]

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in condi- tions, or that the degree of compliance with the policies or procedures may deteriorate.

[Opinion paragraph]

In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of EarthWear Cloth- iers as of December 31, 2015 and 2014, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 2015, in conformity with accounting principles generally accepted in the United States of America. Also, in our opin- ion, EarthWear Clothiers maintained, in all material respects, effective internal control over financial reporting as of December 31, 2015, based on criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Willis & Adams Boise, Idaho February 15, 2016

E X H I B I T 7 – 5

Final PDF to printer

244 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 244 09/30/15 02:50 PM

Other Reporting Issues

Management’s Report Incomplete or Improperly Presented If the auditor determines that elements of management’s annual report on ICFR are incom- plete or improperly presented, the auditor should modify his or her report to include an explanatory paragraph describing the reasons for this determination.

The Auditor Decides to Refer to the Report of Other Auditors As discussed in Chapter 18 in connection with the financial statement audit, on some engage- ments, parts of the audit may be completed by another public accounting firm. In such cir- cumstances, the auditor must decide whether to refer to work performed by the other auditor. The decision is based on factors similar to those considered by the auditor who uses the work and reports of other independent auditors when reporting on a company’s financial state- ments. If the auditor decides to make reference to the report of the other auditor as a basis, in part, for his or her opinion, the auditor should refer to the report of the other auditor in describing the scope of the audit and in expressing the opinion.

Practice I N S I G H T

In the first several years of Sarbanes-Oxley compliance, approximately 75 percent of the material weaknesses reported were identified when the auditor discovered a material misstatement while conducting substantive audit procedures. When a material misstatement is discovered, the auditor does a “root cause analysis” to find out why the entity’s internal control over financial reporting failed to prevent or detect the misstatement. Such an analysis usually leads to the identification of a mate- rial weakness.

An Example of an Adverse Opinion on the Effectiveness of ICFR Because of the Existence of a Material Weakness

Report of Independent Registered Public Accounting Firm [Standard Wording for the Introductory, Scope, Definition, and Inherent Limitations Paragraphs]

[Explanatory Paragraph]

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a rea- sonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis. The following material weakness has been identified and included in management’s assessment. Treadron Company had an inadequate system for recording cash receipts, which could have prevented the Company from recording cash receipts on accounts receivable completely and properly. Therefore, cash received could have been diverted for unauthorized use, lost, or otherwise not prop- erly recorded to accounts receivable. This material weakness was considered in determining the nature, timing, and extent of audit tests applied in our audit of the 2015 financial statements, and this report does not affect our report dated February 15, 2016, on those financial statements.

[Opinion Paragraph]

In our opinion, because of the effect of the material weakness described above on the achievement of the objectives of the control criteria, Treadron Company has not maintained effective internal control over financial reporting as of December 31, 2015, based on criteria estab- lished in Internal Control—Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Mortensen & Mortensen Houston, Texas February 15, 2016

E X H I B I T 7 – 6

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 245

mes32502_ch07_220-260.indd 245 09/30/15 02:50 PM

Subsequent Events The auditor has a responsibility to report on any changes in internal control that might affect financial reporting between the end of the reporting period and the date of the auditor’s report. Chapter 17 describes the types of procedures the auditor undertakes to search for subsequent events affecting an entity’s financial statements and affecting the entity’s ICFR. As noted in Chapter 17, the auditor’s treatment of a subsequent event depends on whether the event reveals information about a material weakness that existed as of the end of the reporting period or whether the event creates or reveals information about a new condition that did not exist as of the end of the reporting period.

Management’s Report Contains Additional Information Management may include additional information in its report on ICFR. For example, manage- ment may include disclosures about corrective actions taken by the entity after the date of management’s assessment, the entity’s plans to implement new controls, or a statement that management believes the cost of correcting a material weakness would exceed the benefits to be derived from implementing new controls. The auditor should disclaim an opinion on such information and include the following language as the last paragraph of the report:

We do not express an opinion or any other form of assurance on management’s statement referring to the costs and related benefits of implementing new controls.

If the auditor believes that the additional information contains a material misstatement of fact, he or she should discuss the matter with management. If the auditor concludes that a material misstatement of fact remains after discussing it with management, he or she should notify the audit committee in writing. The auditor also should consider consulting the audi- tor’s legal counsel about further actions to be taken, including the auditor’s responsibility under the Securities Exchange Act of 1934 (AS5, ¶C14).

Reporting on a Remediated Material Weakness at an Interim Date If management remediates a material weakness after the “as of ” date, the auditor can provide an interim opinion rather than making the entity wait 12 months to receive a clean opinion regarding its ICFR in the next year-end report. Thus, the auditor can attest on a timely basis as to whether an entity has eliminated the cause of a previously issued adverse opinion regarding its ICFR.

Additional Required Communications in an Audit of ICFR

The auditor has a number of communication responsibilities under AS5. As shown in Figure 7–1, the auditor must communicate in writing to management and the audit com- mittee all significant deficiencies and material weaknesses identified during the audit. The written communication should be made prior to the issuance of the auditor’s report on ICFR. The auditor’s communication should distinguish clearly between those matters considered to be significant deficiencies and those considered to be material weaknesses. If a significant deficiency or material weakness exists because the oversight by the entity’s audit committee is ineffective, the auditor must communicate that specific significant deficiency or material weakness in writing to the board of directors.

In addition, the auditor should communicate to management, in writing, all control defi- ciencies (deficiencies in internal control that are not material or significant) identified during the audit and inform the audit committee when such a communication has been made. Keep in mind that the auditor’s role is to identify material weaknesses. The auditor is not required to perform procedures to identify control deficiencies that do not rise to the level of a material weakness.

LO 7-15

Final PDF to printer

246 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 246 09/30/15 02:50 PM

The auditor’s written communication about control deficiencies states that the communi- cation is intended solely for the information and use of the board of directors, audit commit- tee, management, and others within the organization. When governmental authorities require the entity to furnish such a report, a specific reference to such regulatory agencies may be made in the report. These written communications also include the definitions of control defi- ciencies, significant deficiencies, and material weaknesses and clearly identify the types of deficiencies being communicated. The auditor’s communication may indicate that no mate- rial weaknesses were identified if none were found. However, because the auditor’s proce- dures were geared toward detecting material weaknesses, the auditor may not represent that no significant deficiencies were noted during an audit of internal control.

When auditing ICFR, the auditor may become aware of fraud or other possible illegal acts. If the matter involves fraud, it must be brought to the attention of the appropriate level of management. If the fraud involves senior management, the auditor must communicate the matter directly to the audit committee. If the matter involves other possible illegal acts, the auditor must be assured that the audit committee is adequately informed, unless the matter is clearly inconsequential. When timely communication is important, the auditor communicates such matters during the course of the audit rather than at the end of the engagement.

Advanced Module 1: Special Considerations for an Audit of Internal Control

The PCAOB specifies two areas that require special consideration by management and the auditor during an audit of ICFR:

∙ Service organizations. ∙ Safeguarding assets.

Use of Service Organizations Many companies use service organizations to process transactions. If the service organiza- tion’s services make up part of an entity’s information system, then they are considered part of the information and communication component of the entity’s ICFR. Thus, both management and the auditor must consider the activities of the service organization.

Management and the auditor should perform the following procedures with respect to the activities performed by the service organization: (1) obtain an understanding of the nature and significance of the services provided by the service organization and their effect on the user entity’s internal control relevant to the audit, sufficient to identify and assess the risks of material misstatement and (2) design and perform audit procedures responsive to those risks.

Evidence about the operating effectiveness of controls that are relevant to management’s assessment and the auditor’s opinion may be obtained by performing tests of the user orga- nization’s controls over the activities of the service organization, performing tests of con- trols at the service organization, or obtaining a service auditor’s report on the design and operating effectiveness of controls placed in operation at the service organization (referred to as a Service Organization Control 1 “Type 2” report discussed in Chapter 6). If a service auditor’s report on controls placed in operation and tests of operating effectiveness is avail- able, management and the auditor separately evaluate whether this report provides sufficient evidence to support the assessment and opinion. Important factors that management and the auditor should consider include the scope of the examination, the controls tested, the results of those tests of controls, and the service auditor’s opinion on the operating effectiveness of the controls. Management and the auditor should also make inquiries concerning the service auditor’s reputation, competence, and independence.

When a significant period of time has elapsed between the time period covered by the tests of controls in the service auditor’s report and the date of management’s assessment, additional procedures should be performed.

LO 7-16

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 247

mes32502_ch07_220-260.indd 247 09/30/15 02:50 PM

If the auditor concludes that additional evidence about the operating effectiveness of controls at the service organization is required, the auditor should perform additional proce- dures. For example, the auditor might investigate whether management has taken actions to monitor or evaluate the quality of the service provider and evaluate the results of such actions. The auditor might also contact the service organization to obtain specific information, or request that a service auditor be engaged to perform procedures that will supply the necessary information. Finally, the auditor might even visit the service organization and perform such procedures firsthand. Based on the evidence obtained, management and the auditor should determine whether they have obtained sufficient evidence to obtain the reasonable assurance necessary for their assessment and opinion, respectively.

Safeguarding of Assets Safeguarding of assets is defined in AS5 as policies and procedures that “provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or dispo- sition of the entity’s assets that could have a material effect on the financial statements.” This definition is consistent with the definition in the COSO Framework. For example, an entity could have safeguarding controls over inventory tags (preventive controls) and perform timely periodic physical inventory counts (detective control) for its quarterly and annual financial reporting dates. Given that the definitions of material weakness and significant deficiency relate to the likelihood of misstatement of the financial statements, the failure of the inven- tory tag control will not result in a significant deficiency or material weakness if the physical inventory count prevents a misstatement of the financial statements. Therefore, the COSO definition indicates that although losses might occur, controls over financial reporting are effective if they provide reasonable assurance that those losses are properly reflected in the financial statements.

Advanced Module 2: Computer-Assisted Audit Techniques

Major accounting firms have IT specialists who often use computer-assisted audit techniques (CAATs) to assist the auditor in testing application controls, transactions, and account bal- ances. Many of these controls are embedded into the entity’s computer programs and can thus be tested via CAATs. Additionally, the auditor may also gain great efficiencies by using CAATs to execute substantive procedures when the information is maintained in machine- readable form. The following types of CAATs are discussed:

∙ Generalized audit software. ∙ Custom audit software. ∙ Test data.

Other techniques are discussed in advanced IT auditing books.4

Generalized Audit Software Generalized audit software (GAS) includes programs that allow the auditor to perform tests on computer files and databases. IDEA is an example of a GAS program that is widely used in practice. GAS was developed so that auditors would be able to conduct similar CAATs in dif- ferent IT environments. For example, GAS permits an auditor to select and prepare accounts receivable confirmations from a variety of computer systems. This type of software provides a high-level computer language that allows the auditor to easily perform various functions on an entity’s computer files and databases. A sample of functions that can be performed by GAS is shown in Table 7–9.

LO 7-17

LO 7-18

4For example, see S. Senft, F. Gallegos, and A. Davis, Information and Control, 4th Edition (Boca Raton, FL: CRC Press, 2012).

Final PDF to printer

248 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 248 09/30/15 02:50 PM

GAS offers several advantages: (1) it is easy to use; (2) limited IT expertise or program- ming skills are required; (3) the time required to develop the application is usually short; and (4) an entire population can be examined, eliminating the need for sampling in some instances. Among the disadvantages of GAS are that (1) it involves auditing after the entity has processed the data rather than while the data are being processed, (2) it provides a limited ability to verify programming logic because its application is usually directed to testing entity files or databases, and (3) it is limited to audit procedures that can be conducted on data avail- able in electronic form. Your instructor may assign you to use IDEA to work some problems during your study of this text. Becoming familiar with IDEA is a great opportunity to get a head start on others entering the profession because it is a widely used and very useful tool.

Custom Audit Software Custom audit software is generally written by auditors for specific audit tasks. Such programs are necessary when the entity’s computer system is not compatible with the auditor’s GAS or when the auditor wants to conduct some testing that may not be possible with the GAS. It may also be more efficient to prepare custom programs if they will be used in future audits of the entity or if they may be used on similar engagements. The major disadvantages of custom soft- ware are that (1) it is expensive to develop, (2) it may require a long development time, and (3) it may require extensive modification if the entity changes its accounting application programs.

Practice I N S I G H T

When using IDEA or any other auditing tool, remember to examine the underlying source docu- ments. According to the PCAOB, one firm used a computer-assisted auditing procedure to identify potentially fraudulent journal entries, but the firm failed to examine the underlying documentation to determine whether any of the journal entries were in fact fraudulent (PCAOB Release 104-2005-120).

Functions Performed by Generalized Audit Software

Function Description

File or database access Reads and extracts data from an entity’s computer files or databases for further audit testing.

Selection operators Select from files or databases transactions that meet certain criteria. Arithmetic functions Perform a variety of arithmetic calculations (addition, subtraction, and so on) on

transactions, files, and databases. Statistical analyses Provide functions supporting various types of audit sampling. Report generation Prepares various types of documents and reports.

T A B L E 7 – 9

Inventory observation and testing provide a good example of where such a program might be useful. Suppose an entity maintains computerized perpetual inventory records that are updated by the sales and purchasing systems. Further assume that the entity conducts a physical inventory count once a year, at which time the perpetual records are corrected. At the time of the physical inventory count, the entity’s employees record the physical counts on special computer forms that are optically scanned to create a physical inventory file. The quantities on hand are priced using an approved price file. What results from this analysis is the inventory balance used for updating the perpetual records and the financial statements.

The auditors who observe the entity’s physical inventory count record the results on special computer forms that are optically scanned and used as input to the custom program. The cus- tom program performs the following audit procedures: (1) traces the test counts into the entity’s perpetual inventory file and prints out any exceptions; (2) performs a complete mathematical test, including extensions, footings, crossfootings, and use of approved prices; (3) summarizes the inventory by type; and (4) prints out items in excess of a predetermined amount for review.

Final PDF to printer

KEY TERMS

Computer-assisted audit techniques (CAATs). Computer programs that allow auditors to test computer files and databases. Control deficiency. A weakness in the design or operation of a control such that management or employees, in the normal course of performing their assigned functions, fail to prevent or detect misstatements on a timely basis. Entity-level controls. Controls that have a pervasive effect on the entity’s system of inter- nal control such as controls related to the control environment; controls over management override; the entity’s risk assessment process; centralized processing and controls, including shared service environments; controls to monitor results of operations; controls to monitor other controls, including activities of the internal audit function, the audit committee, and self-assessment programs; controls over the period-end financial reporting process; and poli- cies that address significant business control and risk management practices. Internal control over financial reporting. A process designed by, or under the supervision of, the entity’s principal executive and principal financial officers, or persons performing similar functions, and effected by the entity’s board of directors, management, and other per- sonnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. Material weakness. A deficiency, or a combination of deficiencies, in ICFR, such that there is a reasonable possibility that a material misstatement of the entity’s annual or interim finan- cial statements will not be prevented or detected on a timely basis. Relevant assertion. A financial statement assertion that has a reasonable possibility of con- taining a misstatement or misstatements that would cause the financial statements to be mate- rially misstated. Remediation. The process of correcting a material weakness as part of management’s assess- ment of the effectiveness of ICFR.

Chapter 7 Auditing Internal Control over Financial Reporting 249

mes32502_ch07_220-260.indd 249 09/30/15 02:50 PM

Test Data The auditor uses test data for testing the application controls in the entity’s computer pro- grams. In using this method, the auditor first creates a set of simulated data (that is, test data) for processing. The data should include both valid and invalid data. After calculating the expected results of processing the test data, the auditor uses the entity’s computer and appli- cation programs to process the data. The valid data should be properly processed, while the invalid data should be identified as errors. The results of this processing are compared to the auditor’s predetermined results. This technique can be used to check

∙ Data validation controls and error detection routines. ∙ Processing-logic controls. ∙ Arithmetic calculations. ∙ The inclusion of transactions in records, files, and reports.

The objective of using the test data method is to ensure the accuracy of the computer processing of transactions.

The main advantage of the test data method is that it provides direct evidence on the effectiveness of the controls included in the entity’s application programs. However, the test data method has a number of potential disadvantages. First, it can be very time-consuming to create the test data. Second, the auditor may not be certain that all relevant conditions or con- trols are tested. The use of special computer programs called test data generators may help alleviate these potential disadvantages. Third, the auditor must be certain that the test data are processed using the entity’s regular production programs. This concern can be alleviated if the entity’s general controls for program changes, access, and library functions are reliable. Last, the auditor must be sure to remove the valid test data from the entity’s files.

Final PDF to printer

250 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 250 09/30/15 02:50 PM

Safeguarding of assets. Those policies and procedures that provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the entity’s assets that could have a material effect on the financial statements. Significant account or disclosure. An account or disclosure is significant if there is a reason- able possibility that the account or disclosure could contain a misstatement that, individually or when aggregated with others, has a material effect on the financial statements, considering the risks of both overstatement and understatement. Significant deficiency. A deficiency, or a combination of deficiencies, in ICFR that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight of the entity’s financial reporting. Walkthrough. A transaction being traced by an auditor from origination through the entity’s information system until it is reflected in the entity’s financial reports. It encompasses the entire process of initiating, authorizing, recording, processing, and reporting individual trans- actions and controls for each of the significant processes identified.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 7-1, 7-2 7-1 Briefly summarize management’s and the auditor’s basic responsibilities under Section 404 of the Sarbanes-Oxley Act of 2002.

LO 7-4 7-2 Describe how the terms likelihood and magnitude play a role in evaluating the significance of a control deficiency.

LO 7-5 7-3 The first element in management’s process for assessing the effectiveness of internal control is determining which controls should be tested. Describe the process man- agement might use to identify the controls to test as part of their assessment of ICFR.

LO 7-5, 7-8 7-4 Describe how management and the auditor decide on which locations or business units to test.

LO 7-5 7-5 Management must document its assessment of internal control. What would such documentation include?

LO 7-6 7-6 List the steps in the auditor’s process for an audit of ICFR. LO 7-7 7-7 How does the auditor evaluate the objectivity and competence of others who per-

form work for management? LO 7-7, 7-8 7-8 Describe the steps in obtaining an understanding of ICFR using a top-down, risk-

based approach. LO 7-8 7-9 The period-end financial reporting process controls are always important. What are

those controls, why are they important, and what should the auditor’s evaluation of those controls include?

LO 7-8 7-10 A walkthrough involves tracing a transaction through the information system. What types of evidence can an auditor obtain by performing a walkthrough?

LO 7-10 7-11 AS5 indicates that certain circumstances are indicators of a material weakness. What are these circumstances, and why do you think the PCAOB assessed them as being of such importance?

LO 7-11 7-12 Describe what is meant when management remediates a material weakness. If a material weakness is remediated and sufficiently tested before the “as of” date, what can management assert about ICFR? Explain why.

LO 7-13 7-13 What are the auditor’s documentation requirements for an audit of ICFR? LO 7-14 7-14 What are the types of reports that an auditor can issue for an audit of ICFR? Briefly

identify the circumstances justifying each type of report. LO 7-14 7-15 Under what circumstances would an auditor give an adverse opinion on the effec-

tiveness of an entity’s ICFR?

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 251

mes32502_ch07_220-260.indd 251 09/30/15 02:50 PM

LO 7-14 7-16 Under what circumstances would an auditor disclaim an opinion on the effectiveness of an entity’s ICFR?

LO 7-16 7-17 What should the auditor do when a significant period of time has elapsed between the service organization auditor’s report and the date of management’s assessment?

LO 7-18 7-18 Distinguish between generalized and custom audit software. List the functions that can be performed by generalized audit software.

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 7-1, 7-2 7-19 The Sarbanes-Oxley Act of 2002 requires management to include a report on the effectiveness of ICFR in the entity’s annual report. It also requires auditors to report on the effectiveness of ICFR. Which of the following statements concerning these requirements is false?

a. The auditor should evaluate whether internal controls over financial reporting are designed and operating effectively.

b. Management’s report should state its responsibility for establishing and maintain- ing an adequate internal control system.

c. Management should identify material weaknesses in its report. d. The auditor should provide recommendations for improving internal control in

the audit report.

LO 7-4, 7-10 7-20 A control deviation caused by an employee performing a control procedure that he or she is not authorized to perform is always considered a

a. Deficiency in design. b. Deficiency in operation. c. Significant deficiency. d. Material weakness.

LO 7-4, 7-10 7-21 Which of the following is not a factor that might affect the likelihood that a control deficiency could result in a misstatement in an account balance?

a. The susceptibility of the related assets or liability to loss or fraud. b. The interaction or relationship of the control with other controls. c. The financial statement amounts exposed to the deficiency. d. The nature of the financial statement accounts, disclosures, and assertions involved.

LO 7-6, 7-8 7-22 Entity-level controls can have a pervasive effect on the entity’s ability to meet the control criteria. Which one of the following is not an entity-level control?

a. Controls to monitor results of operations. b. Management’s risk assessment process. c. Controls to monitor the inventory taking process. d. The period-end financial reporting process.

LO 7-8, 7-9 7-23 Which of the following controls would most likely be tested during an interim period?

a. Controls over nonroutine transactions. b. Controls over the period-end financial reporting process. c. Controls that operate on a continuous basis. d. Controls over transactions that involve a high degree of subjectivity.

LO 7-8, 7-9 7-24 If the financial reporting risks for a location are low and the entity has good entity- level controls, management may rely on which of the following for its assessment?

a. Documentation and test controls over specific risks. b. Self-assessment processes in conjunction with entity-level controls. c. Documentation and test entity-level controls over the entire entity. d. Selective control test at that location.

Final PDF to printer

252 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 252 09/30/15 02:50 PM

LO 7-8, 7-9 7-25 A walkthrough is one procedure used by an auditor as part of the internal control audit. A walkthrough requires an auditor to

a. Tour the organization’s facilities and locations before beginning any audit work. b. Trace a transaction from every class of transactions from origination through the

entity’s information system. c. Trace a transaction from each major class of transactions from origination through

the entity’s information system. d. Trace a transaction from each major class of transactions from origination through

the entity’s information system until it is reflected in the entity’s financial reports.

LO 7-9 7-26 When auditors report on the effectiveness of internal control “as of” a specific date and obtain evidence about the operating effectiveness of controls at an interim date, which of the following items would be the least helpful in evaluating the additional evidence to gather for the remaining period?

a. Any significant changes that occurred in internal control subsequent to the interim date.

b. The length of the remaining period. c. The specific controls tested prior to the “as of” date and the results of those tests. d. The walkthrough of the control system conducted at interim.

LO 7-14 7-27 AnnaLisa, an auditor for N. M. Neal & Associates, is prevented by the management of Lileah Company from auditing controls over inventory. Lileah is a public com- pany. Management explains that controls over inventory were recently implemented by a highly regarded public accounting firm that the entity hired as a consultant and insists that it is a waste of time for AnnaLisa to evaluate these controls. Inventory is a material account, but procedures performed as part of the financial statement audit indicate the account is fairly stated. AnnaLisa found no material weaknesses in any other area of the entity’s internal control relating to financial reporting. What kind of report should AnnaLisa issue on the effectiveness of Lileah’s internal control?

a. An unqualified report. b. An adverse report. c. A disclaimer of opinion. d. An exculpatory opinion.

LO 7-14 7-28 In auditing a public company, Natalie, an auditor for N. M. Neal & Associates, iden- tifies four deficiencies in ICFR. Three of the deficiencies are unlikely to result in financial misstatements that are material. One of the deficiencies is reasonably likely to result in misstatements that are not material but significant. What type of audit report should Natalie issue?

a. An unqualified report. b. An adverse report. c. A disclaimer of opinion. d. An exculpatory opinion.

LO 7-14 7-29 In auditing ICFR for a public company, Emily finds that the entity has a signifi- cant subsidiary located in a foreign country. Emily’s accounting firm has no offices in that country, and the entity has thus engaged another reputable firm to conduct the audit of internal control for that subsidiary. The other auditor’s report indicates that there are no material weaknesses in the foreign subsidiary’s ICFR. What should Emily do?

a. Disclaim an opinion because she cannot rely on the opinion of another auditor in dealing with a significant subsidiary.

b. Accept the other auditor’s opinion and express an unqualified opinion, making no reference to the other auditor’s report in her audit opinion.

c. Accept the other auditor’s opinion after evaluating the auditor’s work and make reference to the other auditor’s report in her audit opinion.

d. Qualify the opinion because she is unable to conduct the testing herself, and this constitutes a significant scope limitation.

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 253

mes32502_ch07_220-260.indd 253 09/30/15 02:50 PM

LO 7-15 7-30 Which of the following statements concerning control deficiencies is true? a. The auditor should communicate to management, in writing, all control deficien-

cies in internal control identified during the audit. b. All significant deficiencies are material weaknesses. c. All control deficiencies are significant deficiencies. d. An auditor must immediately report material weaknesses and significant defi-

ciencies discovered during an audit to the PCAOB.

LO 7-15 7-31 Significant deficiencies and material weaknesses must be communicated to an enti- ty’s audit committee because they represent

a. Material fraud or illegal acts perpetrated by high-level management. b. Disclosures of information that significantly contradict the auditor’s going con-

cern assumption. c. Significant deficiencies in the design or operation of internal control. d. Potential manipulation or falsification of accounting records.

LO 7-18 7-32 Which of the following most likely represents a weakness in internal control of an IT system?

a. The systems analyst reviews output and controls the distribution of output from the IT department.

b. The accounts payable clerk prepares data for computer processing and enters the data into the computer.

c. The systems programmer designs the operating and control functions of programs and participates in testing operating systems.

d. The control clerk establishes control over data received by the IT department and reconciles control totals after processing.

LO 7-18 7-33 A primary advantage of using generalized audit software packages to audit the finan- cial statements of an entity that uses an IT system is that the auditor may

a. Consider increasing the use of substantive tests of transactions in place of analyti- cal procedures.

b. Substantiate the accuracy of data through self-checking digits and hash totals. c. Reduce the level of required tests of controls to a relatively small amount. d. Access information stored on computer files while having a limited understanding

of the entity’s hardware and software features.

PROBLEMS All applicable problems are available with Connect.

LO 7-6, 7-7, 7-8 7-34 Following are three examples of controls for accounts that you have determined are significant for the audit of ICFR. For each control, determine the nature, timing, and extent of testing of the control's design and operating effectiveness. Refer to Exhibit 7–3 for an example of how to format your answer.

Control 1. Monthly Manual Reconciliation: Through discussions with entity personnel and review of entity documentation, you find that entity personnel rec- oncile the accounts receivable subsidiary ledger to the general ledger on a monthly basis. To determine whether misstatements in accounts receivable (existence, valu- ation, and completeness) would be detected on a timely basis, you decide to test the control provided by the monthly reconciliation process.

Control 2. Daily Manual Preventive Control: Through discussions with entity personnel, you learn that entity personnel make a cash disbursement only after they have matched the vendor invoice to the receiving report and purchase order. To deter- mine whether misstatements in cash (existence) and accounts payable (existence, valuation, and completeness) would be prevented on a timely basis, you decide to test the control over making a cash disbursement only after matching the invoice with the receiving report and purchase order.

Final PDF to printer

254 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 254 10/22/15 11:00 AM

Control 3. Programmed Preventive Control and Weekly Information Technology–Dependent Manual Detective Control: Through discussions with entity personnel, you learn that the entity’s computer system performs a three-way match of the receiving report, purchase order, and invoice. If there are any excep- tions, the system produces a list of unmatched items that employees review and fol- low up on weekly. The computer match is a programmed application control, and the review and follow-up of the unmatched items report is a manual detective control. To determine whether misstatements in cash (existence) and accounts payable–inven- tory (existence, valuation, and completeness) would be prevented or detected on a timely basis, you decide to test the programmed application control of matching the receiving report, purchase order, and invoice, as well as the review and follow-up control over unmatched items.

Note: In answering Problems 7-35 and 7-36, you may want to refer to Willis & Adams’

Policy Statement on Evaluating Control Deficiencies. A copy of the policy can be downloaded from the firm’s website in Connect.

LO 7-4, 7-6, 7-10 7-35 Following are examples of control deficiencies that may represent significant defi- ciencies or material weaknesses. For each control deficiency, indicate whether it is a significant deficiency or material weakness. Justify your decision.

a. The entity uses a standard sales contract for most transactions. Individual sales transactions are not material to the entity. Sales personnel are allowed to mod- ify sales contract terms. The entity’s accounting function reviews significant or unusual modifications to the sales contract terms but does not review changes in the standard shipping terms. The changes in the standard shipping terms could require a delay in the timing of revenue recognition. Management reviews gross margins on a monthly basis and investigates any significant or unusual relation- ships. In addition, management reviews the reasonableness of inventory levels at the end of each accounting period. The entity has experienced limited situations in which revenue has been inappropriately recorded in advance of shipment, but amounts have not been material.

b. The entity has a standard sales contract, but sales personnel frequently modify the terms of the contract. The nature of the modifications can affect the timing and amount of revenue recognized. Individual sales transactions are frequently mate- rial to the entity, and the gross margin can vary significantly for each transaction. The entity does not have procedures in place for the accounting function to regu- larly review modifications to sales contract terms. Although management reviews gross margins on a monthly basis, the significant differences in gross margins on individual transactions make it difficult for management to identify potential misstatements. Improper revenue recognition has occurred, and the amounts have been material.

c. The entity has a standard sales contract, but sales personnel frequently modify the terms of the contract. Sales personnel frequently grant unauthorized and unre- corded sales discounts to customers without the knowledge of the accounting department. These amounts are deducted by customers in paying their invoices and are recorded as outstanding balances on the accounts receivable–aging. Although these amounts are individually insignificant, when added up they are material and have occurred regularly over the past few years.

LO 7-4, 7-6, 7-10 7-36 Following are examples of control deficiencies that may represent significant deficiencies or material weaknesses. For each of the following scenarios, indicate whether the deficiency is a significant deficiency or material weakness. Justify your decision.

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 255

mes32502_ch07_220-260.indd 255 09/30/15 02:50 PM

a. During its assessment of ICFR, the management of Lorenz Corporation and its auditors identified the following control deficiencies that individually represent significant deficiencies:

∙ Inadequate segregation of duties over certain information system access controls. ∙ Several instances of transactions that were not properly recorded in subsidiary

ledgers. While the transactions that weren’t recorded properly were not mate- rial, the gross amount of the transactions of that type totaled up to an amount several times materiality.

∙ A lack of timely reconciliations of the account balances affected by the improp- erly recorded transactions.

b. During its assessment of ICFR, management of First Coast BankCorp and its auditors identified the following deficiencies that individually represent signifi- cant deficiencies: the design of controls over the estimation of credit losses (a critical accounting estimate); the operating effectiveness of controls for initiating, processing, and reviewing adjustments to the allowance for credit losses; and the operating effectiveness of controls designed to prevent and detect the improper recognition of interest income. In addition, during the past year, First Coast expe- rienced a significant level of growth in the loan balances that were subjected to the controls governing credit loss estimation and revenue recognition, and further growth is expected in the upcoming year.

LO 7-4, 7-5, 7-10 7-37 For each of the following cases, indicate why management and the auditors deter- mined that the control deficiency was a material weakness.

Case 1: In our assessment of the effectiveness of internal control over finan- cial reporting as of December 31, 2015, we identified a material weakness over the accounting for and disclosure of derivatives associated with warrant instruments pri- marily because we lacked technical expertise and adequate procedures to develop and document our common stock warrant analysis on the applicability of ASC 815 “Derivatives and Hedging—Contracts in Entity’s Own Equity” to our warrant instru- ments. Because of the lack of technical expertise and adequate procedures to develop and document our analysis of the applicability of ASC 815, which was characterized as a material weakness with regard to accounting for warrants, management has con- cluded that we did not maintain effective internal control over financial reporting as of December 31, 2015, based on the criteria in Internal Control—Integrated Framework.

Case 2: In the course of making our assessment of the effectiveness of internal control over financial reporting, we identified a material weakness in our internal control over financial reporting. The preparation and review process for the calcula- tion of the tax provision was inadequate, which led to errors in the computation of deferred tax assets and related income tax benefit.

Case 3: Management identified a material weakness in First Bank Company’s system of internal control over financial reporting with respect to ensuring the appropriate calculation of its allowance for loan losses. Specifically, during a pro- cess enhancement to the model that calculates the allowance for loan losses, the quarterly average loss rate was not annualized due to a computational error. Control procedures in place for reviewing the quantitative model for calculating the allow- ance for loan losses did not identify this error in a timely manner, and, as such, the Company did not have adequately designed procedures.

LO 7-4, 7-10, 7-14 7-38 For each of the following independent situations, indicate the type of report on ICFR you would issue. Justify your report choice.

a. Hansen, Inc., has restated previously issued financial statements to reflect the correction of a misstatement.

b. Shu & Han Engineering does not have effective oversight of the entity’s external financial reporting.

c. Kim Semiconductor has an ineffective audit committee.

Final PDF to printer

256 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 256 09/30/15 02:50 PM

d. The internal audit function at Smith Components, a very large manufacturing company, was ineffective. The entity’s auditor has determined that the internal audit function needed to be effective in order for the entity to have an effective monitoring component.

e. The auditors of Benron identified significant financial statement fraud by the entity’s chief financial officer.

f. Conroy Trucking Company has an ineffective control environment. g. Edwards & Eddins, CPAs, communicated significant deficiencies to Waste Dis-

posal’s management and the audit committee for the last two years. At the end of the current year, these significant deficiencies remain uncorrected.

LO 7-10, 7-14 7-39 For each of the following independent situations relating to the audit of ICFR, indi- cate the reason for and the type of audit report you would issue.

a. During the audit of Wood Pharmaceuticals, you are surprised to find several con- trol deficiencies in the entity’s internal control. You determine that there is a rea- sonable possibility that any one of them could result in a misstatement that is significant. Although the odds are extremely low that the deficiencies, singly or taken together, will result in a material misstatement of the entity’s financial state- ments, the large number of problems causes you concern. Management’s written assessment concludes that the entity’s ICFR was effective as of the report date.

b. You agreed to perform an audit for Rodriguez & Co., after the entity’s year-end. Due to time constraints, your audit firm could not complete a full audit of ICFR. However, the evidence you did collect suggests that the entity has exceptionally strong ICFR. You seriously doubt that a material weakness would have been found if time had permitted a more thorough audit. Management’s written assess- ment concludes that the entity’s ICFR was effective as of the report date.

c. George & Diana Company’s internal audit function identified a material weakness in the entity’s ICFR. The entity corrected this weakness about four months prior to the end of the annual reporting period. Management reassessed controls in the area and found them effective. After reevaluating and retesting the relevant con- trols, you believe the controls to have been effective for a sufficient period of time to provide adequate evidence that they were designed and operating effectively as of the end of the entity’s reporting period. Management’s written assessment concludes that the entity’s internal control was effective as of the report date.

d. Reynolds’ Distilleries identified what you agree is a material weakness and made an adverse assessment in its report on ICFR. The entity had not corrected the material weakness as of the end of the reporting period.

e. Cindy & David Company’s management identified a material weakness in the enti- ty’s ICFR during its assessment process. The entity corrected this weakness about a month prior to the end of the annual reporting period. Management reassessed controls in the area and believes they were effective as of the end of the reporting period. After reevaluating and retesting the relevant controls, you agree that the new controls are well designed, but since the controls over this particular area are applied only once at the end of each month (i.e., the controls have only operated two times since being corrected), you do not believe you have sufficient audit evi- dence to assess their operating effectiveness. Management’s written assessment concludes that the entity’s internal control was effective as of the report date.

f. During the audit of ICFR for Big Al & Larry Industries, you discover several con- trol deficiencies. You determine that there is more than a reasonable possibility that any one of them could result in a financial statement misstatement. Although you do not believe that any of the deficiencies taken individually will result in a material misstatement, you believe there is a moderately low likelihood that, taken together, the deficiencies could produce a material misstatement. Manage- ment’s written assessment concludes that the entity’s internal control was effec- tive as of the report date.

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 257

mes32502_ch07_220-260.indd 257 09/30/15 02:50 PM

LO 7-10, 7-14 7-40 For each of the following independent situations, indicate the type of report on ICFR you would issue. Justify your report choice.

a. The management’s report on ICFR issued by Graham Granary, Inc., includes dis- closures about corrective actions taken by the entity after the date of manage- ment’s assessment and the entity’s plans to implement new controls.

b. Meryll Company’s management identified a material weakness prior to the “as of” date and implemented controls to correct it. Management believes that the new controls have been operating for a sufficient period of time to determine that they are designed and operating effectively. However, Meryll’s auditor disagrees with the sufficiency of the time period for testing the operating effectiveness of the controls.

LO 7-10, 7-14 7-41 Assume that scenario (a) in Problem 7-36 is a material weakness. Prepare a draft of the auditor’s report for an audit of ICFR. Assume that Lorenz’s auditor is issuing a separate report on internal control.

LO 7-10, 7-14 7-42 Assume that scenario (b) in Problem 7-36 is a material weakness. Prepare a draft of the auditor’s report for an audit of ICFR. Assume that First Coast’s auditor is issuing a combined report for the financial statement audit and audit of internal control.

LO 7-10, 7-14 7-43 The following audit report was drafted by a junior staff accountant of Lipske & Griffin, CPAs, at the completion of the audit of Douglas Company’s ICFR. The report was submitted to the engagement partner, who reviewed matters thoroughly and properly concluded that there was a material weakness in the entity’s ICFR. Douglas’ management agreed and wrote an assessment indicating that the entity’s ICFR was not effective as of the end of the reporting period. Sufficient, compe- tent evidence was obtained during the financial statement audit to provide reason- able assurance that the overall financial statements present fairly in accordance with GAAP.

Required: Identify the errors and omissions contained in the auditor’s report as drafted by the

staff accountant. Group your listing of the errors and omissions by paragraph, where applicable. Do not redraft the report.

Report of Independent Registered Public Accounting Firm [Introductory paragraph] We have audited management’s assessment, included in the accompanying Management Report on the Financial Statements and Internal Control, that Douglas did not maintain effective internal control over financial reporting as of December 31, 2015, based on criteria estab- lished in Enterprise Risk Management—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Douglas’ management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on management’s assessment and an opinion on the effectiveness of the company’s internal control over financial reporting based on our audit.

[Scope paragraph]

We conducted our audit in accordance with generally accepted auditing standards (United States). Those standards require that we plan and perform the audit to obtain assurance about whether effective internal control was maintained. Our audit included obtaining an understanding of internal control over financial reporting, evaluating management’s assessment, testing and evaluating the operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

[Definition paragraph]

A company’s internal control over financial reporting is a process designed to provide assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted auditing principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide assurance

Final PDF to printer

258 Part 3 Understanding and Auditing Internal Control

mes32502_ch07_220-260.indd 258 09/30/15 02:50 PM

that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted auditing principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposi- tion of the company’s assets that could have an inconsequential effect on the financial statements.

[Inherent limitations paragraph]

Because of its inherent limitations, internal control over financial reporting will prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in condi- tions, or that the degree of compliance with the policies or procedures may deteriorate.

[Opinion paragraph]

In our opinion, management’s assessment that Douglas maintained ineffective internal control over financial reporting as of December 31, 2015, is fairly stated, in all material respects, based on criteria established in Enterprise Risk Management—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). We therefore express an adverse opinion on man- agement’s assessment. Also in our opinion, Douglas maintained, in all material respects, effective internal control over financial reporting as of December 31, 2015, based on criteria established in Enterprise Risk Management—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), except for one material weakness, which results in our issuing a quali- fied opinion on Douglas’ internal control over financial reporting.

[Explanatory paragraph]

We have also audited, in accordance with generally accepted accounting standards (United States), the consolidated financial statements of Douglas, and our report dated February 15, 2015, expressed a qualified opinion.

Lipske & Griffin, CPAs Mapleton, Arizona March 11, 2016

LO 7-18 7-44 Auditors use various audit techniques to gather evidence when an entity’s account- ing information is processed using IT. Select the audit procedure from the following list and enter it in the appropriate place on the grid.

Audit procedure: 1. Test data method. 2. Custom audit software. 3. Auditing around the computer. 4. Generalized audit software.

Description of Audit Technique Audit Technique

a. Program written by the auditor to perform a specific task for a particular entity

b. The auditor’s auditing of the inputs and outputs of the system without verification of the processing of the data

c. Processing fictitious and real data separately through the entity’s IT system

LO 7-18 7-45 Brown, CPA, is auditing the financial statements of Big Z Wholesaling, Inc., a con- tinuing audit client, for the year ended January 31, 2015. On January 5, 2015, Brown observed the tagging and counting of Big Z’s physical inventory and made appropri- ate test counts. These test counts have been recorded on a computer file. As in prior years, Big Z gave Brown two computer files. One file represents the perpetual inven- tory (first-in, first-out) records for the year ended January 31, 2015. The other file represents the January 5 physical inventory count.

Assume: 1. Brown issued an unqualified opinion on the prior year’s financial statements. 2. All inventory is purchased for resale and located in a single warehouse. 3. Brown has appropriate computerized audit software.

Final PDF to printer

Chapter 7 Auditing Internal Control over Financial Reporting 259

mes32502_ch07_220-260.indd 259 09/30/15 02:50 PM

4. The perpetual inventory file contains the following information in item number sequence:

a. Beginning balances at February 1, 2014: item number, item description, total quantity, and price.

b. For each item purchased during the year: date received, receiving report number, vendor item number, item description, quantity, and total dollar amount.

c. For each item sold during the year: date shipped, invoice number, item number, item description, quantity, and dollar amount.

d. For each item adjusted for physical inventory count differences: date, item num- ber, item description, quantity, and dollar amount.

5. The physical inventory file contains the following information in item number sequence: tag number, item number, item description, and count quantity.

Required: Describe the substantive auditing procedures Brown may consider performing with

computerized audit software using Big Z’s two computer files and Brown’s com- puter file of test counts. The substantive auditing procedures described may indicate the reports to be printed out for Brown’s follow-up by subsequent application of manual procedures. Do not describe subsequent manual auditing procedures.

Group the procedures by those using (a) the perpetual inventory file and (b) the physical inventory and test count files.

INTERNET ASSIGNMENTS

LO 7-4, 7-10, 7-14 7-46 Search the Internet (e.g., an entity’s website or sec.gov), and find an audit report for an entity’s audit of internal control over financial reporting. Determine whether the entity used the combined or separate format. Specify whether the report identifies any material weaknesses, and if so briefly describe the nature of the issue.

LO 7-4, 7-14 7-47 Search the Internet (e.g., an entity’s website or sec.gov), and find an audit report for an entity’s audit of internal control over financial reporting that expresses an adverse opinion with respect to the effectiveness of internal control.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using the IDEA software.

Final PDF to printer

mes32502_ch07_220-260.indd 260 09/30/15 02:50 PM

Final PDF to printer

mes32502_ch08_261-299.indd 261 09/30/15 03:25 PM

261

PART FOUR

Statistical and Nonstatistical Sampling Tools for Auditing

CHAPTER 8 Audit Sampling: An Overview and Application to Tests of Controls

CHAPTER 9 Audit Sampling: An Application to Substantive Tests of Account Balances

Final PDF to printer

mes32502_ch08_261-299.indd 262 09/30/15 03:25 PM

CHAPTER

8 8-1 Learn the definition of audit sampling and why auditors

use sampling to gather evidence. 8-2 Understand basic sampling terminology. 8-3 Learn the types of audit procedures that do and do not

involve sampling. 8-4 Learn the types of audit sampling.

8-5 Learn the sampling requirements in auditing standards. 8-6 Learn how to apply attribute sampling to tests of

controls. 8-7 Work through an example of attribute sampling. 8-8 Learn how to apply nonstatistical sampling to tests of

controls.

AICPA, Audit Sampling (Audit Guide) (New York: AICPA, 2012) AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 530, Audit Sampling PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements PCAOB Auditing Standard No. 8, Audit Risk (AU-C 200) PCAOB Auditing Standard No. 9, Audit Planning (AU-C 300)

PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit (AU-C 320) PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 14, Evaluating Audit Results (AU-C 450) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

263

mes32502_ch08_261-299.indd 263 09/30/15 03:25 PM

Audit Sampling: An Overview and Application to Tests of Controls

I n the next two chapters we examine how auditors use audit sampling to gather evidence to evaluate management’s assertions. Sampling and statis- tics in general are topics that make many people feel uncomfortable. Before

getting into technical audit sampling and statistical terms, we have found that it is useful for students to consider some of the basic concepts of sampling in a nontechnical context.

What If You Were an Apple Inspector? Please imagine that you have just taken a job as an apple inspector for Best Apples, Inc.—a large apple grower. You are replacing a previous inspector who was recently fired for lack of due care, and your new employer has made it clear that you must meet high performance standards. Best Apples owns and operates many apple orchards and sells its apples to major fruit processors (hereafter “buyers”) whose products include fresh apples, applesauce, and apple juice. Best Apples makes large shipments of apples to buyers on a daily basis during harvest season; each shipment contains approximately 1,500 bushels from various orchards. Each bushel contains 100 to 150 apples. The bushel indicates which orchard the apples come from. Your job is to manually inspect the quality of apples just prior to shipment. Obviously, there is neither the time nor the need to inspect every apple, so you will examine a sample of apples to draw conclusions about the quality of apples in the whole shipment.

Stop and Think: Imagine it is your first day on the job; consider for a moment what information about the apples your employer or the buyer you would like to know before you begin your inspections.

Before beginning inspections, it would be useful to know the answers to the following questions:

∙ For what purpose will the current shipment be used (e.g., fresh apples, sauce, or juice)?

∙ The definition of a defect—what constitutes a bad apple? ∙ Tolerable defect percentage—what percentage of defective apples will the

buyers accept in a shipment?

∙ What has Best Apples’ historical defect percentage been? ∙ Have growing conditions (e.g., weather, pests) been normal this year? ∙ What happens if we send a shipment that contains an unacceptably high

percentage of defects?

∙ Level of assurance or confidence—how confident do I need to be in my test- ing results?

∙ What quality controls and processes does Best Apples have in place? ∙ Are the defect percentages the same for all orchards?

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

264 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 264 10/22/15 10:53 AM

Suppose you receive satisfactory answers to these questions and you begin your test- ing. The primary purpose of sampling is to draw inferences about the whole population based on the results of testing only a subset of the population. You examine a sample of 20 apples and find 1 defective apple. Projecting your sample defect rate to the total popu- lation suggests a shipment defect rate of 5 percent (1/20).

Stop and Think: While 5 percent is your best estimate based on your sample results, will you be positive that you have determined the correct defect rate for the entire shipment?

While 5 percent is the projected defect rate, there is a chance the shipment defect rate could be higher or lower than your sample rate of 5 percent. The uncertainty associated with sampling is known as sampling risk. Whenever inspectors or auditors test less than the entire population, there is a risk that the sample results will not be similar to what the results would be if the inspector were to test the entire population. In other words, sam- pling risk is the risk that the results of a sample are not representative of the population.

Sampling theory allows us to measure the risk associated with sampling. For example, if we knew a buyer would accept up to 10 percent defective apples in a shipment, we can compute the risk that the actual shipment defect rate is higher than 10 percent (you will learn how to make such evaluations in this chapter). Inspectors and auditors can reduce sampling risk by taking larger samples. In the extreme, if you tested 100 percent of the apples in the shipment, then there would be no sampling risk because you would know with certainty the true shipment defect rate. While it would not be economical for you to inspect every apple, you could increase your sample size to reduce the risk that the ship- ment will contain an unacceptably high rate of defects. So an important concept in audit sampling is that by increasing sample size, you can reduce uncertainty and risk.

The converse of sampling risk is confidence level. In other words, while two samples of different sizes might yield a similar defect rate of 5 percent (1/20 and 5/100), the larger sample will produce more confidence that the shipment has an acceptably low defect rate (relative to the buyer’s acceptable rate of say 10 percent). We can also say that the larger sample is associated with less risk and that the shipment actually has an unacceptably high defect rate (i.e., less sampling risk). We will continue to refer to this apple inspector example as we introduce sampling terms and concepts in this chapter.

This chapter has two overall objectives: (1) to provide an introduction and overview of audit sampling and (2) to apply statistical attribute sampling and nonstatistical sampling techniques to tests of controls. The sampling techniques covered in this chapter are appli- cable for testing conducted for both an audit of internal controls over financial reporting and a financial statement audit. In Chapter 9 we cover statistical and nonstatistical sam- pling techniques for substantive tests of account balances.

Overview of Audit Sampling

The fundamental concepts of audit sampling apply to sampling applied to both tests of con- trols (Chapter 8) and tests of balances (Chapter 9). For a very small entity, it may be possible for the independent auditor to examine all of the records during the period. However, given the size and complexity of most entities needing a financial statement audit, it is not economi- cal to examine all the accounting records and supporting documents. Auditors therefore often find it necessary to draw conclusions about the fairness of financial statement assertions based on examinations of samples of the records and transactions.1 As a result, the auditor

LO 8-1

1See the introduction to the American Institute of Certified Public Accountants, Audit Sampling (AICPA Audit Guide) (New York: AICPA, 2012) for a discussion of the development of sampling in auditing.

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 265

mes32502_ch08_261-299.indd 265 09/30/15 03:25 PM

provides reasonable, not absolute, assurance that the financial statements are fairly presented. Accepting some uncertainty is the trade-off between the cost of examining all the data and the cost of making an incorrect decision based on a sample of the data.

Auditing standards recognize and permit both statistical and nonstatistical methods of audit sampling. With nonstatistical sampling the auditor does not strictly apply statistical tech- niques and has the ability to apply some judgment to evaluate the results.Research suggests that both methods are common in practice.2 Both nonstatistical and statistical methods are based on the same fundamental sampling theories. In fact, the steps and techniques used for these two sampling approaches are far more similar than they are different, and auditing standards indi- cate the sample sizes for the two approaches should be approximately the same. To properly apply a nonstatistical sampling approach, it is necessary to understand the underlying statistical principles; thus, we cover statistical sampling before we discuss nonstatistical sampling.

Occasionally, students will ask if recent advances in computer-assisted audit techniques and big data analysis have, or will have, eliminated the need for audit sampling. Two advances have reduced the number of times auditors need to apply sampling techniques to gather audit evi- dence. First, many companies have developed well-controlled, automated accounting systems that can process routine transactions with no or very few errors. Rather than rely on audit sam- pling to test routine transactions processed by these automated information systems, auditors test the processing software control configurations and general computer controls (e.g., restricted access, program change management) associated with the automated controls. Second, the advent of powerful audit software such as IDEA allows auditors, in some situations, to download and examine entire populations of data rather than rely on a sample from the population.

While technology has reduced the number of situations where audit sampling is neces- sary, technology will never totally eliminate the need for auditors to rely on sampling to some degree because (1) many control processes and data input procedures require human involve- ment (e.g., reconciliations, review, and resolution of a system’s generated exception reports); (2) many testing procedures require the auditor to physically inspect an asset (e.g., inventory) or inspect characteristics of a transaction or balance (e.g., terms in a contract); (3) in many cases auditors are required to obtain and evaluate evidence from third parties (e.g., letters confirming accounts receivable balances from the entity’s customers); and (4) data analysis is only as good as the quality of the underlying data and often the completeness, accuracy, and validity of the underlying data need to be tested and sampling can be an effective and efficient technique. These situations require the auditor’s “hands-on” attention. When the number of items or transactions in these populations is large, it is not economical for auditors to test 100 percent of the population; instead they use sampling to gather sufficient audit evidence.

Definitions and Key Concepts

Audit Sampling Audit sampling is defined as the selection and evaluation of less than 100 percent of the items in a population of audit relevance selected in such a way that the auditor expects the sample to be representative of the population and thus likely to provide a reasonable basis for conclu- sions about the population.

Sampling Risk When sampling is used by an auditor, an element of uncertainty enters into the auditor’s con- clusions. This element of uncertainty, referred to as sampling risk, was discussed briefly in the apple inspector example at the beginning of this chapter. Sampling risk refers to the possibility that the sample drawn is not representative of the population and that, as a result, the auditor

2See R. Elder, A. Akresh, S. Glover, J. Higgs, and J. Liljegren, “Audit Sampling Research: A Synthesis and Implica- tions for Future Research,” Auditing: A Journal of Practice and Theory (2013), and B. Christensen, R. Elder and S. Glover, “Behind the Numbers: Insights into Large Audit Firm Sampling Approaches,” Accounting Horizons (2015).

LO 8-1

LO 8-2

Final PDF to printer

266 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 266 09/30/15 03:25 PM

will reach an incorrect conclusion about the account balance or class of transactions based on the sample. Thus, a representative sample is one where the evaluation of the sample results leads to the same conclusions that would be drawn if the same audit procedures were applied to the entire population. When using audit sampling to obtain evidence, the auditor must always accept some sampling risk simply because he or she is not examining all items in a popula- tion. Sampling risk is one reason why auditors must accept some detection and audit risk, as discussed in Chapter 4.

Due to sampling risk, the auditor faces the chance that the evaluation of a sample may lead to one of two possible types of decision errors: (1) deciding that the population tested is not acceptable when in reality it is and (2) deciding that the population tested is accept- able when in reality it is not. In statistical terms, these errors are known as Type I and Type II errors, respectively. More formally, Type I and Type II errors are defined as follows:

∙ Risk of incorrect rejection (Type I). In testing an internal control, this is the risk that the sample supports a conclusion that the control is not operating effectively when, in truth, the control is operating effectively. When an auditor is evaluating the level of reliance that can be placed on a control in the context of a financial statement audit, this risk is also commonly referred to as the risk of underreliance or the risk of assessing control risk too high.

In substantive testing, this is the risk that the sample supports the conclusion that the recorded account balance is materially misstated when it is actually not materially misstated.

∙ Risk of incorrect acceptance (Type II). In testing a control, this is the risk that the sample supports a conclusion that the control is operating effectively when, in truth, it is not operating effectively. When an auditor is evaluating the level of reliance that can be placed on a control in the context of a financial statement audit, this risk is also commonly referred to as the risk of overreliance, or the risk of assessing control risk too low.

In substantive testing, this is the risk that the sample supports the conclusion that the recorded account balance is not materially misstated when it is actually materially misstated.

Stop and Think: Which of the above risks relates primarily to audit efficiency and which relates primarily to audit effectiveness?

The risk of incorrect rejection (a Type I decision error) relates to the efficiency of the audit. This type of decision error can result in the auditor conducting more audit work than necessary in order to reach the correct conclusion. The risk of incorrect acceptance (a Type II decision error) relates to the effectiveness of the audit. This type of decision error can result in the auditor failing to detect a material misstatement in the financial statements, which can lead to litigation against the auditor by parties that rely on the financial statements. Because of the potentially severe consequences of a Type II decision error, auditors design their sampling applications to keep this risk to an acceptably low level. Auditors typically focus only on Type II decision errors in determining their sample sizes, because Type I decision errors affect effi- ciency and not effectiveness. For these reasons, in this chapter we do not address the potential implications on sampling applications of Type I errors.

Audit procedures can also involve nonsampling risk. Nonsampling risk is the risk that the auditor reaches an erroneous conclusion for any reason that is not related to sampling risk; that auditors will make judgment errors caused by the use of inappropriate audit procedures or misinterpretation of audit evidence and failure to recognize a misstatement or deviation. When applying audit sampling to substantive tests of details, both sampling and nonsam- pling risk make up the auditor’s detection risk. While statistical sampling allows the auditor to quantify and control sampling risk, no sampling method allows the auditor to measure nonsampling risk. The uncertainty related to nonsampling risk can be controlled by adequate training, proper planning, and effective supervision.

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 267

mes32502_ch08_261-299.indd 267 09/30/15 03:25 PM

Three Important Factors In the preface to the chapter, we asked you to imagine that you were an apple inspector and we asked you to consider what information you would like to have before you began testing apples. While you would want answers to all the questions listed in the preface, you will find that three of the factors listed there are the most impor- tant inputs to determine sample sizes for all types of audit sampling. These three inputs are (1) desired level of assurance in the results of the sample (or confidence level), (2) acceptable defect rate (or tolerable error), and (3) historical defect rate (or expected error).

Confidence Level The first input, confidence level, is the complement of sampling risk. For example, as an apple inspector you have to accept some risk that the shipment defect percentage is higher than your sample defect percentage, and higher than the defect rate the buyer will tolerate. You would determine your acceptable level of sampling risk by considering the amount of reliance to be placed on your tests and the consequences of a decision error. The more the reliance placed on your inspection (versus other testing or quality control measures) and the more severe the consequences of an error, the less risk you will want to accept and the more confident you will want to be in your testing. For example, if the consequence of a failed shipment is that the apple buyer will stop doing business with your company, you will want to accept little risk and be highly confident in your sample results. Auditors, like inspectors, focus on both risk and confidence level. In statistical terminology, a confidence level represents the probability that a given interval includes the true, but unknown, measure of the characteristic of interest. For example, to place reliance on a control, an auditor may want to be 95 percent confident that the control operates effectively at least 97 percent of the time (or fails to operate no more than 3 percent of the time). Because risk is the complement of confidence level, auditors can set either confidence level or sampling risk. For example, the auditor may set sampling risk for a particular sampling application at 5 percent, which results in a confidence level of 95 percent. Confidence level and sampling risk are related to sample size: the larger the sam- ple, the higher the confidence level and the lower the sampling risk.

Tolerable and Expected Error Once the desired confidence level is established, the appropriate sample size is determined largely by how much tolerable error exceeds expected error. The smaller the difference between these two variables, the more precise the sampling results must be, and therefore the larger the sample size needed. For example, assume that during your interview for the apple inspector position you were told that the historical shipment defect rate has averaged 3 percent ±2 percent and the buyers typically can accept up to 10 percent defective apples. However, as you are planning your sample on the first day of work, you learn that poor weather this year has resulted in an expected defect rate of 7 percent ±3 percent. All else equal, the new infor- mation will require a larger sample size because now there is a smaller margin for error or smaller difference between tolerable and expected error. This is because there is less room to accommodate sampling risk in the interval between 7 and 10 percent than there is in the inter- val between 3 and 10 percent. Similarly, even assuming the historical rate stayed at 3 percent, if a customer reduced their acceptance defect level from 10 percent to 6 percent the margin for error would be smaller. It doesn’t matter which of the two factors, tolerable or expected error, causes a change in the difference between them to be smaller; the critical factor is how large the difference is between the defect rate (or misstatement) that is expected and the defect rate (or misstatement) that can be tolerated.

In typical statistical sampling terminology, the term precision relates to how close a sample estimate is to the population characteristic being estimated, given a specified sam- pling risk. Thus, precision at the planning stage of an audit sampling application is the difference between the expected and the tolerable deviation rate or misstatement. Audit- ing standards use the term allowance for sampling risk to reflect the concept of preci- sion in a sampling application. For example, if an auditor expected that a control would have a 2 percent deviation (failure) rate and he or she were willing to tolerate a deviation

Final PDF to printer

268 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 268 09/30/15 03:25 PM

rate of 5 percent, the allowance for sampling risk would be 3 percent. Remember that in order to use audit sampling to gather audit evidence, auditors must be able to “tolerate” some deviations (for controls testing) or misstatement (for substantive testing) to provide an allowance for sampling risk. The only way to completely remove this risk is to test all the items in a population.

Audit Evidence Choices That Do and Do Not Involve Sampling In assessing the risk of material misstatement, or in auditing an account balance or a class of transactions, the auditor seldom relies on a single test. Generally, the auditor applies a number of audit procedures in order to reach a conclusion. Some audit procedures involve sampling as defined by auditing standards, while others do not involve sampling. Table 8–1 indicates the types of evidence that are commonly gathered using audit sampling as well as types where sampling is generally not used.

We have already covered the types of evidence in earlier chapters, but here are some examples of typical sampling applications.

∙ Inspection of tangible assets. An auditor typically attends an entity’s year-end inventory count. Because the number of inventory items can be very large, the auditor may use audit sampling to select inventory items to physically inspect and count.

∙ Inspection of records or documents. A control may require that before a check is written to a vendor, the payables clerk must match an approved purchase order to an approved receiving report and vendor invoice and indicate an acceptable match by initialing a copy of the check stapled to the other three documents. For large companies, this sort of control would be performed many times a day. The auditors can gather evidence on the effectiveness of the control by testing a sample of the documentation packages.

∙ Reperformance. As discussed in Chapter 7, to comply with PCAOB standards, publicly traded entities must document and test controls over important assertions for significant accounts. In assessing the competence and objectivity of the entity’s work, the auditor may reperform a sample of the tests performed by the entity.

∙ Confirmation. A common technique to gather evidence that accounts receivable balances exist and are accurately recorded is to send letters to customers asking them to confirm their balance. Rather than send a letter to all customers, the auditor can select a sample of customers.

Testing All Items with a Particular Characteristic Table 8–1 indicates that sampling is commonly used to gather evidence of the first five types. It is also common for auditors to use other testing approaches instead of sampling or in combination with sampling to gather evidence. For example, when an account or class of transactions is made up of a few large items, the auditor can easily test all the items in the account or class of transactions. Because

LO 8-3

Relationship between Evidence Types and Audit Sampling

Type of Evidence Audit Sampling Commonly Used

Inspection of tangible assets Yes Inspection of records or documents Yes Reperformance Yes Recalculation Yes Confirmation Yes Analytical procedures No Scanning No Inquiry No Observation No

T A B L E 8 – 1

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 269

mes32502_ch08_261-299.indd 269 09/30/15 03:25 PM

the entire class or balance is subjected to a 100 percent examination, such an audit procedure does not involve sampling. More common than testing 100 percent of the items in an account balance or class of transactions is a technique in which the auditor tests all items with a par- ticular characteristic of interest based on risk or monetary value. For example, if the auditor is aware of certain transactions that look unusual or present greater risk, the auditor should test all these items rather than applying audit sampling.

Similarly, if a relatively small number of large transactions make up a relatively large per- centage of an account or class of transactions, auditors will typically test all the transactions greater than a particular dollar amount. As an illustration, an auditor may decide to audit all 15 individual accounts receivable balances greater than $100,000, because these large custom- ers make up 70 percent of the total account balance. For the remaining 30 percent of the total account balance consisting of individual customer account balances less than $100,000, the auditor could apply audit sampling. Alternatively, the auditor could decide to apply substan- tive analytical procedures to the part of the total receivables balance consisting of individual customer accounts under $100,000, or may even decide to apply no audit procedures to this part of the total account because he or she deems that an acceptably low risk of material mis- statement exists in this group. In these last two instances, the auditor is not using sampling.

Testing Only One or a Few Items Automated information systems process transactions consistently unless the system or programs are changed. When testing automated IT controls, the auditor may decide to test one or a few of each type of transactions at a point in time. In conjunction with that test of the automated controls, the auditor may test general controls over changes to the system and program in order to provide evidence that the automated controls have been operating over the audit period. This type of test of automated IT control does not involve audit sampling.

Types of Audit Sampling

Nonstatistical versus Statistical Sampling There are two general approaches to audit sampling: nonstatistical and statistical. In nonstatis- tical sampling, the auditor does not strictly follow statistical techniques to determine the sample size, select the sample, and/or measure sampling risk when evaluating results. Statistical sam- pling, on the other hand, uses the laws of probability to compute sample size and evaluate the sample results. Statistical sampling permits the auditor to use the most efficient sample size and to quantify the sampling risk for the purpose of reaching a statistical conclusion about the population. As noted earlier in the chapter, auditing standards require that both methods lead to comparable sample sizes and evaluations. Both approaches require the use of the auditor’s pro- fessional judgment to plan, perform, and evaluate the sample evidence. The major advantages of statistical sampling are that it helps the auditor (1) design an efficient sample, (2) measure the sufficiency of evidence obtained, and (3) quantify sampling risk. The disadvantages of sta- tistical sampling include additional costs of (1) training auditors in the proper use of sampling techniques, (2) designing and conducting the sampling application, and (3) lacking consistent application across audit teams due to the complexity of the underlying concepts.

With a nonstatistical sampling application, the auditor must rely on his or her profes- sional judgment, in combination with audit firm guidance and knowledge of the underlying statistical sampling theories, to reach a conclusion about the audit test. Therefore, to prop- erly apply nonstatistical sampling, auditors’ judgment and their firm’s sampling guidance must be grounded in statistical sampling theory. Thus, a disadvantage of nonstatistical sam- pling is that auditor judgment may diverge significantly from sampling theory, resulting in testing that is not as effective as statistical sampling. Audit firms that use nonstatistical sampling address this concern by providing their auditors with nonstatistical sampling guid- ance and procedures that are easy to use, encourage consistency in sampling applications across engagement teams, and are grounded in sampling theory. Firms that use

LO 8-4

Final PDF to printer

270 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 270 09/30/15 03:25 PM

nonstatistical audit sampling approaches build in their sampling experts’ decisions into sampling tools and templates, which can simplify the application of audit sampling, reduce mistakes than can occur in applying statistical sampling, and foster consistency in applica- tion across audit teams. Recent research finds that the use of templates can increase the proper application of audit sampling in practice.3

This chapter and Chapter 9 provide detailed coverage of both statistical and nonstatis- tical sampling. Even though nonstatistical sampling is very common in practice, we cover statistical sampling first because statistical theory provides the foundation for both sampling approaches.

3See M. Durney, R. Elder, and S. Glover, “Field Data on Accounting Error Rates and Audit Sampling,” Auditing: A Journal of Practice and Theory (2014). 4Variations of monetary-unit sampling are known as probability-proportional-to-size sampling and cumulative monetary amount sampling.

Practice I N S I G H T

Whether nonstatistical or statistical sampling is used, the sample size must be sufficient to support reliance on the type of controls and assertions being tested. PCAOB inspection teams have found instances of auditors using sample sizes that were smaller than required to support their conclusions regarding the effectiveness of controls tested (e.g., PCAOB Release No. 104-2012-271).

Types of Statistical Sampling Techniques Auditors use three major types of statistical sampling techniques: attribute sampling, monetary-unit sampling, and classical variables sampling.

Attribute Sampling Attribute sampling is used to estimate the proportion of a population that possesses a specified characteristic. The most common use of attribute sampling is for tests of controls. In the case of controls testing, the auditor wants to determine the deviation rate for a control implemented within the entity’s accounting system. For example, the auditor may want to gather evidence that a credit check is performed on customer orders before ship- ment. Measurement of the deviation rate provides evidence about whether the control is oper- ating effectively to process accounting transactions properly and therefore provides support for the auditor’s set level of control risk. Attribute sampling may also be used with a substantive test of transactions when such a test is conducted with a test of controls as a dual-purpose test.

Monetary-Unit Sampling Monetary-unit sampling uses attribute-sampling theory and techniques to estimate the monetary amount of misstatement for a class of transactions or an account balance.4 Auditors use this sampling technique because it has a number of advantages over classical variables sampling. Monetary-unit sampling builds upon attribute-sampling theory to express a conclusion regarding the monetary amount of estimated misstatement in an account. You will learn about monetary-unit sampling in Chapter 9.

Classical Variables Sampling Classical variables sampling in auditing utilizes the tech- niques typically taught in an undergraduate statistics class. While auditors sometimes use variables sampling to estimate the dollar value of a class of transactions or account balance, it is more frequently used to determine whether an account is materially misstated. Classical variables sampling is covered in Advanced Module 1 in Chapter 9.

Regardless of the approach or type of sampling, auditing standards contain requirements that auditors must follow when planning, selecting a sample for, and performing and evalu- ating the audit sampling applications. We will refer to these requirements as we discuss the different approaches and types of audit sampling.

The remainder of this chapter presents an application of statistical attribute sampling to tests of controls, followed by a discussion of nonstatistical sampling applied to tests of controls.

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 271

mes32502_ch08_261-299.indd 271 09/30/15 03:25 PM

Attribute Sampling Applied to Tests of Controls

Attribute sampling is a statistical sampling method used to estimate the proportion of a char- acteristic in a population. In applying this technique to tests of controls, the auditor normally attempts to determine the operating effectiveness of a control in terms of deviations from a prescribed internal control.

In conducting a statistical sample for a test of controls, auditing standards require the auditor to properly plan, perform, and evaluate the sampling application and adequately doc- ument each phase of the sampling application in the working papers. The following sections discuss the steps that are included in the three phases of an attribute-sampling application. Table 8–2 lists the steps involved in the three phases of an attribute-sampling application.

Calabro Wireless, Inc., Illustration Audit tests for the audit of Calabro Wireless Ser- vices, Inc., will be used to demonstrate an attribute-sampling application. Calabro is a busi- ness services company that uses wireless communications technology to develop solutions for businesses. The company emphasizes its systems, reliability, solution-oriented marketing, and high level of customer service. The company provides high-quality, low-cost service to the marketplace. In recent years, the company has experienced annual growth of about 20 percent per year. Andrew Judd is the audit senior on the Calabro audit and his firm has audited Cal- abro for 10 years. The auditors have developed an understanding of Calabro’s revenue process and have decided to rely on selected controls to reduce control risk below the maximum for the current year financial statement audit.

LO 8-5, 8-6, 8-7

Steps in Attribute Sampling

Planning 1. Determine the test objectives. 2. Define the population characteristics: • Define the sampling population. • Define the sampling unit. • Define the control deviation conditions. 3. Determine the sample size, using the following inputs: • The desired confidence level or risk of incorrect acceptance. • The tolerable deviation rate. • The expected population deviation rate.

Performance 4. Select sample items. 5. Perform the auditing procedures: • Understand and analyze any deviations observed.

Evaluation 6. Calculate the sample deviation rate and the computed upper deviation rate. 7. Draw final conclusions.

T A B L E 8 – 2

Practice I N S I G H T

Given the integrated audit of internal control and the financial statements for public companies, the auditor often performs tests of controls that simultaneously satisfy the objectives of both audits (AS5).

Planning Proper planning of attribute sampling involves completing a number of important steps. Each of these steps, in turn, requires the use of professional judgment on the part of the auditor. The following subsections document Judd’s sampling plan on the Calabro Wireless Services audit. Typically, a public accounting firm uses a formal working paper or template to document the steps in the sampling plan.

Final PDF to printer

272 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 272 09/30/15 03:25 PM

Step 1: Determine the Test Objectives Auditing standards require that sampling appli- cations be well planned and take into consideration the relationship of the sample to the objective(s) of the test. The objective of attribute sampling when used for tests of controls is to evaluate the operating effectiveness of the internal control for purposes of the internal con- trol audit for public companies (see Chapter 7) or to determine the degree of reliance that can be placed on controls for a financial statement audit. Thus, the auditor assesses the deviation or error rate that exists for each control selected for testing. Audit sampling for tests of con- trols is generally appropriate when the completion of a control procedure leaves documentary evidence (e.g., initials or electronic signature of approval).

In the Calabro audit, the objective of the test is to determine if Calabro’s revenue pro- cess is functioning as documented. Judd, the audit senior, wants to determine if the controls identified concerning credit authorization, contract approval, and proper pricing are operating effectively and thus allow control risk to be set below the maximum.

Calabro’s revenue transactions arise in the following manner:

Customers may lease a wireless device from the company or purchase a wireless device and pay only a monthly fee for the use of the company’s software and system. Each customer enters into a service contract with the company, which provides for the payment of the access fee and the purchase or lease of one or more wireless devices. Contracts with customers with large numbers of devices are typically for three- to five-year terms, while contracts for smaller quantities are typi- cally for one-year terms with renewal options at the end of the terms.

For this sampling application, Judd has decided to rely on three controls in Calabro’s revenue process. The three control procedures and their definitions are as follows:

1. Sales and service contracts are properly authorized for credit approval. Calabro’s credit department personnel check the creditworthiness of new customers and establish a credit limit based on that evaluation. For existing customers, the amount of the new sale or lease is added to the existing accounts receivable balance, and the total is compared to the customer’s credit limit. If the amount is less than the credit limit, the transaction is processed. If the total is more than the credit limit, the transaction is subjected to review by the credit manager before the sale is approved.

2. Sales are not recorded without an approved sales and lease contract. Calabro’s revenue process contains a control that no revenue transactions are to be recorded unless an approved sales or lease contract is sent to the billing department.

3. Sales and lease contracts are properly priced. Calabro’s revenue process also includes a control that requires billing department personnel to use an authorized price list for the sale of wireless devices. Access and lease fees are determined based on a fee structure that includes volume discounts for large-unit customers.

Step 2: Define the Population Characteristics To achieve the test objectives, the audi- tor must carefully consider the characteristics of the sampling population.

Define the Sampling Population. All or a subset of the items that constitute the class of transactions (or account balance when not testing controls) make up the sampling popula- tion. The auditor must determine that the population from which the sample is selected is appropriate for the specific assertion, because sample results can be projected only to the population from which the sample was selected. For example, suppose the auditor is inter- ested in examining the effectiveness of a control designed to ensure that all shipments to customers are billed by testing whether all shipments were, in fact, billed. If the auditor uses the population of sales invoices as the sampling population, he or she is not likely to detect goods shipped but not billed, because the population of sales invoices includes only sales that were billed. In this example, the correct sampling population for testing the complete- ness assertion would be the population of all shipped goods as documented by shipping records such as bills of lading.

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 273

mes32502_ch08_261-299.indd 273 09/30/15 03:25 PM

There is a natural tendency to designate an entire class of transactions (or all the items in an account balance) as the population. However, the sample population should be restricted to the transactions and time period under the same system of controls that are relevant to the assertions being tested. For example, if interim testing will be conducted in October for a calendar year-end entity, the sampling population can be defined as all transactions in the first nine months of the year. The results of the sampling application in this case would apply only to the nine-month period tested. However, the auditor must also consider whether to conduct additional tests in the remaining period under audit through year-end (see Chapters 6 and 7 for discussions of what auditors do to “roll forward” testing between an interim date and year-end).

Once the population has been defined, the auditor must determine that the physical rep- resentation (referred to as the frame) of the population is complete. This determination is typically made by comparing the frame—for example, an accounts receivable listing—to the general ledger or by examining and accounting for the numerical sequence of prenumbered sales invoice documents. Because the auditor selects the sample from the frame, any conclu- sions relate only to that physical representation of the population. If the frame and the popula- tion differ, the auditor might draw the wrong conclusion about the population. In the example above, if the frame and the population differ, the sales journal (the frame) would not include all sales transactions during the period of interest (the population).

For the audit of Calabro’s revenue process, Judd has decided the population will include all sales and leases recorded in the entire year. The physical representation of the population is the file of sales and lease contracts maintained in the sales department. Based on a review of the entity’s procedures for completeness, which includes accounting for prenumbered docu- ments, Judd has determined that the frame is complete. The population of sales and lease transactions for the year contains 125,000 items that are numbered from 1 to 125,000.

Define the Sampling Unit. The individual members of the sampling population are called the sampling units. In the apple inspector example, the sampling unit is an individual apple. In auditing, a sampling unit may be a document, an entry, or a line item. Each sampling unit makes up one item in the population. The sampling unit should be defined in relation to the control being tested.

The sampling unit for the test of controls in the Calabro audit is defined as the sales or lease contract. Judd can perform all tests for the controls selected by examining this set of documents.

Define Control Deviation Conditions. For tests of controls, a deviation is a departure from adequate performance of the internal control. It is important for the auditor to define carefully what is considered a deviation. Thinking back to the apple inspector example, before you begin your inspection, you need to know what constitutes a “bad” apple–does it take a minor blemish or significant damage to conclude that an apple is defective?

Judd has defined control deviations for each of the internal controls being assessed as follows:

1. Sales and service contracts are properly authorized for credit approval. A deviation in this test is defined as the failure of Calabro’s credit department personnel to follow proper credit approval procedures for new and existing customers.

2. Sales are not recorded without an approved sales and lease contract. For this control, a deviation is defined as the absence of an approved sales or lease contract.

3. Sales and lease contracts are properly priced. A deviation in this case is the use of an unauthorized price for a wireless device or an incorrect access or lease fee.

Step 3: Determine the Sample Size Considerable judgment is required in determining the appropriate values for the inputs that are used to compute sample size.5 The three key

5For input parameters commonly used in practice, see M. Durney, R. Elder, and S. Glover, “Field Data on Accounting Error Rates and Audit Sampling,” Auditing: A Journal of Practice and Theory (2014).

Final PDF to printer

274 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 274 09/30/15 03:25 PM

inputs to determining the sample are the same as those discussed earlier: the desired confi- dence level, tolerable deviation rate, and expected population deviation rate. Auditing stan- dards require that auditors give adequate consideration to the appropriate value of these inputs. Because of the difficulty of making these input judgments, determining the sample size is typically the most difficult step of an audit sampling application.

Desired Confidence Level. As discussed earlier in the chapter, the complement of the confi- dence level is the risk that the sample results will support a conclusion that the control is func- tioning effectively when in truth it is not (i.e., the risk of incorrect acceptance). In a financial statement audit, this can result in assessing control risk too low. This risk influences the effec- tiveness of the audit. If the auditor sets control risk too low and overrelies on the controls, the level of substantive procedures may be too low to detect material misstatements that may be present in the financial statement account. This is because when control risk inappropriately decreases, the auditor increases the acceptable level of detection risk associated with sub- stantive testing to compensate (see discussion of the audit risk model in Chapter 4). Thus, if control risk is mistakenly set at a low level, detection risk will be set too high. This increases the risk that the auditor will fail to detect a material misstatement if one exists in the account.

In setting the desired confidence level and acceptable level of risk, the auditor considers the significance of the account, the importance of the assertion on which the control provides assurance, as well as the difficulty or complexity in applying the control. The more significant the account and the more complex, the higher the “what could go wrong” risk and the higher the desired confidence. The other important factor in determining the desired confidence level is the degree of reliance to be placed on the control. Generally, when the auditor has decided to rely on controls, the confidence level is set at 90 or 95 percent, meaning that the auditor is willing to accept a 10 or 5 percent risk of accepting the control as effective when in fact it is not. However, the auditor must remember that there is a direct relationship between the confi- dence level and sample size: the more confident the auditor would like to be (and the less risk he or she is willing to accept), the larger the sample size must be, all else equal. For example, in the illustration below the effect on the sample size is substantial (a 21 percent increase) when the desired confidence level increases from 90 to 95 percent.

Desired Confidence Level Sample Size6

90% 77

95% 93

6The sample sizes assume a tolerable deviation rate of 5 percent, an expected population deviation rate of 1 percent, and a large population.

Thus, the auditor must balance effectiveness concerns with efficiency concerns when set- ting the desired confidence level and acceptable risk of incorrect acceptance.

Tolerable Deviation Rate. The tolerable deviation rate is the maximum deviation rate from a prescribed control that the auditor is willing to accept and still consider the control effective (i.e., the control procedure would be relied on).

Stop and Think: Why would an auditor “tolerate” any deviations in a control and still consider it effective?

There are two reasons auditors will tolerate deviations and still consider a control to be effective. The first reason is technical and relates to sampling risk. Remember that for an audi- tor (or an apple inspector) to use sampling to gather evidence there must be some margin for error, because there is a risk that the sample deviation rate differs from the population deviation

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 275

mes32502_ch08_261-299.indd 275 09/30/15 03:25 PM

rate. Even if there are no deviations in a sample, there must still be an allowance (or upper con- fidence limit) for sampling risk. Just as in the apple inspector example, the only way to know with certainty what the shipment defect rate actually is would be to inspect all the apples.

The second reason auditors are willing to tolerate some control deviations relates to the purpose and application of controls. To be effective, most controls do not need to operate 100 percent of the time so long as the times the control fails to operate are not predictable and the person(s) performing the control investigate(s) processing exceptions observed during the proper application of the control. By way of analogy, suppose you have battery-operated smoke detectors in your apartment or house and one of the alarms starts to signal a low bat- tery. The fact that a day or two passes between the removal of the old battery and installation of a new one doesn’t render the system of controls ineffective for the entire period you have lived in the apartment or house. The risk of being harmed in a fire is pretty remote, even if there were no smoke detectors at all. Also, if one detector isn’t working, you have other smoke detectors that will sound if smoke appears. Obviously, if all the smoke detectors are disabled for long periods of time, the system of fire detection is not effective and the risk of injury due to fire increases. Similarly, when a control fails to operate, it usually does not result in a mon- etary misstatement to the financial statements, because most transactions are properly input and processed (i.e., actual inherent risk is less than 100 percent) and there are other compen- sating controls or processes that might detect a misstatement should one occur. Furthermore, if the operator of the control investigates processing exceptions that are discovered, he or she can research the cause and potential implications of the exception(s) and take corrective actions if necessary.

To be effective, a control does need to operate effectively for a reasonably high percent- age of the time. Table 8–3 provides some examples of the relationship between the assessed importance of a control and the tolerable deviation rate.

A low tolerable deviation rate (such as 3 to 5 percent) is used when the auditor plans to test the effectiveness of a highly important control. A higher tolerable deviation rate (6 to 10 percent) is used when the auditor plans to test the effectiveness of a moderately important control.

The sample size is inversely related to the tolerable deviation rate. The lower the tolerable deviation rate, the larger the sample size. Recall that in testing controls, the key determinant of sample size is the amount by which tolerable deviation rate exceeds the expected deviation rate. For example, assuming a desired confidence level of 95 percent, an expected population deviation rate of 0 percent, and a large population, the effect of tolerable deviation rate on sample size is

Tolerable Deviation Rate Sample Size

3% 99

6% 49

10% 29

Examples of Tolerable Deviation Rates for Assessed Importance of a Control

Assessed Importance of a Control Tolerable Deviation Rate

Highly important 3–5% Moderately important 6–10%

T A B L E 8 – 3

Expected Population Deviation Rate. The expected population deviation rate is the rate the auditor expects to exist in the population. Some level of deviation may be expected because the controls that auditors typically use sampling to test will be dependent on some human involvement (e.g., matching documents, credit approval, following up on system-generated exception reports), and humans are not perfect. The auditor can develop this expectation

Final PDF to printer

276 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 276 09/30/15 03:25 PM

based on prior years’ results or on a pilot sample. If the auditor believes that the expected population deviation rate exceeds the tolerable deviation rate, the statistical testing should not be performed, because in such a situation no amount of sampling can reduce the population deviation rate below the tolerable rate. Instead, the auditor should perform additional substan- tive procedures rather than relying on the control.

The sample size has a direct relationship to the expected population deviation rate; the larger the expected population deviation rate, the larger the sample size, all else equal. For example, assuming a desired confidence level of 95 percent, a tolerable deviation rate of 5 percent, and a large population, the effect of the expected population deviation rate on sample size is

Expected Population Deviation Rate Sample Size

0% 59

1% 93

2% 181

The dramatic effect of expected population deviation rate on sample size highlights the importance of a good estimate of the expected deviation rate.

Stop and Think: It is perplexing to some that an estimate of the expected population deviation rate is required as an input to determine sample size—after all, isn’t the pur- pose of testing a sample to estimate the deviation rate in the population?

The reason an estimate of expected deviation rate is necessary relates back to the notion of precision, or by how much the tolerable deviation rate exceeds the estimated deviation rate, as discussed earlier in the chapter. Recall the apple inspector illustration where the buyer’s tolerable defect rate was 10 percent and poor weather increased the expected defect rate from a historical rate of 3 percent ±2 percent to 7 percent ±3 percent. All else equal, the increase in expected defect rate will require a larger sample size, because there is now less room for sam- pling risk to be accommodated, and thus the sampling conclusion needs to be more precise. Just as the historical defect rate is an important input for apple inspection, a good estimate of the expected population deviation rate is very important for attribute sampling because the statistical sample size will be just large enough such that if the auditor observes the deviation rate she or he expects or lower, the sampling application will support a conclusion that the control is operating effectively. Similarly, if the auditor observes a higher deviation rate than the expected rate used in the sample size calculation, this usually means the sample results are unacceptable. As such, it is wise to be somewhat conservative when estimating the expected population deviation rate so that the sample size will be adequate even if the population devia- tion rate is slightly larger than the auditor initially thought it would be.

Table 8–4 shows Judd’s decision for each of the parameters required to determine sample size. Judd decides to set the desired confidence level at 95 percent (i.e., the risk of incorrect acceptance is 5 percent), the tolerable deviation rate at 6 percent, and the expected population deviation rate at 1 percent for control 1. In other words Judd is willing to conclude that the controls are effective if he can be at least 95 percent confident that control 1 does not have a deviation rate greater than 6 percent. For control 1, Judd has planned a high confidence level (see Table 8–3). A similar strategy is followed for control 3. For control 2, Judd has planned a moderate confidence level because he plans to place less reliance on the control. In this sampling plan, the effect of the population size can be ignored because the population is very large. The effect of population size on attribute sampling is discussed below.

Tables 8-5 and 8-6 are used to determine the sample size for each of the controls. For control 1, Judd uses Table 8–5 to determine the sample size because the desired confidence level is 95 percent. Judd identifies the column for a 6 percent tolerable deviation rate and

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 277

mes32502_ch08_261-299.indd 277 09/30/15 03:25 PM

reads down that column until the row for a 1 percent expected population deviation rate is found. The sample size for control 1 is 78 items. For control 2, Judd uses Table 8–6 because the desired confidence level is 90 percent. Reading down the 8 percent tolerable deviation rate column until the 2 percent expected population deviation rate is found, Judd determines that the sample size is 48. Finally, the sample size for control 3 is 93. This is found by using Table 8–5 and reading down the 5 percent tolerable deviation rate column until the 1 percent expected deviation rate row is reached.

Significant areas of Tables 8-5 and 8-6 are covered by asterisks. Another way to explain the cause of the asterisks is insufficient precision. Recall that to apply sampling there must be sufficient margin for error. When tolerable and estimated deviation rates are too close together, sample sizes will become too large to be practical or are simply not computable because there is insufficient allowance for sampling risk. Furthermore, in some instances where an asterisk appears in the tables, the expected population deviation rate is greater than

The Auditor’s Decisions for Sample Size in Calabro Wireless Example

Control*

Parameters 1 2 3

Desired confidence level 95% 90% 95% Tolerable deviation rate 6% 8% 5% Expected population deviation rate 1% 2% 1% Sample size from table 78 48 93

T A B L E 8 – 4

*Control 1: Sales or lease contracts are properly authorized for credit approval. Control 2: Sales are not recorded without an approved sales and lease contract. Control 3: Sales and lease contracts are properly priced.

Statistical Sample Sizes for Attribute Sampling—95 Percent Desired Confidence Level (i.e., 5 Percent Risk of Incorrect Acceptance)

Expected Population Deviation Rate

Tolerable Deviation Rate*

2% 3% 4% 5% 6% 7% 8% 9% 10% 15%

0.00% 149(0) 99(0) 74(0) 59(0) 49(0) 42(0) 36(0) 32(0) 29(0) 19(0) .25 236(1) 157(1) 117(1) 93(1) 78(1) 66(1) 58(1) 51(1) 46(1) 30(1) .50 * 157(1) 117(1) 93(1) 78(1) 66(1) 58(1) 51(1) 46(1) 30(1) .75 * 208(2) 117(1) 93(1) 78(1) 66(1) 58(1) 51(1) 46(1) 30(1)

1.00 * * 156(2) 93(1) 78(1) 66(1) 58(1) 51(1) 46(1) 30(1) 1.25 * * 156(2) 124(2) 78(1) 66(1) 58(1) 51(1) 46(1) 30(1) 1.50 * * 192(3) 124(2) 103(2) 66(1) 58(1) 51(1) 46(1) 30(1) 1.75 * * 227(4) 153(3) 103(2) 88(2) 77(2) 51(1) 46(1) 30(1) 2.00 * * * 181(4) 127(3) 88(2) 77(2) 68(2) 46(1) 30(1) 2.25 * * * 208(5) 127(3) 88(2) 77(2) 68(2) 61(2) 30(1) 2.50 * * * * 150(4) 109(3) 77(2) 68(2) 61(2) 30(1) 2.75 * * * * 173(5) 109(3) 95(3) 68(2) 61(2) 30(1) 3.00 * * * * 195(6) 129(4) 95(3) 84(3) 61(2) 30(1) 3.25 * * * * * 148(5) 112(4) 84(3) 61(2) 30(1) 3.50 * * * * * 167(6) 112(4) 84(3) 76(3) 40(2) 3.75 * * * * * 185(7) 129(5) 100(4) 76(3) 40(2) 4.00 * * * * * * 146(6) 100(4) 89(4) 40(2) 5.00 * * * * * * * 158(8) 116(6) 40(2) 6.00 * * * * * * * * 179(11) 50(3) 7.00 * * * * * * * * * 68(5)

*Sample size is too large to be cost-effective for most audit applications. The number in parentheses represents the maximum number of deviations in a sample of that size that allows the auditor to conclude that the tolerable deviation rate is not exceeded.

T A B L E 8 – 5

Final PDF to printer

278 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 278 09/30/15 03:25 PM

the tolerable deviation rate; audit sampling obviously is not appropriate in such situations because there is no allowance for sampling risk.

Auditors often establish one sample size for all controls tested within a business process; this is particularly true when all the tests of controls are to be conducted on the same sampling units. This is an acceptable practice because the auditor would use the largest of the computed sample sizes. Therefore, in this example, the auditor may decide to use a sample size of 93 to test the three controls. However, we will assume that the auditor in the Calabro example used the sample sizes shown in Table 8–4.

Computing Sample Size with IDEA Software Exhibit 8–1 shows the screen display from IDEA software for determining the sample size for control 3.7 The auditor opens a workbook, chooses the “Analysis” tab and within the “Sam- ple” group the auditor clicks on “Attribute.” The attribute sampling window is then displayed and the auditor enters the relevant data. The auditor enters “125000” for “Population size” (commas are not included when entering values in IDEA), “5” for “% Tolerable deviation rate,” “1” for “% Expected deviation rate” (i.e., expected population deviation rate), “95” for “Confidence level,” and clicks the “Compute” button at the bottom of the window. This pro- duces a sample size of 93, the same as the sample size determined using the tables. Advanced Module 2 in this chapter provides a chart comparing the terminology used by IDEA to the terminology used in the attribute sampling tables.

Population Size. Students and auditors are often surprised that the size of the popula- tion is not an important factor in determining sample size for attribute sampling. Due to the

7IDEA software, images, and material are used with the permission of CaseWare Analytics. The authors are grateful to the company for allowing the use of this material.

Statistical Sample Sizes for Attribute Sampling—90 Percent Desired Confidence Level (i.e., 10 Percent Risk of Incorrect Acceptance)*

Expected Population Deviation Rate

Tolerable Deviation Rate

2% 3% 4% 5% 6% 7% 8% 9% 10% 15%

0.00% 144(0) 76(0) 57(0) 45(0) 38(0) 32(0) 28(0) 25(0) 22(0) 15(0) .25 194(1) 129(1) 96(1) 77(1) 64(1) 55(1) 48(1) 42(1) 38(1) 25(1) .50 194(1) 129(1) 96(1) 77(1) 64(1) 55(1) 48(1) 42(1) 38(1) 25(1) .75 265(2) 129(1) 96(1) 77(1) 64(1) 55(1) 48(1) 42(1) 38(1) 25(1)

1.00 * 176(2) 96(1) 77(1) 64(1) 55(1) 48(1) 42(1) 38(1) 25(1) 1.25 * 221(3) 132(2) 77(1) 64(1) 55(1) 48(1) 42(1) 38(1) 25(1) 1.50 * * 132(2) 105(2) 64(1) 55(1) 48(1) 42(1) 38(1) 25(1) 1.75 * * 166(3) 105(2) 88(2) 55(1) 48(1) 42(1) 38(1) 25(1) 2.00 * * 198(4) 132(3) 88(2) 75(2) 48(1) 42(1) 38(1) 25(1) 2.25 * * * 132(3) 88(2) 75(2) 65(2) 42(1) 38(1) 25(1) 2.50 * * * 158(4) 110(3) 75(2) 65(2) 58(2) 38(1) 25(1) 2.75 * * * 209(6) 132(4) 94(3) 65(2) 58(2) 52(2) 25(1) 3.00 * * * * 132(4) 94(3) 65(2) 58(2) 52(2) 25(1) 3.25 * * * * 153(5) 113(4) 82(3) 58(2) 52(2) 25(1) 3.50 * * * * 194(7) 113(4) 82(3) 73(3) 52(2) 25(1) 3.75 * * * * * 131(5) 98(4) 73(3) 52(2) 25(1) 4.00 * * * * * 149(6) 98(4) 73(3) 65(3) 25(1) 5.00 * * * * * * 160(8) 115(6) 78(4) 34(2) 6.00 * * * * * * * 182(11) 116(7) 43(3) 7.00 * * * * * * * * 199(14) 52(4)

T A B L E 8 – 6

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 279

mes32502_ch08_261-299.indd 279 09/30/15 03:25 PM

Sample Screens from IDEA™ SoftwareE X H I B I T 8 – 1

properties of the underlying sampling distribution, the population size has little or no effect on the attribute sampling sample size, unless the population is relatively small (e.g., less than 1,000 items). In fact, so long as the population is made up of similar items under the same system of controls, it doesn’t matter if the population is 100,000 items, 1 million items, 100 million items, or more; the sample size is the same. If you use the IDEA software that accompanies or is available with this book, you can verify that the sample size computed in Exhibit 8–1 doesn’t change if you keep entering larger population sizes. Some audit sampling software programs do not consider population size when computing sample size for attribute sampling and other programs, like IDEA, do consider the effects of population size. See what happens when you recompute the sample size in Exhibit 8–1 with smaller population sizes such as 1,000 or 100. Because most of the populations that auditors test are larger than several hundred items, and because assuming large population sample size does not reduce the effec- tiveness of the sampling application, the sample size tables ignore the effects of population, as does the remainder of this chapter. However, in Advanced Module 1 in this chapter, we include a brief discussion of how sample sizes can be manually adjusted for smaller popula- tions and a small population sample size table is provided for testing controls that operate infrequently (i.e., quarterly, monthly, weekly).

Table 8–7 summarizes the effects of the four factors on the size of the sample to be selected.

Performance After the sampling application has been planned, an auditor performs each of the following steps.

Step 4: Select Sample Items Auditing standards require that the sample items be selected in such a way that the sample can be expected to represent the population. Thus, all items must have an equal opportunity to be selected. The following two selection methods are acceptable for attributes sampling.

Final PDF to printer

280 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 280 09/30/15 03:25 PM

Random-Number Selection. The auditor may select a random sample using random num- bers generated by a spreadsheet application or audit sampling software. Using this method of selection, every item in the population (such as a document or customer account) has the same probability of being selected as every other sampling unit in the population. Statis- tical sampling requires that the auditor be able to measure the probability of selecting the sampling units selected. Thus, random-number selection is used in many statistical sampling applications. Auditors typically use unrestricted random sampling without replacement for sampling applications. This means that once an item is selected, it is removed from the frame and cannot be selected a second time. Given the auditor’s objectives, it seems sensible for an auditor to include an item only once in the sample. Random numbers can be obtained from random-number tables or software such as MS Excel or IDEA. For the Calabro audit, Judd used MS Excel to generate 93 (the sample size determined by using the tables) random num- bers between 1 and 125,000 and collected sales and lease contracts corresponding to those random numbers for testing.

Obtaining Random Numbers from IDEA Software Exhibit 8–2 shows an example of the output from the random-number generator in IDEA. On the “Analysis” tab, in the “Sample” group, in the “Other” folder, the auditor clicks on “Generate Random Numbers.” The Generate Random Numbers window is then displayed and the auditor enters the relevant data. The sample size of 93 is entered for “Generate how many random num- bers.” The “Seed” is used to start the random-number process. IDEA automatically creates a random seed or the auditor can enter a random number seed. The auditor then enters the range of the invoice number sequence (1 to 125,001).8 Accept the defaults (unchecked boxes) for “Include detailed calculations” and “Allow duplicate numbers” so that each random number is unique. If the population data are available in electronic format, IDEA or spreadsheet programs like MS Excel can randomly select the sample records directly from the population.9

Systematic Selection. When using a systematic selection approach to select a sample, the auditor determines a sampling interval by dividing the sampling population by the sample size. A starting number is selected in the first interval, and then every nth item is selected. When a random starting point is used, systematic selection provides a sample where every sampling unit has an equal chance of being selected. For example, suppose the auditor wishes to select 100 items from a population of 15,000 items numbered 1 to 15,000. The sampling interval in this case is 150 (15,000 ÷ 100). The auditor chooses a random number in the first

8Each random number generated by IDEA will be greater than or equal to the minimum value and less than the maxi- mum value you specify. Notice the box in Exhibit 1 says, “Up to but not including:”. No random number will be equal to the maximum value. For this reason, the maximum is input as 125,001. 9An example of sampling population data in an electronic format is provided in the IDEA end-of-chapter problems for Chapter 9, available from Connect.

The Effect of Sample Selection Factors on Sample Size for Attribute Sampling

Examples

Factor Relationship to Sample Size Change in Factor Effect on Sample

Desired confidence level Direct Lower Decrease

Higher Increase

Tolerable deviation rate Inverse Lower Increase

Higher Decrease

Expected population deviation rate Direct Lower Decrease

Higher Increase

Population size Decreases sample size only when population size is small (e.g., 1,000 or fewer items). Therefore, popula- tion size generally has no effect on sample size.

T A B L E 8 – 7

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 281

mes32502_ch08_261-299.indd 281 09/30/15 03:25 PM

An Example of a Random Sample Drawn from IDEA™E X H I B I T 8 – 2

interval (i.e., between 1 and 150), say 125, and that item is selected for testing. The second item is 275 (125 + 150), the third item is 425, and so on. To avoid the possibility that a systematic sample will miss systematic deviations in the population (e.g., control deviations occurring every 300th unit or every Friday afternoon), the auditor can use several random starting points. In our example, after selecting 10 items, the auditor could use a new random start between the 10th and 11th interval to select the 11th item.

Step 5: Perform the Audit Procedures After the sample items have been selected, the auditor conducts the planned audit procedures. In conducting the audit procedures for tests of controls, the auditor may encounter the following situations:

∙ Voided documents. The auditor may occasionally select a voided document in a sample. If the transaction has been properly voided, it does not represent a deviation. The item should be replaced with a new sample item.

Final PDF to printer

282 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 282 09/30/15 03:25 PM

∙ Unused or inapplicable documents. Sometimes a selected item is not appropriate for the definition of the control. For example, the auditor may define a deviation for a purchase transaction as a vendor’s bill not supported by a receiving report. If the auditor selects a telephone or utility bill, there will not be a receiving report to examine. In such a case, the absence of the receiving report would not be a deviation. The auditor would simply replace the item with another purchase transaction.

∙ Inability to examine a sample item. Auditing standards require that the auditor consider the effect of not being able to apply a planned audit procedure to a sample item. For most tests of controls, the auditor examines documents for evidence of the performance of the control. If the auditor is unable to examine a document or to use an alternative procedure to test whether the control was adequately performed, the sample item is a deviation for purposes of evaluating the sample results.

∙ Stopping the test before completion. If a large number of deviations are detected early in the tests of controls, the auditor should consider stopping the test as soon as it is clear that the results of the test will not support the planned assessed level of control risk. If such a case occurred in the context of an audit of internal controls for a public company, the entity would be informed, and the exceptions would be considered a control deficiency unless remediation and retesting are successful or there are other controls that adequately address the increased risk of misstatement. In the context of a financial statement audit, the auditor would rely on other internal controls or set control risk at the maximum for the audit assertion affected, and appropriately enhance the related substantive tests.

Whenever a deviation is observed in controls, the auditor should investigate the nature, cause, and consequence of the deviation.

Understand and Analyze Deviations Observed. The auditor should evaluate the qualitative aspects of the deviations identified. This involves two considerations. First, the nature of each deviation and its cause and consequences should be considered. For example, the auditor should determine if a deviation represents an unintentional error or a fraud and whether the deviation actually resulted in a monetary misstatement to the financial statements. The audi- tor should also attempt to determine whether a deviation resulted from a cause such as misun- derstanding of instructions or carelessness. Understanding the nature and cause of a deviation helps the auditor better assess control risk and evaluate whether the deviation(s) represent(s) control deficiencies. In Chapter 7, Table 7–7 lists specific deficiencies that are indicative of material weaknesses (e.g., deviations that indicate management fraud, deviation(s) that resulted in monetary misstatements that are significant). Second, the auditor should con- sider how the deviations may impact the other phases of the audit. For example, suppose that deviations found in a test of the revenue process resulted from improper granting of credit. As a result, the risk that the valuation assertion was not met for accounts receivable would increase, and the auditor would therefore increase substantive procedures for the allowance for uncollectible accounts.

In the Calabro example, Judd examines each of the sample items for the presence of a deviation. Thus, for control 1, Judd tests the 78 sales and lease contracts (sample size from the table) for proper credit authorization procedures by credit department personnel. The results of the audit procedures can be documented in a working paper similar to the example shown in Exhibit 8–3. As noted earlier, when multiple controls are tested on one sampling unit, audi- tors often decide to test all controls for the full sample when such testing can be efficiently conducted. The choice of whether to test all controls for the full sample is a matter of risk management. The argument supporting this approach is that since the auditor is physically inspecting the documentation in the full sample, the auditor may want to reduce the risk that deficiencies go undetected in the documents examined for the full sample. The concern is that at some future date a litigation event may identify deviations in sample items 79 to 93 for control 1, and those deviations seem readily apparent to the courts based only on a cursory review of the documents. In legal terms, if the auditor failed to detect a deviation that a jury

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 283

mes32502_ch08_261-299.indd 283 09/30/15 03:25 PM

A Sample Working Paper for Recording the Results of Tests of ControlsE X H I B I T 8 – 3

B20 DLJ 2/3/16

CALABRO WIRELESS SERVICES

Controls Tested—Revenue Process 12/31/15

Control Procedure

Sample Item Sales and Lease Transaction Number 1 2 3

1 35381 ✓ ✓ ✓ 2 82765 D ✓ ✓ • • • • • • • • 48 1347 ✓ ✓ ✓ 49 1283 D ✓ • • • • • • 77 52140 ✓ ✓ 78 88878 ✓ ✓ • • • • 91 107409 ✓ 92 17080 ✓ 93 122891 ✓

Number of deviations 2 0 0 Sample size from tables 78 48 93 Sample deviation rate 2.6% 0% 0% Desired confidence level 95% 90% 95% Computed upper deviation rate from tables 8.2% 5.0% 3.3% Tolerable deviation rate 6% 8% 5% Auditor’s decision Does not support Supports reliance Supports reliance reliance

Tick Mark Legend ✓ = Sales or lease contract examined for proper performance of control procedure. No deviation. D = Deviation Control not performed properly.

believes a professional auditor should have detected, then there is greater risk that the auditor could be successfully sued for negligence. Chapter 20 covers auditor legal liability and the definitions of negligence.

Before calculating the sample results and drawing final conclusions on the sampling plan, Judd investigates the nature and cause of the exceptions. Judd also considers whether the deviations may impact the other phases of the audit. In the current example, two deviations were detected for control 1, which relates to proper authorization of credit. Judd’s investiga- tion indicates that both deviations had occurred when sales in excess of credit limits were made to existing customers. Further investigation disclosed that the sales manager instead of the credit manager had approved the sale. Judd now knows the nature and cause of the errors. The effect of the control deviations is likely to be an increase in the amount of audit work conducted on the allowance for uncollectible accounts.

After the audit procedures have been completed, the auditor proceeds with his or her evaluation of the sample results.

Evaluation Step 6: Calculate the Sample Deviation and Computed Upper Deviation Rates After completing the audit procedures, the auditor summarizes the deviations for each con- trol tested and evaluates the results. Determining the sample results for an attribute-sampling application can be accomplished by the use of a computer program or attribute-sampling tables. The auditor calculates the sample deviation rate and the computed upper deviation rate. The

Final PDF to printer

284 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 284 09/30/15 03:25 PM

sample deviation rate is simply the number of deviations found in the sample divided by the number of items in the sample. This calculation projects the sample results to the population and is required by auditing standards. For example, if 2 deviations were found in a sample of 50, the sample deviation rate would be 4 percent (2 ÷ 50). In attribute sampling, the sample deviation rate represents the auditor’s best estimate of the population deviation rate. However, because this result is based on a sample, the auditor does not know the true population devia- tion rate and must consider an allowance for sampling risk.

In evaluating the results of testing a control, the auditor is normally concerned only with whether the true deviation rate exceeds the tolerable deviation rate. Because the auditor does not know the true deviation rate, he or she calculates a computed upper deviation rate. The computed upper deviation rate is the sum of the sample deviation rate and an appropriate allowance for sampling risk. This sum represents an upper limit on how high the population deviation rate might actually be, at a controlled level of sampling risk (e.g., 5 or 10 percent). In other words, at the 95 percent confidence level, there is only a 5 percent chance that the true population deviation rate exceeds the computed upper deviation rate. This is sometimes referred to as the upper-limit approach.

Exhibit 8–3 shows the results of the tests of the three controls for the Calabro audit. Judd calculates the sample deviation rate and the computed upper deviation rate for each control tested. To determine the computed upper deviation rate, Judd uses either Table 8–8 or Table 8–9, depending on the desired confidence level for the test. A 95 percent confidence level is desired for control 1; thus, Judd uses Table 8–8 in the following way. The column for the actual number of deviations found (2 deviations) is read down until the appropriate row for sample size is found. If the exact sample size is not found, the closest smaller sample size is used. This approach provides a conservative (larger) computed upper deviation rate. For control 1, the row for a sample size of 75 is used. The computed upper deviation rate for con- trol 1 is 8.2 percent. Thus, for control 1, the sample deviation rate is 2.6 percent and the allow- ance for sampling risk is 5.6 percent (8.2 - 2.6). For control 2, Table 8–9 is used because the desired confidence level is 90 percent. In this case, no deviations were found, so the sample deviation rate is 0 percent and the upper computed deviation rate is 5 percent (round- ing the sample size down to 45). No control deviations were found for control 3; therefore,

Statistical Sample Results Evaluation Table (Computed Upper Deviation Rates) for Attribute Sampling—95 Percent Desired Confidence Level

Sample Size

Actual Number of Deviations Found

0 1 2 3 4 5 6 7 8 9 10

25 11.3 17.6 * * * * * * * * * 30 9.5 14.9 19.6 * * * * * * * * 35 8.3 12.9 17.0 * * * * * * * * 40 7.3 11.4 15.0 18.3 * * * * * * * 45 6.5 10.2 13.4 16.4 19.2 * * * * * * 50 5.9 9.2 12.1 14.8 17.4 19.9 * * * * * 55 5.4 8.4 11.1 13.5 15.9 18.2 * * * * * 60 4.9 7.7 10.2 12.5 14.7 16.8 18.8 * * * * 65 4.6 7.1 9.4 11.5 13.6 15.5 17.4 19.3 * * * 70 4.2 6.6 8.8 10.8 12.6 14.5 16.3 18.0 19.7 * * 75 4.0 6.2 8.2 10.1 11.8 13.6 15.2 16.9 18.5 20.0 * 80 3.7 5.8 7.7 9.5 11.1 12.7 14.3 15.9 17.4 18.9 * 90 3.3 5.2 6.9 8.4 9.9 11.4 12.8 14.2 15.5 16.8 18.2 100 3.0 4.7 6.2 7.6 9.0 10.3 11.5 12.8 14.0 15.2 16.4 125 2.4 3.8 5.0 6.1 7.2 8.3 9.3 10.3 11.3 12.3 13.2 150 2.0 3.2 4.2 5.1 6.0 6.9 7.8 8.6 9.5 10.3 11.1 200 1.5 2.4 3.2 3.9 4.6 5.2 5.9 6.5 7.2 7.8 8.4

*Over 20 percent.

T A B L E 8 – 8

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 285

mes32502_ch08_261-299.indd 285 09/30/15 03:25 PM

the sample deviation rate is 0 percent. Table 8–9 shows a computed upper deviation rate of 3.3 percent (rounding the sample size down to 90). In other words, even though the auditor’s best estimate based on the results of the testing is that the population contains no deviations, the allowance for sampling risk associated with the sample tested is 3.3 percent.

The upper limit represents the upper one-sided confidence limit for the population deviation rate based on the sample size, the number of deviations, and the planned level of confidence. In evaluating the results of testing a control, the auditor is normally concerned only with whether the true deviation rate exceeds the tolerable deviation rate. Therefore, the auditor is generally concerned only with how high the population deviation rate might be; it doesn’t matter how low the population deviation rate might be.

Computing Upper Deviation Rate with IDEA Software Exhibit 8–4 shows the output from IDEA for control 3. The auditor opens a database and on the “Analysis” tab, in the “Sample” group, the auditor clicks on “Attribute.” The Attri- bute Sampling window is then displayed and the auditor chooses the “Sample Evaluation” tab at the top of the window and enters the relevant data. The auditor enters “125000” for “Population size,” “93”for “Sample size,” “0” for “Number of deviations in sample,” “95” for “Desired confidence level,” and hits the “Compute” button at the bottom of the window. The estimated 1-sided upper limit (i.e., computed upper deviation rate) is 3.17 percent. Advanced Module 2 in this chapter provides a chart comparing the terminology used by IDEA to the terminology used in the attribute sampling tables.

Step 7: Draw Final Conclusions In drawing a conclusion about the statistical sampling application for tests of controls, the auditor compares the tolerable deviation rate to the com- puted upper deviation rate. If the computed upper deviation rate is less than or equal to the tol- erable deviation rate, the auditor can conclude that the control tested can be relied upon. If the computed upper deviation rate exceeds the tolerable deviation rate, the auditor will normally conclude that the control is not operating at an acceptable level. For an audit of internal con- trol over financial reporting, the ineffective control would be considered a control deficiency unless the entity remediates the control and both the entity and the auditor retest to support the remediated control’s effectiveness. For purposes of an audit of internal control, the auditor

Statistical Sample Results Evaluation Table (Computed Upper Deviation Rates) for Attribute Sampling—90 Percent Desired Confidence Level

Sample Size

Actual Number of Deviations Found

0 1 2 3 4 5 6 7 8 9 10

20 10.9 18.1 * * * * * * * * * 25 8.8 14.7 19.9 * * * * * * * * 30 7.4 12.4 16.8 * * * * * * * * 35 6.4 10.7 14.5 18.1 * * * * * * * 40 5.6 9.4 12.8 16.0 19.0 * * * * * * 45 5.0 8.4 11.4 14.3 17.0 19.7 * * * * * 50 4.6 7.6 10.3 12.9 15.4 17.8 * * * * * 55 4.1 6.9 9.4 11.8 14.1 16.3 18.4 * * * * 60 3.8 6.4 8.7 10.8 12.9 15.0 16.9 18.9 * * * 70 3.3 5.5 7.5 9.3 11.1 12.9 14.6 16.3 17.9 19.6 * 80 2.9 4.8 6.6 8.2 9.8 11.3 12.8 14.3 15.8 17.2 18.6 90 2.6 4.3 5.9 7.3 8.7 10.1 11.5 12.8 14.1 15.4 16.6 100 2.3 3.9 5.3 6.6 7.9 9.1 10.3 11.5 12.7 13.9 15.0 120 2.0 3.3 4.4 5.5 6.6 7.6 8.7 9.7 10.7 11.6 12.6 160 1.5 2.5 3.3 4.2 5.0 5.8 6.5 7.3 8.0 8.8 9.5 200 1.2 2.0 2.7 3.4 4.0 4.6 5.3 5.9 6.5 7.1 7.6

*Over 20 percent.

T A B L E 8 – 9

Final PDF to printer

286 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 286 09/30/15 03:25 PM

Evaluation Results from IDEA™E X H I B I T 8 – 4

must evaluate the likelihood and magnitude of a potential misstatement arising as a result of control deficiencies (see Chapter 7).

For a financial statement audit, the final conclusion about control risk for the accounting system being tested is based on the auditor’s professional judgment of the sample results and other relevant tests of controls such as inquiry and observation. If the auditor concludes that the evidence supports the planned level of control risk, no modifications of the planned substantive procedures are necessary. On the other hand, if the planned level of control risk is not supported by the sample results and other tests of controls, the auditor should either (1) test other control procedures that could support the planned level of control risk or (2) increase the assessed level of control risk and modify the nature, extent, or timing of substantive procedures.

Table 8–10 shows the auditor’s risks when evaluating sample evidence on the planned level of control risk. If the evidence supports the planned level of control risk and the internal control is reliable, the auditor has made a correct decision. Similarly, if the evidence does not support the planned level of control risk and the internal control is not reliable, a correct deci- sion has been made. The other two combinations result in decision errors by the auditor. If the evidence supports the planned level of control risk and the internal control is not reliable, the auditor will have incorrectly accepted the control as effective and overrelied on internal control (Type II error). This results in the auditor establishing detection risk too high and leads to a lower level of evidence being gathered through substantive procedures. Thus, the

The Auditor’s Risks When Evaluating Sample Evidence on the Planned Level of Control Risk

Auditor’s Decision Based on Sample Evidence

True State of Internal Control

Reliable Not Reliable

Supports the planned level of control risk Correct decision Risk of incorrect acceptance (Type II) Does not support the planned level of control risk Risk of incorrect rejection (Type I) Correct decision

T A B L E 8 – 1 0

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 287

mes32502_ch08_261-299.indd 287 09/30/15 03:25 PM

auditor’s risk of not detecting material misstatement is increased. This can lead to a lawsuit against the auditor. If the evidence does not support the planned level of control risk and the internal control is reliable (Type I error), the auditor will have incorrectly rejected the control and detection risk will have been set too low. Thus, a higher level of evidence will be gathered by substantive procedures, leading to overauditing and an inefficient audit.

For the Calabro audit, Exhibit 8–3 shows that the sample evidence does not support the operating effectiveness of control 1 (credit authorization) because the computed upper devi- ation rate (8.2 percent) exceeds the tolerable deviation rate (6 percent). For control 1, the sample deviation rate was 2.6 percent and the allowance for sampling risk was 5.6 percent. In this example, there appear to be no other controls or other evidence to support the operating effectiveness of control 1. Thus, Judd increases both the assessed level of control risk and the substantive procedures related to the valuation assertion.

Judd’s sample evidence supports the reliability of controls 2 and 3 because the computed upper deviation rates are less than the tolerable deviation rates. If Judd were performing tests of controls for the audit of internal control over financial reporting for a public company, he would conclude that controls 2 and 3 operate effectively and that the exceptions in control 1 represent a control deficiency. Judd would then need to evaluate the likelihood and magnitude of a potential misstatement arising as a result of the valuation-related control deficiency.

Nonstatistical Sampling for Tests of Controls

When conducting a nonstatistical sampling application for tests of controls, the auditor con- siders each of the steps shown in Table 8–2. The differences between nonstatistical and statis- tical sampling occur in any or all of the following steps:

∙ Determining the sample size. ∙ Selecting the sample items. ∙ Calculating the computed upper deviation rate.

Determining the Sample Size When a nonstatistical sampling application is used in determining sample size, the auditor should consider the desired confidence, the tolerable deviation rate, and the expected population deviation rate. While the auditor is not required to use a statistical formula or table to determine sample size, professional standards indicate that sample sizes for nonstatistical and statistical applications should be comparable. In other words, “nonstatistical” does not justify an auditor in using sample sizes that are too small to provide sufficient evidence. Nonstatistical sample sizes are determined by applying professional judgment and guidance in audit firm policy.

A number of public accounting firms establish guidelines for nonstatistical sample sizes for tests of controls. Typically, accounting firms’ nonstatistical guidelines are consistent with sampling theory and are designed to provide two primary benefits: (1) to simplify the judg- ments required by field auditors by having experts at firm headquarters make firmwide judg- ments and (2) to improve consistency in sampling applications within and across engagement teams. For example, a firm might establish guidelines as follows for populations greater than 250 (see Advanced Module 1 for sample sizes related to small populations):

LO 8-8

Desired Level of Controls Reliance Sample Size

Low 10–15

Moderate 20–30

High 40–60

In developing nonstatistical sampling guidelines like those above, the firms’ experts have decided what confidence levels achieve low, moderate, and high assurance (say, 60–65, 75–80, and 90–95 percent confidence, respectively). The experts have decided reasonable

Final PDF to printer

288 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 288 09/30/15 03:25 PM

levels of tolerable deviation rates (say, between 5 and 10 percent), and they have decided to base an initial sample on zero expected deviations. Following this guidance, if one or more deviations are found in the sample, the auditor needs to expand the sample or increase the assessed level of control risk.

Selecting the Sample Items While random-sample or systematic-sample (with a random start) selection is required for sta- tistical sampling, nonstatistical sampling allows the use of those selection methods as well as other selection methods such as haphazard sampling. When a haphazard selection approach is used, sampling units are selected without any conscious bias—that is, without a special reason for including or omitting items from the sample. This does not imply that the items are selected in a careless manner; rather, the sampling units are selected to represent the popula- tion. Haphazard selection may be useful for nonstatistical sampling, but it should not be used for statistical sampling because the auditor cannot measure the probability of an item being selected. When using audit sampling, the auditor should avoid distorting the sample by select- ing only items that are unusual or large or items that are the first or last items in the frame, because the auditor needs a sample that represents the population in order to draw inferences about the population from the sample. This is not to say that selection of unusual, large, or risky events, transactions, or balances should be avoided in other audit procedures that do not involve audit sampling. To the contrary, the auditor should focus specific audit procedures on all such items, using 100 percent testing rather than audit sampling, which requires selection of items in a population using chance (i.e., random or haphazard selection).

Calculating the Computed Upper Deviation Rate With a nonstatistical sample, the auditor can calculate the sample deviation rate but cannot quantify the computed upper deviation rate and the sampling risk associated with the test. The AICPA Audit Guide Audit Sampling provides the following advice for considering sampling risk in a nonstatistical test of controls:

If the auditor is performing a nonstatistical sampling application, sampling risk . . . cannot be measured directly; however, it is generally appropriate for the auditor to conclude that the sample results do not support the planned assessed level of control risk if the rate of deviation identified in the sample exceeds the expected population deviation rate used when designing the sample.10

Suppose an auditor planned a nonstatistical sampling application by setting the desired confidence level at “high” (i.e., 90 to 95 percent), the expected population deviation rate at .5 percent, and the tolerable deviation rate at 8 percent. Assume the auditor judgmentally determines to select a sample size of 50 items and makes the selections haphazardly. If the auditor detects no control deviations, the sample deviation rate is 0 percent. In this instance, the sample deviation rate, 0 percent, is less than the expected population deviation rate, .5 percent, and there is an acceptable risk that the true population deviation rate exceeds the tolerable deviation rate.

Now assume that one control deviation had been detected. The sample deviation rate is 2 percent, which is greater than the expected population deviation rate (.5 percent). Now there is an unacceptably high risk that the true population deviation rate exceeds the tolerable devi- ation rate. Referring to the statistical evaluation table illustrates why the results of the non- statistical sample are not likely to support the effectiveness of the control. Table 8–8 shows that if one deviation is found in a sample of 50 items, the computed upper deviation rate is 9.2 percent. This exceeds the tolerable deviation rate of 8 percent.

Stop and Think:What factors would cause an audit sampling approach to be consid- ered a “nonstatistical” approach?

10Adapted from American Institute of Certified Public Accountants, Audit Sampling (Audit Guide) (New York: AICPA, 2012).

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 289

mes32502_ch08_261-299.indd 289 09/30/15 03:25 PM

An approach is nonstatistical if (1) judgment is used to determine the sample size, (2) a haphazard sample selection technique is used, and/or (3) the sample results are evaluated judgmentally. A nonstatistical approach can involve random selection and a judgmental eval- uation. Haphazardly selected samples should not be evaluated statistically in a formal way (although such an evaluation could be used to inform an auditor’s judgment). However, it is important to note that any randomly drawn sample can be statistically evaluated—even if the auditor labels the approach “nonstatistical” and even if the sample size was not statistically derived. This is an important point because it highlights the need for auditors to understand the key concepts of sampling theory even if they are using a nonstatistical approach. Remem- ber, if an auditor randomly selects a sample and then evaluates the results judgmentally, the quality of his or her judgment can be evaluated against statistical theory by outside experts.

Conclusion

The use of sampling is common in auditing because of the need to gather evidence over large populations of entity data in a cost-effective manner. In this chapter we discussed the basic concepts that are relevant to all forms of audit sampling, such as sampling risk. Whenever auditors use sampling techniques, they face the risk that their sample is not representative of the population, which could lead them to draw the wrong conclusions. Statistical theory allows auditors to measure this risk and manage it by taking the appropriate sample size. In this chapter we focused primarily on statistical attributes sampling for tests of controls and we provided a step-by-step approach to planning a sample, executing the sample testing, and evaluating the results from the sample. The steps were illustrated using both statistical tables and the audit software IDEA. Nonstatistical sampling is commonly used in practice, but it is important to remember nonstatistical approaches must be firmly grounded in statistical theory.

This chapter covered sampling for tests of controls and in Chapter 9 you will learn about statistical and nonstatistical sampling techniques auditors use when testing monetary balances (i.e., substantive testing).

Advanced Module 1: Considering the Effect on Sample Size of a Small Population

As noted in the chapter, due to the properties of the underlying sampling distribution, popula- tion size had little or no effect on attribute sampling sample sizes for populations containing more than 1,000 items.

The attribute sampling tables presented earlier in this chapter assume a large population. When the population size is smaller than 1,000, the sample size taken from the tables can be adjusted by using the finite population correction factor as follows:

Finite population correction factor = √ _______

1 − ( n / N )

where n = the sample size from the tables. N = the number of units in the population. For example, the sample size for a desired confidence of 90 percent, a tolerable deviation

rate of 10 percent, and an expected population deviation rate of 1 percent is 39 when popula- tion size is 10,000. If the population size was 100, the sample size of 39 could be adjusted as follows:

Sample size = n √ _______

1 − ( n / N )

= 39 √ __________

1 − ( 39 / 100 ) = 31

Final PDF to printer

290 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 290 09/30/15 03:25 PM

KEY TERMS

Allowance for sampling risk. The uncertainty that results from sampling; the difference between the expected mean of the population and the tolerable deviation or misstatement. Attribute sampling. Sampling used to estimate the proportion of a population that possesses a specified characteristic. Audit sampling. The selection and evaluation of less than 100 percent of the population of audit relevance such that the auditor expects the items selected to be representative of the pop- ulation and, thus, likely to provide a reasonable basis for conclusions about the population. Classical variables sampling. The use of normal distribution theory to estimate the dollar amount of misstatement for a class of transactions or an account balance. Desired confidence level. The probability that the true but unknown measure of the charac- teristic of interest is within specified limits. Expected population deviation rate. The deviation rate that the auditor expects to exist in the population. Monetary-unit sampling. Attribute-sampling techniques used to estimate the dollar amount of misstatement for a class of transactions or an account balance. Nonsampling risk. The risk that auditors will make judgment errors caused by the use of inappropriate audit procedures or misinterpretation of audit evidence and failure to recognize a misstatement or deviation. Nonstatistical sampling. Audit sampling that relies on the auditor’s judgment to determine sample size (typically of comparable size to a statistically based sampling approach), select the sample, and/or evaluate the results for the purpose of reaching a conclusion about the population.

IDEA Term Sampling Table Term

Computing Sample Size Attribute Sampling Confidence Level % Tolerable Deviation Rate % Expected Deviation Rate

Attribute Sampling Desired Confidence Level Tolerable Deviation Rate Expected Population Deviation Rate

Sample Evaluation Attribute Sampling Sample Size Number of Deviations in Sample % Desired Confidence Level Upper limit

Attribute Sampling Sample Size Actual Number of Deviations Found Desired Confidence Level Computed Upper Deviation Rate

Small Population Sample Size Table11

Control Frequency and Population Size Sample Size

Quarterly (4) 2 Monthly (12) 2–4 Semimonthly (24) 3–8 Weekly (52) 5–9

11This is Table 3.5 from the American Institute of Certified Public Accountants, Audit Sampling (Audit Guide) (New York: AICPA, 2012).

Advanced Module 2: Comparing Terminology for Attribute Sampling between IDEA and Sampling Tables

Some controls may operate only weekly, monthly, or quarterly. For infrequent controls some auditors use sample sizes provided in the following table:

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 291

mes32502_ch08_261-299.indd 291 09/30/15 03:25 PM

Representative sample. The evaluation of the sample will result in conclusions that are simi- lar to those that would be drawn if the same procedures were applied to the entire population. Risk of incorrect acceptance. The risk that the sample supports the conclusion that the con- trol is operating effectively when it is not or that the recorded account balance is not materi- ally misstated when it is materially misstated. Risk of incorrect rejection. The risk that the sample supports the conclusion that the control is not operating effectively when it actually is or that the recorded account balance is materi- ally misstated when it is not materially misstated. Sampling risk. The possibility that the sample drawn is not representative of the population and that, as a result, the auditor reaches an incorrect conclusion about the reliability of the control, the account balance, or class of transactions based on the sample. Sampling unit. The individual items constituting a population being sampled. Statistical sampling. Sampling that uses the laws of probability to select and evaluate the results of an audit sample, thereby permitting the auditor to quantify the sampling risk for the purpose of reaching a conclusion about the population. Tolerable deviation rate. The maximum deviation rate from a prescribed control that the auditor is willing to accept without altering the planned assessed level of control risk.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 8-1 8-1 Define audit sampling. Why do auditors sample instead of examining every transaction?

LO 8-2 8-2 Distinguish between Type I and Type II errors. What terms are used to describe these errors when the auditor is conducting tests of controls and substantive tests? What costs are potentially incurred by auditors when such decision errors occur?

LO 8-3 8-3 List audit evidence types that do not involve sampling and provide an example of a situation where an auditor would not use audit sampling.

LO 8-1 8-4 Distinguish between nonstatistical and statistical sampling. What are the advantages and disadvantages of using statistical sampling?

LO 8-6, LO 8-7 8-5 Define attribute sampling. Why is this sampling technique appropriate for tests of controls?

LO 8-6, 8-7, 8-8 8-6 How does the timing of controls testing affect the population definition? LO 8-7 8-7 List the four factors that enter into the sample size decision. What is the relationship

between sample size and each of these factors? LO 8-6, 8-7, 8-8 8-8 In performing certain audit procedures, the auditor may encounter voided docu-

ments, inapplicable documents, or missing documents, or the auditor may stop test- ing before examining all the items selected for the sample. How should each of these situations be handled within the attribute-sampling application?

LO 8-6, 8-7, 8-8 8-9 The auditor should evaluate the qualitative aspects of deviations found in a sam- pling application. What are the purposes of evaluating the qualitative aspects of deviations?

LO 8-8 8-10 How should the results of a nonstatistical test of controls sample be evaluated in terms of considering sampling risk?

Final PDF to printer

292 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 292 09/30/15 03:25 PM

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 8-4 8-11 An advantage of statistical sampling over nonstatistical sampling is that statistical sampling helps an auditor to

a. Eliminate the risk of nonsampling errors. b. Reduce audit risk and materiality to a relatively low level. c. Measure the sufficiency of the evidential matter obtained. d. Minimize the failure to detect errors and fraud.

LO 8-4, 8-6 8-12 Samples to test internal controls are intended to provide a basis for an auditor to conclude whether

a. The controls are operating effectively. b. The financial statements are materially misstated. c. The risk of incorrect acceptance is too high. d. Materiality for planning purposes is at a sufficiently low level.

LO 8-6, 8-7 8-13 When assessing the tolerable deviation rate, the auditor should consider that, while deviations from control procedures increase the risk of material misstatements, such deviations do not necessarily result in misstatements. This explains why

a. A recorded disbursement that does not show evidence of required approval may nevertheless be a transaction that is properly authorized and recorded.

b. Deviations would result in errors in the accounting records only if the deviations and the misstatements occurred on different transactions.

c. Deviations from pertinent control procedures at a given rate ordinarily would be expected to result in misstatements at a higher rate.

d. A recorded disbursement that is properly authorized may nevertheless be a trans- action that contains a material misstatement.

LO 8-6, LO 8-7 8-14 Which of the following combinations results in the greatest decrease in sample size in an attribute sample for a test of controls?

Desired Confidence Level

Tolerable Deviation Rate

Expected Population Deviation Rate

a. b. c. d.

Decrease Increase Decrease Decrease

Decrease Increase Increase Increase

Increase Decrease Decrease Increase

Questions 8–15 and 8–16 are based on the following information: An auditor desired to test credit approval on 10,000 sales invoices processed during

the year. The auditor designed a statistical sample that would provide 1 percent risk of assessing control risk too low for the assertion that not more than 7 percent of the sales invoices lacked approval. The auditor estimated from previous experience that about 2½ percent of the sales invoices lacked approval. A sample of 200 invoices was examined, and 7 of them were lacking approval. The auditor then determined the computed upper deviation rate to be 8 percent.

LO 8-6, 8-7 8-15 In the evaluation of this sample, the auditor decided to increase the level of the preliminary assessment of control risk because the

a. Tolerable deviation rate (7 percent) was less than the computed upper deviation rate (8 percent).

b. Expected population deviation rate (7 percent) was more than the percentage of errors in the sample (3½ percent).

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 293

mes32502_ch08_261-299.indd 293 09/30/15 03:25 PM

c. Computed upper deviation rate (8 percent) was more than the percentage of errors in the sample (3½ percent).

d. Expected population deviation rate (2½ percent) was less than the tolerable devia- tion rate (7 percent).

LO 8-6, 8-7 8-16 Based on the information above, the planned allowance for sampling risk was a. 5½ percent. b. 4½ percent. c. 3½ percent. d. 1 percent.

LO 8-2, 8-6 8-17 The following table depicts the possible outcomes for the auditor’s estimated com- puted upper deviation rate based on a sample relative to the auditor’s tolerable devia- tion rate (i.e., the computed upper deviation rate will either be above or below the tolerable deviation rate). The table also depicts the two possible states of the actual population deviation rate compared with the auditor’s tolerable deviation rate (the actual population deviation rate is unknown to the auditor).

Auditor’s Estimate Based on Sample Results

Actual Population Deviation Rate Is Less Than Tolerable Deviation

Rate

Actual Population Deviation Rate Exceeds Tolerable

Deviation Rate

Computed upper deviation rate is less than tolerable deviation rate.

1 3

Computed upper deviation rate exceeds tolerable deviation rate.

2 4

Suppose as a result of sample testing of controls, an auditor assesses control risk higher than necessary given the actual (but unknown) population deviation rate and thereby increases substantive testing. This is illustrated by which of the four possible outcome conditions in the table above?

a. 1. b. 2. c. 3. d. 4.

LO 8-6 8-18 Which of the following statements is correct concerning statistical sampling in tests of controls?

a. Deviations from controls at a given rate usually result in misstatements at a higher rate.

b. As the population size doubles, the sample size should also double. c. The qualitative aspects of deviations are not considered by the auditor. d. There is an inverse relationship between the sample size and the tolerable devia-

tion rate.

LO 8-2, 8-6 8-19 Assume an auditor is evaluating a statistical attribute sample of 50 items that resulted in three deviations. What should the auditor conclude if the tolerable deviation rate is 7 percent, the expected population deviation rate is 5 percent, and the allowance for sampling risk is 2 percent?

a. The planned assessed level of control risk should be modified because the tol- erable deviation rate plus the allowance for sampling risk exceeds the expected population deviation rate.

b. The sample results should be accepted as support for the planned assessed level of control risk because the sample deviation rate plus the allowance for sampling risk exceeds the tolerable deviation rate.

Final PDF to printer

294 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 294 09/30/15 03:25 PM

c. The sample results should be accepted as support for the planned assessed level of control risk because the tolerable deviation rate less the allowance for sampling risk equals the expected population deviation rate.

d. The planned assessed level of control risk should be modified because the sample deviation rate plus the allowance for sampling risk exceeds the tolerable deviation rate.

LO 8-2, 8-6 8-20 As a result of sampling procedures applied as tests of controls, an auditor incorrectly assesses control risk lower than appropriate. The most likely explanation for this situation is that

a. The deviation rates of both the auditor’s sample and the population exceed the tolerable deviation rate.

b. The deviation rates of both the auditor’s sample and the population are less than the tolerable deviation rate.

c. The deviation rate in the auditor’s sample is less than the tolerable deviation rate, but the deviation rate in the population exceeds the tolerable deviation rate.

d. The deviation rate in the auditor’s sample exceeds the tolerable deviation rate, but the deviation rate in the population is less than the tolerable deviation rate.

PROBLEMS All applicable problems are available with Connect.

LO 8-1, 8-2 8-21 Audit sampling involves applying an audit procedure to less than 100 percent of the population for the purpose of evaluating some characteristic of the population. The fact that an audit involves sampling is noted in the scope paragraph of the auditor’s report, which contains the phrase “An audit includes examining, on a test basis.” When an auditor uses sampling, an element of uncertainty enters into the auditor’s conclusions.

Required: a. Explain the auditor’s justification for accepting the uncertainties that are inherent

in the sampling process. b. Discuss the uncertainties that collectively embody the concept of audit risk. c. Discuss the nature of sampling risk and nonsampling risk. Include the effect of

sampling risk on tests of controls.

LO 8-2, 8-3, 8-4 8-22 Match the term to the definition.

a. Attribute sampling b. Desired confidence level c. Allowance for sampling risk d. Sampling risk e. Sampling population f. Nonstatistical sampling g. Tolerable deviation rate

1. The possibility that the sample drawn is not representative of the population and leads to an incorrect conclusion

2. Relies on the auditor’s judgment to determine sample size and evaluate the results

3. The maximum deviation rate from a prescribed control that an auditor is willing to accept

4. All or a subset of the items that constitute the class of transactions 5. The probability that the true but unknown measure of the charac-

teristic of interest is within specified limits 6. Used to estimate the proportion of a population that possesses a

certain characteristic 7. The difference between the expected and the tolerable deviation rate

LO 8-6, 8-7 8-23 Following is a set of situations that may or may not involve sampling. 1. An auditor is examining loan receivables at a local bank. The population of loans

contains two strata. One stratum is composed of 25 loans that are each greater than $1 million. The second stratum contains 450 loans that are less than $1 million. The auditor has decided to test all loans greater than $1 million and 15 loans less than $1 million.

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 295

mes32502_ch08_261-299.indd 295 09/30/15 03:25 PM

2. Assume the same facts as number 1 except that the auditor decides to apply ana- lytical procedures to the second stratum of loans.

3. An auditor has haphazardly selected 30 sales invoices to be examined for proper pricing of the goods purchased by the customer.

4. The prepaid insurance account is made up of four policies that total $45,000. The auditor has decided that this account is immaterial and decides that no policies will be examined.

Required: Indicate which situations involve audit sampling (statistical or nonstatistical) and why.

LO 8-6, 8-7 8-24 Jenny Jacobs, CPA, is planning to use attribute sampling in order to determine the degree of reliance to be placed on an entity’s system of internal control over sales. Jacobs has begun to develop an outline of the main steps in the sampling plan as follows:

1. State the test objectives (for example, to test the reliability of internal controls over sales).

2. Define the population (the period covered by the test, the sampling unit, the com- pleteness of the population).

3. Define the sampling unit (for example, sales invoices).

Required: a. What are the remaining steps in the outline that Jacobs should include in the sta-

tistical test of sales invoices? b. What are the advantages of using statistical audit sampling?

(AICPA, adapted)

LO 8-6 8-25 Determine the sample size for each of the control procedures shown in the following table (assuming a very large population):

Control Procedure

Parameters 1 2 3 4

Risk of incorrect acceptance 5% 5% 10% 10% Tolerable deviation rate 4% 5% 7% 8% Expected population deviation rate 1% 2% 3% 4% Sample size

LO 8-6 8-26 Using the sample sizes determined in Problem 8-25 and the number of deviations shown here, determine the sample deviation rate, the computed upper deviation rate, and the auditor’s conclusion (i.e., testing results do or do not support operating effectiveness of the control) for each control procedure.

Control Procedure

Results 1 2 3 4

Number of deviations 0 5 4 3 Sample size Sample deviation rate Computed upper deviation rate Auditor’s conclusion

Final PDF to printer

296 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 296 09/30/15 03:25 PM

LO 8-6 8-27 Determine the sample size for each of the control procedures shown in the following table (assuming a very large population):

Control Procedure

Parameters 1 2 3 4

Risk of incorrect acceptance 5% 5% 10% 10% Tolerable deviation rate 6% 7% 4% 3% Expected population deviation rate 2% 2% 1% 0% Sample size

Control Procedure

Results 1 2 3 4

Number of deviations 4 2 2 0 Sample size Sample deviation rate Computed upper deviation rate Auditor’s conclusion

Control Procedure

Parameters 1 2

Desired confidence 95% 90% Tolerable deviation rate 7% 9% Expected population deviation rate 2% 2.5%

LO 8-6 8-28 Using the sample sizes determined in Problem 8-27 and the number of deviations shown here, determine the sample deviation rate, computed upper deviation rate, and the auditor’s conclusion (i.e., testing results do or do not support operating effective- ness of the control) for each control procedure.

LO 8-8 8-29 Calgari Clothing Company manufactures high-quality silk ties that are marketed under a number of trademarked names. Joe & Vandervelte LLP has been the com- pany’s auditors for five years. Lisa Austen, the senior-in-charge of the audit, has reviewed Calgari’s controls over purchasing and inventory, and she determined that a number of controls can be relied upon to reduce control risk. Austen has decided to test two control procedures over purchases and inventory: (1) purchase orders are agreed to receiving reports and vendor’s invoices for product, quantity, and price; and (2) inventory is transferred to raw material stores using an approved, prenum- bered receiving report.

Austen decided to use a nonstatistical sampling approach based on the following judgments for each control procedure and has judgmentally decided to use a sample size of 75 purchase orders for control 1 and 30 receiving reports for control 2.

After completing the examination of the sample items, Austen noted one deviation for each control procedure.

Required: What conclusion should Austen reach about each control procedure? Justify your

answer.

Final PDF to printer

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls 297

mes32502_ch08_261-299.indd 297 09/30/15 03:25 PM

LO 8-8 8-30 Nathan Matthews conducted a test of controls where the tolerable deviation rate was set at 6 percent and the expected population deviation rate was 3 percent. Using a sample size of 150, Matthews performed the planned test of controls. He found six deviations in the sample, and he calculated the computed upper deviation rate to be 7.8 percent.

Required: a. Based on the sample results, what allowance for sampling risk is included in the

computed upper deviation rate of 7.8? b. Assume that Matthews preliminarily assessed control risk as “low.” Given the

results above, the auditor could decide to do one of three things: (1) increase the sample size, (2) increase the preliminary assessment of control risk, or (3) not adjust the preliminary assessment of control risk. Describe how Matthews could justify each of those three actions.

LO 8-8 8-31 Doug Iceberge, senior-in-charge of the audit of Fisher Industries, has decided to test the following two controls for Fisher’s revenue process.

1. All sales invoices are supported by proper documentation, that is, a sales order and a shipping document.

2. All sales invoices are mathematically correct. Iceberge has decided to use a nonstatistical sampling approach based on the follow-

ing judgments for each control and has judgmentally decided to use a sample size of 50 sales invoice packets.

Control Procedure

Parameters 1 2

Desired confidence level 95% 90% Risk of assessing control risk too low 5% 10% Tolerable deviation rate 6% 8% Expected population deviation rate 3% 3%

After completing the examination of the 50 sample items, Iceberge noted one devia- tion for control 1 and two deviations for control 2.

Required: What should Iceberge conclude about each control? Justify your answer.

DISCUSSION CASE

LO 8-2, 8-5, 8-6 8-32 Baker, CPA, was engaged to audit Mill Company’s financial statements for the year ended September 30. After studying Mill’s internal control, Baker decided to obtain evidence about the effectiveness of both the design and the operation of the controls that may support a low assessed level of control risk concerning Mill’s shipping and billing functions. During the prior years’ audits, Baker had used nonstatistical sam- pling, but for the current year Baker used a statistical sample in the tests of controls to eliminate the need for judgment.

Baker wanted to assess control risk at a low level, so a tolerable deviation rate of 20 percent was established. To estimate the population deviation rate and the computed upper deviation rate, Baker decided to apply an attribute sampling technique that would use an expected population deviation rate of 3 percent for the 8,000 shipping documents and to defer consideration of the allowable risk of assessing control risk too low until the sample results were evaluated. Baker used the tolerable deviation rate, the popula- tion size, and the expected population deviation rate to determine that a sample size of

Final PDF to printer

298 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch08_261-299.indd 298 09/30/15 03:25 PM

80 would be sufficient. When it was subsequently determined that the actual population was about 10,000 shipping documents, Baker increased the sample size to 100.

Baker’s objective was to ascertain whether Mill’s shipments had been properly billed. Baker took a sample of 100 invoices by selecting the first 25 invoices from the first month of each quarter. Baker then compared the invoices to the corresponding prenumbered shipping documents.

When Baker tested the sample, eight deviations were discovered. Additionally, one shipment that should have been billed at $10,443 was actually billed at $10,434. Baker considered this $9 to be immaterial and did not count it as an error.

In evaluating the sample results, Baker made the initial determination that a 5 percent risk of assessing control risk too low was desired and, using the appropri- ate statistical sampling table, determined that for eight observed deviations from a sample size of 100, the computed upper deviation rate was 14 percent. Baker then calculated the allowance for sampling risk to be 5 percent, the difference between the actual sample deviation rate (8 percent) and the expected error rate (3 percent). Baker reasoned that the actual sample deviation rate (8 percent) plus the allow- ance for sampling risk (5 percent) was less than the computed upper deviation rate (14 percent); therefore, the sample supported a low level of control risk.

Required: Describe each incorrect assumption, statement, and inappropriate application of

attribute sampling in Baker’s procedures. (AICPA, adapted)

HANDS-ON CASES

EarthWear Online

Tests of Controls (Part B) In Part A you completed controls testing on the sample of voucher packets selected by Willis & Adams’ staff and evaluated the results (see Part A mini case description in Chapter 6). Your task is to statistically quantify and evaluate the results of tests of controls from Part A using the methods outlined in the chapter.

Visit Connect to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch08_261-299.indd 299 09/30/15 03:25 PM

Final PDF to printer

mes32502_ch09_300-336.indd 300 10/10/15 12:57 PM

CHAPTER

9 9-1 Understand the similarities and differences between audit

sampling for tests of controls and substantive tests of details of account balances.

9-2 Learn to apply monetary-unit sampling. 9-3 Work through an extended example of monetary-unit

sampling.

9-4 Learn to apply nonstatistical sampling techniques and work through an example.

9-5 Learn to apply classical variables sampling. 9-6 Work through an example of classical variables

difference estimation.

AICPA, Audit Sampling (Audit Guide) (New York: AICPA, 2012) AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 530, Audit Sampling PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 8, Audit Risk (AU-C 200) PCAOB Auditing Standard No. 9, Audit Planning (AU-C 300) PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

301

mes32502_ch09_300-336.indd 301 10/10/15 12:57 PM

Audit Sampling: An Application to Substantive Tests of Account Balances

T his chapter demonstrates the application of audit sampling to substan- tive tests of details of account balances. In Chapter 8, attribute sampling was used to determine whether controls were operating effectively and

could therefore be relied on by the auditor to generate accurate accounting information. Thus, the objective of attribute sampling was to determine the reli- ability of the entity’s controls. In this chapter, the purpose of the sampling appli- cation is to determine if a financial statement account is fairly stated.

Two statistical sampling techniques, monetary-unit sampling and classical variables sampling, and a nonstatistical sampling technique are demonstrated in this chapter. While both statistical sampling methods can provide sufficient, appropriate evidence, a monetary-unit sample may be more practical for most audit applications. The chapter starts with an introduction of monetary-unit sampling and an extended example. Nonstatistical sampling is then covered. Advanced Module 1 contains a discussion and example of classical variables sampling.

Final PDF to printer

302 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 302 10/10/15 12:57 PM

Sampling for Substantive Tests of Details of Account Balances

The basic statistical concepts discussed in Chapter 8 are also applicable for sampling approaches used to test account balances. As with attribute sampling, three important deter- minants of sample size for testing account balances are desired confidence level, tolerable misstatement, and estimated misstatement. Unlike attribute sampling in Chapter 8, population size does influence sampling computations when testing monetary account balances. Mis- statements discovered in the audit sample testing an account balance must be projected to the population, and there must be an allowance for sampling risk.

In the preface to Chapter 8, we asked you to imagine that you were an apple inspector. We did this to illustrate some of the basic concepts of audit sampling before covering the techni- cal details. Before we get into the details of audit sampling for substantive tests, we want you to use your developing professional judgment and understanding of sampling to evaluate the sampling results related to a test of the inventory balance provided below. Suppose the mis- statement of $2,000 represents differences between the auditor’s inventory test count and the amount in the entity’s records based on the entity’s inventory counting procedures:

LO 9-1

Book value of the inventory account balance $3,000,000

Book value of items sampled $ 100,000

Audited value of items sampled $ 98,000

Total amount of misstatement observed in audit sample $ 2,000

The purpose of audit sampling is to draw inferences about the entire population (the reported inventory account balance in the example above) from the results of a sample.

Stop and Think: Using just the information provided above, what is your best estimate of the misstatement in the inventory account balance?

In Chapter 8 our best estimate of the population deviation rate for control testing was the sam- ple deviation rate. Similarly, when using audit sampling to test account balances, we will want to project the misstatement observed in the sample to the population. In the example above, the observed misstatement could be projected to the population by computing the ratio of mis- statement to the total dollars sampled: 2 percent ($2,000 ÷ $100,000). Applying this ratio to the entire account balance produces a best estimate or projected misstatement in the inventory account of $60,000 (2% × $3,000,000). If your best estimate is that the account is overstated by $60,000, do you believe the account is fairly stated? The answer to this question, like many questions in auditing, is “it depends.” It depends in part on the amount of misstatement that can be tolerated for the inventory account. If the amount of misstatement that can be tolerated for this account is $50,000, then we cannot conclude that the account is fairly stated because our best estimate (or projected misstatement) is higher than the amount we can tolerate. What if tolerable misstatement were $110,000; would you conclude that the account is fairly stated? The answer is again, “it depends.” Whenever sampling is used, the evaluation must include an allowance for sampling risk. When sampling is used to estimate monetary misstatement, a confidence bound or limit must be established as an allowance for sampling risk. In the above example, the misstatement in the population could be $60,000, but it also might be higher or lower because the estimate is based on a sample. If tolerable misstatement is $110,000, and the upper limit on the account’s possible misstatement is less than $110,000, then the account is considered fairly stated. The size of the upper limit on misstatement is largely dependent on the sample size, which is also directly related to the desired confidence level. This is an important concept—the uncertainty inherent in sampling, sampling risk, decreases as the sample size increases.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 303

mes32502_ch09_300-336.indd 303 10/10/15 12:57 PM

You may remember from your statistics courses using concepts such as a “standard devi- ation” and a “normal distribution” (i.e., Z scores or confidence coefficients) to compute con- fidence limits and intervals. This traditional statistical approach is used for classical variables sampling, which is covered in Advanced Module 1. In response to the difficult mathematical calculations involved in classical variable sampling and due to other limitations discussed later, auditors developed an audit sampling approach for testing balances called monetary-unit sampling. Monetary-unit sampling is based on attribute-sampling concepts. While the compu- tations involved in classical variables sampling can now easily be performed with a personal computer or handheld calculator, auditors have found that monetary-unit sampling provides other important advantages. However, monetary-unit sampling is not the best approach for all substantive tests of details; therefore, in this chapter we also cover nonstatistical sampling and classical variables sampling.

Monetary-Unit Sampling

Monetary-unit sampling (MUS) is based on attribute-sampling theory modified to express a monetary conclusion rather than a rate of occurrence. MUS was developed by auditors to over- come the computational complexity of other statistical sampling techniques and because most accounting populations contain relatively little misstatement. Classical variables sampling is not very effective in dealing with populations with little or no misstatement (see Advanced Module 1). Recent research indicates that account balances sampled by auditors typically do have low error rates.1 MUS is commonly used by auditors to test accounts such as accounts receivable, loans receivable, investment securities, and inventory. While MUS is based on attribute-sampling theory, the fact that MUS is designed to test monetary amounts (e.g., dol- lars, yen, pesos) rather than internal control effectiveness causes important differences in these techniques. The differences are driven by the characteristics of control deviations and monetary misstatements. In attribute sampling, the control either works or it does not. Thus, all items sampled either do or do not represent a deviation. Attribute sampling provides an estimate and upper limit on the percentage of the time that a control is failing. With MUS, the sampling item tested may be valid and posted to the correct account in the correct period, but the dollar amount may not be accurately recorded. For instance, an invoice for $2,565 might be entered into the accounting system as $2,655. In this case there is a misstatement, but the misstatement is only about 3.5 percent of the transaction. A direct application of attribute sampling to mon- etary items would treat all misstatements as deviations, or 100 percent misstatements. How- ever, doing so would not result in a useful estimate of the monetary misstatement in the population. MUS begins with attribute-sampling concepts as a foundation but takes into con- sideration misstatement amounts observed in each sampling unit when computing the best esti- mate of the population misstatement and formulating the confidence limits around this estimated misstatement. Over the years academics, audit firms, and software programmers (e.g., IDEA) have developed slightly different MUS approaches and enhancements. However, the underlying concepts in all MUS approaches are similar to those discussed in this chapter.

To summarize, the basic underlying concepts of MUS are straightforward. MUS uses attribute-sampling theory to estimate the percentage of monetary units in a population that might be misstated (like a sample deviation rate) and then multiplies this percentage by an estimate of how much the dollars are misstated. Keep these basic concepts in mind as you study MUS in this chapter.

MUS is designed primarily to test for overstatement errors. However, it can accommo- date understatement errors if special considerations are made during the evaluation of the sample results. MUS is most appropriate for low-error-rate populations because it provides as effective a test as classical variables sampling does but has a more efficient sample size. Fol- lowing are some advantages and disadvantages of MUS.

LO 9-2

1See M. Durney, R. Elder, S. Glover, “Field Data on Accounting Error Rates and Audit Sampling,” Auditing: A Jour- nal of Practice and Theory (2014).

Final PDF to printer

304 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 304 10/10/15 12:57 PM

Advantages ∙ MUS does not require the user to make any assumptions about the distribution of

misstatements, whereas classical variables sampling (see Advanced Module 1) relies on normal distribution theory and requires an estimate of the variation (or standard deviation) of misstatements in the population.

∙ When the auditor expects little to no misstatements, it is more difficult to determine sample size using classical variables sampling given the need to assume a distribution of misstatements. In the absence of misstatements, a conservative surrogate is used in classical variable sampling (see Advanced Module 1). In situations with little or no misstatement, MUS usually results in a smaller sample size than classical variables sampling.

∙ When applied using a probability-proportional-to-size sample selection procedure as outlined in this text, MUS automatically results in a stratified sample because sampled items are selected in proportion to their dollar amounts. Thus, larger dollar items have a higher probability of being selected. With classical variables sampling, the population must be stratified in order to focus on larger items.

Disadvantages ∙ The selection of zero or negative balances generally requires special design

consideration. For example, if examining zero balances is important (searching for unrecorded liabilities in accounts payable), the auditor must test those items separately because such items will not be selected using a probability-proportional-to-size selection method. Alternatively, if an account such as accounts receivable contains credit balances, the auditor should segregate those items and test them separately.

∙ When more than a few misstatements are detected using an MUS approach, the sample results calculations as shown in the textbook may overstate the allowance for sampling risk. This occurs because the methods used to determine the amount of misstatement are conservative. Thus, an auditor is more likely to reject an acceptable recorded book value and overaudit.2

Applying Monetary-Unit Sampling In Chapter 8 the general considerations when using sampling for substantive tests were discussed along with the steps in a sampling application. In conducting MUS for substan- tive tests of details of account balances, the auditor follows the same basic steps outlined in Chapter 8 for attribute sampling. Table 9–1 lists each step by the three phases in the sampling application. Again, the auditor is required to use substantial judgment and should adequately document the sampling application in the audit working papers.

Planning Step 1: Determine the Test Objectives Audit sampling is most often used in substantive testing to test the hypothesis that a financial statement account is fairly stated.3 The objective of MUS for substantive tests of details is to test the assertion that no material misstatements exist in an account balance, a class of transactions, or a disclosure component of the financial statements.

2There are alternative methods that overcome this disadvantage. However, these methods are more complex. See D. A. Leslie, A. D. Teitlebaum, and R. J. Anderson, Dollar Unit Sampling: A Practical Guide for Auditors (Toronto: Copp, Clark and Pitman, 1979), and W. L. Felix, Jr., R. A. Grimlund, F. J. Koster, and R. S. Roussey, Arthur Ander- sen’s New Monetary-Unit Sampling Approach, Auditing: A Journal of Practice & Theory (Fall 1990), pp. 116, for a discussion of alternative approaches. 3A less common use for sampling is to estimate the size of the misstatement in an account that is known to contain a substantial misstatement. The development of such an estimate may be part of a consulting engagement or to provide supporting evidence related to an entity’s misstatement estimate. The discussion in this chapter is limited to using audit sampling to test the assertion that an account or monetary population is fairly stated.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 305

mes32502_ch09_300-336.indd 305 10/10/15 12:57 PM

Step 2: Define the Population Characteristics To achieve the test objectives, the audi- tor must carefully consider the characteristics of the sampling population.

Define the Population. The auditor must define the population so that the selected sample is appropriate for the assertions being tested, because sample results can be projected only to the population from which the sample was selected. For example, if the auditor is concerned about goods shipped but not billed, the population of shipping documents rather than sales invoices is the appropriate population for drawing the sample.

For MUS, the population is defined as the monetary value of an account balance, such as accounts receivable, investment securities, or inventory. As with attribute sampling, once the population has been defined, the auditor must determine that the physical representation, or frame, of the population is complete. For example, if the auditor is testing the accounts receivable account, he or she would foot the accounts receivable subsidiary ledger and agree the total to the general ledger account to verify the completeness of the frame. Because the auditor selects the sample from the frame, any conclusions about the population relate only to that frame, which is the physical representation of the population. If the frame and the intended sampling population differ, the auditor might very well draw an incorrect conclusion about the population.

Practice I N S I G H T

When applying audit sampling as a detailed test, it is important to properly link the desired level of assurance or confidence from the sample to the achieved level of controls reliance for the related account and assertion. Inspectors find that audit samples used as substantive tests are sometimes designed based on the planned level of reliance on controls; however, inspectors sometimes find evidence of control deficiencies in the audit working papers and in such cases the planned level of reliance would not be supported. As a result, inspectors may conclude that the audit sample used for the substantive test was too small and resulted in insufficient audit evidence being gathered (see, for example, PCAOB Release 104-201-273).

Steps in a Monetary-Unit Sampling Application

Planning 1. Determine the test objectives. 2. Define the population characteristics: • Define the population. • Define the sampling unit. • Define a misstatement. 3. Determine the sample size, using the following inputs: • Desired confidence level or risk of incorrect acceptance. • Tolerable misstatement. • Expected population misstatement. • Population size.

Performance 4. Select sample items. 5. Perform the auditing procedures: • Understand and analyze any misstatements observed.

Evaluation 6. Calculate the projected misstatement and the upper limit on misstatement. 7. Draw final conclusions.

T A B L E 9 – 1

Define the Sampling Unit. With MUS, an individual dollar represents the sampling unit. In fact, this is where monetary-unit (or dollar-unit) sampling gets its name. For example, if the population to be sampled is the accounts receivable balance of $2.5 million, then there are 2.5 million sampling units in the population. However, because the accounts receivable bal- ance is organized by customer or transaction (e.g., customer account or invoice number) and not by individual dollars, the auditor does not audit the individual dollar but rather the customer account or transaction that contains the selected dollar. In other words, while the sampling unit

Final PDF to printer

306 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 306 10/10/15 12:57 PM

is an individual dollar in a customer account (or invoice), the auditor can’t very well audit a single dollar; instead, the auditor will audit the entire customer account (or transaction) that contains the selected dollar. The customer account or transaction that contains the selected dol- lar is called the logical unit. In essence, by selecting a dollar contained in a customer account (or transaction), the auditor by extension selects the logical unit that contains the selected mon- etary unit to audit. If the difference between a sampling unit and a logical unit is not entirely clear to you, don’t worry, we illustrate these concepts in the extended example below.

Define a Misstatement. For MUS, a misstatement is defined as the difference between mon- etary amounts in the entity’s records and amounts supported by audit evidence. A clear mis- statement definition is important because definitions that are too narrow or too broad may result in inefficient or ineffective testing. For example, if an accounts receivable confirmation letter from a customer reports a difference between the customer records and the entity’s records, it would not be considered a misstatement if the difference is explainable and support- able by the circumstances, such as timing differences (e.g., the customer mistakenly confirms a balance as of January 31 when the confirmation letter requests the customer’s balance as of the December 31 year-end) and other documentation supports the entity’s recorded value.

Step 3: Determine the Sample Size Considerable judgment is required in determining the appropriate values for the inputs used to compute an MUS sample size. The following four factors must be considered.

Desired Confidence Level or Acceptable Risk of Incorrect Acceptance. There is a direct relationship between the confidence level and sample size. The basic idea is fairly simple: to increase confidence, more work is required, which is reflected in a larger sample size. Confi- dence level and the risk of incorrect acceptance are complements. If the auditor wants to be 95 percent confident in the sampling conclusion, then he or she must be willing to accept a 5 percent risk of incorrect acceptance. The risk of incorrect acceptance is the risk that the sample supports the conclusion that the recorded account balance is fairly stated when in fact it is not (a Type II error). This risk relates to the effectiveness of the audit. In determining an acceptable risk of incorrect acceptance, the auditor should consider the components of the audit risk model: the acceptable level of audit risk and risk of material misstatement. For prac- tical purposes, the acceptable risk of incorrect acceptance is the same as detection risk (DR) after considering the assessed level of detection risk based on other substantive procedures such as substantive analytical procedures. If the auditor incorrectly accepts an account balance as being fairly stated when it is actually materially misstated, he or she will allow the issuance of financial statements that are not fairly presented. The users of those financial statements may then sue the auditor for damages that result from relying on those financial statements. There is an inverse relationship between the risk of incorrect acceptance and sample size. The lower the acceptable risk of incorrect acceptance, the larger the sample size must be.

Tolerable Misstatement. Tolerable misstatement is the maximum amount by which the account can be misstated and still be acceptable to the auditor as being fairly presented. It will always be less than overall materiality. In Chapter 3 we illustrated how overall material- ity and tolerable misstatement are determined. Remember from Chapter 3 that for an audit to be economically feasible, the auditor and users of the financial statements must tolerate some margin for misstatement (i.e., the auditor provides reasonable assurance that the financial statements are fair, not absolute assurance that the financial statements are error-free).

Audit sampling techniques designed to test the assertion that an account is fairly stated cannot be performed unless tolerable misstatement exceeds expected misstatement by a suffi- cient amount, because there must always be room for an allowance for sampling risk between the two measures. Tolerable misstatement is also inversely related to sample size—the lower the amount of tolerable misstatement, the more precise the test the auditor needs, and the larger the sample size must be.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 307

mes32502_ch09_300-336.indd 307 10/10/15 12:57 PM

Expected Misstatement. The expected misstatement is the dollar amount of misstatement that the auditor believes exists in the population. The auditor can develop this expectation based on the assessment of inherent risk, prior years’ results, a pilot sample, the results of related substantive procedures, or the results of tests of controls. As the expected misstate- ment approaches the tolerable misstatement, the auditor needs more precise information from the sample. Therefore, there is a direct relationship to sample size: the larger the expected misstatement, the larger the sample size must be.

Population Size. Population size is directly related to sample size. Because MUS popula- tions are made up of individual dollars, populations tested with MUS are usually large. As such, some MUS approaches, like the one we demonstrate below using the attributes tables in Chapter 8, do not use population size directly as an input for sample size determination, but population size is used in the conversion of tolerable and expected misstatements to percent- ages, which does influence sample size. However, for approaches like the one used in IDEA, population size is a direct input to determine sample size.

Table 9–2 summarizes the effects of the four factors on sample size.

Computing Sample Sizes Using the Attribute-Sampling Tables A monetary-unit sample size can be determined by using the attribute sample size tables shown in Chapter 8. The auditor first determines the desired confidence level and then converts the tolerable misstatement and the expected misstatement to percentages of the book value of the balance tested. For example, suppose the auditor has established a tolerable misstatement of $125,000 and an expected misstatement of $25,000 for an accounts receivable account with a book value of $2,500,000. The tolerable misstatement would be 5 percent ($125,000 ÷ $2,500,000), and the expected misstatement would be 1 percent ($25,000 ÷ $2,500,000). If the desired confidence level is 95 percent (or a risk of incorrect acceptance of 5 percent), the auditor would use Table 8–5 in Chapter 8. In this example, the sample size is 93. Be sure you can identify how the sample size was determined using Table 8–5 before moving on.

Computing Sample Sizes Using IDEA Software programs like IDEA can also be used to determine sample size. Exhibit 9–1 shows the computation of sample size for the previous example using IDEA. To compute sample size with IDEA, the auditor opens a database (for sample size calculations, it can be any data- base file) and on the “Analysis” tab, in the “Sample” group the auditor clicks on “Monetary Unit,” and then on “Plan.” The Monetary Unit Sampling - Plan window is displayed and the auditor enters the relevant data. The auditor unchecks the box “Use values from database field” and enters “2500000” for “Value of the sampled population,” “95” for “Confidence

The Effect of Sample Selection Factors on Sample SizeT A B L E 9 – 2

Examples

Factor Relationship to Sample Size Change in Factor Effect on Sample

Desired confidence level Direct Lower Decrease

Higher Increase

Tolerable misstatement Inverse Lower Increase

Higher Decrease

Expected misstatement Direct Lower Decrease

Higher Increase

Population size Direct Lower Decrease

Higher Increase

Final PDF to printer

308 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 308 10/10/15 12:57 PM

level %,” “125000” for “Tolerable error,” “25000” for “Expected error,” and clicks the “Esti- mate” button at the top of the window. Note that with IDEA the auditor can enter tolerable and expected misstatement in either dollars or percentage terms. The result is a sample size of 90, which is a slightly smaller sample than the size determined using the tables.4 Advanced Module 2 in this chapter provides a chart comparing the terminology used by IDEA to com- pute sample size and the terminology using the manual approach.

Performance Step 4: Select Sample Items In drawing the sample items, the auditor attempts to select the sample in such a way that it accurately represents the population. The auditor selects a sample for MUS by using a systematic selection approach called probability-proportional-to-size selec- tion, often with the help of a computer program such as IDEA. Probability-proportional-to-size sample selection uses a sampling interval to select sample items. In other words, after a ran- dom start, subsequent items are selected by adding the interval as illustrated below. By using the interval value in the sample selection process, larger logical units have a higher probability of being selected. The sampling interval can be determined by dividing the book value of the population by the sample size. Keep in mind that MUS defines an individual dollar (or other monetary unit) as the sampling unit. Because the first sampling item is randomly selected within the first interval, each individual dollar in the population has an equal chance of being selected. Figure 9–1 provides an example of how probability-proportional-to-size selection is applied.

In Figure 9–1, the total book value of the entity’s accounts receivable balance is $2,500,000, and the auditor determined a sample size of 93. The sampling interval will be $26,882 ($2,500,000 ÷ 93). To select a probability-proportional-to-size sample, the auditor arranges the entity’s accounts receivable records in some order (e.g., by customer number or alphabetically) and then creates a column of cumulative dollars. In Figure 9–1, the customer records are arranged by customer number. The auditor obtains a random number between 1

4IDEA software uses a different underlying statistical distribution than the attribute-sampling tables, which resulted in a slightly smaller sample size from IDEA (see footnote 6).

Sample Size Calculation Using IDEA™ SoftwareE X H I B I T 9 – 1

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 309

mes32502_ch09_300-336.indd 309 10/10/15 12:57 PM

and the size of the sampling interval ($26,882) by using computer software such as IDEA or MS Excel. The random number becomes the first sample item selected, and then the sampling interval is added to determine the second sampling item and so on for every 26,882nd dollar in the population. In the example illustrated in Figure 9–1, the random start is $3,977, and the customer account that contains the 3,977th dollar is selected for testing. In this case, Admin- gton Hospital, with a balance of $15,495, is selected for testing. The auditor then adds the sampling interval, either manually or with the aid of a computer program, through the popula- tion and selects each logical unit that contains the computed amount.5 Following this process, the second customer account selected would be Good Hospital Corp., which contains the 30,859th dollar ($3,977 + 26,882) and has a balance of $21,893. The third account would be Axa Corporation, which contains the 57,741st dollar ($30,859 + 26,882), and so on until the entire population has been subjected to sampling and 93 units have been selected.

The advantage of using this approach to select the sample is that while each dollar in the population has an equal chance of being selected, logical units containing more dollars have a higher chance of being selected, hence the name “probability-proportional-to-size” sample selection. Note that all logical units with a book value larger than the sampling interval (such as Axa Corporation and Lilly Health, Inc.) are certain to be selected using this method. From an audit perspective, this approach guarantees that all individually significant accounts are examined and that, in general, the sample will be made up of larger accounts. This approach is particularly appropriate when the auditor is primarily concerned about overstatements and larger overstatements are expected to be found in larger logical units (such as with accounts receivable). If the auditor is primarily concerned about understatements or unrecorded amounts, other selection techniques (e.g., random or specific identification) should be used.

Stop and Think: In the example in Figure 9–1, what is the probability that customer 1213, Andrew Call Medical (with a zero balance), will be selected?

The probability that a customer with a zero balance will be selected using systematic selection of monetary values is zero because there are no monetary units to select.

When the logical unit, a customer account in this example, exceeds the sampling interval, more than one sampling unit may be selected from the same logical unit. If this happens, the

5The Systematic Sample command in IDEA’s sampling menu can also be used to select a probability- proportional- to-size sample.

An Example of Probability-Proportional-to-Size SelectionF I G U R E 9 – 1

Customer Number and Name (Logical Unit) Customer Balance

Cumulative Dollars

Sample Items (Random start $3,977,

interval $26,882)

1001 Ace Emergency Center $ 2,350 $ 2,350 1002 Admington Hospital 15,495 17,845 (1) $ 3,977 1003 Jess Base, Inc 945 18,790 1004 Good Hospital Corp. 21,893 40,683 (2) 30,859 1005 Jen Mara Corp. 3,968 44,651 1006 Axa Corporation 32,549 77,200 (3) 57,741 1007 Green River Mtg 2,246 79,446 1008 Bead Hospital Centers 11,860 91,306 (4) 84,623

• • • • • • • • • • • •

1213 Andrew Call Medical 0 2,472,032 • 1214 Lilly Health, Inc. 26,945 2,498,977 (93) $2,477,121 1215 Jayne Ann Corp. 1,023 $2,500,000 Total Accounts Receivable $2,500,000

Final PDF to printer

310 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 310 10/10/15 12:57 PM

logical unit is included only once when the sample results are evaluated. Thus, the number of logical units examined may be less than the computed sample size, which is another advan- tage of this selection technique. In fact, once the auditor has used the computed sample size to determine an interval, the computed sample size is not used again in an MUS application. As you will see later, rather than use the computed sample size in the evaluation of results, the auditor uses the sampling interval.

Step 5: Perform the Audit Procedures After the sample items have been selected, the auditor conducts the planned audit procedures on the logical units containing the selected sam- pling units. In some instances, the auditor may not be able to conduct the planned procedures on a particular logical unit (e.g., customer account). This may occur, for example, because a supporting document is missing. Unless other evidence is available, such items should be con- sidered misstatements. The auditor must also be careful to conduct the audit procedures so as to avoid nonsampling errors caused by carelessness, poor supervision, or mistaken judgment. After all the audit procedures have been completed, the auditor evaluates the sample results.

Evaluation Step 6: Calculate the Projected Misstatement and the Upper Limit on Misstate- ment The misstatements detected in the sample must be projected to the population. As mentioned earlier, an MUS application is designed primarily to test for overstatement errors. The projection of the errors to the population is referred to as the projected misstatement (IDEA refers to this as the most likely error); it is comparable to the sample deviation rate or best estimate in Chapter 8. The auditor calculates an allowance for sampling risk and adds it to the projected misstatement. The total of the projected misstatement and the allowance for sam- pling risk is referred to as the upper misstatement limit (IDEA refers to this as the upper error limit; see Advanced Module 2 for IDEA terminology). These computations are somewhat involved, so rather than talk about them in abstract terms, we explain them using an example.

An Extended Example An example is used to demonstrate the computation and evaluation of projected and upper misstatement limit (UML) of a monetary-unit sampling application. The following information relates to the audit of an entity’s accounts receivable balance:

LO 9-3

Example Information

• Book value = $2,500,000 • Tolerable misstatement = $125,000 • Sample size = 93 • Desired confidence level = 95% • Expected amount of misstatement = $25,000 • Sampling interval = $26,882

The calculations of sample size and sampling interval using the attribute sampling tables were shown previously. Assume that, based on the auditor’s understanding of the busi- ness and previous experience auditing this account, the auditor is primarily concerned with overstatements.

Basic Precision As you learned in Chapter 8 with attribute sampling, even when the audi- tor observes no control deviations, the allowance for sampling risk still results in a computed upper deviation limit. The same is true for MUS; if no misstatements are found in the sample, the projection or best estimate of the population misstatement would be zero dollars. However, even with zero projected misstatements, an allowance for sampling risk must be computed, which will result in an upper misstatement limit that is greater than zero. This allowance for sampling risk when no misstatements are observed is referred to as the basic precision. If the appropriate sample size was computed and was then used to derive the sampling interval and no misstatements were found in the logical units tested, then the upper misstatement limit will be less than or equal to the tolerable misstatement used to compute the sample size.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 311

mes32502_ch09_300-336.indd 311 10/10/15 12:57 PM

In evaluating MUS results, the sampling interval and the desired level of confidence are two of the important factors, along with the MUS misstatement factors in Table 9–3 (see foot- note 4). In the example, the sampling interval is $26,882 and the desired level of confidence is 95 percent. For basic precision, use the factor associated with zero misstatements in Table 9–3. The misstatement factor is 3.0. The upper misstatement limit (and basic precision) is thus $80,646 (3.0 × $26,882). The basic precision essentially assumes any undetected mis- statements in the population are misstated by 100 percent. This is a conservative assumption, but it is justified because the potential cost of underestimating the amount of misstatement in an entity’s financial statements is very high.

In practice, auditors use firm-specific MUS guidance or software programs like IDEA to determine MUS sample sizes and to evaluate MUS results. Although firms and software devel- opers use different algorithms and assumptions in computing MUS misstatement limits, the underlying theory and ultimate conclusions are similar. We demonstrate how to manually com- plete the calculations, which will help you better understand output from packages like IDEA.

Misstatements Detected Assume that the auditor sent confirmations to the customers selected from the entity’s accounts receivable account using a sampling interval of $26,882 as illustrated in Figure 9–1 and that all but four customers returned confirmations indicating the entity’s records are correct. Based on document inspection and inquiry of management, the four detected misstatements appear to be unintentional processing errors. For example, discounts granted were not recorded or in the case of Learn Heart Centers the merchandise was returned prior to year-end, but the credit was not processed until the subsequent period. The following table lists the misstatements detected:

Customer Book Value Audit Value Difference Tainting Factor

(column 4 ÷ column 2)

Good Hospital Corp. $21,893 $18,609 $3,284 .15 Marva Medical Supply 6,705 4,023 2,682 .40 Learn Heart Centers 15,000 0 15,000 1.00 Axa Corp. 32,549 30,049 2,500 Not applicable*

*Book value is greater than the sampling interval, which means the item will be selected, the error is known and there is no sampling risk.

6The misstatement factors in Table 9–3 are based on computed upper deviation rate factors used in attribute sampling (based on the binomial distribution). In MUS, the sampling interval and the tainting factor are used in the evalua- tion, and as later illustrated, the original computed sample size is not used in the evaluation approach when using the attribute sampling tables. When the population is large and the misstatement rate is low (both common for MUS applications using accounting data), the limiting form of the binomial distribution is the Poisson distribution, which only requires the level of confidence to determine the appropriate misstatement factor to compute the upper misstate- ment limit (see Leslie et al., 1979, Dollar Unit Sampling). The Poisson distribution factors are nearly identical to the misstatement factors in Table 9–3.

Monetary Unit Sampling Misstatement Factors for Sample Evaluation6

90% Desired Confidence Level 95% Desired Confidence Level

Number of Misstatements

Misstatement Factor

Incremental Increase

Misstatement Factor

Incremental Increase

0 2.3 3.0 1 3.9 1.6 4.7 1.7 2 5.3 1.4 6.2 1.5 3 6.6 1.3 7.6 1.4 4 7.9 1.3 9.0 1.4 5 9.1 1.2 10.3 1.3 6 10.3 1.2 11.5 1.2

T A B L E 9 – 3

Final PDF to printer

312 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 312 10/10/15 12:57 PM

Overstatement Misstatements Detected If misstatements are found in the sample, the auditor needs to calculate a projected or likely misstatement and an allowance for sampling risk. Because in an MUS sample each selected dollar “represents” a group of dollars in the population, the percentage of misstatement in the logical unit represents the percentage of misstatement in the sampling interval from which the dollar was selected. Three types of situ- ations can occur with detected misstatements.

1. The logical unit is equal to or greater than the sampling interval. In this situation, the projected misstatement is equal to the actual misstatement detected in the logical unit. For example, the Axa Corporation account in Figure 9–1 contained a balance of $32,549, which is larger than the sampling interval of $26,882. In the example, the projected misstatement associated with this account would be $2,500, and no sampling risk is added. No allowance for sampling risk is necessary for these large accounts because all accounts larger than the sampling interval will automatically be selected by an MUS sampling approach using probability- proportional-to-size selection. Since all the dollars in the large accounts are audited, there is no risk of additional potential misstatement associated with large accounts (logical units).

2. The logical unit’s book value is less than the sampling interval, and it is misstated by less than 100 percent. This is the most common situation. The percentage of misstatement in the logical unit is referred to as the tainting factor. The tainting factor is calculated using the following formula:

Tainting factor = Book value − Audit value _____________________ Book value

For example, the Good Hospital Corp. account is overstated by $3,284. Thus, the tainting factor for the account would be .15 [(21,893 - 18,609) ÷ 21,893]. The projected misstatement for the interval containing this logical unit would be $4,032 (.15 × $26,882). The tainting factor associated with the interval containing the Marva Medical Supply account is .40 ($2,682 ÷ $6,705), and the projected misstatement for the interval is $10,753 (.40 × $26,882). An allowance for sampling risk would be added to these projected misstatements as illustrated below.

3. The book value of the logical unit is less than the sampling interval, and it is 100 percent misstated. Because the logical unit represents the group of dollars in the sampling interval, the sampling interval is assumed to be 100 percent in error. In the above example, the audited value for Learn Heart Centers is $0. The projected error for the interval containing this logical unit is $26,882, which is determined by multiplying the percentage misstated (100 percent) by the size of the sampling interval ($26,882). An allowance for sampling risk would be added to this amount as illustrated below.

Computing Upper Misstatement Limit Manually To compute the upper misstatement limit (UML), the auditor first computes basic pre-

cision and then ranks the detected misstatements based on the size of the tainting factor from the largest tainting factor to the smallest. Projected and upper misstatement limits are computed using the computed tainting factor and the appropriate misstatement factor from Table 9–3. Finally, misstatements detected in logical units greater than the sampling interval are added.

The UML in this case is $150,621 and is calculated as follows. First, basic precision, $80,646, is computed by multiplying the sampling interval by the misstatement factor from Table 9–3, ($26,882 × 3.0). The $80,646 represents the sampling risk that exists even if no misstatements are observed in the sample. Remember, because we are basing our conclusions on a sample, we cannot be sure there are no misstatements in the population even if we find none in the sample.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 313

mes32502_ch09_300-336.indd 313 10/10/15 12:57 PM

Second, logical units smaller than the interval where misstatements are detected, Learn Heart Centers, Marva Medical, and Good Hospital, are ranked according to the size of their tainting factor from largest to smallest.

Third, the projected misstatements for Learn Heart Centers, Marva Medical, and Good Hospital are calculated. Projected misstatement is computed by multiplying the sampling interval by the tainting factor (column 2 × column 3). This calculation is based on the assump- tion that the dollar selected for testing represents the sampling interval. In turn, it is assumed that the extent of misstatement in the logical unit that contains the sampled dollar represents the amount of misstatement in the sampling interval.

Next, for the intervals containing the Learn Heart Centers, Marva Medical, and Good Hospital accounts, an allowance for sampling risk is added to the projected misstatement by multiplying the projected misstatement by the incremental change in the misstatement factor for the desired confidence level. In this example, the desired confidence is 95 percent, so the misstatement factors are taken from the appropriate column in Table 9–3. For basic precision, the factor, 3.0, is taken from the “Misstatement Factor” column of Table 9–3 (95 percent con- fidence) because it is the first “layer” of the UML calculation.

For the first misstatement observed, Learn Heart Centers, the misstatement factor from Table 9–3 (95 percent confidence) is 4.7. However, the misstatement factors in Table 9–3 are cumulative. In other words, the factor for 1 misstatement, 4.7, includes the sampling risk asso- ciated with zero misstatements (i.e., it includes the misstatement factor 3.0). Since basic preci- sion already includes the factor for zero misstatements, only the increase or increment is used for the first misstatement, and likewise for subsequent misstatements. The incremental change is calculated by simply subtracting the misstatement factor for the current number of misstate- ments from the factor for the previous number of misstatements (i.e., 4.7 - 3.0 = 1.7). Thus, for Good Hospital, the projected misstatement is $4,032, and the UML is $5,645 (1.4 × $4,032) as illustrated in the table above. The difference between the projected misstatement and the UML is the allowance for sampling risk. Thus, the allowance for sampling risk for Good Hos- pital is $1,613 ($5,645 - $4,032).

Ranking the logical units by their tainting factors leads to a UML that is conservative because the largest tainting factor is multiplied by the largest incremental change in the mis- statement factor. This conservative approach means there is a higher risk that an acceptable account balance will be rejected by the auditor.

Finally, misstatements detected in logical units that are greater than the sampling inter- val are added to the upper limit. As noted earlier, the reason misstatements from logical units greater than the sampling interval do not require projection or the consideration of sampling risk is because all accounts larger than the sampling interval will automatically be selected by a probability-proportional-to-size sampling approach. Since all the dollars in the large accounts are audited, there is no sampling risk associated with large accounts (logical units). Thus, in the example above, the misstatement detected in Axa Corp.’s balance, $2,500

Customer Name

Tainting Factor

Sampling Interval

Projected Misstatement

(columns 2 × 3)

95% Misstatement Factor or Increment

(from Table 9–3)

Upper Misstatement Limit

(columns 2 × 3 × 5)

Basic Precision 1.0 $26,882 NA 3.0 $ 80,646 Learn Heart Centers 1.0 26,882 26,882 1.7 (4.7 – 3.0) 45,700 Marva Medical 0.40 26,882 10,753 1.5 (6.2 – 4.7) 16,130 Good Hospital 0.15 26,882 4,032 1.4 (7.6 – 6.2) 5,645 Add misstatements

detected in logical units greater than the sampling interval:

Axa Corp. NA 26,882 2,500 NA 2,500

Total $44,167 $150,621

NA = not applicable

Final PDF to printer

314 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 314 10/10/15 12:57 PM

($32,549 - $30,049), is simply added to the upper misstatement. Similarly, the misstatement in Axa Corp is added to the other projected error amounts to come up with total projected misstatement of $44,167.

Step 7: Draw Final Conclusions For this example, the final decision on whether the accounts receivable balance is materially misstated is made by comparing the tolerable mis- statement to the UML. If the UML is less than or equal to the tolerable misstatement, the evidence supports the conclusion that the account balance is not materially misstated. In this case the UML of $150,621 is more than the tolerable misstatement of $125,000. Because the UML exceeds the tolerable misstatement of $125,000, the auditor has evidence that there is an unacceptably high risk that accounts receivable is materially misstated.

The auditor now has four options. First, the sample size can be increased. While this approach is possible in theory, it is not practical in many audit settings. Second, other substan- tive procedures can be performed. This approach might be followed if the auditor’s qualitative analysis of the detected misstatements indicates that there is a systematic problem with the population. For example, the auditor might determine that three of the misstatements occurred in the pricing of one particular product line sold by the entity. In this instance, he or she might design a substantive procedure that examines the pricing of all sales in that product line. Third, the auditor can request that management adjust the accounts receivable balance. In our exam- ple, the minimum adjustment would be $25,621 ($150,621 - $125,000). If the entity adjusts the account by $25,621, the UML will be equal to or less than the tolerable misstatement at a 5 percent risk of incorrect acceptance. Finally, if the entity refuses to adjust the account, the auditor would issue a qualified or adverse opinion (this situation would be extremely rare).

Table 9–4 illustrates the risks auditors face when evaluating an account balance based on sample evidence. If the evidence supports the fairness of the account balance based on the sample evidence and the account is not materially misstated, the auditor has made a correct decision. If the evidence does not support the fairness of the account based on the sample evidence and the account is materially misstated, a correct decision has also been made. The other two combinations result in decision errors by the auditor. If the evidence does not sup- port the fairness of the account when it is in reality not materially misstated (Type I error), the auditor will have incorrectly rejected the account. This can lead to overauditing and an inef- ficient audit. If the evidence supports the account as fairly stated when the account actually contains a material misstatement, the auditor will have incorrectly accepted the account (Type II error). Keep in mind, however, that the auditor almost never finds out the “true” account balance unless later events, such as lawsuits against the auditor for issuing a report on mis- leading financial statements, require an examination of the entire population.

Computing Projected Misstatement and Upper Error Limit Using IDEA Exhibit 9–2 shows the evaluation of the sample results using IDEA software and the sample size computed in Exhibit 9–1. The Upper Error Limit is $146,473 and the Most Likely Error is $45,189. To use IDEA to evaluate sample results the auditor must have the underlying IDEA data file open containing the book value and audit value of the sampled items. The IDEA evaluation interface is somewhat complex and is not illustrated here; however,

The Auditor’s Risks When Evaluating a Financial Statement Account Based on Sample Evidence

True State of Financial Statement Account

Auditor’s Decision Based on Sample Evidence Not Materially Misstated Materially Misstated

Supports the fairness of the account balance

Correct decision Risk of incorrect acceptance (Type II)

Does not support the fairness of the account balance

Risk of incorrect rejection (Type I) Correct decision

T A B L E 9 – 4

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 315

mes32502_ch09_300-336.indd 315 10/10/15 12:57 PM

Sample Results with Overstatement Misstatements Using IDEA™ SoftwareE X H I B I T 9 – 2

opportunities to evaluate MUS sample results using IDEA are included in the IDEA problems available on Connect. In comparing the manually computed projected error, $44,167, and the manually computed UML, $150,621 (illustrated earlier using the attribute sampling tables), to IDEA’s projected error and upper error limit, we see the values are similar but not identical.

Final PDF to printer

316 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 316 10/10/15 12:57 PM

As illustrated in the bottom of Exhibit 9–2, IDEA uses a different underlying statistical distri- bution to estimate misstatement factors than does the manual approach illustrated earlier. Advanced Module 2 in this chapter provides a chart comparing the terminology used by IDEA and the terminology used when using the tables to evaluate MUS test results.7

7The warning at the bottom of the IDEA output screen refers to how “High Value” items are handled in the evalua- tion. When there are very large items that may be selected multiple times by using the sampling interval and system- atic selection, IDEA’s technical literature provides alternative approaches to handle such cases. 8See Leslie et al., 1979, Dollar Unit Sampling. Alternative approaches are also used in practice. For example, if the direction of the errors in the population is unknown, a two-sided confidence interval can be constructed by separat- ing the understatements and calculating a lower limit on misstatements. See A. D. Bailey, Jr., Statistical Auditing: Review, Concepts, and Problems (New York: Harcourt Brace Jovanovich, 1981), for a discussion of this approach.

Practice I N S I G H T

Audit firms typically develop standardized documentation templates for audit sampling applications to ensure all steps in the process are completed and documented in a consistent manner. You should be aware that alternative methods of calculating the upper limit on misstatement are avail- able and used by some public accounting firms. These alternative methods will produce UMLs that are somewhat different from those shown here. While there are minor differences in how MUS is car- ried out, the foundational concepts are the same so your understanding of the techniques illustrated in this chapter will carry over to other approaches.

The Effect of Understatement Misstatements The methodology used earlier for computing the UML is based on the auditor’s assumption, at the time of planning the sam- pling application, that all errors in the population are overstatements. Recall that MUS is not particularly effective at detecting understatements because under an MUS approach the probability of selecting a smaller account is proportionately lower than the probability of selecting a larger account. Thus, an understated account is, by definition, less likely to be selected than an overstated account. In the extreme, an account could be missing from the records or it could be 100 percent understated and recorded at a value of $0; in either case the probability of the account being selected for audit will be zero. When understate- ment errors are detected, different approaches can be used. Some approaches adjust the total “most likely error” downward but do not adjust the “upper-error limit.” To demon- strate this approach, assume that the auditor detected the four overstatement misstatements shown in the previous example and that the following understatement misstatement was also detected.

Customer Book Value Audit Value Difference Tainting Factor

(column 4 ÷ column 2)

Wayne County Medical $2,000 $2,200 -200 -.10

The computations below show the evaluation of the sample results including the under- statement misstatement. Note that the UML is still $150,621 but that projected misstate- ment is now reduced by the projected understatement $2,688 (.10 × $26,882). Because this approach for including understatements in the evaluation does not influence the UML, understatements are always added to the evaluation table after the overstatement errors. In other words, even if the understatement tainting factor had been larger than tainting factors of overstatement errors, the understatement would still be placed in the table after the ranked overstatement taints.

Some auditors also adjust down the UML by the projected understatement to obtain a net upper misstatement limit,which in our example would reduce the UML to $147,933 ($150,056 – $2,688).8 Using the previous decision rule, the auditor would still conclude that

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 317

mes32502_ch09_300-336.indd 317 10/10/15 12:57 PM

the account was materially misstated because the net UML of $147,933 is more than the toler- able misstatement of $125,000.

IDEA adjusts down both the most likely error and the upper error limit and reports a “Gross upper error limit” and a “Net upper error limit.” Exhibit 9–3 shows the evaluation of the sample results, including the understatement misstatement, using IDEA software and sample size computed in Exhibit 9–1. The most likely or projected understatement is $2,778. Note that the “Gross upper error limit” is still $146,473 but that the “Net upper error limit” is now reduced by the projected understatement $143,695 ($146,473 – 2,778). Similarly, the “Net most likely error” is reduced by the same projected understatement.

Customer Name Tainting Factor

Sampling Interval

Projected Misstatement

(columns 2 × 3)

95% Misstatement Factor or Increment

(from Table 9–3)

Upper Misstatement Limit (columns

2 × 3 × 5)

detected in logical units greater than the sam- pling interval:

Axa Corp. NA 26,882 2,500 NA 2,500

Total $41,479 $150,621

NA = not applicable

Sample Results with Under- and Overstatements Using IDEA™ SoftwareE X H I B I T 9 – 3

Final PDF to printer

318 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 318 10/10/15 12:57 PM

Nonstatistical Sampling for Tests of Account Balances9

Nonstatistical audit sampling is commonly used in practice.10 Remember from our discussion of nonstatistical sampling in Chapter 8 that “nonstatistical” sampling is not “bad” sampling and that auditing standards require that nonstatistical approaches yield sample sizes and eval- uations comparable to statistical sampling. As discussed in Chapter 8, audit firms find that there are some advantages to using a tailored nonstatistical sampling approach (e.g., firms’ expert judgments are built into templates and guidance such as the confidence levels defined as high, moderate, and low assurance; more consistent application of sampling; and allowance of appropriate auditor judgment during the final evaluation). When conducting a nonstatisti- cal sampling application for testing an account balance, the auditor considers each of the steps shown in Table 9–1. The sampling unit for nonstatistical sampling is normally a customer account, an individual transaction, or a line item on a transaction. When a nonstatistical sam- pling application is used, the following items need further explanation:

∙ Identifying individually significant items. ∙ Determining the sample size. ∙ Selecting sample items. ∙ Calculating the sample results.

Identifying Individually Significant Items In many nonstatistical sampling applications, the auditor determines which items should be tested individually and which items should be subjected to sampling. The items that will be tested individually are items that may contain potential misstatements that individually exceed tolerable misstatement. These items are tested 100 percent because the auditor is not willing to accept any sampling risk. For example, an auditor using nonstatistical sampling may be examining an entity’s accounts receivable balance in which 10 customer account bal- ances are greater than tolerable misstatement. The auditor would test all 10 large accounts, and supposing that those 10 made up 40 percent of the total account balance, the auditor would apply nonstatistical audit sampling to the remaining customer accounts making up the other 60 percent of the total balance. Testing all individually significant items produces an emphasis on large items similar to probability-proportional-to-size selection. Recall that probability-proportional-to-size selection guarantees that all items greater than the sampling interval will be included in the sample.

Determining the Sample Size When determining the sample size, the auditor should consider the level of desired confi- dence, the risk of material misstatement, the tolerable and expected misstatements, and the population size. While an auditor may determine a nonstatistical sample size by using profes- sional judgment, auditing standards indicate that the sample sizes for statistical and nonsta- tistical sampling should be similar (AU-C 530.A14). Thus, it is common for firms to develop guidance for nonstatistical sampling based on statistical theory such as the formula provided below, which was adapted from the AICPA Audit Guide Audit Sampling:11

Sample size = ( Sampling population book value ______________________________ Tolerable − Expected misstatement ) × Confidence factor

LO 9-4

9The approach presented here for nonstatistical sampling is based on the American Institute of Certified Public Accountants, Audit Sampling (Audit Guide) (New York: AICPA, 2012). 10See R. Elder, A. Akresh, S. Glover, J. Higgs, and J. Liljegren, Audit Sampling Research: A Synthesis and Impli- cations for Future Research, Auditing: A Journal of Practice and Theory (2013), and B. Christensen, R. Elder and S. Glover, “Behind the Numbers: Insights into Large Audit Firm Sampling Approaches,” Accounting Horizons (2015). 11This formula is based on the statistical theory underlying monetary-unit sampling. This approach will yield lower confidence levels as expected misstatement becomes larger relative to tolerable misstatement.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 319

mes32502_ch09_300-336.indd 319 10/10/15 12:57 PM

The “sampling population book value” excludes the amount of items to be individually audited. The confidence factor is identified by determining the level of desired confidence (largely driven by the amount of other relevant audit evidence in the “assurance bucket”; see Chapter 5) and the risk of material misstatement (i.e., inherent and control risk). Table 9–5 con- tains the confidence factors for various combinations of desired confidence and risk assessment.

Selecting Sample Items When any form of audit sampling is used to gather evidence, auditing standards require that the sample items be selected in such a way that the sample can be expected to represent the population. While some form of random sample or systematic selection (e.g., probability pro- portional to size) is required for statistical sampling, auditing standards allow the use of these selection methods, as well as other selection methods including haphazard sampling when using nonstatistical sampling. As discussed in Chapter 8, haphazard selection allows the audi- tor to “randomly” select items judgmentally (i.e., with no conscious biases or reasons for including or omitting items from the sample). This does not imply that the items are selected in a careless manner; rather, the sampling units are selected such that they will be representa- tive of the population. Research indicates that haphazard selection is commonly used in prac- tice.12 The reason haphazard selection is not appropriate for statistical sampling is because people are not very good at being truly random, no matter how hard we may try. For example, the first item on a report or computer screen may never be selected by the auditor because it doesn’t feel “random” to the auditor to select the very first item. Such biases mean that each item in the population did not have an equal chance of being selected.

Calculating the Sample Results Auditing standards require that the auditor project the amount of misstatement found in the sample to the population. There are two common methods of projecting the amount of mis- statement found in a nonstatistical sample.

The first method of projecting the sample results to the population is to apply the mis- statement ratio observed in the sample to the population. For example, if the auditor finds misstatements of $1,500 in a sample totaling $15,000, the misstatement ratio in the sample is 10 percent (1,500 ÷ 15,000), and that ratio is applied to the population. If the total pop- ulation is $200,000, then projected misstatement using the ratio approach will be $20,000 (10% × $200,000). This method of projection is often referred to as ratio projection, and it is used with both nonstatistical sampling and classical variables statistical sampling (see Advanced Module 1 in this chapter). Ratio projection is used when the dollar amount of mis- statement is expected to relate to the dollar amount of items tested.

The second method, referred to as difference projection, projects the average misstate- ment of each item in the sample to all items in the population and is used when the misstate- ment is expected to be relatively constant for all items in the population regardless of their dollar size. Difference estimation is the name of a sampling technique that uses information

12See B. Christensen, R. Elder and S. Glover, Behind the Numbers: Insights into Large Audit Firm Sampling Approaches, Accounting Horizons (2015).

Confidence Factors for Nonstatistical Sampling

Desired Level of Confidence

Assessment of Risk of Material Misstatement High Moderate Low

High 3.0 2.3 2.0 Moderate 2.3 1.6 1.2 Low 2.0 1.2 1.0

T A B L E 9 – 5

Final PDF to printer

320 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 320 10/10/15 12:57 PM

about misstatements to determine sample size, projected misstatement, and confidence bounds. Difference estimation is illustrated in Advanced Module 1.

In evaluating the results of a nonstatistical sample, the auditor uses professional judgment and experience to draw a conclusion. If the sample is drawn haphazardly (versus randomly), the allowance for sampling risk cannot be statistically quantified within a specified level of confidence. The Audit Sampling guide provides the following direction:

If the total factual and projected misstatement is less than the tolerable misstatement for the account balance or class of transactions, the auditor then should consider the risk that such a result might be obtained even though the true monetary misstatement for the population exceeds tolerable mis- statement. Alternatively, the auditor may compare the projected misstatement to the expected mis- statement used in determining the sample size. When projected misstatement exceeds the expected misstatement, the sample may not be large enough to provide the planned risk of incorrect accep- tance (that is, results in an inadequate allowance for sampling risk).

Stop and Think: What factors would cause a sampling approach to be labeled “nonstatistical”?

An approach is considered nonstatistical if (1) judgment, rather than a statistical table or formula, is used to determine the sample size, (2) a haphazard sample selection technique is used, and/or (3) the sample results are evaluated judgmentally. A nonstatistical approach can involve random selection and a judgmental evaluation. Haphazardly selected samples should not be formally evaluated statistically (although such an evaluation could be used to inform an audi- tor’s judgment). However, it is important to note that any randomly drawn sample can be statisti- cally evaluated—even if the auditor labels the approach “nonstatistical” and even if the sample size was not statistically derived. This is an important point because it highlights the need for auditors to understand the key concepts of sampling theory even if they are using a nonstatistical approach. If an auditor randomly selects a sample and evaluates the results judgmentally, the quality of his or her judgment can be compared to statistical theory by an outside expert.

An Example of Nonstatistical Sampling This example extends the example shown in Chapter 8 for the tests of controls of the revenue process for Calabro Wireless Services, Inc. The audit senior, Andrew Judd, has decided to design a nonstatistical sampling application to examine the accounts receivable balance of Calabro Wireless Services at December 31, 2013. As of December 31, there were 11,800 accounts receivable accounts with a balance of $3,717,900, and the population is composed of the following strata:

Number and Size of Accounts Book Value of Stratum

15 accounts > $25,000 $ 550,000

250 accounts > $3,000 850,500

11,535 accounts < $3,000 2,317,400

Judd has made the following decisions:

∙ Based on the results of the tests of controls, the risk of material misstatement is assessed as low.

∙ The tolerable misstatement allocated to accounts receivable is $55,000, and the expected misstatement is $15,000.

∙ The desired level of confidence is moderate based on the other audit evidence already gathered.

∙ All customer account balances greater than $25,000 will be audited.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 321

mes32502_ch09_300-336.indd 321 10/10/15 12:57 PM

Based on these decisions, the sample size is determined as follows. First, individually significant items are deducted from the account balance, leaving a balance of $3,167,900 ($3,717,900 - $550,000) to be sampled. Second, the sample size for the remaining balance is determined using the nonstatistical sample size formula:

Sample size = ( $3, 167, 900 _________________ $55, 000 − $15, 000 ) × 1.2 = 95 The confidence factor of 1.2 is determined by using Table 9–5 and a “Low” assessment

for risk of material misstatement and “Moderate” level of desired confidence. The 95 sample items are divided between the two strata based on the recorded amount for each stratum. Accordingly, 26 [($850,500 ÷ $3,167,900) × 95] of the 95 are allocated to the stratum of accounts greater than $3,000 and 69 to the stratum of accounts less than $3,000. The total number of items tested is 110, composed of 15 individually significant accounts and a sample of 95 items.

Judd mailed positive confirmations to each of the 110 accounts selected for testing. Either the confirmations were returned to Judd or he was able to use alternative procedures to determine that the receivables were valid. Four customers indicated that their accounts were overstated, and Judd determined that the misstatements had resulted from unintentional errors by entity personnel. The results of the sample are summarized as follows:

Stratum Book Value of Stratum

Book Value of Sample

Audit Value of Sample

Amount of Overstatement

>$25,000 $ 550,000 $550,000 $549,500 $ 500 >$ 3,000 850,500 425,000 423,000 2,000 <$ 3,000 2,317,400 92,000 91,750 250

Stratum Known or Factual

Misstatement Ratio of Misstatements

in Stratum Tested Projected

Misstatement

>$25,000 $ 500 Not Applicable—100% Tested $ 500 >$ 3,000 2,000 ($2,000 ÷ 425,000) × $850,500 4,002 <$ 3,000 250 ($250 ÷ 92,000) × $2,317,400 6,298 Total projected misstatement $10,800

Based on analysis of the misstatements found, Judd concluded that the amount of mis- statement in the population was likely to correlate to the total dollar amount of the items in the population and not to the number of items in the population. Thus, he decided to use ratio projection (applying the ratio of misstatement in the sampling strata) to compute the projected misstatement. His projection of the misstatements follows:

The total projected or likely misstatement is $10,800. Judd should conclude that there is an acceptably low risk that the true misstatement exceeds the tolerable misstatement because the projected misstatement of $10,800 is less than the expected misstatement of $15,000.

Before reaching a final conclusion on the fair presentation of Calabro’s accounts receiv- able balance, Judd would consider the qualitative characteristics of the misstatements detected and the results of other auditing procedures. If these steps are successfully com- pleted, Judd can conclude that the accounts receivable balance is fairly presented in confor- mity with GAAP.

Advanced Module 1: Classical Variables Sampling

Classical variables sampling uses normal distribution theory to evaluate the characteristics of a population based on sample data. This approach to audit sampling is similar to the tech- niques taught in college introductory statistics courses. While this is not a statistics book, we do want to discuss briefly how distribution theory is helpful for audit sampling. In Figure 9–2

LO 9-5

Final PDF to printer

322 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 322 10/10/15 12:57 PM

you will see two normally distributed, bell-shaped curves that depict sampling distributions. The mean, or average, of the distributions is $10,000. Auditors most commonly use classi- cal variables sampling to estimate the size of misstatement, so in our example let’s say the $10,000 represents the size of the total misstatement in an account or population. The flatter, wider distribution in Figure 9–2 is based on a sample size of 50, and the taller, thinner distri- bution is based on a sample size of 200. Both sampling distributions are taken from the same underlying population.

The sampling distributions are formed by plotting the projected misstatements yielded by an infinite number of audit samples of the same size taken from the same underlying popula- tion. For example, the height of the flatter distribution at $9,000 represents the number (or percent) of times a sample size of 50 would return a projected misstatement of $9,000.

Rather than actually take an infinite number of samples of the same size to form a picture of the distribution, the distribution is modeled using the mathematical properties of the nor- mal distribution. Thus, a sampling distribution is really a theoretical distribution that models how the means of an infinite number of hypothetical samples of a given sample size would be distributed. A sampling distribution is useful because it allows us to estimate the probability of observing any single sample result. Two important features of sampling distributions are very useful for auditors:

∙ The mean of the sampling distribution will be equal to the true mean of the underlying population. Thus, Figure 9–2 tells us that the true misstatement in the population is $10,000.

∙ The area under the curve can be used to quantify likelihoods. For example, the standard error for the flatter curve is $1,000. If we look at the area covered by 2 standard errors above and 2 standard errors below the mean (i.e., the area under the curve between $8,000 and $12,000), we know that the area captures about 95 percent of all observed sample results. This is simply a mathematical property of a bell- shaped distribution.

Considering the first feature listed above, if auditors did actually take an infinite or even a very large number of samples of, say, size 50, they could determine with near certainty the amount of misstatement in an account. That seems easy enough—except that taking an infi- nite number or even 500 samples of size 50 is not economically practical. Instead, the auditor

$8,000 $9,000 $10,000

Mean Misstatement population

$11,000 $12,000

Sample size 200

Sample size 50

Normally Distributed Sampling DistributionsF I G U R E 9 – 2

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 323

mes32502_ch09_300-336.indd 323 10/10/15 12:57 PM

will only take one sample of size 50 and will use the results of that single sample to estimate the actual misstatement in the population.

Stop and Think: What information does distribution theory provide to an auditor that only takes one sample?

Distribution theory can be very useful even when the auditor is only drawing one sample because the theory allows for an uncertain, but informed, prediction to be made about the underlying population.

Referring to the flatter distribution in Figure 9–2, which sampling outcome is more likely, a projected sample misstatement result of $10,000 or $12,000? The height of the curve in the middle indicates values around the mean of the distribution will be more commonly observed than values in the tails of the distribution. Because the most likely projected misstatement is one that is near the true misstatement, the auditor considers the observed projected sample misstatement as the best estimate of the true misstatement in the population. While the sample projection is the best estimate, the auditor understands there is uncertainty or sampling risk. Referring again to Figure 9–2, the most likely sample result is a projected misstatement at or near $10,000, but is it possible the auditor could draw a random sample of 50 that yields a projected misstatement of $8,000? Yes, due to sampling risk, it is possible to draw a nonrepre- sentative sample. However, observing a projected misstatement of $8,000 from a sample of 50 is not very likely, given that the “true” population misstatement is $10,000. Now, consider the same question but with a sample size of 200 instead of 50. Could a sample of 200 produce a projected misstatement of $8,000? Again it is possible, but because the distribution for a sam- ple of 200 is taller and tighter than the distribution for a sample of 50, it is much less likely that the auditor will get a projected misstatement result of $8,000 from a sample size of 200. The basic idea is simple: as the sample size increases, the results from the sample are increasingly likely to approximate the true population mean. In the extreme, if the sample size equaled the size of the population, the sample mean would exactly equal the true population mean.

Distribution theory allows auditors to quantify sampling risk through the use of confi- dence bounds, which are used to form what is commonly called a confidence interval. Refer- ring to the flatter distribution in Figure 9–2, if the auditor wants to be 95 percent confident that his or her sample results include the true population misstatement, he or she would add and subtract 2 standard errors to and from the sample projected misstatement. For example, if the auditor takes a sample of 50 and computes a projected misstatement of $11,250, the audi- tor can be 95 percent confident that the interval between $9,250 and $13,250 ($11,250 ± $2,000) contains the true population misstatement. Thus, even though auditors do not know for sure which part of the actual sampling distribution their sample results come from (because they do not actually take an infinite number of samples to form the distribution), they use normal distribution theory to compute an interval of values that is likely to contain the true population value. The computational complexity of calculating classical variables sampling results, in particular computing the standard deviation, made it a difficult technique for audi- tors to use before electronic calculators and personal computers were common on audit engagements. This complexity was one of the factors that led to the development of MUS. Another important reason MUS was developed is that most accounting populations contain relatively little misstatement, and the estimators used to compute sample size and potential misstatement for some classical variables sampling techniques (e.g., difference estimation) are not effective in populations with little or no misstatement.13 Therefore, MUS is used in practice because of the advantages discussed earlier in the chapter.

Classical variables sampling can easily handle both overstatement and understate- ment errors. It is most appropriate for populations that contain a moderate-to-high rate of misstatement. Some applications of this sampling approach include auditing accounts

13See M. Durney, R. Elder and S. Glover, “Field Data on Accounting Error Rates and Audit Sampling,” Auditing: A Journal of Practice and Theory, 2014.

Final PDF to printer

324 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 324 10/10/15 12:57 PM

receivable in which unapplied credits exist or a relatively large amount of misstatement is expected, and inventory in which significant audit differences are expected between test counts and pricing tests. Following are some of the advantages and disadvantages of classical variables sampling.

Advantages ∙ When the auditor expects a relatively large number of differences between book and

audited values, classical variables sampling will normally result in a smaller sample size than monetary-unit sampling.

∙ Classical variables sampling techniques are effective for both overstatements and understatements. No special evaluation considerations are necessary if the sample data include both types of misstatements.

∙ The selection of zero balances generally does not require special sample design considerations because the sampling unit will not be an individual dollar, as it is in MUS, but rather a customer account, a transaction, or a line item.

Disadvantages ∙ When using the approach to evaluate likely misstatement in an account or population,

some classical variables sampling techniques (e.g., difference estimation) do not work well when little or no misstatement is expected.

∙ In order to determine the sample size for the technique illustrated in this text, the auditor must estimate the standard deviation of the audit differences. Since this value is unknown, auditors often use a surrogate such as the standard deviation of the recorded values in the population. However, this approach tends to overstate the standard deviation of the differences because recorded values tend to be more variable than audit differences in most accounting populations.

∙ If few misstatements are detected in the sample data, the estimated variance used for evaluation purposes may underestimate the true variance, and the resulting projection of the misstatements and the related confidence limits may be unreliable.

A number of classical variables sampling techniques are available to the auditor for pro- jecting the sample results to the population. These include mean per unit, difference, ratio, and regression techniques. These techniques differ basically on the assumed relationship between the book value and the audit value. We demonstrated ratio projection in the prior sec- tion on nonstatistical sampling. In this section we illustrate how the classical variables sam- pling technique known as difference estimation is used to determine sample size, project misstatement, and compute confidence bounds.14

Applying Classical Variables Sampling The discussion in this section focuses on the special features that apply to classical variables sampling. A detailed example is included to demonstrate the application of classical variables sampling.

Defining the Sampling Unit When an auditor uses classical variables sampling tech- niques, the sampling unit can be a customer account, an individual transaction, or a line item. For example, in auditing accounts receivable, the auditor can define the sampling unit to be a customer’s account balance or an individual sales invoice included in the account balance.

14See D. M. Roberts, Statistical Auditing (New York: AICPA, 1978), or see A. D. Bailey, Jr., Statistical Auditing: Review, Concepts, and Problems (New York: Harcourt Brace Jovanovich, 1981), for a discussion of the other classi- cal variables sampling techniques.

LO 9-6

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 325

mes32502_ch09_300-336.indd 325 10/10/15 12:57 PM

Determining the Sample Size The following formula can be used to determine the sample size for a classical variables sample:

Sample size = [ Population size (in sampling units) × CC × SD __________________________________________ Tolerable misstatement − Estimated misstatement ] 2

where CC = Confidence coefficient SD = Estimated standard deviation of audit differences

Table 9–6 shows the confidence coefficient values for various levels of desired confidence. The risk of incorrect acceptance is the risk that the auditor will mistakenly accept a popula- tion as fairly stated when the true population misstatement is greater than tolerable misstate- ment and is the complement of the level of confidence. For example, at a confidence level of 95 percent, the risk of incorrect acceptance is 5 percent (1 - .95).15

The following example demonstrates how to determine sample size using this formula. Assume that the auditor has decided to apply classical variables sampling to an entity’s accounts receivable account. Based on the results of testing internal controls over the rev- enue process, the auditor expects to find a moderate level of misstatement in accounts receiv- able due mainly to improper pricing of products on sales invoices. The year-end balance for accounts receivable contains 5,500 customer accounts and has a book value of $5,500,000. The tolerable misstatement for accounts receivable has been established at $50,000, and the expected misstatement has been estimated at $20,000. The auditor would like a high level of assurance from the test and has set the desired confidence level at 95 percent (risk of incorrect rejection of 5 percent). Based on the results of last year’s audit work, the standard deviation of audit differences is set at $31. Using these parameters, a sample size of 125 is calculated (rounding up):

Sample size = [ 5, 500 × 1 . 96 × $31 ___________________ $50, 000 − $20, 000 ] 2

= 125

In calculating the sample size, the confidence coefficient value (CC) for the desired level of confidence is taken from Table 9–6. The CC for a 95 percent confidence level is 1.96.

Selecting the Sample Sample selection for classical variables sampling normally relies on random-selection techniques. If the sampling unit is defined to be a customer account, the accounts to be examined can be selected randomly from the aged trial balance of accounts receivable. In this example, a random sample of 125 customer accounts is selected.

15Because an account can only be over- or understated, but not both, the risk of incorrect acceptance is commonly referred to in the technical literature as a one-tailed test. However, when an auditor uses a sample to evaluate the fair- ness of an account, she or he does not know with certainty the size or direction of the actual misstatement; therefore, it is appropriate to use the traditional two-tailed values of the confidence coefficient as shown in Table 9–6. The confidence coefficient associated with the risk of incorrect rejection can also be included in the sample size computa- tion. If this risk is included in the formula, the sample size will be larger. In practice, the risk of incorrect rejection is typically not considered because it deals with efficiency and not effectiveness. When an account is incorrectly rejected due to a nonrepresentative sample, the auditor typically performs more work, which will provide evidence that the account is fairly stated. Auditors have determined that it is more costly to increase all sample sizes to control for the risk of incorrect rejection than it is to simply perform additional procedures when they believe an account is rejected incorrectly.

Confidence Coefficient Values

Desired Level of Confidence Confidence Coefficient

95% 1.96 90% 1.64 80% 1.28 70% 1.04

T A B L E 9 – 6

Final PDF to printer

326 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 326 10/10/15 12:57 PM

Calculating the Sample Results Difference projection computes the projected or likely misstatement in the population by projecting the average misstatement of each item in the sample to all items in the population. Continuing with the prior example, assume that the auditor has confirmed 125 individual customer accounts receivable, and that confirmation evidence and alternative procedures, performed for customers who did not reply, results in the determination that 30 customer accounts contain misstatements. Table 9–7 presents the details of the 30 misstatements and the data necessary for evaluating the sample results. The known or factual difference between the book value and the audited value is shown in the fifth column. The sixth column contains the square of each difference. The sum of these squared differences is needed to calculate the standard deviation.

The first calculation is the mean misstatement per sampling item, which is calculated by dividing the known or factual audit differences in the sample by the sample size as follows:

Mean misstatement per sampling item

Total audit difference __________________ Sample size

$2.65

$330 . 20 ________ 125

Thus, the average misstatement in a customer account based on the sample data is an overstatement of $2.65.

Summary of Misstatements Detected

Sample Item Number Account Number Book Value Audit Value Audit Difference Squared Audit Difference

1 3892 $ 1,221.92 $ 1,216.40 $ 5.52 $ 30.47 4 1982 2,219.25 2,201.34 17.91 320.77 8 893 1,212.00 1,204.34 7.66 58.68 9 25 5,190.21 5,201.21 -11.00 121.00

13 1703 7,205.40 7,188.29 17.11 292.75 19 4258 3,685.62 3,725.62 -40.00 1,600.00 22 765 58.30 50.64 7.66 58.68 34 1256 17,895.15 17,840.30 54.85 3,008.52 36 3241 542.95 525.98 16.97 287.98 45 895 895.24 823.70 71.54 5,117.97 47 187 10,478.60 10,526.40 -47.80 2,284.84 55 4316 95.00 90.00 5.00 25.00 57 2278 1,903.51 1,875.00 28.51 812.82 59 1843 185.23 200.25 -15.02 225.60 61 64 4,759.65 4,725.32 34.33 1,178.55 69 2371 2,549.61 2,540.26 9.35 87.42 70 1982 12,716.50 12,684.23 32.27 1,041.35 72 2350 361.45 375.50 -14.05 197.40 75 349 11,279.40 11,250.40 29.00 841.00 87 2451 74.23 95.40 -21.17 448.17 88 3179 871.58 837.96 33.62 1,130.30 91 1839 571.13 590.00 -18.87 356.08 93 4080 9,467.24 9,504.50 -37.26 1,388.31 97 13 45.20 40.75 4.45 19.80

100 1162 524.90 515.15 9.75 95.06 101 985 7,429.09 7,356.21 72.88 5,311.49 108 304 12,119.60 12,043.60 76.00 5,776.00 110 1977 25.89 26.89 -1.00 1.00 115 1947 1,982.71 2,025.87 -43.16 1,862.79 118 1842 6,429.35 6,384.20 45.15 2,038.52

Total $123,995.91 $123,665.71 $330.20 $36,018.32

T A B L E 9 – 7

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 327

mes32502_ch09_300-336.indd 327 10/10/15 12:57 PM

The mean misstatement must then be projected to the population. The projected mean misstatement for the population is an overstatement of $14,575, which is determined as follows:

Projected population

Population size

Mean misstatement

misstatement (in sampling units) per sampling item $14,575

5,500

$2.65

The projected population misstatement is the auditor’s “best estimate” of the likely misstatement present in the account. However, the auditor is relying on a sample, and the resulting uncertainty must be recognized by calculating an allowance for sampling risk. The allowance for sampling risk is represented by the confidence bound. To calculate the confi- dence bound, the auditor first calculates the standard deviation of audit differences (SD), by using the following formula:

SD = √ _____________________________________________________________

Total squared audit differences − ( Sample size × Mean difference per sampling item 2 ) ____________________________________________________________ Sample size − 1

SD = √ ______________________

$36, 018 . 32 − ( 125 × 2 . 65 2 ) _____________________ 125 − 1 = $16 . 83

In our example, the standard deviation is $16.83. The confidence bound is then calcu- lated using the following formula:

Confidence bound

Population size ________________ (in sampling units)

SD ______________ √

____________ (Sample size)

$16,228

5,500

(1.96)

$16.83 ______ √

____ 125

In calculating the confidence bound, the auditor uses the confidence coefficient (CC) value for the desired level of confidence.16 In our example, the confidence bound is $16,228. The auditor then calculates a confidence interval as follows:

Confidence interval = Projected population misstatement ± Confidence bound Confidence interval = $14,575 ± $16,228

where $30,803 is the upper limit and -$1,653 is the lower limit. The auditor can be 95 per- cent confident that the actual misstatement in the population is between the upper and lower limits. Since the auditor can tolerate $50,000 misstatement (either under- or overstatement), the auditor can accept the population as fairly stated.

The auditor decides that the evidence supports or does not support the account bal- ance by determining whether the upper and lower limits are within tolerable misstatement. If both limits are within the bounds of tolerable misstatement, the evidence supports the conclusion that the account is not materially misstated. If either limit is outside the bounds of tolerable misstatement, the evidence does not support the conclusion that the account is materially correct. In our example, the upper and lower limits are within the bounds of tolerable misstatement and the auditor can conclude the account is fairly stated. Figure 9–3 displays this result.

When the evidence indicates that the account may be materially misstated, the auditor must consider the same four options discussed under monetary-unit sampling: (1) increase sample size, (2) perform additional substantive procedures, (3) adjust the account, or (4) issue a qualified or adverse opinion.

16Note that the CC value simply represents the number of standard errors the auditor would like to use in establish- ing the confidence bounds around the sample result. The sample mean 1 standard error results in about a 65 percent confidence interval, ±2 standard errors results in about a 95 percent confidence interval, and 3 standard errors results in about a 99 percent confidence interval.

Final PDF to printer

328 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 328 10/10/15 12:57 PM

Advanced Module 2: Comparing Terminology for Monetary-Unit Sampling between IDEA and Manual Calculation

A Comparison of the Lower and Upper Misstatement Limits to Tolerable Misstatement

F I G U R E 9 – 3

($50,000) $0 $50,000

Tolerable misstatement

Lower limit ($1,653)

Projected population

misstatement $14,575

Upper limit $30,803

IDEA Term Manual Calculation Term

Computing Sample Size

Monetary (Sampling) Confidence Materiality Expected Total Errors Interval

Monetary-Unit Sampling Desired Confidence Level Tolerable Misstatement (converted to a percentage of the population) Expected Misstatement (converted to a percent of the population) Sampling Interval

Sample Evaluation

Monetary (Sampling) Interval Errors Most Likely Error Upper Error Limit

Monetary-Unit Sampling Sampling Interval Misstatements or Differences Detected Projected Misstatement Upper Misstatement Limit

KEY TERMS

Allowance for sampling risk. The uncertainty that results from sampling; the difference between the expected mean of the population and the tolerable deviation or misstatement. Audit sampling. The selection and evaluation of less than 100 percent of the population of audit relevance such that the auditor expects the items selected to be representative of the pop- ulation and, thus, likely to provide a reasonable basis for conclusions about the population. Classical variables sampling. The use of normal distribution theory to estimate the dollar amount of misstatement for a class of transactions or an account balance. Confidence bound. A measure of sampling risk added and subtracted to the projected mis- statement to form a confidence interval. Expected misstatement. The amount of misstatement that the auditor believes exists in the population. Factual misstatements. These are misstatements about which there is no doubt. For exam- ple, an auditor may test a sales invoice and determine that the prices applied to the products ordered are incorrect. Once the products are correctly priced, the amount of misstatement is known. In such cases, the auditor knows the exact amount of the misstatement.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 329

mes32502_ch09_300-336.indd 329 10/10/15 12:57 PM

Monetary-unit sampling (MUS). Attribute-sampling techniques used to estimate the dollar amount of misstatement for a class of transactions or an account balance. Nonsampling risk. The risk that the auditor reaches an erroneous conclusion for any reason not related to sampling risk (e.g., judgment error, inappropriate procedures, failing to detect a misstatement when applying an audit procedure). Nonstatistical sampling. Audit sampling that relies on the auditor’s judgment to determine the sample size, select the sample, and/or evaluate the results for the purpose of reaching a conclusion about the population. Projected misstatements. These are the auditor’s best estimate of misstatements in popula- tions, involving the projection of misstatements identified in an audit sample to the entire population from which the sample was drawn. Risk of incorrect acceptance. The risk that the sample supports the conclusion that the recorded account balance is not materially misstated when it is materially misstated. Risk of incorrect rejection. The risk that the sample supports the conclusion that the recorded account balance is materially misstated when it is not materially misstated. Sampling risk. The possibility that the sample drawn is not representative of the population and that, as a result, the auditor reaches an incorrect conclusion about the account balance or class of transactions based on the sample. Sampling unit. The individual item constituting a population being sampled. Statistical sampling. Sampling that uses the laws of probability to select and evaluate the results of an audit sample, thereby permitting the auditor to quantify the sampling risk for the purpose of reaching a conclusion about the population. Tolerable misstatement. The amount of planning materiality that is allocated to a financial statement account. Upper misstatement limit. The total of the projected misstatement plus the allowance for sampling risk.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 9-2 9-1 List the steps in a statistical sampling application for substantive testing. LO 9-2 9-2 How is the sampling unit defined when monetary-unit sampling is used for statistical

sampling? How is the sampling unit defined when classical variables sampling is used?

LO 9-2 9-3 How are the desired confidence level, the tolerable misstatement, and the expected misstatement related to sample size?

LO 9-2 9-4 Identify the advantages and disadvantages of monetary-unit sampling. LO 9-2, 9-3 9-5 How does the use of probability-proportional-to-size selection provide an increased

chance of sampling larger items? LO 9-2, 9-3 9-6 What is the decision rule for determining the acceptability of sample results when

monetary-unit sampling is used? LO 9-1, 9-4 9-7 How do the desired confidence level, risk of material misstatement, and toler-

able and expected misstatements affect the sample size in a nonstatistical sampling application?

LO 9-4 9-8 Describe the two methods suggested for projecting a nonstatistical sample result. How does an auditor determine which method should be used?

LO 9-5 9-9 What are the advantages and disadvantages of classical variables sampling? LO 9-5, 9-6 9-10 What is the decision rule for determining the acceptability of sample results when

classical variables sampling is used?

Final PDF to printer

330 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 330 10/10/15 12:57 PM

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 9-1, 9-5 9-11 Which of the following sampling methods would be used to estimate a numeric mea- surement of a population, such as a dollar value?

a. Random sampling. b. Numeric sampling. c. Attribute sampling. d. Variable sampling.

LO 9-1, 9-2 9-12 A number of factors influence the sample size for a substantive test of details of an account balance. All other factors being equal, which of the following would lead to a larger sample size?

a. Greater reliance on internal controls. b. Greater reliance on analytical procedures. c. Smaller expected frequency of misstatements. d. Smaller amount of tolerable misstatement.

LO 9-1, 9-2, 9-4, 9-5 9-13 Considering each independently, a change in which of the following sample planning factors would influence the sample size for a substantive test of details for a specific account?

Expected Misstatement Tolerable Misstatement

a. b. c. d.

No Yes No Yes

No Yes Yes No

Increase in Tolerable Misstatement Increase in Assessed Level of Control Risk

a. b. c. d.

Decrease sample size Decrease sample size Increase sample size Increase sample size

Decrease sample size Increase sample size Decrease sample size Increase sample size

LO 9-1, 9-2 9-14 The risk of incorrect acceptance relates to the a. Effectiveness of the audit. b. Efficiency of the audit. c. Planning materiality. d. Allowable risk of tolerable misstatement.

LO 9-2, 9-3 9-15 Which of the following statements concerning monetary-unit sampling is correct? a. The sampling distribution should approximate the normal distribution. b. Overstated units have a lower probability of sample selection than units that are

understated. c. The auditor controls the risk of incorrect acceptance by specifying the desired

confidence level for the sampling plan. d. The sampling interval is calculated by dividing the number of physical units in

the population by the sample size.

LO 9-2, 9-3 9-16 How would increases in tolerable misstatement and assessed level of control risk affect the sample size in a substantive test of details?

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 331

mes32502_ch09_300-336.indd 331 10/10/15 12:57 PM

LO 9-2, 9-5 9-17 An auditor is performing substantive procedures of pricing and extensions of per- petual inventory balances consisting of a large number of items. Past experience indicates that there may be numerous pricing and extension errors. Which of the following statistical sampling approaches is most appropriate?

a. Classical variables sampling. b. Monetary-unit sampling. c. Stop-n-go sampling. d. Attribute sampling.

LO 9-1, 9-2, 9-5 9-18 Which of the following statements concerning the auditor’s use of statistical sam- pling is correct?

a. An auditor needs to estimate the dollar amount of the standard deviation of the population in order to use classical variables sampling.

b. An assumption of monetary-unit sampling is that the underlying accounting pop- ulation is normally distributed.

c. A classical variables sample needs to be designed with special considerations to include negative balances in the sample.

d. The selection of zero balances usually does not require special sample design considerations when using monetary-unit sampling.

LO 9-1, 9-5 9-19 In classical variables sampling, which of the following must be known in order to estimate the appropriate sample size required to meet the auditor’s needs in a given situation?

a. The qualitative aspects of misstatements. b. The total dollar amount of the population. c. The acceptable level of risk. d. The estimated percentage of deviations in the population.

LO 9-2, 9-5 9-20 Which of the following would most likely be an advantage in using classical vari- ables sampling rather than monetary-unit sampling?

a. An estimate of the standard deviation of the population’s recorded amounts is not required.

b. The auditor rarely needs the assistance of a computer program to design an effi- cient sample.

c. Inclusion of zero and negative balances generally does not require special design considerations.

d. Any amount that is individually significant is automatically identified and selected.

PROBLEMS All applicable problems are available with Connect.

LO 9-1, 9-2, 9-5 9-21 Edwards has decided to use monetary-unit sampling in the audit of an entity’s accounts receivable balance. Few, if any, misstatements of account balance over- statement are expected.

Required: a. Identify the advantages of using monetary-unit sampling over classical variables

sampling. b. Calculate the sample size and the sampling interval Edwards should use for the

following information:

Tolerable misstatement $ 15,000 Expected misstatement $ 6,000 Desired confidence level 95% Recorded amount of accounts receivable $300,000

Final PDF to printer

332 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 332 10/10/15 12:57 PM

c. Calculate the UML assuming that the following three misstatements were discov- ered in testing based on the MUS sample computed in part (b).

Misstatement Number Book Value Audit Value

1 $ 400 $ 320 2 500 0 3 3,000 2,500

(AICPA, adapted)

LO 9-2, 9-3 9-22 The firm of Le and Lysius was conducting the audit of Coomes Molding Corpora- tion for the fiscal year ended October 31. Michelle Le, the partner in charge of the audit, decides that MUS is the appropriate sampling technique to use in order to audit Coomes’ inventory account. The balance in the inventory at October 31 was $4,250,000. Michelle has established the following: risk of incorrect acceptance = 5% (i.e., the desired confidence level of 95%), tolerable misstatement = $212,500, and expected misstatement = $63,750.

Required: a. Calculate the sample size and sampling interval. b. Hon Zhu, staff accountant, performed the audit procedures listed in the inventory

audit program for each sample item. Using the sample size computed in part (a), calculate the upper limit on misstatement based on the following misstatements. What should Hon conclude about Coomes’ inventory account?

Error Number Book Value Audit Value

1 $ 6,000 $ 1,000 2 24,000 9,000 3 55,000 5,000

LO 9-2, 9-3 9-23 McMullen and Mulligan, CPAs, were conducting the audit of Cusick Machine Tool Company for the year ended December 31. Jim Sigmund, senior-in-charge of the audit, plans to use MUS to audit Cusick’s inventory account. The balance at Decem- ber 31 was $9,000,000.

Required: a. Based on the following information, compute the required MUS sample size: Tolerable misstatement = $360,000 Expected misstatement = $90,000 Risk of incorrect acceptance = 5% b. Nancy Van Pelt, staff accountant, used the sample items selected in part (a) and

performed the audit procedures listed in the inventory audit program. She notes the following misstatements:

Misstatement Number Book Value Audit Value

1 $10,000 $7,500 2 9,000 6,000 3 60,000 0 4 800 640

Using this information, calculate the upper misstatement limit. What conclusion should Van Pelt make concerning the inventory?

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 333

mes32502_ch09_300-336.indd 333 10/10/15 12:57 PM

c. Assume that, in addition to the four misstatements identified in part (b), Van Pelt had identified the following two understatements:

Misstatement Number Book Value Audit Value

5 $6,000 $6,500 6 750 800

Calculate the net projected population misstatement.

LO 9-4 9-24 The accounting firm of Johnson and Johnson has decided to design a nonstatistical sample to examine the accounts receivable balance of Francisco Fragrances, Inc., at October 31. As of October 31, there were 1,500 accounts receivable accounts with a balance of $5.5 million. The accounts receivable population can be segregated into the following strata:

Number and Size of Accounts Book Value of Stratum

10 accounts > $50,000 $ 750,000 440 accounts > $5,000 3,000,000 1,050 accounts < $5,000 1,750,000

Jonathan L. Gren, senior-in-charge of the audit, has made the following decisions:

∙ Based on the results of the tests of controls and risk assessment procedures, a low assessment is made for the risk of material misstatement.

∙ The desired confidence level is moderate. ∙ The tolerable misstatement allocated to accounts receivable is $155,000, and the

expected misstatement is $55,000. ∙ All the balances greater than $50,000 will be audited.

Required: a. Using the nonstatistical sampling formula included in the textbook, compute the

suggested sample size for this test. b. Gren confirmed the accounts receivable accounts selected and noted the following

results:

Stratum Book Value of

Stratum Book Value of Sample

Audit Value of Sample

Amount of Overstatement

>$50,000 $ 750,000 $750,000 $746,500 $ 3,500 >$ 5,000 3,000,000 910,000 894,750 15,250 <$ 5,000 1,750,000 70,000 68,450 1,550

Using ratio projection, what is the total projected misstatement? What conclusion should Gren make concerning the accounts receivable balance?

LO 9-5, 9-6 9-25 World-famous mining mogul Steve Wilsey hired the public accounting firm of Joe Wang Associates, PC, to conduct an audit of his new acquisition, Cougar Goldust, Inc. The gold inventory was scheduled to be taken on November 30. The perpet- ual records show only the weight of the gold in various inventory bins. Wang has decided to use a variables sampling approach (difference estimation) to determine the correct weight of the gold on hand. (Note that the pricing of the inventory is straightforward because the market value on November 30 determines the price for balance sheet purposes.) There are 4,000 bins in the Cougar warehouse. The bins will serve as the sampling units. Wang’s desired level of confidence is 90 percent.

Final PDF to printer

334 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 334 10/10/15 12:57 PM

The tolerable misstatement is set at 35,000 ounces, and the expected misstatement is 10,000 ounces. The perpetual record shows 700,000 ounces on hand.

Required: [Note: Parts (a) and (b) are independent of each other.] a. Compute the preliminary sample size. The estimated standard deviation is

25 ounces. b. Assume that Wang examined a sample of 100 bins. The following information

summarizes the results of the sample data gathered by Wang:

Difference Number

Recorded Weight

Audited Weight

Audit Difference

Squared Audit Difference

1 445 440 5 25 2 174 170 4 16 • • • • • • • • • • • • • • •

29 217 215 2 4 30 96 97 (1) 1

Total 24,000 23,600 400 17,856

Compute the sample results and indicate what conclusion Wang should make concerning the inventory balance.

LO 9-5, 9-6 9-26 You are in charge of the audit of Hipp Supply Company for the year ended December 31. In prior years, your firm observed the inventory and tested compilation and pric- ing. Various misstatements were always found. About 10 percent of the dollar value of the inventory is usually tested.

This year you have established the tolerable misstatement to be $5,000. The enti- ty’s book value is $97,500. The entity has 960 inventory items, the number of which has been determined by examining inventory codes. Each item will be tagged with a prenumbered inventory tag numbered from 1 to 960. You plan to evaluate the results using classical variables sampling (difference estimation).

Assume you have selected a sample of 100 items randomly. For each sample item, audit tests are performed to make sure that the physical count is correct, the pricing is accurate, and the extensions of unit price and quantity are correct. The results are summarized as follows:

Inventory Tag Number Book Value Audit Value

Audit Difference

Squared Audit Difference

6 $ 100 $ 100 $ 0 $ 0 42 85 85 0 0 46 120 120 0 0 51 420 450 (30) 900 55 18 18 0 0 56 10 10 0 0 • • • • • • • • • • • • • • •

851 25 25 0 0 854 152 150 2 4 857 85 85 0 0 862 76 86 (10) 100

Total $10,147 $9,666 $481 $8,895

There were 50 differences, making up the net difference of $481. The recorded total of the entity’s inventory sheets is $97,500.

Final PDF to printer

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances 335

mes32502_ch09_300-336.indd 335 10/10/15 12:57 PM

Required: Determine the results of the audit tests using a desired confidence level of 90 percent. Indicate whether the evidence supports the fair presentation of the inventory account.

DISCUSSION CASES

LO 9-1, 9-2, 9-5 9-27 Mead, CPA, was engaged to audit Jiffy Company’s financial statements for the year ended August 31. Mead is applying sampling procedures.

During the prior years’ audits Mead used classical variables sampling in per- forming tests of controls on Jiffy’s accounts receivable. For the current year Mead decided to use monetary-unit sampling in confirming accounts receivable because MUS uses each account in the population as a separate sampling unit. Mead expected to discover many overstatements but presumed that the MUS sample would still be smaller than the corresponding size for classical variables sampling.

Mead reasoned that the MUS sample would automatically result in a stratified sample because each account would have an equal chance of being selected for con- firmation. Additionally, the selection of negative (credit) balances would be facili- tated without special considerations.

Mead computed the sample size using the risk of incorrect acceptance, the total recorded book amount of the receivables, and the number of misstated accounts allowed. Mead divided the total recorded book amount of the receivables by the sample size to determine the sampling interval. Mead then calculated the stan- dard deviation of the dollar amounts of the accounts selected for evaluation of the receivables.

Mead’s calculated sample size was 60, and the sampling interval was determined to be $10,000. However, only 58 different accounts were selected because two accounts were so large that the sampling interval caused each of them to be selected twice. Mead proceeded to send confirmation requests to 55 of the 58 customers. Three selected accounts each had insignificant recorded balances under $20. Mead ignored these three small accounts and substituted the three largest accounts that had not been selected in the sample. Each of these accounts had a balance in excess of $7,000, so Mead sent confirmation requests to those customers.

The confirmation process revealed two differences. One account with an audited amount of $3,000 had been recorded at $4,000. Mead projected this to be a $1,000 misstatement. Another account with an audited amount of $2,000 had been recorded at $1,900. Mead did not count the $100 difference because the purpose of the test was to detect overstatements.

In evaluating the sample results, Mead determined that the accounts receivable balance was not overstated because the projected misstatement was less than the allowance for sampling risk.

Required: Describe each incorrect assumption, statement, and inappropriate application of

sampling in Mead’s procedures. (AICPA, adapted)

LO 9-1, 9-4 9-28 Doug Stevens, CPA, is interested in testing the fairness of the ending inventory bal- ance during the audit of Morris Co. Doug has relatively little experience using sta- tistical sampling methods and, quite frankly, doesn’t like to turn anything over to random chance—especially the selection of items to test. Doug used a judgmental method of selecting items for testing. The method involves testing the inventory-item balances that he deems most risky or most likely to be misstated. Doug identified items to test based on size of balance, findings from prior years, age of inventory, description, and professional judgment.

Final PDF to printer

336 Part 4 Statistical and Nonstatistical Sampling Tools for Auditing

mes32502_ch09_300-336.indd 336 10/10/15 12:57 PM

He selected 26 items with a total book value of $720,000. In his “sample,” he found a combined $80,000 in overstatement errors. The book value of inventory on the entity’s records is $1,090,000. Overall materiality for the engagement is $500,000. Doug’s policy is to use 50 percent or less of overall materiality as toler- able misstatement for any one account.

Required: a. What is your opinion of Doug’s method of selecting his “sample”? b. Evaluate Doug’s results. Does he have sufficient evidence to conclude the bal-

ance is fairly stated?

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using the IDEA software.

Final PDF to printer

337

mes32502_ch10_337-385.indd 337 10/10/15 02:21 PM

PART FIVE

Auditing Business Processes

CHAPTER 10 Auditing the Revenue Process

CHAPTER 11 Auditing the Purchasing Process

CHAPTER 12 Auditing the Human Resource Management Process

CHAPTER 13 Auditing the Inventory Management Process

CHAPTER 14 Auditing the Financing/Investing Process: Prepaid Expenses, Intangible Assets, and Property, Plant, and Equipment

CHAPTER 15 Auditing the Financing/Investing Process: Long-Term Liabilities, Stockholders’ Equity, and Income Statement Accounts

CHAPTER 16 Auditing the Financing/Investing Process: Cash and Investments

Final PDF to printer

mes32502_ch10_337-385.indd 338 10/10/15 02:21 PM

CHAPTER

10 10-1 Understand why knowledge of an entity’s revenue

recognition policies is important to the audit. 10-2 Understand the revenue process. 10-3 Know the types of transactions in the revenue process

and the financial statement accounts affected. 10-4 Be familiar with the types of documents and records used

in the revenue process. 10-5 Understand the functions in the revenue process. 10-6 Know the appropriate segregation of duties for the

revenue process. 10-7 Understand the inherent risks relevant to the revenue

process and related accounts. 10-8 Know how to assess control risk for a revenue process.

10-9 Know the key internal controls and develop relevant tests of controls for revenue, cash receipts, and sales returns transactions.

10-10 Relate the assessment of control risk to substantive testing.

10-11 Know the substantive analytical procedures used to audit revenue-related accounts.

10-12 Know the substantive tests of transactions and the tests of details used to audit revenue-related accounts.

10-13 Understand the confirmation process for accounts receivable.

10-14 Understand how to audit other types of receivables. 10-15 Understand how to evaluate the audit findings and reach

a final conclusion on revenue-related accounts.

AICPA, Audit Guide, Auditing Revenue in Certain Industries (New York: AICPA, 2012) SEC Staff Accounting Bulletin No. 101, Revenue Recognition in Financial Statements (SAB No. 101) COSO, Internal Control—Integrated Framework (New York: AICPA, 2013) AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 505, External Confirmations AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 610, Using the Work of Internal Auditors PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

Preliminary engagement activities

(Chapter 3)

Client acceptance/ continuance (Chapter 3)

Consider and audit internal control

(Chapters 6 and 7)

Plan the audit (Chapters 3, 4, and 5)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Major Phases of an Audit

339

mes32502_ch10_337-385.indd 339 10/10/15 02:21 PM

Auditing the Revenue Process

A uditors generally divide an entity’s information system into business processes or transaction cycles. Using this approach, the auditor is able to gather evidence by examining the processing of related transactions

from their origin to their ultimate disposition in accounting journals and led- gers. We first introduced the concept of viewing a business from a process perspective in Chapter 2. Figure 10–1 summarizes a model of business center- ing on business processes or transaction cycles. As the figure shows, the five basic processes are (1) the revenue process, (2) the purchasing process, (3) the human resource management process, (4) the inventory management process, and (5) the financing process. Auditors divide the financial statement compo- nents into business processes or cycles in order to manage the audit better.

In this chapter, the concepts and techniques learned in the previous chap- ters are applied to determine the risk of material misstatement (i.e., setting the level of inherent risk and control risk) for the revenue process and related accounts. The revenue process focuses on the sale of goods and services to customers. For virtually all entities, the revenue and purchasing processes rep- resent the two major business processes that affect the financial statements.

The chapter starts by reviewing the basic concepts related to revenue rec- ognition. An overview of the revenue process is then presented as an aid in providing you with an understanding of the process. This is followed by a dis- cussion of the specific factors that affect the assessment of inherent risk for the revenue process and the auditor’s assessment of control risk. While the main focus of this chapter is auditing the revenue process for a financial statement audit, the concepts covered for setting control risk are applicable to an audit of internal control over financial reporting for public companies. The remain- der of the chapter discusses the substantive procedures the auditor conducts to reach the appropriate level of detection risk for the accounts affected by the revenue process. While the main emphasis is on accounts receivable, the discussion also covers the allowance for uncollectible accounts, bad-debt expense, and sales returns and allowances. Because the cash account is affected by other business processes, it is covered separately in Chapter 16.

Final PDF to printer

340 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 340 10/10/15 02:21 PM

Business Processes

In fo

rm at

io n

Sy st

em s a

nd Int

ern al C

ont rols

to Ens ure Transactions Are Properly Executed, Captured, and

Processed Inform

ation System

sandInternalControlstoEnsureTransactionsAr ePro

perl yE

xec ute

d, Ca

pt ur

ed ,a

nd Pr

oc es

se d

Financing process

Human resource

management process

Purchasing process

Inventory management

process

Revenue process

Business Objectives and Strategies

Management and Board of Directors

Performance Measurement and Assessment

External Financial Reporting

R is

k A

ss es

sm en

t a nd

M an

ag em

en t

C orporate G

overnance

Business Transactions

An Overview of BusinessF I G U R E 1 0 – 1

Final PDF to printer

Chapter 10 Auditing the Revenue Process 341

mes32502_ch10_337-385.indd 341 10/10/15 02:21 PM

Revenue Recognition

Revenue recognition is reviewed at the beginning of this chapter because knowledge of this underlying concept is fundamental to auditing the revenue process. Additionally, revenue must be recognized in conformity with GAAP in order for an auditor to issue an unqualified opinion. FASB Statement of Financial Accounting Concepts No. 6, “Elements of Financial Statements,” defines revenues as

inflows or other enhancements of assets of an entity or settlements of its liabilities (or a combina- tion of both) from delivery or producing goods, rendering services, or other activities that consti- tute the entity’s major or central operations (¶78).

Revenues are measured by the exchange value of the goods and services provided. In general, the entity receives cash or claims to cash for the goods or services provided. Claims to cash are usually referred to as trade accounts receivable. FASB Statement of Financial Accounting Concepts No. 5, “Recognition and Measurement in Financial Statements of Business Enterprises” (¶83), requires that before revenue is recognized (recorded), it must be (1) realized or realizable and (2) earned. Revenue is realized when a product or service is exchanged for cash, a promise to pay cash, or other assets that can be converted into cash. Revenue is earned when an entity has substantially completed the earning process, which generally means a product has been delivered or a service has been provided.

The SEC in SAB No. 101 provides the following criteria for revenue recognition:

∙ Persuasive evidence of an arrangement exists. ∙ Delivery has occurred or services have been rendered. ∙ The seller’s price to the buyer is fixed or determinable. ∙ Collectibility is reasonably assured.

Revenue recognition continues to pose a significant audit risk to auditors and has resulted in questions about the integrity of the financial reporting process (see Exhibit 10–1). As we noted in Chapter 4, the auditor should presume that there is a risk of material misstatement due to fraud relating to revenue recognition.

LO 10-1

Practice I N S I G H T

According to the Association of Certified Fraud Examiners, there are eight common methods for committing financial statement fraud. These include

1. early revenue recognition; 2. holding the books open past the accounting period; 3. fictitious sales; 4. failure to record returns; 5. fraud in the percentage of completion method; 6. related-party transactions; 7. overstating receivables and inventory; and 8. liability and expense omissions.

The auditor should be alert for the following activities that are fraud risks related to rev- enue recognition:

∙ Side agreements are arrangements that are used to alter the terms and conditions of recorded sales in order to entice customers to accept delivery of goods and services.

∙ Channel stuffing (also known as trade loading) is a marketing practice that suppliers sometimes use to boost sales by inducing distributors to buy substantially more inventory than they can promptly resell.

Final PDF to printer

342 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 342 10/10/15 02:21 PM

∙ Related-party transactions require special consideration because related parties may be difficult to identify. Related-party transactions also may pose significant “substance over form” issues.

∙ Bill and hold sales (also called parked inventory schemes) are sales where the customer agrees to purchase the goods but the seller retains physical possession until the customer requests shipments. Unless certain conditions are met, such an arrangement does not qualify as a sale because delivery has not occurred.

For most entities, the revenue recognition process occurs over a short period of time (days or weeks), but in certain industries, such as construction or defense, the revenue recog- nition process may extend over a period of years.

An entity’s revenue recognition policies affect how transactions are processed and how they are accounted for in the financial statements. Thus, an auditor must understand an enti- ty’s revenue recognition policies in order to audit the revenue process.

Practice I N S I G H T

In 2014, the IASB and the FASB published a proposed joint standard on revenue recognition. This standard would replace most of the guidance on revenue recognition that currently exists under IFRS and U.S. GAAP. If implemented, this guidance will have a significant effect on how many com- panies recognize revenue. While the effective date for the standard has not been finalized, students should be aware of the potential implications if this standard is finalized.

Hewlett-Packard Has No Autonomy!

In October 2011 Hewlett-Packard (HP) acquired Autonomy Corporation, Britain’s biggest software com- pany and second largest in Europe, for approximately $11 billion. A year later, HP took an impairment charge related to its acquisition of Autonomy for $8.8 billion. HP claimed it had been duped into over- paying for Autonomy. An internal investigation had revealed “serious accounting improprieties” and “outright misrepresentations” in connection with the acquisition. Apparently, the investigation team found that for at least two years, “Autonomy booked sales of low-margin hardware products as software and would label the cost of that hardware as marketing or other expenses, which made products appear faster growing and more profitable than they really were.” In addition, there are reports that at least one year before the HP acquisition, an Autonomy executive brought forth concerns about the company’s accounting practices.

Sales personnel at Autonomy used a Dotcom tactic for increasing revenues by offering to buy custom- ers’ products in return for purchasing Autonomy’s software. Mr. Michael Lynch (the former founder and CEO of Autonomy) defended Autonomy’s accounting practices and stated that Autonomy’s accounting was consistent with International Accounting Standards.

Litigation against HP, its executives, and Autonomy’s former executives continues. In December 2014, U.S. District Judge Charles Beyer rejected a proposed settlement between HP and the Company’s shareholders.

Sources: B. Worthen, “H-P Says It Was Duped, Takes $8.8 Billion Charge,” The Wall Street Journal (November 21, 2012), p. A1; B. Worthen, P. Sonne, and J. Scheck, “Long before H-P Deal, Autonomy’s Red Flags,” The Wall Street Journal (November 27, 2012), p. A1 and S. Ovide, “Judge Rejects Proposed Settlement in Lawsuit Over H-P’s Autonomy Deal,” The Wall Street Journal (December 19, 2014), online.

E X H I B I T 1 0 – 1

Overview of the Revenue Process

In this section, we present an overview of the revenue process for EarthWear Clothiers, Inc., beginning with an order from a customer, proceeding to the exchange of goods or services for a promise to pay, and ending with the receipt of cash. Exhibit 10–2 describes EarthWear’s revenue process.

LO 10-2

Final PDF to printer

Chapter 10 Auditing the Revenue Process 343

mes32502_ch10_337-385.indd 343 10/10/15 02:21 PM

Stop and Think: Before proceeding, take a moment and review Exhibit 10–2. Do any risks seem especially apparent? If so, how might these risks impact the nature, timing, and extent of your audit procedures?

Figure 10–2 presents the flowchart of EarthWear’s revenue process (excluding sales from company stores), which will provide a framework for discussing controls and tests of controls in more detail. The discussion of the revenue process in this chapter can be applied equally well to manufacturing, wholesale, and service organizations. It should be kept in mind, how- ever, that an accounting system must be tailored to meet the specific needs of an entity. There- fore, you should concentrate on understanding the basic concepts presented so that they can be applied to specific revenue systems.

You should also notice that the revenue process shown in Figure 10–2 interacts with the inventory management process. Many accounting systems integrate the revenue, purchasing, human resources, and inventory processes. The flowcharts used in this text to represent those processes show the points where the processes interact with one another. As entities use more IT, it is easier to integrate the information flow among the various business processes.

We will now discuss the following topics related to the revenue process:

∙ Types of transactions and financial statement accounts affected. ∙ Types of documents and records. ∙ Major functions. ∙ Key segregation of duties.

Types of Transactions and Financial Statement Accounts Affected Three types of transactions are typically processed through the revenue process:

∙ The sale of goods or rendering of a service for cash or credit. ∙ The receipt of cash from the customer in payment for the goods or services. ∙ The return of goods by the customer for credit or cash.

LO 10-3

Description of EarthWear’s Revenue Process

EarthWear provides 24-hour toll-free telephone numbers that may be called seven days a week (except Christmas Day) to place orders. Telephone calls are answered by the company’s sales representatives, who use online computer terminals to enter customer orders and to retrieve

information about product characteristics and availability. The company’s sales representatives enter orders into an online order entry and inventory control system. Customers using the company’s Internet site complete a computer screen template that requests information on product code, size, color, and so forth. When the customer finishes shopping for products, he or she enters delivery and credit card infor- mation into a computer-based form. EarthWear provides assurance through CPA WebTrust that the web- site has been evaluated and tested to meet WebTrust Principles and Criteria.

Computer order processing is performed each night on a batch basis, at which time shipping tickets are printed with bar codes for optical scanning. Inventory is picked based on the location of individual products rather than orders, followed by computerized sorting and transporting of goods to multiple packing stations and shipping zones. The computerized inventory control system also handles items that customers return. Orders are generally shipped by United Parcel Service (UPS) at various tiered rates, depending upon the total dollar value of each customer’s order. Other expedited delivery services are available for additional charges.

With the exception of sales to groups and companies for corporate incentive programs, customers pay in cash (in stores) or with credit cards. EarthWear’s major bank is reimbursed directly by credit card com- panies, usually within three days. Group and corporate accounts are granted credit by the credit depart- ment. When group or corporate orders are received from new customers, the credit department performs a credit check following corporate policies. A credit authorization form is completed with the credit limit entered into the customer database. When a group or corporate order is received from an existing cus- tomer, the order is entered, and the data validation program performs a credit check by comparing the sum of the existing order and the customer’s balance to the customer’s credit limit.

E X H I B I T 1 0 – 2

Final PDF to printer

344 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 344 10/10/15 02:21 PM

The key controls involved in each of these transactions are discussed later in the chapter. For some entities, other types of transactions that may occur as part of the revenue process include scrap sales, intercompany sales, and related-party sales. The auditor should be aware of how these transactions are processed and their related controls when they represent mate- rial amounts in the financial statements.

The revenue process affects numerous accounts in the financial statements. The most significant accounts affected by each type of transaction are as follows:

Type of Transaction Account Affected

Sales transactions Trade accounts receivable Sales Allowance for uncollectible accounts Bad-debt expense

Cash receipts transactions Cash Trade accounts receivable Cash discounts

Sales return and allowance transactions Sales returns Sales allowances Trade accounts receivable

Error correction

Ship goods

Customer sales order

Error report

Approved shipping

ticket

Approved shipping

ticket

By phone or Internet

Order Entry Department IT Department Shipping Department

Customer

Price

Inventory

Open orders

See Note A

By mail or fax

Data validation program

Shipping program

To customer Credit Department Note A: If the order is from a new group or corporate customer, a credit check is performed according to the company's policies. Otherwise, a credit check is performed by the data validation program.

Note B: The shipping ticket that is forwarded to the customer contains quantity and price for each product purchased.

See Note B

Batched nightly

Input

Flowchart of the Revenue Process—EarthWear Clothiers, Inc.F I G U R E 1 0 – 2

Final PDF to printer

Chapter 10 Auditing the Revenue Process 345

mes32502_ch10_337-385.indd 345 10/10/15 02:21 PM

Flowchart of the Revenue Process—EarthWear Clothiers, Inc. (continued on next page)

F I G U R E 1 0 – 2

IT Department

Open orders

Inventory Shipping

transactions Shipping

transactions

Accounts receivable

Sales Remittance transactions

Shipping transactions

Accounts receivable

Remittance transactions

General ledger

Billing program

Accounts receivable

update

Accounts receivable reporting

Daily shipping

listing

Sales invoices

Daily sales report

Daily remittance

report

Customer statements

• Sales journal • Cash receipts journal • Aged trial balance of accounts receivable • Sales summary • Remittance summary • Journal entry summary

To group or corporate customer or credit card company

To sales department

Note C: A weekly open- order report is prepared and reviewed by billing department personnel. Outstanding orders are investigated.

To group or corporate customers

Billing Department

See Note C

Input

Weekly or monthly reports

Weekly or

Monthly

Types of Documents and Records Table 10–1 lists the more important documents and records that are normally contained in the revenue process. Each of these items is discussed briefly in the order that they normally occur in the process. The reader should keep in mind that in many IT systems these documents and records may exist only in digital form.

LO 10-4

Final PDF to printer

346 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 346 10/10/15 02:21 PM

Customer Sales Order This document contains the details of the type and quantity of products or services ordered by the customer. Customer sales orders may be prepared and forwarded by a salesperson, mailed or faxed, or received by telephone or over the Internet. In the EarthWear example (Figure 10–2), order entry personnel enter the mailed or faxed

Flowchart of the Revenue Process—EarthWear Clothiers, Inc. (concluded)

F I G U R E 1 0 – 2

IT Department

From bank

Remittance advice

transactions Accounts receivable

Cash remittance

update

Error report

Error correction

Reconciled by cash receipts

clerks

Remittance advice listing

From bank

Cash Receipts Department

Input

Daily remittance

report

Remittance advice

transactions

Documents and Records Included in the Revenue Process

Customer sales order Credit approval form Open-order report Shipping document Sales invoice Sales journal Customer statement

Accounts receivable subsidiary ledger Aged trial balance of accounts receivable Remittance advice Cash receipts journal Credit memorandum Write-off authorization

T A B L E 1 0 – 1

Final PDF to printer

Chapter 10 Auditing the Revenue Process 347

mes32502_ch10_337-385.indd 347 10/10/15 02:21 PM

information from customer sales orders into the revenue system. Phone or Internet sales are entered directly into the data validation program.

Credit Approval Form When a customer purchases products on credit from the entity for the first time, the entity should have a formal procedure for investigating the creditworthiness of the customer. The result of this procedure should be documented on some type of credit approval form. When the customer plans to purchase additional products in the future, this procedure should be used to establish the customer’s credit limit. The amount of the credit limit should be documented on the approval form. When credit limits are included in the entity’s customer files, the approval forms represent the source documents authorizing the amounts contained in the information system. EarthWear follows such a policy for its group and corporate customers (see Exhibit 10–2).

Open-Order Report This is a report of all customer orders for which processing has not been completed, perhaps because items ordered are out of stock and on backorder. In the typical reve- nue process, once a customer’s order has been accepted, the order is entered into the system. After the goods have been shipped and billed, the order should be noted as filled. This report should be reviewed daily or weekly, and old orders should be investigated to determine if any goods have been shipped but not billed or to determine why orders have not been filled. Figure 10–2 shows that EarthWear has an open-order file. Note C indicates that an open-order report is pre- pared weekly and reviewed by billing department personnel for long overdue orders.

Shipping Document A shipping document should be prepared anytime goods are shipped to a customer. This document generally serves as a bill of lading and contains information on the type of product shipped, the quantity shipped, and other relevant information. In some revenue systems, the shipping document and bill of lading are separate documents. A copy of the shipping document is sent to the customer, while another copy of the shipping document is used to initiate the billing process. Figure 10–2 shows that EarthWear follows a similar process using a shipping ticket.

Sales Invoice This document is used to bill the customer. The sales invoice contains infor- mation on the type of product or service, the quantity, the price, and the terms of trade. The original sales invoice is usually forwarded to the customer, and copies are distributed to other departments within the organization. The sales invoice is typically the source document that signals the recognition of revenue. The majority of EarthWear’s sales are made to customers using credit cards, and they receive an acknowledgement of the sale, usually by email, directly from the company. However, the shipping ticket that accompanies the goods contains the quantity and prices for products purchased. That amount shows up on the customer’s credit card statement.

Sales Journal Once a sales invoice has been issued, the sale needs to be recorded in the accounting records. The sales journal is used to record the necessary information for each sales transaction. Depending on the complexity of the entity’s operation, the sales journal may contain information classified by type of sale (for example, product line, intercompany sales, related parties). The sales journal contains columns for debiting accounts receivable and cred- iting the various sales accounts. EarthWear maintains such a journal.

Customer Statement This document is usually mailed to a customer monthly. It contains the details of all sales, cash receipts, and credit memorandum transactions processed through the customer’s account for the period. EarthWear prepares monthly statements only for group and corporate customers who have accounts receivable with the company.

Accounts Receivable Subsidiary Ledger The accounts receivable subsidiary ledger contains an account and the details of transactions with each customer. A transaction recorded

Final PDF to printer

348 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 348 10/10/15 02:21 PM

in the sales journal and cash receipts journal is posted to the appropriate customer’s account in the accounts receivable subsidiary ledger. For IT systems such as EarthWear’s, this infor- mation is maintained in the accounts receivable file (see Figure 10–2).

Aged Trial Balance of Accounts Receivable This report, which is normally pre- pared weekly or monthly, summarizes all the customer balances in the accounts receiv- able subsidiary ledger. Customers’ balances are reported in aging categories (such as 30 days or less, 31–60 days, 61–90 days, more than 90 days old) based on the time expired since the date of the sales invoice. The aged trial balance of accounts receivable is used to monitor the collection of receivables and to ensure that the details of the accounts receivable subsidiary ledger agree with the general ledger control account. The auditor uses this report for conducting much of the substantive audit work in accounts receivable. EarthWear prepares an aged trial balance of accounts receivable for group and corporate customers.

Remittance Advice This document is usually mailed with the customer’s bill and returned with the customer’s payment for goods or services. A remittance advice contains informa- tion regarding which invoices are being paid by the customer. Many entities use turnaround documents, where a portion of the sales invoice serves as a remittance advice that is returned with the customer’s payment. EarthWear receives remittance advices from group and corpo- rate customers after the payment has been processed by the company’s bank. Payments from credit card companies are also made directly to the bank, and a remittance advice listing is forwarded to EarthWear.

Cash Receipts Journal This journal is used to record the entity’s cash receipts. The cash receipts journal contains columns for debiting cash, crediting accounts receivable, and credit- ing other accounts such as scrap sales or interest income. EarthWear maintains such a journal.

Credit Memorandum This document is used to record credits for the return of goods in a customer’s account or to record allowances that will be issued to the customer. Its form is generally similar to that of a sales invoice, and it may be processed through the system in the same way as a sales invoice. Exhibit 10–3 describes how EarthWear handles goods returned from customers. The process of customer returns is not shown in the revenue flowchart (Figure 10–2).

Write-Off Authorization This document authorizes the write-off of an uncollectible account. It is normally initiated in the credit department, with final approval for the write-off coming from the treasurer. Depending on the entity’s accounting system, this type of transac- tion may be processed separately or as part of the normal stream of sales transactions. Earth- Wear has negligible bad debts because most sales are made by credit card. Any bad debts related to group or corporate sales are written off by the credit department after approval by the treasurer.

Description of EarthWear Clothiers’ Process for Handling Customer Returns

In order to receive credit for returned goods, customers must mail the goods to EarthWear’s receiving department. There the goods are inspected, and a receiving document, which also serves as a credit memorandum, is prepared. Credit memoranda are entered into the revenue process along with the nor- mal batching of customer orders. The customer receives either a replacement product, a cash refund, or a credit to his or her credit card.

The returned goods are placed back into inventory if they are not defective or damaged. If the goods are defective or damaged they are listed as “seconds” and sold at reduced prices. The inventory records are updated to reflect either the original cost or the reduced price.

E X H I B I T 1 0 – 3

Final PDF to printer

Chapter 10 Auditing the Revenue Process 349

mes32502_ch10_337-385.indd 349 10/10/15 02:21 PM

The Major Functions The principal objective of the revenue process is selling the entity’s goods or services at prices and terms that are consistent with management’s policies. Table 10–2 summarizes the functions that normally take place in a typical revenue process.

Order Entry The initial function in the revenue process is the entry of new sales orders into the system. It is important that sales or services be consistent with management’s authoriza- tion criteria before entry into the revenue process. In most entities, there is a separate order entry department (see Figure 10–2).

Credit Authorization The credit authorization function must determine that the customer is able to pay for the goods or services. Failure to perform this function properly may result in bad-debt losses. In many entities, customers have preset credit limits. The credit authorization function must ensure that the credit limit is not exceeded without additional authorization. Where credit limits are programmed into the information system, a sale that causes a custom- er’s balance to exceed the authorized credit limit should not be processed. The system should also generate an exception report or review by the credit function prior to further processing. Periodically, each customer’s credit limit should be reviewed to ensure that the amount is con- sistent with the customer’s ability to pay.

The credit authorization function also has responsibility for monitoring customer pay- ments. An aged trial balance of accounts receivable should be prepared and reviewed by the credit function. Payment should be requested from customers who are delinquent in paying for goods or services. The credit function is usually responsible for preparing a report of customer accounts that may require write-off as bad debts. However, the final approval for writing off an account should come from an officer of the company who is not responsible for credit or col- lections. If the authorization for bad-debt write-off is part of the credit function, it is possible for credit personnel who have access to cash receipts to conceal misappropriation of cash by writing off customers’ balances. In many organizations, the treasurer approves the write-off of customer accounts because this individual is responsible for cash management activities and the treasurer’s department is usually separate from the credit function. In some entities, the accounts written off are turned over to a collection agency for continuing collection efforts. By following this procedure, an entity discourages the use of fictitious bad-debt write-offs to conceal the misappropriation of cash. Most entities have a separate credit department.

Shipping Goods should not be shipped, nor should services be provided, without proper authorization. The main control that authorizes shipment of goods or performance of ser- vices is payment or proper credit approval for the transaction. The shipping function must also ensure that customer orders are filled with the correct product and quantities. To ensure timely billing of customers, completed orders must be promptly forwarded to the billing func- tion. The shipping function is normally completed within a separate shipping department.

LO 10-5

Functions in the Revenue Process

Order entry Acceptance of customer orders for goods and services into the system in accordance with management criteria.

Credit authorization Appropriate approval of customer orders for creditworthiness. Shipping Shipping of goods that has been authorized. Billing Issuance of sales invoices to customers for goods shipped or services provided;

also, processing of billing adjustments for allowances, discounts, and returns. Cash receipts Processing of the receipt of cash from customers. Accounts receivable Recording of all sales invoices, collections, and credit memoranda in individual

customer accounts. General ledger Proper accumulation, classification, and summarization of revenues, collections,

and receivables in the financial statement accounts.

T A B L E 1 0 – 2

Final PDF to printer

350 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 350 10/10/15 02:21 PM

Billing The main responsibility of the billing function is to ensure that all goods shipped and all services provided are billed at authorized prices and terms. The entity’s controls should prevent goods from being shipped to customers who are not being billed. In an IT sys- tem, an open-order report should be prepared and reviewed for orders that have not been filled on a timely basis. In other systems, all prenumbered shipping documents should be accounted for and matched to their related sales invoices. Any open or unmatched transactions should be investigated by billing department or sales department personnel.

The billing function is also responsible for handling goods returned for credit. The key control here is that a credit memorandum should not be issued unless the goods have been returned. A receiving document should first be issued by the receiving department to acknowl- edge receipt of the returned goods.

Cash Receipts The collection function must ensure that all cash collections are properly identified and promptly deposited intact at the bank. Many companies use a lockbox system, in which customers’ payments are sent directly to the entity’s bank. The bank then forwards a file of cash receipts transactions and remittance advices to the entity. In situations where pay- ments are sent directly to the entity, the checks should be restrictively endorsed and a “prelist- ing” or control listing prepared. All checks should be deposited daily.

Accounts Receivable The accounts receivable function is responsible for ensuring that all billings, adjustments, and cash collections are properly recorded in customers’ accounts receivable records. Any entries in customers’ accounts should be made from authorized source documents such as sales invoices, remittance advices, and credit memoranda. In an IT system, the entries to the customers’ accounts receivable records may be made directly as part of the normal processing of these transactions. The use of control totals and daily activ- ity reports provides the control for ensuring that all transactions are properly recorded. The accounts receivable function is normally performed within the billing department or a sepa- rate accounts receivable department.

General Ledger The main objective of the general ledger function in terms of a revenue process is to ensure that all revenues, collections, and receivables are properly accumulated, classified, and summarized in the accounts. In an IT system, the use of control or summary totals ensures that this function is performed correctly. One important function is the recon- ciliation of the accounts receivable subsidiary ledger to the general ledger control account. The general ledger function is also normally responsible for mailing the monthly customer account statements.

Key Segregation of Duties One of the most important controls in any accounting system is proper segregation of duties. This is particularly important in the revenue process because of the potential for theft and fraud. Therefore, individuals involved in the order entry, credit, shipping, or billing functions should not have access to the accounts receivable records, the general ledger, or any cash receipts activities. If IT is used extensively in the revenue process, there should be proper segregation of duties in the IT department. Table 10–3 contains some of the key segregation of duties for the revenue process, as well as examples of possible errors or fraud that can result from conflicts in duties.

Table 10–4 shows the proper segregation of duties for individual revenue functions across the various departments that process revenue transactions.

Stop and Think: Using this table, briefly analyze EarthWear’s flowchart as shown in Figure 10–2. Evaluate whether EarthWear has sufficient segregation of duties. If not, what could happen as a result?

LO 10-6

Final PDF to printer

Chapter 10 Auditing the Revenue Process 351

mes32502_ch10_337-385.indd 351 10/10/15 02:21 PM

Inherent Risk Assessment

In examining the revenue process, the auditor should consider the inherent risk factors that may affect both the revenue and cash receipts transactions and the financial statement accounts affected by those transactions. Many business risks are also inherent risks. The assessment of the potential effects of inherent risk factors is one of the inputs for the assessment of the risk of material misstatement. Chapter 4 pointed out the three conditions (incentive/pressure, opportunity, and attitude) that are generally present when fraud occurs. Four specific inherent risk factors that may affect the revenue process are the following:

∙ Industry-related factors. ∙ The complexity and contentiousness of revenue recognition issues. ∙ The difficulty of auditing transactions and account balances. ∙ Misstatements detected in prior audits.

Industry-Related Factors Factors such as the profitability and health of the industry in which an entity operates, the level of competition within the industry, and the industry’s rate of technological change affect the potential for misstatements in the revenue process. For example, if the industry is

LO 10-7

Key Segregation of Duties in the Revenue Process and Possible Errors or Fraud

Segregation of Duties Possible Errors or Fraud Resulting from Conflicts of Duties

The credit function should be segregated from the billing function.

If one individual has the ability to grant credit to a customer and also has responsibility for billing that customer, it is possible for sales to be made to customers who are not creditworthy. This can result in bad debts.

The accounts receivable function should be segregated from the general ledger function.

If one individual is responsible for the accounts receivable records and also for the general ledger, it is possible for that individual to conceal unauthorized shipments. This can result in unrecorded sales transactions and theft of goods.

The shipping function should be segregated from the billing function.

If one individual who is responsible for shipping goods is also involved in the billing function, it is possible for unauthorized shipments to be made and for the usual billing procedures to be circumvented. This can result in unrecorded sales transactions and theft of goods.

The cash receipts function should be segregated from the accounts receivable function.

If one individual has access to both the cash receipts and the accounts receivable records, it is possible for cash to be diverted and the shortage of cash in the accounting records to be covered. This can result in theft of the entity’s cash.

T A B L E 1 0 – 3

Segregation of Duties for the Revenue Process Functions by Department

Department

Revenue and Accounts Receivable Functions Order Entry Credit Shipping

Accounts Receivable

Cash Receipts IT Treasurer

Receiving and preparing customer order X Approving credit X Shipping goods to customer and completing shipping

document X

Preparing customer invoice X X Updating accounts receivable records for sales X X Receiving customer’s remittance X Updating accounts receivable for remittances X X Preparing accounts receivable aged trial balance X X Authorization of accounts receivable write-off X

T A B L E 1 0 – 4

Final PDF to printer

352 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 352 10/10/15 02:21 PM

experiencing a lack of demand for its products, the entity may be faced with a declining sales volume, which can lead to operating losses and poor cash flow. Similarly, competition within the industry can affect the entity’s pricing policies, credit terms, and product warranties. If such industry-related factors are present, management may engage in activities that can result in misstatements.

The level of government regulation within the industry may also affect sales activity. While all industries are regulated by legislation restricting unfair trade practices such as price fixing, a number of industries are more highly regulated. For example, banks and insurance companies are subject to both state and federal laws that may limit an entity’s operations. The products developed and sold by pharmaceutical companies are regulated by the Food and Drug Administration. Finally, most states have consumer protection legislation that may affect product warranties, returns, financing, and product liability. Industry-related factors directly impact the auditor’s assessment of inherent risk for assertions such as authorization and accuracy.

The Complexity and Contentiousness of Revenue Recognition Issues For most entities the recognition of revenue is not a major problem because revenue is recog- nized when a product is shipped or a service is provided. However, for some entities the rec- ognition of revenue may involve complex calculations.1 Examples include recognition of revenue on long-term construction contracts, long-term service contracts, lease contracts, and installment sales.

Stop and Think: Briefly consider EarthWear and its revenue process. Does Earth- Wear’s typical revenue process indicate a higher or lower risk of material misstatement due to improper revenue recognition?

In some cases, there may be disputes between the auditor and management over when rev- enue, expenses, and related profits should be recognized. In such circumstances, the auditor should assess the risk of material misstatement to be high. Revenue recognition may also have a significant impact on the cutoff and accuracy assertions.

The Difficulty of Auditing Transactions and Account Balances Accounts that are difficult to audit can pose inherent risk problems for the auditor. For exam- ple, management’s estimate for the allowance for uncollectible accounts and sales returns can be difficult to audit because of the subjectivity that may be involved in determining proper value. The risk of a material misstatement for these estimates is a function of factors such as the complexity of the customer base and the reliability of the data available to test the accounts. For example, the only evidence available to determine the collectibility of a cus- tomer’s account may be past payment history or a credit agency report. Such evidence is not as reliable as payments by the customer.

Misstatements Detected in Prior Audits The presence of misstatements in previous audits is a good indicator that misstatements are likely to be present during the current audit. With a continuing engagement, the auditor has the results of prior years’ audits to help in assessing the potential for misstatements in the revenue process.

1See American Institute of Certified Public Accountants, Auditing Revenue in Certain Industries, Audit Guide (New York: AICPA, 2012), for an overall discussion of the complexities of revenue recognition and, in particular, of the software and high-technology industries.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 353

mes32502_ch10_337-385.indd 353 10/10/15 02:21 PM

Control Risk Assessment

The concepts involved in control risk assessment were discussed in Chapter 6. The follow- ing sections apply the approach outlined there to the revenue process. For discussion pur- poses, it is assumed that the auditor has decided to follow a reliance strategy for the revenue process. Figure 10–3 summarizes the three steps for setting control risk when a reliance strategy is being followed. Each of these steps is briefly reviewed within the context of the revenue process.

Understand and Document Internal Control In order to assess the control risk for the revenue process, the auditor must understand the five components of internal control.

Control Environment Table 6–3 in Chapter 6 listed the factors that are important in under- standing the control environment (e.g., integrity and ethical values, commitment to compe- tence). Because these factors have a pervasive effect on all business processes, understanding the control environment is generally completed on an overall entity basis. The auditor should, however, consider how the various control environment factors may affect the individual busi- ness processes. In the remaining discussion of the revenue process, it is assumed that the control environment factors, including general IT controls, are reliable.

The Entity’s Risk Assessment Process The auditor must understand how management considers risks that are relevant to the revenue process, estimates their significance, assesses the likelihood of their occurrence, and decides what actions to take to address those risks. Some of these risks include competition, rapid growth, and new technology. Each of these factors can represent a serious risk to an entity’s internal controls over the revenue process.

Control Activities When a reliance strategy is adopted for the revenue process, the auditor needs to understand the controls that exist to ensure that management’s objectives are being

LO 10-8

Understand and document the revenue process based on

a reliance strategy.

Plan and perform tests of controls on revenue transactions.

Set and document the control risk for the revenue process.

Major Steps in Setting Control Risk for the Revenue ProcessF I G U R E 1 0 – 3

Final PDF to printer

354 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 354 10/10/15 02:21 PM

met. More specifically, the auditor identifies what controls ensure that the assertions for trans- actions and events are being met.

Information Systems and Communication For each major class of transactions in the revenue process, the auditor needs to obtain the following knowledge:

∙ The process by which sales, cash receipts, and sales returns and allowances transactions are initiated.

∙ The accounting records, supporting documents, and accounts that are involved in processing sales, cash receipts, and sales returns and allowances transactions.

∙ The flow of each type of transaction from initiation to inclusion in the financial statements, including computer processing of the data.

∙ The process used to prepare estimates for accounts such as the allowance for uncollectible accounts and sales returns.

The auditor can develop an understanding of the revenue process by conducting a walk- through. This involves the auditor’s “walking” a transaction through the accounting system and documenting the various functions that process it. In the case of a continuing audit, the auditor has the prior years’ systems documentation to assist in the walkthrough, although the possibility of changes in the system must be considered. If the system has been changed substantially, or the audit is for a new client, the auditor should prepare new documentation of the system.

Monitoring of Controls The auditor needs to understand the entity’s monitoring of controls in the revenue process. This includes understanding how management assesses the design and operation of controls in the revenue process. It also involves understanding how supervisory personnel within the system review the personnel who perform the con- trols and evaluate the performance of the entity’s IT function, as well as the effectiveness of controls.

Plan and Perform Tests of Controls The auditor should systematically examine the entity’s revenue process to identify relevant controls that help to prevent, or detect and correct, material misstatements. Because these controls are relied upon, the auditor conducts tests of controls to ensure that the controls in the revenue process operate effectively. Audit procedures used to test controls in the revenue process include inquiry of client personnel, inspection of documents and records, observation of the operation of the control, walkthroughs, and reperformance by the auditor of the control activities.

Subsequent sections examine tests of controls for each major type of transaction in the revenue process. Chapter 8 presented sampling approaches to conducting tests of controls.

Set and Document Control Risk Once the tests of controls in the revenue process have been completed, the auditor sets the achieved level of control risk. If the results of the tests of controls support the planned level of control risk, the auditor conducts the planned level of substantive procedures for the related account balances. If the results of the tests of controls do not support the planned level of control risk, the auditor sets control risk at a level higher than planned. Additional substantive procedures in the accounts affected by the revenue process must then be conducted.

The auditor should document the achieved level of control risk for the revenue process using either quantitative amounts or qualitative terms such as “low,” “medium,” and “high.” The documentation of the achieved level of control risk for the revenue process would include documentation of the accounting system such as the flowchart included in Figure 10–2, the results of the tests of controls, and a memorandum indicating the overall conclusions about control risk.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 355

mes32502_ch10_337-385.indd 355 10/10/15 02:21 PM

Control Activities and Tests of Controls— Revenue Transactions

Table 10–5 presents the assertions about transactions and events that were discussed in Chap- ters 2, 5, and 6. Table 10–6 summarizes the assertions for revenue transactions along with some examples of possible misstatements. For each of these misstatements we have included one or two possible control activities that management could implement to mitigate the risk as well as some example tests of controls that the auditor could use to test those controls. This table (and similar tables in later chapters) is not an exhaustive list of misstatements, control activities, or tests of controls for revenue transactions; rather, it provides some specific examples by assertion to help you understand the underlying concepts. Most of these controls exist within EarthWear’s revenue process (Figure 10–2).

The auditor’s decision process for planning and performing tests of controls involves con- sidering the assertions and the possible misstatements that can occur if internal control does not operate effectively. The auditor evaluates the entity’s accounting system to determine the controls that will prevent, or detect and correct, such misstatements. When controls are pres- ent and the auditor decides to rely on them, they must be tested to evaluate their effectiveness. For example, suppose the auditor’s evaluation of the entity’s revenue process indicates that monthly statements are mailed to customers by the accounts receivable department with com- plaints being handled by the billing department. This control is intended to prevent the record- ing of fictitious sales transactions. The auditor can review and test the entity’s procedures for mailing customer statements and handling complaints. If no exceptions or an immaterial number are noted, the auditor has evidence that the control is operating effectively.

Each of the assertions shown in Table 10–6 for revenue transactions is discussed mainly in terms of control activities and tests of controls. The column for test of controls includes both manual tests and computer-assisted audit techniques (CAATs). The choice of which type of test of controls is appropriate for a particular assertion will be a function of the following:

∙ The volume of transactions or data. ∙ The nature and complexity of the systems by which the entity processes and controls

information. ∙ The nature of the available evidence, including audit evidence in electronic form.

The following sections also include a discussion of control activities and tests of controls that are relevant for EarthWear’s revenue process.

Occurrence of Revenue Transactions Auditors are concerned about the occurrence assertion for revenue transactions because clients are more likely to overstate sales than to understate them. The auditor is concerned about two major types of material misstatements: sales to fictitious customers and recording of revenue when goods have not been shipped or services have not been performed. In other words, the

LO 10-9

Assertions about Classes of Transactions and Events for the Period under Audit

Occurrence. All revenue and cash receipt transactions and events that have been recorded have occurred and pertain to the entity.

Completeness. All revenue and cash receipt transactions and events that should have been recorded have been recorded.

Authorization. All revenue and cash receipt transactions and events are properly authorized. Accuracy. Amounts and other data relating to recorded revenue and cash receipt transactions and events have been

recorded appropriately. Cutoff. All revenue and cash receipt transactions and events have been recorded in the correct accounting period. Classification. All revenue and cash receipt transactions and events have been recorded in the proper accounts.

T A B L E 1 0 – 5

Final PDF to printer

356 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 356 10/10/15 02:21 PM

Summary of Assertions, Possible Misstatements, Example Control Activities, and Example Tests of Controls for Revenue Transactions

Assertion Possible Misstatement Example Control Activity Example Tests of Controls

Occurrence Fictitious revenue

Revenue recorded, goods not shipped, or services not performed

Segregation of duties

Sales recorded only with approved customer order and shipping document

Accounting for numerical sequences of sales invoices

Monthly customer statements; complaints handled independently

Observation and evaluation of proper segregation of duties.

Testing of a sample of sales invoices for the presence of authorized customer order and shipping document; if IT application, examination of application controls.

Review and testing of client procedures for accounting for numerical sequence of sales invoices; if IT application, examination of application controls.

Review and testing of client procedures for mailing and handling complaints about monthly statements.

Completeness Goods shipped or services performed, revenue not recorded

Accounting for numerical sequences of shipping documents and sales invoices

Shipping documents matched to sales invoices

Sales invoices reconciled to daily sales report An open-order file that is maintained currently

and reviewed periodically

Review and testing of clients procedures for accounting for numerical sequence of shipping documents and sales invoices; if IT application, examination of application controls.

Tracing of a sample of shipping documents to their respective sales invoices and to the sales journal.

Testing of a sample of daily reconciliations. Examination of the open-order file for unfilled orders.

Authorization Goods shipped or services performed for a customer who is a bad credit risk

Shipments made or services performed at unauthorized prices or on unauthorized terms

Proper procedures for authorizing credit and shipment of goods

Authorized price list and specified terms of trade

Review of clients procedures for granting credit. Examination of sales orders for evidence of proper

credit approval; if IT application, examination of application controls for credit limits.

Comparison of prices and terms on sales invoices to authorized price list and terms of trade; if IT application, examination of application controls for authorized prices and terms.

Accuracy Revenue transaction recorded at an incorrect dollar amount

Authorized price list and specified terms of trade Each sales invoice agreed to shipping

document and customer order for product type and quantity; mathematical accuracy of sales invoice verified

Same as above. Examination of sales invoice for evidence that

client personnel verified mathematical accuracy. Recomputation of the information on a sample of

sales invoices; if IT application, examination of application controls and consideration of use of computer-assisted audit techniques.

Revenue transactions not posted correctly to the sales journal, customers accounts in accounts receivable subsidiary ledger or general journal

Sales invoices reconciled to daily sales report

Daily postings to sales journal reconciled with posting to subsidiary ledger

Subsidiary ledger reconciled to general ledger control account

Examination of reconciliation of sales invoices to daily sales report.

Examination of reconciliation of entries to sales journal with entries to subsidiary ledger.

Review of reconciliation of subsidiary ledger to general ledger control account.

Cutoff Revenue transactions recorded in the wrong period

All shipping documents forwarded to the billing function daily

Daily billing of goods shipped

Comparison of the dates on sales invoices with the dates of the relevant shipping documents.

Comparison of the dates on sales invoices with the dates they were recorded in the sales journal.

Classification Revenue transaction not properly classified

Chart of accounts

Proper codes for different types of products or services

Review of sales journal and general ledger for proper classification.

Examination of sales invoices for proper classification; if IT application, testing of application controls for proper codes.

T A B L E 1 0 – 6

auditor needs assurance that all recorded revenue transactions are valid. The controls shown in Table 10–6 are designed to reduce the risk that revenue is recorded before goods are shipped or services are performed. The major control for preventing fictitious sales is proper segregation of duties between the shipping function and the order entry and billing functions. If these func- tions are not properly segregated, unauthorized shipments can be made to fictitious customers by circumventing normal billing control activities. Requiring an approved customer sales order and shipping document before revenue is recognized also minimizes the recording of fictitious

Final PDF to printer

Chapter 10 Auditing the Revenue Process 357

mes32502_ch10_337-385.indd 357 10/10/15 02:21 PM

sales in an entity’s records. Accounting for the numerical sequence of sales invoices can be accomplished manually or by computer. The use of monthly customer statements also reduces the risk of revenue being recorded before goods are shipped or services are performed because customers are unlikely to recognize an obligation to pay in such a circumstance. Figure 10–2 shows that EarthWear’s revenue process includes these control activities where applicable.

For each of the controls shown, a corresponding test of control is indicated. For example, the auditor can observe and evaluate the segregation of duties. The auditor can also examine a sample of sales invoices for the presence of an authorized customer order and shipping document for each one. In an IT environment, such as EarthWear’s revenue process, the audi- tor can test the application controls to ensure that revenue is recorded only after an approved customer order has been entered and the goods shipped.

Completeness of Revenue Transactions The major misstatement that concerns both management and the auditor is that goods are shipped or services are performed and no revenue is recognized. Failure to recognize rev- enue means that the customer may not be billed for goods or services and the entity does not receive payment. Control activities that ensure that the completeness assertion is being met include accounting for the numerical sequence of shipping documents and sales invoices, matching shipping documents with sales invoices, reconciling the sales invoices to the daily sales report, and maintaining and reviewing the open-order file. For example, EarthWear rec- onciles the batch totals of orders entered and provides a reconciliation of the daily shipping listing and the daily sales report. Additionally, the open-order file is reviewed periodically with follow-up on any order older than some predetermined date.

Tests of controls for these control activities are listed in Table 10–6. For example, to test the control that shipping documents are matched to sales invoices, the auditor could select a sample of bills of lading and trace each one to its respective sales invoice and to the sales jour- nal. If all bills of lading in the sample were matched to sales invoices and included in the sales journal, the auditor would have evidence that all goods shipped are being billed. The auditor could also use a generalized audit software package to print the items in the open-order file that are older than the entity’s predetermined time frame for completing a transaction. These trans- actions would then be investigated to determine why the sales were not completed.

Authorization of Revenue Transactions Possible misstatements due to improper authorization include shipping goods to or perform- ing services for customers who are bad credit risks and making sales at unauthorized prices or terms. As discussed earlier in this chapter, management should establish procedures for authorizing credit, prices, and terms. Additionally, no goods should be shipped without a properly authorized sales order. Table 10–6 lists a number of tests of controls for this asser- tion. In an IT revenue process such as EarthWear’s, the auditor may need to review the appli- cation controls and use CAATs to test the proper authorization of revenue transactions.

Accuracy of Revenue Transactions Accuracy is an important assertion because revenue transactions that are not processed accu- rately result in misstatements that directly affect the amounts reported in the financial state- ments. Again, the presence of an authorized price list and terms of trade reduces the risk of inaccuracies. There should also be controls that ensure proper verification of the information contained on the sales invoice, including type of goods and quantities shipped, prices, and terms. If the controls are manual, the sales invoice may contain the initials of the entity per- sonnel who verified the mathematical accuracy. In an IT application such as EarthWear’s, most of these controls would be programmed. For example, the price list is maintained in a master file. However, the entity still needs controls to ensure that the authorized price list is updated promptly and that only authorized changes are made to the master file. The auditor can verify the application controls by using CAATs.

Final PDF to printer

358 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 358 10/10/15 02:21 PM

The accuracy assertion also includes the possibility that transactions are not posted cor- rectly to the sales journal, customers’ accounts in accounts receivable subsidiary ledger, or the general ledger. In the revenue process, control totals should be utilized to reconcile sales invoices to the daily sales report, and the daily recordings in the sales journal should be rec- onciled with the posting to the accounts receivable subsidiary ledger. The accounts receivable subsidiary ledger should periodically be reconciled to the general ledger control account. In a properly designed revenue system, such controls are programmed and reconciled by the con- trol groups in the IT department and the user departments. The auditor can examine and test the application controls and various reconciliations.

Cutoff of Revenue Transactions If the entity does not have adequate controls to ensure that revenue transactions are recorded on a timely basis, sales may be recorded in the wrong accounting period. The entity should require that all shipping documents be forwarded to the billing function daily. The auditor can test this control by comparing the date on a bill of lading with the date on the respective sales invoice and the date the sales invoice was recorded in the sales journal. In EarthWear’s revenue process, the shipping department forwards the approved shipping order to the billing department for entry into the billing program. In such a system, sales should be billed and recorded within one or two days of shipment.

Classification of Revenue Transactions The use of a chart of accounts and proper codes for recording revenue transactions should provide adequate assurance about this assertion. The auditor can review the sales journal and general ledger for proper classification and can test sales invoices for proper classification by examining programmed controls to ensure that sales invoices are coded by type of product or service.

Control Activities and Tests of Controls—Cash Receipts Transactions

Table 10–7 summarizes the assertions for cash receipts transactions along with some exam- ples of possible misstatements. For each of these misstatements we have included one or two possible control activities that management could implement to mitigate the risk as well as some example tests of controls that the auditor could use to test those controls. This table is not an exhaustive list of misstatements, control activities, or tests of controls for cash receipts transactions; rather, it provides some specific examples by assertion to help you understand the underlying concepts. In assessing the control risk for cash receipts transactions, the audi- tor follows the same decision process as described for revenue transactions. Each of the asser- tions shown in Table 10–7 is discussed with an emphasis on the control activities and tests of controls. The substantive audit procedures for cash are covered in Chapter 16.

LO 10-9

Practice I N S I G H T

The risk of misappropriation of funds may be greatly reduced by implementing a central lockbox at a bank to receive payments instead of receiving customer payments directly at the organization’s location.

Occurrence of Cash Receipts Transactions The possible misstatement that concerns the auditor when considering the occurrence asser- tion is that cash receipts are recorded but not deposited in the entity’s bank account. In order to commit such a fraud, an employee needs access to both the cash receipts and the accounts receivable records; segregation of duties normally prevents this type of defalcation. Thus, proper segregation of duties between the cash receipts function and the accounts receivable

Final PDF to printer

Chapter 10 Auditing the Revenue Process 359

mes32502_ch10_337-385.indd 359 10/10/15 02:21 PM

Summary of Assertions, Possible Misstatements, Example Control Activities, and Example Tests of Controls for Cash Receipts Transactions

Assertion Possible Misstatement Example Control Activity Example Tests of Controls

Occurrence Cash receipts recorded but not received or deposited

Segregation of duties Observation and evaluation of proper segregation of duties.

Use of lockbox system Inquiry of management about lockbox policy.

Monthly bank reconciliations prepared and independently reviewed

Review of monthly bank reconciliation for indication of independent review.

Completeness Cash receipts stolen or lost before recording

Same control procedures as above Same tests of controls as above.

Checks restrictively endorsed when received and daily cash list prepared

Observation of the endorsement of checks.

Daily cash receipts reconciled with posting to accounts receivable subsidiary ledger

Testing of the reconciliation of daily cash receipts with posting to accounts receivable subsidiary ledger.

Customer statements prepared on a regular basis; complaints handled independently

Inquiry of client personnel about handling of monthly statements and examination of resolution of complaints.

Authorization Cash discounts not properly taken

Procedures specifying policies for cash discounts

Testing of a sample of cash receipts transactions for proper cash discounts.

Accuracy Cash receipts recorded at incorrect amount

Daily remittance report reconciled to control listing of remittance advices

Review and testing of reconciliation.

Monthly bank statement reconciled and independently reviewed

Examination of monthly bank reconciliation for independent review.

Cash receipts not properly posted to cash receipts journal, accounts receivable subsidiary ledger, and general ledger accounts

Daily remittance report reconciled daily with postings to cash receipts journal and accounts receivable subsidiary ledger

Review and testing of reconciliation; if IT application, testing of application controls for posting.

Monthly cash receipts journal agreed to general ledger posting

Review of posting from cash receipts journal to the general ledger.

Accounts receivable subsidiary ledger reconciled to general ledger control account

Examination of reconciliation of accounts receivable subsidiary ledger to general ledger control account.

Cutoff Cash receipts recorded in wrong period

Use of a lockbox system or a control procedure to deposit cash receipts daily

Examination of cash receipts for daily deposit.

Classification Cash receipts recorded in wrong financial statement account

Chart of accounts Tracing of cash receipts from listing to cash receipts journal for proper classification.

Review of cash receipts journal for unusual items.

T A B L E 1 0 – 7

function is one control procedure that can prevent such misstatements. Another very strong control that prevents such misstatements is the use of a lockbox system, such as the system used by EarthWear (Figure 10–2). With a lockbox system, the customers’ cash receipts are mailed directly to the entity’s bank, thereby preventing the entity’s employees from having access to cash. The cash is deposited in the entity’s account, and the bank forwards the remit- tance advices and a file of the cash receipts transactions to the entity for processing. Finally, preparation of monthly bank reconciliations that are independently reviewed reduces the pos- sibility that cash receipts will be recorded but not deposited.

Completeness of Cash Receipts Transactions A major misstatement related to the completeness assertion is that cash or checks are stolen or lost before being recorded in the cash receipts records. Proper segregation of duties and

Final PDF to printer

360 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 360 10/10/15 02:21 PM

a lockbox system are strong controls for ensuring that this assertion is met. When a lockbox system is not used, checks should be restrictively endorsed when received, and a daily cash listing should be prepared. An additional control is reconciliation of the daily cash receipts with the amounts posted to customers’ accounts in the accounts receivable subsidiary led- ger. An example of this control is shown in EarthWear’s system, where the total of the remit- tance advices is reconciled with the daily remittance report by the cash receipts department.

In terms of tests of controls, the controls conducted for the occurrence assertion also provide some evidence about completeness. In addition, the auditor can observe the entity’s personnel endorsing the checks and preparing the cash listing. The reconciliation of the daily cash receipts with the postings to the accounts receivable subsidiary ledger can be tested by the auditor on a sample basis.

When the entity does not have adequate segregation of duties or if collusion is sus- pected, an employee has the ability to steal cash and manipulate the accounting records to hide the misstatement. This is sometimes referred to as lapping. When lapping is used, the perpetrator covers the cash shortage by applying cash from one customer’s account against another customer’s account. For example, suppose customer 1 has a balance of $5,000 and mails a check for $3,000 as payment on the account. An entity’s employee who has access to both the cash receipts and the accounts receivable records can convert the $3,000 pay- ment to his or her personal use. The theft of the cash can be covered in the following way: The $3,000 payment is not reflected in the customer’s account. When a payment is subse- quently received from customer 2, the payment is deposited in the entity’s cash account but applied to customer 1’s accounts receivable account. Now the shortage of cash is reflected in customer 2’s accounts receivable account. The entity employee who stole the cash keeps hiding the theft by shifting the $3,000 difference from one customer’s accounts receivable account to another’s.

If cash is stolen before it is recorded as just described, the fraud is difficult and time- consuming for the auditor to detect. If the auditor suspects that this has occurred, the individ- ual cash receipts have to be traced to the customers’ accounts receivable accounts to ensure that each cash receipt has been posted to the correct account. If a cash receipt is posted to a different account, this may indicate that someone is applying cash to different accounts to cover a cash shortage. However, if duties are not properly segregated, that person may also be able to hide the theft through use of a credit memorandum, bad-debt write-off, or no recogni- tion of the revenue transaction. For example, the employee could issue a credit memorandum for $3,000 against the customer’s accounts receivable account to cover the $3,000 difference.

Stop and Think: Suppose that you were auditing an entity (e.g., a restaurant or bar) where a large portion of the payments are made in cash. How would an auditor deter- mine if all the cash was being recorded and not stolen by employees?

In this situation, there is no accounts receivable. The owner could analyze typical cash receipts for dips in trends and could also compare daily and weekly revenue to reductions in inventory. Also the owner could use other types of activities such as the use of an “informant” to observe bar employees and activity at the cash registers.

Authorization of Cash Discounts Terms of trade generally include discounts for payment within a specified period as a way of encouraging customers to pay on time. Controls in the accounting system should ensure that management’s policies concerning cash discounts are followed. For example, the entity may establish terms of trade of 2/10, net/30 days. Customers paying within 10 days are then entitled to a 2-percent discount. When the cash is received, client personnel should check to be sure that the customer is complying with the payment terms. The auditor can test this control by examining a sample of cash receipts transactions to determine if the entity’s cash discount policies are being followed.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 361

mes32502_ch10_337-385.indd 361 10/10/15 02:21 PM

Accuracy of Cash Receipts Transactions There are several potential reasons that could lead cash receipts to be recorded at an incor- rect amount. For example, the wrong amount of cash received could be recorded from the remittance advice or the receipt could be incorrectly processed during data entry. One control activity that provides reasonable assurance that such errors would be detected and corrected is to reconcile the daily remittance report to control listing of remittance advices. The corre- sponding tests of controls involve examining and testing the various reconciliations that take place in this part of the revenue process. The use of monthly customer statements also pro- vides a check on posting to the correct customer account because a customer who has made a payment and whose monthly statement does not reflect it will complain to the entity. It is also possible that a customer’s payment gets posted to the wrong customer account. One control activity that can provide assurance for this classification assertion is that the daily remittance report is reconciled daily with postings to the cash receipts journal and accounts receivable subsidiary ledger. Tests of controls would include review and testing of reconciliations.

Cutoff of Cash Receipts Transactions If the entity uses a lockbox system or if cash is deposited daily in the entity’s bank, there is a small possibility of cash being recorded in the wrong period. Generally, the auditor has little concern with this type of misstatement because most entities use such control activities.

Classification of Cash Receipts The auditor seldom has major concerns about cash receipts being recorded in the wrong financial statement account. The major control for preventing cash from being recorded in the wrong account is a chart of accounts. The auditor’s concern is with applying appropriate account codes to the individual cash receipts, especially cash receipts from unusual sources such as scrap sales, notes receivable, and proceeds from sales of equipment. The auditor can trace a sample of remittance advices to the cash receipts journal to ensure proper classifica- tion. The cash receipts journal can also be reviewed for unusual items.

Control Activities and Tests of Controls—Sales Returns and Allowances Transactions

For most entities, sales returns and allowances transactions are few and do not represent a material amount in the financial statements. As a result, this text does not cover them in as much detail as revenue or cash receipts transactions. However, credit memoranda that are used to process sales returns and allowances transactions can also be used to cover an unau- thorized shipment of goods or conceal a misappropriation of cash.

Two important controls should be present regarding the processing of credit memoranda. First, each credit memorandum should be approved by someone other than the individual who initiated it. This provides proper segregation of duties between access to the customer’s record and authorization for issuing a credit memorandum. Second, a credit for returned goods should be supported by a receiving document indicating that the goods have been returned. The auditor can perform tests of controls on credit memoranda by examining a sample of credit memoranda for proper approval and the presence of the respective receiving docu- ments. For a credit memorandum issued for a reason other than a return of goods, approval by an appropriate individual is the critical control. See Exhibit 10–3 for a discussion of the control activities used by EarthWear to control sales returns.

For entities with few or immaterial sales returns and allowances transactions, the auditor may decide only to gain an understanding of how such transactions are processed and not to con- duct tests of controls. Substantive analytical procedures (discussed later in this chapter) can then be used to provide sufficient evidence on the fairness of the sales returns and allowances account.

LO 10-9

Final PDF to printer

362 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 362 10/10/15 02:21 PM

Relating the Assessed Level of Control Risk to Substantive Procedures

The results of the auditor’s testing of internal control for the revenue process directly impact detection risk and therefore the level of substantive procedures that will be required for the accounts affected by this process. This includes balance sheet accounts such as accounts receivable, allowance for uncollectible accounts, and cash, as well as income statement accounts such as sales, bad-debt expense, and sales returns and allowances.

When the results of testing controls support the planned level of control risk, the auditor can conduct substantive procedures of these accounts at the planned level. However, if the results of the tests of controls do not support the planned level of control risk, the detection risk will have to be set lower. This normally leads to an increase in the amount of substantive procedures. For example, if controls for the occurrence assertion are weaker than planned for revenue transactions, the auditor might increase the number of accounts receivable confirma- tions mailed to customers.

Auditing Revenue-Related Accounts

The auditor uses substantive procedures to detect material misstatements in revenue-related accounts (e.g., sales, accounts receivable, bad-debt expense).

As discussed in Chapter 5, there are two categories of substantive procedures: (1) substan- tive analytical procedures and (2) tests of details of classes of transactions, account balances, and disclosures. Substantive analytical procedures are used to examine plausible relationships among related accounts. This should include disaggregated analytical procedures for revenue. In the rev- enue process, substantive tests of transactions focus mainly on the sales and cash receipts trans- actions. Tests of details of account balances concentrate on the detailed amounts or estimates that make up the ending balance for revenue-related accounts. Tests of details of disclosures are con- cerned with the presentation and disclosures related to accounts receivable and related accounts.

Table 10–5 presented the assertions for revenue and cash receipts transactions and events. Table 10–8 lists the assertions for account balances and disclosures as they apply to revenue- related accounts. You should note that the auditor may test assertions related to transactions (substantive tests of transactions) in conjunction with testing internal controls.

We discuss substantive analytical procedures first because, after control testing, the assurance “bucket” is usually filled with evidence from substantive analytical procedures before tests of details.

LO 10-10

Management Assertions about Account Balances and Disclosures for Revenue-Related Accounts

Assertions about account balances at the period end: • Existence. Recorded accounts receivable and related accounts exist. • Rights and obligations. The entity holds or controls the rights to accounts receivable and related accounts, and

any liabilities related to those accounts are the obligations of the entity. • Completeness. All accounts receivable and related accounts that should have been recorded have been recorded. • Valuation and allocation. Accounts receivable and related accounts are included in the financial statements at

appropriate amounts, and any resulting valuation or allocation adjustments are appropriately recorded.

Assertions about presentation and disclosure: • Occurrence and rights and obligations. All disclosed events, transactions, and other matters relating to accounts

receivable and related accounts have occurred and pertain to the entity. • Completeness. All disclosures relating to accounts receivable and related accounts that should have been

included in the financial statements have been included. • Classification and understandability. Financial information relating to accounts receivable and related accounts is

appropriately presented and described, and disclosures are clearly expressed. • Accuracy and valuation. Financial and other information relating to accounts receivable and related accounts are

disclosed fairly and in appropriate amounts.

T A B L E 1 0 – 8

Final PDF to printer

Chapter 10 Auditing the Revenue Process 363

mes32502_ch10_337-385.indd 363 10/10/15 02:21 PM

Substantive Analytical Procedures

Substantive analytical procedures are useful audit tests for examining the fairness of revenue- related accounts because such tests provide sufficient evidence at low cost. Table 10–9 lists examples of substantive analytical procedures that are useful in auditing such accounts. Many of the analytical procedures listed in Table 10–9 could also be used for risk assessment procedures at the planning stage or as a final analytical procedure at the completion of the audit. Table 10–9 is not an exhaustive list of substantive analytical procedures for revenue-related accounts; rather, it provides some specific examples by account to help you understand the underlying concepts.

Stop and Think: What evidence might be provided by comparing this year’s gross profit percentage with that of previous years? Further, what might it mean if this year’s percent- age is significantly less than last year’s? What if it is significantly more than last year’s?

Comparison of gross profit percentage to previous years’ or industry data may provide valu- able evidence on unrecorded revenue (an understatement) or fictitious revenue (an overstate- ment) and related accounts receivable when this ratio is significantly higher or lower than previous years’ or industry data. This ratio may also provide information on changes in pric- ing policies.

The five ratios shown under the “Accounts Receivable” subheading in Table 10–9 provide evidence on whether accounts receivable properly reflect net realizable value. Each ratio aids the auditor in assessing the fairness of the allowance for uncollectible accounts, which in turn affects the fairness of accounts receivable and bad-debt expense. The days outstanding

LO 10-11

Examples of Substantive Analytical Procedures Used in Testing Accounts Receivable and Related Accounts

Example Substantive Analytical Procedure Possible Misstatement Detected

Revenue Comparison of gross profit percentage by product line with previous years and industry data.* Comparison of reported revenue to budgeted revenue. Analysis of the ratio of sales in the last month or week to total sales for the quarter or year.* Comparison of revenues recorded daily for periods shortly before and after the end of the audit

period for unusual fluctuations such as an increase just before and a decrease just after the end of the period.*

Comparison of details of units shipped with revenues and production records and consideration of whether revenues are reasonable compared to levels of production and average sales price.*

Comparison of the number of weeks of inventory in distribution channels with prior periods for unusual increases that may indicate channel stuffing.*

Comparison of percentages and trends of sales into the distributor channel with industry and competitors sales trends, if known.*

Unrecorded (understated) revenue. Fictitious (overstated) revenue. Changes in pricing policies. Product-pricing problems.

Accounts Receivable, Allowance for Uncollectible Accounts, and Bad-Debt Expense Comparison of receivables turnover and days outstanding in accounts receivable to previous years

and/or industry data. Comparison of aging categories on aged trial balance of accounts receivable to previous years.* Comparison of bad-debt expense as a percentage of revenue to previous years and/or industry

data. Comparison of the allowance for uncollectible accounts as a percentage of accounts receivable or

credit sales to previous years and/or industry data. Examination of large customer accounts individually and comparison to previous year.

Under- or overstatement of allowance for uncollectible accounts and bad-debt expense.

Sales Returns and Allowances and Sales Commissions Comparison of sales returns as a percentage of revenue to previous years or industry data. Comparison of sales discounts as a percentage of revenue to previous years and/or industry data. Estimation of sales commission expense by multiplying net revenue by average commission rate

and comparison of recorded sales commission expense.

Under- or overstatement of sales returns. Under- or overstatement of sales discounts. Under- or overstatement of sales

commission expense and related accrual.

*Analytical procedures suggested in the AICPA’s Auditing Revenue in Certain Industries, Audit Guide (New York: AICPA, 2012).

T A B L E 1 0 – 9

Final PDF to printer

364 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 364 10/10/15 02:21 PM

in accounts receivable ratio for EarthWear provides a good example of a substantive ana- lytical procedure that provides strong audit evidence support for the accurate valuation of accounts receivable. The days outstanding in accounts receivable ratio is 4.91 and 4.94 days for 2014 and 2015; respectively, suggesting that EarthWear collects its accounts receivable quickly. This result is consistent with the majority of the company’s sales being made with credit cards. EarthWear is reimbursed in three to five days by its credit card providers. Given the relative size of accounts receivable and this result indicating that receivables are col- lected quickly, EarthWear’s auditors may do no further audit work on accounts receivable and instead rely on evidence gathered regarding cash receipts and the ending cash balance.

Stop and Think: Suppose that 2015’s days outstanding in accounts receivable ratio increased substantially. How might this impact the nature, timing, and extent of your audit procedures? What types of EarthWear’s customers would be the source of such bad-debt problems?

Last, comparing the ratio of sales returns or sales discounts to revenue with previous years and industry data provides the auditor with evidence on whether all sales returns or sales discounts have been recorded. The auditor can also estimate sales commission expense by multiplying the average commission rate by net sales and comparing that amount with recorded commission expense. In many situations, the auditor may be able to accept the sales returns, sales discounts, and sales commission expense as fairly presented without conducting any additional substantive tests if such substantive analytical procedures produce results that are consistent with the auditor’s expectations.

Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Table 10–10 presents the assertions for accounts receivable, allowance for uncollectible accounts, and bad-debt expense along with related tests of transactions, account balances, and disclosures. This table should not be construed as an exhaustive list of substantive audit procedures for revenue-related accounts. For each assertion, one or more tests of details are presented. In the following subsection, we discuss how the auditor approaches the audit of each important assertion for revenue-related accounts. We begin with the completeness asser- tion for the accounts receivable balance because the auditor must establish that the detailed records that support the account to be audited agree with the general ledger account. Note that we do not cover each assertion, because they are not applicable to EarthWear or they would have been conducted as tests of controls.

Completeness The auditor’s concern with completeness is whether all accounts receivable have been included in the accounts receivable subsidiary ledger and the general ledger accounts receiv- able account. The reconciliation of the aged trial balance to the general ledger account should detect an omission of a receivable from either the accounts receivable subsidiary ledger or the general ledger account. If the entity’s accounting system contains proper control totals and reconciliations, such errors should be detected and corrected by the relevant control activities for accuracy and completeness. For example, in EarthWear’s revenue process (Figure 10–2), control totals exist for daily shipping and billing. Personnel in the billing department would be responsible for reconciling the two totals. If such control activities do not exist in an entity’s accounting system, or if they are not operating effectively, the auditor will have to trace a sample of shipping documents to sales invoices, the sales journal, and the accounts receivable subsidiary ledger to ensure that the transactions were included in the accounting records.

LO 10-12

Final PDF to printer

Chapter 10 Auditing the Revenue Process 365

mes32502_ch10_337-385.indd 365 10/10/15 02:21 PM

Summary of Assertions and Related Tests of Transactions, Account Balances, and Disclosures—Accounts Receivable, Allowance for Uncollectible Accounts, and Bad-Debt Expense

Assertions about Classes of Transactions Substantive Tests of Transactions*

Occurrence For a sample of sales transactions recorded in the sales journal, trace the sales invoices back to customer orders and shipping documents.

Completeness Trace a sample of shipping documents to the details of the sales invoices and to the sales journal and customers accounts receivable subsidiary ledger.

Authorization and accuracy Compare prices and terms on a sample of sales invoices with authorized price list and terms of trade.

Cutoff Compare dates on a sample of sales invoices with the dates of shipment and with the dates they were recorded in the sales journal.

Classification Examine a sample of sales invoices for proper classification into revenue accounts.

Assertions about Account Balances Tests of Details of Account Balances

Existence Confirm selected accounts receivable. Perform alternative procedures for accounts receivable confirmation exceptions and nonresponses.

Rights and obligations Review bank confirmations for any liens on receivables. Ask management, review any loan agreements, and review board of directors minutes for any

indication that the accounts receivable have been sold. Completeness Obtain an aged trial balance of accounts receivable and agree the total to general ledger control

accounts. Review results of testing the completeness assertion for assessing control risk; trace shipping

documents into sales journal and to accounts receivable subsidiary ledger if such testing was not performed as a test of controls.

Valuation and allocation Examine the results of confirmations of selected accounts receivable. Examine the adequacy of the allowance for uncollectible accounts.

Assertions about Presentation and Disclosure Tests of Details of Disclosures

Occurrence, and rights and obligations Determine whether any receivables have been pledged, assigned, or discounted. Determine if such items require disclosure.

Completeness Complete financial reporting checklist to ensure that all financial statement disclosures related to accounts receivable and related accounts have been disclosed.

Classification and understandability Review of aged trial balance for material credits, long-term receivables, and nontrade receivables. Determine whether such items require separate disclosure on the balance sheet.

Read footnotes to ensure that required disclosures are understandable. Accuracy and valuation Read footnotes and other information to ensure that the information is accurate and properly

presented at the appropriate amounts.

*Each of these substantive tests of transactions could be conducted as a test of controls or a dual-purpose test. Of these six assertions, the cutoff assertion is the one that is most often conducted as a substantive test of transactions.

T A B L E 1 0 – 1 0

The process followed by the auditor is to agree the accounts receivable subsidiary led- ger of customer accounts to the general ledger accounts receivable (control) account. This is typically accomplished by obtaining a copy of the aged trial balance of accounts receivable and comparing the total balance with the general ledger accounts receivable account balance. Exhibit 10–4 presents an aged trial balance of accounts receivable working paper for a wire- less services company: Calabro Wireless Services. An aged trial balance of the subsidiary ledger is used because the auditor will need this type of data to examine the allowance for uncollectible accounts.

The auditor must also have assurance that the detail making up the aged trial balance is correct. This can be accomplished in a number of ways. One approach involves mainly manual audit procedures. First, the aged trial balance is footed and crossfooted. Footing and crossfooting mean that each column of the trial balance is added, and the column totals are then added to ensure that they agree with the total balance for the account. Then a sample of customer accounts included in the aged trial balance is selected for testing. For each selected customer account, the auditor traces the customer’s balance back to the subsidiary ledger detail and verifies the total amount and the amounts included in each column for proper aging.

Final PDF to printer

366 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 366 10/10/15 02:21 PM

A second approach involves the use of CAATs. If the general controls over IT are adequate, the auditor can use a generalized audit software package such as ACL to examine the accu- racy of the aged trial balance generated by the entity’s accounting system.

Cutoff The cutoff assertion attempts to determine whether all revenue transactions and related accounts receivable are recorded in the proper period. While the auditor can obtain assurance about the cutoff assertion for sales by conducting tests of controls, in most cases, cutoff tests are conducted as substantive tests of transactions or as a dual-purpose test. Additionally, sales cutoff is usually coordinated with inventory cutoff because the shipment of goods normally indicates that the earnings process is complete. The auditor wants assurance that if goods have been shipped in the current period, the resulting sale has been recorded, and that if the sales have been recorded, the corresponding inventory has been removed from the accounting records. In addition, the auditor needs to determine if there is proper cutoff for sales returns.

If there is not a proper cutoff of revenue transactions, both the revenue and accounts receivable accounts will be misstated for the current and following years. In most instances, errors related to sales cutoff are unintentional and are due to delays in recognizing the ship- ment of goods or the recognition of the sale. In other instances, the entity may intentionally fail to recognize revenue transactions in the current period or may recognize sales from the next period in the current period (see Exhibit 10–5). The first situation can occur by the rev- enue transactions not being recorded in the sales journal until the next period. For example, sales that take place on the last two days of the current year are recorded as sales in the next year by delaying entry until the current-year sales journal is closed. The second situation is generally accomplished by leaving the sales journal “open” and recognizing sales from the first few days of the next period as current-period sales.

The entity’s accounting system should have controls that ensure timely recording of rev- enue transactions. The results of tests of controls, if performed, should provide evidence of the cutoff assertion. Additionally, the entity should have end-of-period control activities for ensuring a proper sales cutoff between accounting periods.

The test of sales cutoff is straightforward. The auditor first identifies the number of the last shipping document issued in the current period. Then a sample of sales invoices and their related shipping documents is selected for a few days just prior to, and subsequent to, the end of the period. Assuming that sales are recorded at the time of shipment (FOB–shipping point), sales invoices representing goods shipped prior to year-end should be recorded in the

Example of an Aged Trial Balance of Accounts Receivable Working Paper

E X H I B I T 1 0 – 4

Customer Name Total ≤30 Days 31–60 Days 61–90 Days >90 Days

Abbott Construction Acton Labs

• • •

Wright Industries Zorcon, Inc.

$ 10,945¥ 9,705

• • •

29,875¥ 4,340

$ 9,542

• • •

18,875

$ 1,403 5,205

• • •

11,000

$ 4,500 • • •

• • •

$ 4,340

Total $3,717,900 F T/B

$2,044,895 F

$1,301,215 F

$260,253 F

$111,537 F

F = Footed. T/B = Agreed to trial balance. ¥ = Customer account traced to subsidiary ledger; agreed to total and proper aging tested.

CALABRO WIRELESS SERVICES E10 Aged Trial Balance—Accounts Receivable DLJ 12/31/15 1/15/2016

Final PDF to printer

Chapter 10 Auditing the Revenue Process 367

mes32502_ch10_337-385.indd 367 10/10/15 02:21 PM

current period, and invoices for goods shipped subsequent to year-end should be recorded as sales in the next period. Any transaction recorded in the wrong period should be corrected by the entity. For example, suppose the last shipping document issued in the current period was numbered 10,540. None of the recorded revenue transactions sampled from a few days prior to year-end should have related shipping document numbers higher than 10,540, and none of the sampled revenue transactions recorded in the first few days of the subsequent period should have related shipping document numbers lower than 10,540. In an IT system such tests are still necessary because a delay in entering data may occur, or management may manipu- late the recognition of the transactions.

The processing of sales returns may differ across entities. When sales returns are not mate- rial, or if they occur irregularly, the entity may recognize a sales return at the time the goods are returned. However, for entities like EarthWear, sales returns may represent a material amount or may occur regularly. In this instance, the entity may estimate an allowance for sales returns. When sales returns represent a material amount, the auditor needs to test for proper cutoff. If the auditor decides to conduct more detailed tests, the receiving documents used to acknowl- edge receipt of the returned goods must be examined. Using procedures similar to those for testing sales cutoff, the auditor selects a sample of receiving documents for a few days prior to and subsequent to the end of the period. The receiving documents are traced to the related credit memoranda. Sales returns recorded in the wrong period should be corrected, if material.

Existence The existence of accounts receivable is one of the more important assertions because the auditor wants assurance that this account balance is not overstated through the inclusion of fictitious customer accounts or amounts. The major audit procedures for testing the existence assertion for accounts receivable are confirmation of customers’ account balances and exami- nation of subsequent cash receipts. If a customer does not respond to the auditor’s confir- mation request, additional audit procedures may be necessary. The confirmation process is discussed later in this chapter.

Rights and Obligations The auditor must determine whether the accounts receivable are owned by the entity because accounts receivable that have been sold should not be included in the entity’s financial state- ments. For most audit engagements, this does not represent a problem because the entity owns

Sunbeam Corporation Restates Financial Results

Sunbeam Corporation restated its financial results for 1996, 1997, and the first quarter of 1998 based on an extensive audit by its audit committee and two public accounting firms. The special audit found that the pre- viously issued financial statements overstated the loss for 1996, overstated profits for 1997, and understated the loss for the first quarter of 1998. Sunbeam reported that, for certain periods, revenue was incorrectly rec- ognized in the wrong period, partly because of the company’s “bill and hold” practice of billing customers in the current period for products that were delivered in a later period. The company also booked a significant amount of sales that were made to customers under such liberal terms that they did not constitute valid sales at all, but rather appeared to be consignments or guaranteed sales. In 1997 revenue was restated from $1,186 million to $1,073 million, and earnings were reduced from $123.1 million to $52.3 million. The report- ing of these financial irregularities led to the resignation of Sunbeam’s CEO, Al Dunlap.

In 2001, the SEC sued five ex-executives of Sunbeam and Arthur Andersen. Andersen agreed to pay $110 million to settle an accounting-fraud lawsuit over its audit work for Sunbeam.

Sources: J. R. Liang, “Dangerous Games: Did “Chainsaw Al” Dunlap Manufacture Sunbeam’s Earnings Last Year?” Barron’s (June 8, 1998), pp. 17–19; M. Brannigan, “Sunbeam Audit to Repudiate 97 Turnaround,” The Wall Street Journal (October 20, 1998), p. A3; “ Sunbeam to Restate Financial Results; Discloses Adjustments for 1996, 1997, and First Quarter 1998,” The PointCast Network (October 20, 1998); N. Harris, “Andersen to Pay $110 Million to Settle Sunbeam Account-Fraud Lawsuit,” The Wall Street Journal (May 2, 2001), p. A3; and J. Weil, “Five Sunbeam Ex-Executives Sued by SEC,” The Wall Street Journal (May 16, 2001), p. A3.

E X H I B I T 1 0 – 5

Final PDF to printer

368 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 368 10/10/15 02:21 PM

all the receivables. However, in some instances an entity may sell its accounts receivable. The auditor can detect such an action by reviewing bank confirmations, cash receipts for payments from organizations that factor accounts receivable, or corporate minutes for authorization of the sale or assignment of receivables.

Valuation and Allocation The major valuation issue related to accounts receivable is concerned with the net realiz- able value of accounts receivable. The auditor is concerned with determining that the allow- ance for uncollectible accounts, and thus bad-debt expense, is fairly stated. The allowance for uncollectible accounts is affected by internal factors such as the entity’s credit-granting and cash collection policies and external factors such as the state of the economy, conditions in the entity’s industry, and the financial strength of the entity’s customers.

In verifying the adequacy of the allowance for uncollectible accounts, the auditor starts by assessing the entity’s policies for granting credit and collecting cash. If the entity establishes strict standards for granting credit, the likelihood of a large number of bad debts is reduced. Generally, the auditor assesses the adequacy of the allowance account by first examining the aged trial balance for amounts that have been outstanding for a long time. The probability of collecting these accounts can be assessed by discussing them with the credit manager, examining the customers’ financial statements, obtaining credit reports (such as from Dun & Bradstreet), or reviewing the customers’ communications with the entity related to payment.

The second step in assessing the adequacy of the allowance account involves examining the entity’s prior experience with bad debts. The problem with examining only delinquent accounts is that no consideration is given to accounts that are current but that may result in bad debts. By maintaining good historical data on bad debts, the entity can determine what percentage of each aging category will become uncollectible. The auditor can test these percentages for reasonableness. Following is an example of how this approach would work.

Suppose Calabro Wireless Services developed the following historical data on bad debts:

Aging Category Percentage as Bad Debts

<30 days .001 31–60 days .025 61–90 days .14

>90 days .55

The allowance for uncollectible accounts can be determined in the following manner, using the data from Exhibit 10–4:

<30 days 31–60 days 61–90 days >90 days Total

$2,044,895 × .001

$ 2,045

$1,301,215 × .025

$ 32,530

$260,253 × .14

$ 36,435

$111,537 × .55

$ 61,345

$3,717,900

$ 132,355

Suppose that the balance in the allowance for doubtful accounts on Calabro’s general ledger is $135,300. This general ledger balance appears reasonable, given the auditor’s calcu- lation of $132,355.

Stop and Think: Suppose the percentage for bad debts in the 31–60 days column was 5 percent instead of 2.5 percent; would your conclusion change? What if it were 7.5 percent?

While determining the proper amount for the allowance for uncollectible accounts may seem relatively straightforward, considerable judgment on the part of the auditor is involved.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 369

mes32502_ch10_337-385.indd 369 10/10/15 02:21 PM

As mentioned, the auditor must evaluate the collectibility of individual problem accounts and consider whether the historically derived percentages are reasonable, given the current eco- nomic and industry conditions.

Classification The major issues related to the presentation and disclosure assertion about classification are (1) identifying and reclassifying any material credits contained in accounts receivable, (2) segregating short-term and long-term receivables, and (3) ensuring that different types of receivables are properly classified. In many entities, when a customer pays in advance or a credit is issued, the amount is credited to the customer’s accounts receivable account. The auditor should determine the amount of such credits and, if material, reclassify them as either a deposit or another type of liability. The second issue requires that the auditor identify and separate short-term receivables from long-term receivables. Long-term receivables should not be included with trade accounts receivable. The auditor must also ensure that nontrade receivables are properly separated from trade accounts receivable. For example, receivables from officers, employees, or related parties should not be included with trade accounts receiv- able because users might be misled if such receivables are combined.

Other Presentation and Disclosure Assertions Disclosure is important for accounts receivable and related accounts. While management is responsible for the financial statements, the auditor must ensure that all necessary disclo- sures are made. Most public accounting firms use some type of financial statement reporting checklist to ensure that all necessary disclosures are made for each account (completeness). Table 10–11 presents examples of disclosure items for the revenue process and related finan- cial statement accounts. Exhibit 10–6 presents two examples of common disclosures for revenue-related accounts. The first disclosure relates to the basis for recognizing revenue. This disclosure is normally included in a footnote that describes significant accounting poli- cies. The second example presents disclosure of related-party transactions. Disclosures about related-party transactions normally discuss the nature of the transactions, the amounts, and whether the transactions were similar in terms to those for unrelated parties.

Examples of Disclosure Items for the Revenue Process and Related Accounts

Revenue recognition basis. Revenues recognized under the percentage-of-completion method. Long-term sales contracts. Revenues by reportable segment of the business. Revenues and receivables from related parties. Receivables by type (trade, officer, employee, affiliate, and so on). Short- and long-term receivables. Pledged or discounted receivables.

T A B L E 1 0 – 1 1

Sample Disclosures for Revenue Recognition and Related-Party TransactionsE X H I B I T 1 0 – 6

Revenue Recognition Sales are recognized when the company’s products are shipped. Sales to customers with whom the com- pany has reciprocal purchase agreements are accounted for in the same manner as intercompany transac- tions and are eliminated in the financial statements.

Related-Party Transactions The company’s chairman of the board is also chairman of the board of Dayco Industries. Net sales to Dayco were $990,000 and $1,244,000 for the two years ended 2015 and 2014. Accounts receivable from Dayco were $243,000 and $489,000 at December 31, 2015 and 2014, respectively. The company believes that the terms of sale were substantially the same as those available to unrelated parties for similar products.

Final PDF to printer

370 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 370 10/10/15 02:21 PM

The Confirmation Process—Accounts Receivable

Confirmation is audit evidence that is a direct written response from a third party (the con- firming party) to the auditor, in paper form or by electronic or other medium. There is a pre- sumption in auditing standards that auditors will request confirmation of accounts receivable during an audit. However, auditing standards allow the auditor to omit confirming accounts receivable in the following circumstances:

∙ The accounts receivable balance is immaterial. ∙ External confirmations would be ineffective. (This might occur if, based on prior

experience, the auditor determines that the response rate might be low or the responses might not be reliable.)

∙ The auditor’s assessed level of risk of material misstatement at the relevant assertion level is low, and the other planned substantive procedures address the assessed risk.

Because of the importance of accounts receivable confirmations, the auditor should doc- ument completely the decision not to gather such evidence.

LO 10-13

Practice I N S I G H T

Audit deficiencies identified in PCAOB inspections include auditors not documenting how they over- came the presumption that the auditor will request the confirmation of accounts receivable and documenting reasons that are not among the acceptable conditions for not requesting confirmations.

Confirmations can address more than one assertion. However, confirmations normally provide different levels of assurance for different assertions. Accounts receivable confirma- tions are generally a good source of evidence for testing the existence assertion. If the cus- tomer confirms the amount owed to the entity, the auditor has appropriate evidence that the account receivable is valid.2 Accounts receivable confirmations may also provide evidence on the cutoff, completeness, and valuation assertions. For example, a customer’s confirmation of the dollar amount owed provides some evidence on the valuation assertion.

A number of factors affect the reliability of accounts receivable confirmations. The audi- tor should consider each of the following factors when using confirmations to test accounts receivable:

∙ The type of confirmation request. ∙ Prior experience with the client or similar engagements. ∙ The intended respondent.

The types of confirmations are discussed in the next section. The auditor should consider prior experience with the client in terms of confirmation response rates, misstatements identi- fied, and the accuracy of returned confirmations when assessing the reliability of accounts receivable confirmations. For example, if response rates were low in prior audits, the auditor might consider obtaining evidence using alternative procedures. The auditor should consider each respondent’s competence, knowledge, ability, and objectivity when assessing the reli- ability of confirmation requests. For example, if an auditor is confirming accounts receivable for a small retail organization, it is possible that the respondents may not have the knowledge or ability to respond appropriately to the confirmation request. In addition, some large organi- zations and government agencies do not respond to confirmations because it may be difficult to accumulate the necessary data, since they are on a voucher system. Such nonresponses must be tested using procedures discussed later in the chapter.

2Research has shown that accounts receivable confirmations are not always a reliable source of evidence. See P. Caster, R. J. Elder, and D. J. Janvrin, “A Summary of Research and Enforcement Release Evidence on Confirma- tion Use and Effectiveness,” Auditing: A Journal of Practice & Theory (November 2008), pp. 253–280, for a discus- sion of these findings.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 371

mes32502_ch10_337-385.indd 371 10/10/15 02:21 PM

Types of Confirmations There are two types of confirmations: positive and negative. A positive accounts receiv- able confirmation requests that customers indicate whether they agree with the amount due to the client stated in the confirmation. Thus, a response is required regardless of whether the customer believes the amount is correct or incorrect. Sometimes an auditor will use a “blank” form of positive confirmation, in which the request requires the customer to provide the amount owed to the client. Positive confirmations are generally used when an account’s individual balances are large or if errors are anticipated because the risk of material misstate- ments has been judged to be high. Exhibit 10–7 presents an example of a positive confirma- tion request.

A negative confirmation requests that customers respond only when they disagree with the amount due to the client. An example of a negative confirmation request is shown in Exhibit 10–8. The auditor should not use negative confirmation requests as the sole substan- tive audit procedure to address an assessed risk of material misstatement at the assertion level, unless all of the following are present:

∙ The auditor has assessed the risk of material misstatement as low and has obtained sufficient appropriate audit evidence regarding the operating effectiveness of controls relevant to the assertion.

Example of a Positive Confirmation RequestE X H I B I T 1 0 – 7

CALABRO WIRELESS SERVICES

Wright Industries January 7, 2016 8440 S.W. 97 Boulevard Starke, FL 32690

Dear Customers:

Please examine the accompanying statement carefully and either confirm its correctness or report any differences to our auditors

Abbott & Johnson, LLP P.O. Box 669 Tampa, FL 32691

who are auditing our financial statements. Your prompt attention to this request will be appreciated. An envelope is enclosed for your reply. Please do not send your payments

to the auditors.

Sincerely, Jan Rodriguez Controller, Calabro Wireless Services _____________________________________________________________________________________________________

Confirmation:

The balance receivable from us for $29,875 as of December 31, 2015, is correct except as noted below: _____________________________________________________________________________________________________

_____________________________________________________________________________________________________

Wright Industries

Date____________ By ___________________________________________________________________________________

Final PDF to printer

372 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 372 10/10/15 02:21 PM

∙ The population of items subject to negative confirmation procedures comprises a large number of small, homogeneous account balances, transactions, or conditions.

∙ A very low exception rate is expected. ∙ The auditor is not aware of circumstances or conditions that would cause recipients of

negative confirmation requests to disregard such requests.

On some audit engagements, a combination of positive and negative confirmations is used to test accounts receivable because of materiality considerations and a mix of customers. For example, positive confirmations may be sent to selected large-dollar customer accounts and negative confirmations sent to a sample of small-dollar customer accounts.

Because positive accounts receivable confirmations require that customers respond to the auditor, any amounts for which responses are not received must be verified by the auditor using alternative procedures. Negative accounts receivable confirmations require a response only when the information about the customer’s balance is incorrect. Therefore, a nonresponse to a negative confirmation request is generally assumed to represent a valid account receivable. This can be a major drawback to the use of negative confirmations because a nonresponse may just mean the confirmation was simply ignored and discarded. For this reason, negative confirmations generally provide little assurance, that is, they may help “top off” an assurance bucket that is nearly full from other forms of audit evidence.

The accuracy of the accounts receivable confirmation request can generally be improved if a copy of the customer’s monthly statement is enclosed with the confirmation request.

Timing Accounts receivable may be confirmed at an interim date or at year-end. Such considerations were discussed in Chapter 6. The confirmation request should be sent soon after the end of the accounting period in order to maximize the response rate. Sending the confirmations at the end of the accounting period reduces the chance of timing differences arising due to process- ing of purchases and cash disbursements by the customers.

Example of a Negative Confirmation RequestE X H I B I T 1 0 – 8

CALABRO WIRELESS SERVICES

Zorcon, Inc. January 7, 2016 P.O. Box 1429 Melrose, FL 32692-1429

Dear Customers:

Please examine the accompanying statement carefully. If it does NOT agree with your records, please report any differences directly to our auditors

Abbott & Johnson, LLP P.O. Box 669 Tampa, FL 32691

who are auditing our financial statements. Your prompt attention to this request will be appreciated. An envelope is enclosed for your reply. Please do not send your payments

to the auditors.

Sincerely, Jan Rodriguez Controller, Calabro Wireless Services

Final PDF to printer

Chapter 10 Auditing the Revenue Process 373

mes32502_ch10_337-385.indd 373 10/10/15 02:21 PM

Confirmation Procedures The auditor must maintain control over the accounts receivable confirmations so as to minimize the possibility that direct communication between the customers and the audi- tor is biased by interception or alteration of the receivable confirmation by the entity. This includes determining the information to be confirmed; selecting the appropriate confirm- ing parties; designing the confirmation requests, including determining that requests are properly directed to the appropriate confirming parties and provide for being responded to directly to the auditor; and sending the requests, including follow-up requests to any nonresponding confirming parties. For control purposes, the auditor should mail the con- firmations outside the entity’s facilities. Direct mailing from the public accounting firm’s office generally provides the best control. To ensure that any confirmations that are unde- liverable by the post office are returned to the auditors and not the entity, the confirmations should be mailed in envelopes with the public accounting firm’s address listed as the return address. The envelope used by customers for returning the confirmation response should also be addressed to the public accounting firm. The fact that undeliverable confirmations are returned directly to the auditor also provides some assurance that fictitious customers are identified.

The auditor should maintain a record of the confirmations mailed and those returned. When positive confirmations are used, the auditor generally follows up with second, and pos- sibly third, requests to customers who do not reply, in an attempt to increase the response rate to the confirmation requests. In some cases, a customer may respond using electronic media (such as e-mail or fax) or orally. In such situations the auditor should verify the source and contents of the communication. For example, a fax response may be verified by a telephone call to the respondent, and an oral response can be verified by requesting a written communi- cation from the respondent.

Each confirmation exception (that is, difference between the recorded balance and the balance confirmed by the customer) should be carefully examined by the auditor to determine the reason for the difference. In many cases, exceptions result from what are referred to as tim- ing differences. Such differences occur because of delays in recording transactions in either the client’s or the customer’s records. For example, the client may ship goods to a customer on the last day of the period and record it as a current-period sale. The customer will probably receive and record the goods as a purchase in the next period. Such situations are not errors and result only because of a delay in recording the transaction. Payment for goods by a cus- tomer at the end of the period can result in a timing difference if the customer prepares and records the payment in the current period but the client receives and records the receipt in the following period. Again, the difference in the confirmed amount results from a timing differ- ence. Table 10–12 presents some examples of exceptions and their potential causes.

Examples of Exceptions to Confirmation Requests

Type of Difference Potential Cause

Goods not received by customer Timing difference. Goods delivered to wrong customer. Invoice sent to wrong customer. Fictitious sale.

Payment not recorded in client’s records Timing difference. Payment applied to wrong customer account. Cash misappropriated.

Goods returned for credit by customer Timing difference. Processing error Incorrect quantity or price.

Recording error. Amount in dispute Price of goods in dispute.

Goods do not meet specifications. Goods damaged in transit.

T A B L E 1 0 – 1 2

Final PDF to printer

374 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 374 10/10/15 02:21 PM

Alternative Procedures When the auditor does not receive responses to positive confirmations, he or she must apply alternative procedures to determine the existence and valuation of the accounts receivable. Auditors normally send second and third requests; and if necessary, they perform the follow- ing alternative audit procedures:

∙ Examination of specific subsequent cash receipts. ∙ Examination of shipping documentation. ∙ Examination of other client documentation.

Examination of subsequent cash receipts involves checking the accounts receivable sub- sidiary ledger for payments of the specific sales invoices included in the customers’ accounts receivable balances that were outstanding at the date of the confirmation. If the auditor has obtained evidence that the client’s controls are strong for recording cash receipts and the amount collected is a significant portion of the accounts receivable balance, the auditor may stop at this point. If the client’s controls are weak, the auditor may extend the testing by trac- ing the payment in the subsidiary ledger to the cash receipts journal and to the bank statement. If the customer has paid for the goods, the auditor has strong evidence concerning the exis- tence and valuation of the accounts receivable.

If a customer has not paid the accounts receivable, the auditor can examine the underly- ing documentation that supports the revenue transaction. This documentation includes the original customer order or shipping document. If this documentation indicates that the cus- tomer ordered the goods and the goods were shipped, then the auditor would have evidence supporting the validity of the accounts receivable. Last, the auditor may need to examine other correspondence between the client and the customer to obtain adequate evidence on the validity and valuation of the accounts receivable.

Practice I N S I G H T

Properly controlled electronic confirmations may be considered to be reliable audit evidence. If the auditor is satisfied that the electronic confirmation process is secure and properly controlled and the confirmation is directly from a third party who is a bona fide authorized respondent, electronic confir- mations may be considered as an appropriate, valid confirmation response. Various means might be used to validate the sender of electronic information and the respondent’s authorization to confirm the requested information. For example, the use of encryption and electronic digital signatures may improve the security of the electronic confirmation process. Capital Confirmation Inc. has created CONFIRM™, a secure electronic audit confirmation clearinghouse (see http://www.confirmation.com). With this service, auditors can send and receive confirmations in as little as 24 hours with a very high response rate.

Practice I N S I G H T

During an inspection, the PCAOB inspection team found that a regional accounting firm sent accounts receivable confirmations to selected accounts to test existence. For unreturned confirma- tions, the firm tested for subsequent cash receipts. However, many of those accounts had not been paid and the firm did not perform any additional procedures. (PCAOB Release 104-2009-053).

Auditing Other Receivables

Up to this point the discussion has concentrated on trade accounts receivable. Most enti- ties, however, have other types of receivables that are reported on the balance sheet. Some examples include

∙ Receivables from officers and employees. ∙ Receivables from related parties. ∙ Notes receivable.

LO 10-14

Final PDF to printer

Chapter 10 Auditing the Revenue Process 375

mes32502_ch10_337-385.indd 375 10/10/15 02:21 PM

The auditor’s concern with satisfying the assertions for these receivables is similar to that for trade accounts receivable. Typically, each of these types of receivables is confirmed and evaluated for collectibility. The transactions that result in receivables from related parties are examined to determine if they were at “arm’s length.” Notes receivable would also be confirmed and examined for repayment terms and whether interest income has been properly recognized.

Evaluating the Audit Findings— Revenue-Related Accounts

When the auditor has completed the planned substantive procedures, the aggregate misstate- ment for accounts receivable is determined. The aggregate misstatement is then compared to the tolerable misstatement. If the aggregate misstatement is less than the tolerable misstatement, the auditor may accept the account as fairly presented. Conversely, if the aggregate misstate- ment exceeds the tolerable misstatement, the auditor may conclude that the account is not fairly presented. For example, in Chapter 3, a tolerable misstatement for EarthWear was $900,000. Suppose that, after completing the substantive procedures, EarthWear’s auditor determines that the aggregate misstatement is $250,000. In this case, the auditor may conclude that Earth- Wear’s accounts receivable are not materially misstated. However, if the aggregate misstate- ment is $975,000, the auditor’s conclusion will be that the account is materially misstated.

The auditor should also analyze the misstatements discovered through substantive pro- cedures. In some instances, these misstatements may provide additional evidence on con- trol risk. By identifying the causes of the misstatements, the auditor may determine that the original assessment of control risk was too low. For example, the auditor may lower his or her evaluation of the effectiveness of the control for granting credit (that is, may increase control risk) based on a large number of misstatements detected during tests of the allowance for uncollectible accounts. This may impact the auditor’s assessment of audit risk.

If the auditor concludes that audit risk is unacceptably high, additional audit procedures should be performed, the client should adjust the related financial statement accounts to an acceptable level, or a qualified report should be issued. In the previous example, in which EarthWear’s auditor determined that the aggregate misstatement was $975,000, additional audit procedures might be required. Such audit procedures would typically be directed at the systematic errors detected by the substantive procedures. For example, if the substantive tests of transactions indicated that sales invoices were priced incorrectly, the auditor’s additional audit procedures would focus on determining the extent of pricing misstatements. Alternatively, the auditor could conclude that accounts receivable are fairly presented if EarthWear’s manage- ment adjusts the financial statements by $75,000 or more ($975,000 - $900,000). While clients will typically make the full adjustment, an adjustment of at least $75,000 would result in the aggregate misstatement being equal to or less than the tolerable misstatement of $900,000.

In summary, the final decision about accounts receivable and the related accounts is based on whether sufficient appropriate evidence has been obtained from the substantive tests conducted.

LO 10-15

KEY TERMS

Final PDF to printer

376 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 376 10/10/15 02:21 PM

Exception. A response that indicates a difference between information requested to be con- firmed, or contained in the entity’s records, and information provided by the confirming party. General controls. Controls that relate to the overall information processing environment and have a pervasive effect on the entity’s computer operations. Lapping. The process of covering a cash shortage by applying cash from one customer’s accounts receivable against another customer’s accounts receivable. Negative confirmation request. A request that the confirming party respond directly to the auditor only if the confirming party disagrees with the information provided in the request. Nonresponse. A failure of the confirming party to respond, or fully respond, to a positive confirmation request or a confirmation request returned undelivered. Positive confirmation request. A request that the confirming party respond directly to the auditor by providing the requested information or indicating whether the confirming party agrees or disagrees with the information in the request. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of controls in preventing or detecting material misstatements at the relevant assertion level. Tests of details of account balances and disclosures. Substantive tests that concentrate on the details of amounts contained in an account balance and in disclosures. Walkthrough. A transaction being traced by an auditor from origination through the entity’s information system until it is reflected in the entity’s financial reports. It encompasses the entire process of initiating, authorizing, recording, processing, and reporting individual trans- actions and controls for each of the significant processes identified.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 10-1 10-1 Accounting standards require that revenue must be realized or realizable and earned before it can be recognized. Discuss what is meant by the terms realized or realiz- able and earned.

LO 10-5 10-2 Describe the credit function’s duties for monitoring customer payments and handling bad debts.

LO 10-5, 10-6 10-3 When an entity does not adequately segregate duties, the possibility of cash being stolen before it is recorded is increased. If the auditor suspects that this type of defalcation is possible, what type of audit procedures can he or she use to test this possibility?

LO 10-7 10-4 The auditor needs to understand how selected inherent risk factors affect the trans- actions processed by the revenue process. Discuss the potential effect that industry- related factors and misstatements detected in prior periods have on the inherent risk assessment for the revenue process.

LO 10-8 10-5 In understanding the accounting system in the revenue process, the auditor typically performs a walkthrough to gain knowledge of the system. What knowledge should the auditor try to obtain about the accounting system?

LO 10-9 10-6 What are the two major controls for sales returns and allowances transactions? LO 10-11 10-7 List four analytical procedures that can be used to test revenue-related accounts.

What potential misstatements are indicated by each of these analytical procedures? LO 10-12 10-8 Describe how the auditor verifies the accuracy of the aged trial balance. LO 10-13 10-9 List and discuss the three factors mentioned in the chapter that may affect the reli-

ability of confirmations of accounts receivable.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 377

mes32502_ch10_337-385.indd 377 10/10/15 02:21 PM

LO 10-13 10-10 Distinguish between positive and negative confirmations. Under what circumstances would positive confirmations be more appropriate than negative confirmations?

LO 10-14 10-11 Identify three other types of receivables the auditor should examine. What audit pro- cedures would typically be used to audit other receivables?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 10-2, 10-6 10-12 For the control activities to be effective, employees maintaining the accounts receiv- able subsidiary ledger should not also approve

a. Employee overtime wages. b. Credit granted to customers. c. Write-offs of customer accounts. d. Cash disbursements.

LO 10-2, 10-8, 10-9 10-13 Which of the following controls is most likely to help ensure that all credit revenue transactions of an entity are recorded?

a. The billing department supervisor sends a copy of each approved sales order to the credit department for comparison to the customer’s authorized credit limit and current account balance.

b. The accounting department supervisor independently reconciles the accounts receivable subsidiary ledger to the accounts receivable control account each month.

c. The accounting department supervisor controls the mailing of monthly state- ments to customers and investigates any differences reported by customers.

d. The billing department supervisor matches prenumbered shipping documents with entries in the sales journal.

LO 10-2, 10-6, 10-9 10-14 Which of the following internal controls would be most likely to deter the lapping of collections from customers?

a. Independent internal verification of dates of entry in the cash receipts journal with dates of daily cash summaries.

b. Authorization of write-offs of uncollectible accounts by a supervisor independent of the credit approval function.

c. Segregation of duties between receiving cash and posting the accounts receivable ledger.

d. Supervisory comparison of the daily cash summary with the sum of the cash receipts journal entries.

LO 10-2, 10-9 10-15 Smith Corporation has numerous customers. A customer file is maintained and includes a customer record with a name, an address, a credit limit, and an account balance. The auditor wishes to test this file to determine whether credit limits are being exceeded. The best procedure for the auditor to follow would be to

a. Develop test data that would cause some account balances to exceed the credit limit and determine if the system properly detects such situations.

b. Develop a program to compare credit limits with account balances and print out the details of any account with a balance exceeding its credit limit.

c. Request a printout of all account balances so that they can be manually checked against the credit limits.

d. Request a printout of a sample of account balances so that they can be individu- ally checked against the respective credit limits.

LO 10-2, 10-9 10-16 Cash receipts from sales on account have been misappropriated. Which of the following acts would conceal this defalcation and be least likely to be detected by an auditor?

Final PDF to printer

378 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 378 10/10/15 02:21 PM

a. Understating the sales journal. b. Overstating the accounts receivable control account. c. Overstating the accounts receivable subsidiary ledger. d. Understating the cash receipts journal.

LO 10-11 10-17 If accounts receivable turnover (credit sales/receivables) was 7.1 times last year compared to only 5.6 times in the current year, it is possible that there were

a. Unrecorded credit sales in the current year. b. Unrecorded cash receipts last year. c. More thorough credit investigations made by the company late last year. d. Fictitious sales in the current year.

LO 10-11 10-18 If the number of days’ sales in accounts receivable (365 days/receivables turnover) decreases significantly, which of the following assertions for accounts receivable most likely is violated?

a. Existence or occurrence. b. Completeness. c. Rights and obligations. d. Classification.

LO 10-12 10-19 Which of the following is most likely to be detected by an auditor’s review of an entity’s sales cutoff?

a. Unrecorded sales for the year. b. Lapping of year-end accounts receivable. c. Excessive sales discounts. d. Unauthorized goods returned for credit.

LO 10-13 10-20 Negative confirmation of accounts receivable is less effective than positive confir- mation of accounts receivable because

a. A majority of recipients usually lack the willingness to respond objectively. b. Some recipients may report incorrect balances that require extensive follow-up. c. The auditor cannot infer that all nonrespondents have verified their account

information. d. Negative confirmations do not produce evidence that is statistically quantifiable.

LO 10-13 10-21 The negative request form of accounts receivable confirmation is useful particularly when

The Assessed Level of Control Risk Relating to Receivables Is

The Number of Small Balances Is

Consideration by the Recipient Is

a. Low High Likely b. Low Low Unlikely c. High Low Likely d. High High Likely

LO 10-13 10-22 An auditor should perform alternative procedures to substantiate the existence of accounts receivable when

a. No reply to a positive confirmation request is received. b. No reply to a negative confirmation request is received. c. The collectibility of the receivables is in doubt. d. Pledging of the receivables is probable.

LO 10-12, 10-15 10-23 In evaluating the adequacy of the allowance for doubtful accounts, an auditor most likely reviews the entity’s aging of receivables to support management’s financial statement assertion of

a. Existence. b. Valuation and allocation. c. Completeness. d. Rights and obligations.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 379

mes32502_ch10_337-385.indd 379 10/10/15 02:21 PM

PROBLEMS All applicable problems are available with Connect.

LO 10-1 10-24 For each of the following situations based on SAB No. 101, indicate the audit evi- dence that should be obtained to determine whether revenue should be recognized or not in the current period.

1. Your client, Thomson Telecom, maintains an inventory of telecommunications equipment. Bayone Telephone Company placed an order for 10 new transform- ers valued at $5 million, and Thomson delivered them just prior to December 31. Thomson’s normal business practice for this class of customer is to enter into a written sales agreement that requires the signatures of all the authorized repre- sentatives of Thomson and its customer before the contract is binding. However, Bayone has not signed the sales agreement because it is awaiting the requisite approval by the legal department. Bayone’s purchasing department has orally agreed to the contract, and the purchasing manager has assured you that the con- tract will be approved the first week of next year.

2. Best Products is a retailer of appliances that offers “layaway” sales to its customers twice a year. Best retains the merchandise, sets it aside in its inventory, and collects a cash deposit from the customer. The customer signs an installment note at the time the initial deposit is received, but no payments are due until 30 days after delivery.

3. Dave’s Discount Stores is a discount retailer that generates revenue from the sale of membership fees it charges customers to shop at its stores. The membership arrangement requires the customer to pay the entire membership fee (usually $48) at the beginning of the arrangement. However, the customer can unilaterally cancel the membership arrangement and receive a refund of the unused portion. Based on past experiences, Dave’s estimates that 35 percent of the customers will cancel their memberships before the end of the contract.

LO 10-2, 10-5, 10-25 The Art Appreciation Society operates a museum for the benefit and enjoyment of 10-6, 10-9 the community. During the hours the museum is open to the public, two clerks who

are positioned at the entrance collect a five-dollar admission fee from each nonmem- ber patron. Members of the Art Appreciation Society are permitted to enter free of charge upon presentation of their membership cards.

At the end of each day one of the clerks delivers the proceeds to the treasurer. The treasurer counts the cash in the presence of the clerk and places it in a safe. Each Friday afternoon the treasurer and one of the clerks deliver all cash held in the safe to the bank and receive an authenticated deposit slip, which provides the basis for the weekly entry in the cash receipts journal.

The board of directors of the Art Appreciation Society has identified a need to improve the internal control system over cash admission fees. The board has deter- mined that the cost of installing turnstiles or sales booths or otherwise altering the physical layout of the museum would greatly exceed any benefits that might be derived. However, the board has agreed that the sale of admission tickets must be an integral part of its improvement efforts.

Smith has been asked by the board of directors of the Art Appreciation Society to review the internal control over cash admission fees and suggest improvements.

Required: Indicate weaknesses in the existing internal control system over cash admission fees, which Smith should identify, and recommend one improvement for each of the weaknesses identified. Organize your answer as indicated in the following example:

Weakness Recommendation

1. There is no basis for establishing the documentation of the number of paying patrons.

1. Prenumbered admission tickets should be issued upon payment of the admission fee.

(AICPA, adapted)

Final PDF to printer

380 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 380 10/10/15 02:21 PM

LO 10-11, 10-12 10-26 Assertions are expressed or implied representations by management that are reflected in the financial statement components. The auditor performs audit procedures to gather evidence to test those assertions.

Required: Your client is All’s Fair Appliance Company, an appliance wholesaler. Select the most appropriate audit procedure from the following list and enter the number in the appropriate place on the grid. (An audit procedure may be selected once, more than once, or not at all.)

Audit Procedure: 1. Review of bank confirmations and loan agreements. 2. Review of drafts of the financial statements. 3. Select a sample of shipping documents, match them with related sales invoices,

and determine that they have been included in the sales journal and accounts receivable subsidiary ledger.

4. Select a sample of shipping documents for a few days before and after year-end. 5. Confirmation of accounts receivable. 6. Review of aging of accounts receivable with the credit manager.

Assertion Audit Procedure

a. Ensure that the entity has legal title to accounts receivable (rights and obligations).

b. Determine that recorded accounts receivable include all amounts owed to the client (completeness).

c. Verify that all accounts receivable are recorded in the cor- rect period (cutoff).

d. Ensure that the allowance for uncollectible accounts is properly stated (valuation and allocation).

e. Confirm that recorded accounts receivable are valid (existence).

LO 10-12, 10-13 10-27 Adam Signoff-On, CPA, was auditing Defense Industries, Inc. Signoff-On sent posi- tive accounts receivable confirmations to a number of Defense’s government cus- tomers. He received a number of returned confirmations marked “We do not confirm balances because we are on a voucher system.”

Required: a. List alternative procedures that Signoff-On might use to ensure the validity of

these accounts. b. Assuming all the procedures you list are viable options for the Defense audit,

which procedure do you believe provides the highest-quality evidence and why?

LO 10-12, 10-13, 10-15 10-28 The “Accounts Receivable—Confirmation Statistics” working paper shown on the next page was prepared by an audit assistant for the 2015 audit of Lewis County Water Company, Inc., a continuing audit client. The engagement supervisor is reviewing the working papers.

Required: Describe the deficiencies in the working paper that the engagement supervisor should discover. Assume that the accounts were selected for confirmation on the basis of a sample that was properly planned and documented on the working paper.

(AICPA, adapted)

Final PDF to printer

Chapter 10 Auditing the Revenue Process 381

mes32502_ch10_337-385.indd 381 10/10/15 02:21 PM

LO 10-12, 10-13, 10-29 During the year, Strang Corporation began to encounter cash-flow difficulties, and 10-15 a cursory review by management revealed receivable collection problems. Strang’s

management engaged Stanley, CPA, to perform a special investigation. Stanley stud- ied the billing and collection process and noted the following:

∙ The accounting department employs one bookkeeper, who receives and opens all incoming mail. This bookkeeper is also responsible for depositing receipts, filing remittance advices on a daily basis, recording receipts in the cash receipts journal, and posting receipts in the individual customer accounts and the general ledger accounts. There are no cash sales. The bookkeeper prepares and controls the mailing of monthly statements to customers.

∙ The concentration of functions and the receivable collection problems caused Stanley to suspect that a systematic defalcation of customers’ payments through a delayed posting of remittances (lapping of accounts receivable) is present. Stan- ley was surprised to find that no customers complained about receiving erroneous monthly statements.

Required: Identify the procedures Stanley should perform to determine whether lapping exists. Do not discuss deficiencies in the internal control system.

(AICPA, adapted)

LEWIS COUNTY WATER CO., INC. Accounts Receivable—Confirmation Statistics

12/31/15

Accounts Dollars

Number Percent Amount Percent

Confirmation requests sent: Positives ........................................................................................ Negatives ...................................................................................... Total sent ....................................................................................... Accounts selected/client asked us not to confirm ........................ Total selected for testing .............................................................. Total accounts receivable at 12/31/15, confirm date ...................

54 140

194 6

200 2,000

2.7% 7.0

9.7 0.3

10.0 100.0

$ 260,000 20,000

$ 280,000

$2,000,000✓✶

13.0% 1.0

14.0

100.0

Results: Replies received through 2/25/16: Positives—no exception ................................................................ Negatives—did not reply or replied “no exception” ..................... Total confirmed without exception ...............................................

Differences reported and resolved, no adjustment: Positives ........................................................................................ Negatives ...................................................................................... Total .............................................................................................

44C 120C 164

6ϕ 12

18‡

2.2 6.0

8.2

0.3 0.6

0.9

$ 180,000 16,000

$ 196,000

$ 30,000 2,000

$ 32,000

9.0 0.8

9.8

1.5 0.1

1.6

Differences found to be potential adjustments: Positives ........................................................................................ Negatives ...................................................................................... Total 0.6% adjustment, immaterial ............................................... Accounts selected/client asked us not to confirm ........................

2CX 8CX

10 6

0.1 0.4

0.5 0.3

$ 10,000 2,000

$ 12,000

0.5 0.1

0.6

Tick Mark Legend ✓ = Agreed to accounts receivable subsidiary ledger. ✶ = Agreed to general ledger and lead schedule. ϕ = Includes one related-party transaction. C = Confirmed without exception, W/P B-4. CX = Confirmed with exception, W/P B-5.

Conclusion: The potential adjustment of $12,000, or 0.6%, is below the materiality threshold; therefore, the accounts receivable balance is fairly stated.

Index B-3

Final PDF to printer

382 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 382 10/10/15 02:21 PM

LO 10-12, 10-15 10-30 You are engaged to audit the Ferrick Corporation for the year ended December 31, 2015. Only merchandise shipped by the Ferrick Corporation to customers up to and including December 30, 2015, has been eliminated from inventory. The inventory as determined by physical inventory count has been recorded on the books by the com- pany’s controller. No perpetual inventory records are maintained. All sales are made on an FOB–shipping point basis. You are to assume that all purchase invoices have been correctly recorded.

The following lists of sales invoices are entered in the sales journal for the months of December 2015 and January 2016, respectively.

Sales Invoice Amount

Sales Invoice Date

Cost of Merchandise Sold

Date Shipped

December 2015

a. b. c. d. e.

$ 3,000 2,000 1,000 4,000

10,000

Dec. 21 Dec. 31 Dec. 29 Dec. 31 Dec. 30

$2,000 800 600

2,400 5,600

Dec. 31 Dec. 13 Dec. 30 Jan. 9 Dec. 29*

January 2016

f. g. h.

$6,000 4,000 8,000

Dec. 31 Jan. 2 Jan. 3

$4,000 2,300 5,500

Dec. 30 Jan. 2 Dec. 31

*Shipped to consignee.

Required: You are to ensure that there is proper cutoff of sales and inventory. If an item is not properly recorded, prepare the necessary adjusting entries.

DISCUSSION CASES

LO 10-1 10-31 SEC Accounting and Auditing Enforcement Release (AAER) No. 108 specifies cer- tain conditions or criteria that a bill and hold transaction of a public company should meet in order to qualify for revenue recognition. The AAER also specifies certain factors that should be considered in evaluating whether a bill and hold transaction meets the requirements for revenue recognition. AAER No. 108 states that a “bill and hold” transaction should meet the following conditions:

∙ The risks of ownership must have passed to the buyer. ∙ The customer must have made a fixed commitment to purchase the goods, prefer-

ably reflected in written documentation. ∙ The buyer, not the seller, must request that the transaction be on a bill and hold

basis. The buyer must have a substantial business purpose for ordering the goods on a bill and hold basis.

∙ There must be a fixed schedule for delivery of the goods. The date for deliv- ery must be reasonable and must be consistent with the buyer’s business purpose (e.g., storage periods are customary in the industry).

∙ The seller must not have retained any specific performance obligations such that the earning process is not complete.

∙ The ordered goods must have been segregated from the seller’s inventory and not be subject to being used to fill other orders.

∙ The equipment must be complete and ready for shipment.

Final PDF to printer

Chapter 10 Auditing the Revenue Process 383

mes32502_ch10_337-385.indd 383 10/10/15 02:21 PM

Required: Identify and discuss the reliability of the types of evidence an auditor would need to

determine whether each condition cited above was met for a bill and hold transaction.

LO 10-14, 10-15 10-32 Friendly Furniture, Inc., a manufacturer of fine hardwood furniture, is a publicly held SEC-registered company with a December 31 year-end. During May, Friendly had a flood due to heavy rains at its major manufacturing facility that damaged about $525,000 of furniture. Friendly is insured for the property loss at replacement value and carries business interruption insurance for lost production. The company antici- pates that the total insurance proceeds will exceed the carrying value of the destroyed furniture and the cost of repairing the facility will be in the range of $700,000 to $1.75 million. The company believes that the insurance carrier will advance approxi- mately 50 percent of the expected proceeds sometime during July. The company has resumed its operations to about one-half of normal capacity and expects to operate at full capacity by September. The company does not expect to file a formal insurance claim until then because it expects that the entire cost of the business interruption will not be known until September. Friendly expects to receive the proceeds of the settlement from the insurance carrier during its fourth quarter.

The company is in the process of making a stock offering and will file a reg- istration statement with the SEC at the end of July, in which it will present stub period financial statements covering the six-month period through June 30. Based on the minimum amount of the expected proceeds, Friendly would like to recognize a receivable for the insurance proceeds and to report a gain in its financial statements for the period ended June 30. The company would also like to allocate a portion of the expected proceeds to cost of products sold.

Required: a. How much of the expected proceeds from insurance coverage, if any, should

Friendly include in its June 30 financial statements? Justify your answer with relevant accounting pronouncements.

b. Assuming that Friendly records a receivable from the insurance company at June 30 for the proceeds, what type of audit evidence would the auditor gather to sup- port the amount recorded?

INTERNET ASSIGNMENTS

LO 10-2, 10-3, 10-4 10-33 Visit the website of a catalog retailer similar to EarthWear Clothiers and determine how it processes sales transactions, recognizes revenue, and reserves for returns.

LO 10-1 10-34 Visit the SEC’s website (www.sec.gov) and identify a company that has been recently cited for revenue recognition problems. Prepare a memo summarizing the revenue recognition issues for the company.

HANDS-ON CASES

EarthWear Online

Accounts Receivable Tests of Details As part of the accounts receivable tests of details, Willis and Adams’ staff requested balance confirma- tions from a random sample of EarthWear customers. Four of the confirmations indicated potential misstatements and required further review by the client. Your task is to review the results of these four confirmations and then evaluate any errors you detect.

Visit Connect to find a detailed description of the case and to download required materials.

Final PDF to printer

384 Part 5 Auditing Business Processes

mes32502_ch10_337-385.indd 384 10/10/15 02:21 PM

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch10_337-385.indd 385 10/10/15 02:21 PM

Final PDF to printer

mes32502_ch11_386-421.indd 386 09/30/15 03:01 PM

CHAPTER

11 11-1 Understand why knowledge of an entity’s expense and

liability recognition policies is important to the audit. 11-2 Understand the purchasing process. 11-3 Know the types of transactions in the purchasing process

and the financial statement accounts affected. 11-4 Be familiar with the types of documents and records used

in the purchasing process. 11-5 Understand the functions in the purchasing process. 11-6 Know the appropriate segregation of duties for the

purchasing process. 11-7 Understand the inherent risks relevant to the purchasing

process and related accounts. 11-8 Know how to assess control risk for a purchasing process.

11-9 Know the key internal controls and develop relevant tests of controls for purchasing, cash disbursements, and purchase return transactions.

11-10 Relate the assessment of control risk to substantive testing. 11-11 Know the substantive analytical procedures used to audit

accounts payable and accrued expenses. 11-12 Know the substantive tests of transactions and tests of

details of account balances and disclosures used to audit accounts payable and accrued expenses.

11-13 Understand the confirmation process for accounts payable. 11-14 Understand how to evaluate the audit findings and reach a

final conclusion on accounts payable and accrued expenses. 11-15 Understand how to audit the tax provision and related

balance sheet accounts.

COSO, Internal Control—Integrated Framework (New York: AICPA, 2013) AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 505, External Confirmations AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 610, Using the Work of Internal Auditors PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

*The AU-C sections reflect the new, clarified codification of ASB standards. Where the ASB has a standard that is similar to a PCAOB standard, the AU-C reference is included in parentheses after the PCAOB standard. The ASB and PCAOB standards are available free from the respective organi- zations’ websites.

Final PDF to printer

387

mes32502_ch11_386-421.indd 387 09/30/15 03:01 PM

Auditing the Purchasing Process

T he second major business process focuses on the purchase of and pay- ment for goods and services from outside vendors. The acquisition of goods and services includes the purchase of raw materials, supplies,

manufacturing equipment, furniture, and fixtures and payment for repairs and maintenance, utilities, and professional services. This process does not include hiring and paying employees or the internal allocation of costs within an entity. Chapter 12 covers the human resource management process.

This chapter begins by reviewing expense and liability recognition con- cepts with particular emphasis on the categories of expenses. The framework developed in Chapter 10 on the revenue process is used to present the audi- tor’s consideration of internal control. This framework starts with an overview of the purchasing process, including the types of transactions, the documents and records involved, and the functions included in the process. Inherent risk factors that relate directly to the purchasing process are covered next. Assess- ment of control risk is then presented, followed by a discussion of control activ- ities and tests of controls. The last sections of the chapter cover the audit of accounts payable and accrued expenses, the major liability accounts affected by the process. Auditing the expense accounts affected by the purchasing pro- cess is covered in Chapter 15. While the main focus of this chapter is auditing the purchasing process for a financial statement audit, the concepts covered for setting control risk are applicable to an audit of internal control over finan- cial reporting for public companies under the Sarbanes-Oxley Act of 2002. An Advanced Module discusses the audit issues related to auditing the tax provi- sion and related balance sheet accounts.

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

388 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 388 09/30/15 03:01 PM

Expense and Liability Recognition

Many transactions processed through a typical purchasing process involve the recognition of an expense and its corresponding liability. As a result, the auditor should understand the basic underlying concepts of expense and liability recognition in order to audit the purchasing pro- cess. FASB Concept Statement No. 6, “Elements of Financial Statements,” defines expenses and liabilities as follows:

Expenses are outflows or other using up of assets or incurrences of liabilities (or a combination of both) from delivering or producing goods, rendering services, or carrying out other activities that constitute the entity’s ongoing major or central operations. (¶80)

Liabilities are probable future sacrifices of economic benefits arising from present obligations of a particular entity to transfer assets or provide services to other entities in the future as a result of past transactions or events. (¶35)

An entity’s expense recognition policies and the type of expenses involved affect how the transactions are recorded and accounted for in the financial statements. FASB State- ment of Financial Accounting Concepts No. 5, “Recognition and Measurement in Financial Statements of Business Enterprises,” indicates that expenses can be classified into three categories.

1. Certain expenses can be matched directly with specific transactions or events and are recognized upon recognition of revenue. These types of expenses are referred to as product costs and include expenses such as cost of goods sold.

2. Many expenses are recognized during the period in which cash is spent or liabilities incurred for goods and services that are used up at that time or shortly thereafter. Such expenses cannot be directly related to specific transactions and are assumed to provide no future benefit. These expenses are referred to as period costs. Examples of such expenses include administrative salaries and rent expense.

3. Some expenses are allocated by systematic and rational procedures to the periods during which the related assets are expected to provide benefits. Depreciation of plant and equipment is an example of such an expense.

In general, the liabilities normally incurred as part of the purchasing process are trade accounts payable. Other incurred expenses are accrued as liabilities at the end of each account- ing period. Most expenses recognized are product or period costs.

Overview of the Purchasing Process

A purchase transaction usually begins with a purchase requisition being generated by a depart- ment or support function. The purchasing department prepares a purchase order for the pur- chase of goods or services from a vendor. When the goods are received or the services have been rendered, the entity records a liability to the vendor. Finally, the entity pays the vendor. Exhibit 11–1 describes EarthWear’s purchasing system.

LO 11-1

LO 11-2

Practice I N S I G H T

The WorldCom fraud illustrates how expenses may be improperly capitalized as assets to inflate net income. WorldCom inappropriately capitalized telephone line maintenance cost as assets instead of recording them as period expenses. Some common examples of fraudulent capitalization schemes include software development costs, research and development and start-up costs, interest and advertising costs, recording fictitious fixed assets, and depreciation and amortization schemes.

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 389

mes32502_ch11_386-421.indd 389 09/30/15 03:01 PM

Stop and Think: Review Exhibit 11–1. Do any risks seem especially apparent? If so, how might these risks impact the nature, timing, and extent of your audit procedures?

Figure 11–1 presents the flowchart for EarthWear’s purchasing system, which serves as a framework for discussing control activities and tests of controls. As mentioned pre- viously, accounting applications are tailored to meet the specific needs of the entity. You should focus on the basic concepts so that they can be applied to the specific purchasing processes encountered. The following topics related to the purchasing process are covered:

∙ Types of transactions and financial statement accounts affected. ∙ Types of documents and records. ∙ The major functions. ∙ The key segregation of duties.

Types of Transactions and Financial Statement Accounts Affected Three types of transactions are processed through the purchasing process:

∙ Purchase of goods and services for cash or credit. ∙ Payment of the liabilities arising from such purchases. ∙ Return of goods to suppliers for cash or credit.

The first type is a purchase transaction that includes acquiring goods and services. The second type is a cash disbursement transaction that involves paying the liabilities that result from purchasing goods and services. The final type is a purchase return transaction, in which goods previously purchased are returned to a supplier for cash or credit.

LO 11-3

Description of EarthWear’s Purchasing System

The major purchasing activity for EarthWear involves the purchase of clothing and other products that are styled and quality crafted by the entity’s design department. All goods are produced by independent manufacturers, except for most of EarthWear’s soft luggage. The entity purchases

merchandise from more than 200 domestic and foreign manufacturers. For many major suppliers, goods are ordered and paid for through the entity’s electronic data interchange (EDI) system. The computerized inventory control system handles the receipt of shipments from manufacturers, permitting faster access to newly arrived merchandise.

Purchases of other goods and services are made in accordance with EarthWear’s purchasing autho- rization policies. Entity personnel complete a purchase requisition, which is forwarded to the purchasing department for processing. Purchasing agents obtain competitive bids and enter the information into the purchase order program. A copy of the purchase order is sent to the vendor. Goods are received at the receiving department, where the information is agreed to the purchase order. The receiving report is forwarded to the accounts payable department, which matches the receiving report to the purchase order and vendor invoice. The accounts payable department prepares a voucher packet and enters the informa- tion into the accounts payable program.

When payment is due on a vendor invoice, the accounts payable program generates a cash disburse- ment report that is reviewed by the accounts payable department. Items approved for payment are entered into the cash disbursement program, and a check is printed or an electronic funds transfer (EFT) is approved. The checks are sent to the cashier’s department for mailing.

E X H I B I T 1 1 – 1

Final PDF to printer

390 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 390 09/30/15 03:01 PM

From design department or other department

Note A: Purchase orders to certain large vendors are made using the company’s EDI system after review by the purchasing department.

Purchase requisition

Error report

Purchase order Daily

receiving log

Approved purchase

requisition received

Error corrections

N = filed numerically

Purchase order file

Accounts payable

master file

Purchase order

program

Four copies distributed to: • Vendor (original) • Accounts payable department • Receiving department • Purchasing department

Serves as the receiving report (RR). No quantities are contained on this copy.

Enter vendor,

quantity, and purchase order

number Daily

To stores department

(see inventory management

process)

IT DepartmentPurchasing Department Receiving Department

Note A

Input

Purchase order

Goods received,

counted, and inspected

Receiving report

Purchase order (RR)

Flowchart of the Purchasing Process—EarthWear Clothiers, Inc.F I G U R E 1 1 – 1

The purchasing process affects many accounts in the financial statements. The more common accounts affected by each type of transaction are

Type of Transaction Account Affected

Purchase transaction Accounts payable Inventory Purchases or cost of goods sold Various asset and expense accounts

Cash disbursement transaction Cash Accounts payable Cash discounts Various asset and expense accounts

Purchase return transaction Purchase returns Purchase allowances Accounts payable Various asset and expense accounts

Types of Documents and Records Table 11–1 lists the important documents and records that are normally involved in the purchasing process. Each of these items is briefly discussed here. The use of an IT system may affect the form of the documents and the auditor’s approach to testing the purchasing process.

LO 11-4

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 391

mes32502_ch11_386-421.indd 391 09/30/15 03:01 PM

Accounts Payable Department IT Department Cashier's Department

Purchase order

Error report

General ledger

Cash disbursements

report

Accounts payable listing

Receiving report

Vendor invoice

From vendor

Compare invoice to purchase order and receiving

report

Error correction

Review documentation and authorize

payment

Review checks &

EFT listing

Purchase order file

Accounts payable

master file

Accounts payable

master file

General ledger file

Cash disbursements

report

Cash disbursements

program

Checks

EFT listing

Accounts payable update

Accounts payable

reporting Daily

• Open purchase order report • Accounts payable expense distribution report • Voucher register • Cash disbursements journal

Note B: Accounts payable department approves all electronic fund transfers (EFT) in the EDI system.

Note B

Weekly/Monthly

To vendors

B Review account

distribution

Voucher packet

Input

Monthly reports

Checks EFT listing

Documents and Records Involved in the Purchasing Process

Purchase requisition Voucher register/purchases journal Purchase order Accounts payable subsidiary ledger Receiving report Vendor statement Vendor invoice Check/EFT Voucher Cash disbursements journal/check register

T A B L E 1 1 – 1

Flowchart of the Purchasing Process—EarthWear Clothiers, Inc. (continued )

F I G U R E 1 1 – 1

Purchase Requisition This document requests goods or services for an authorized indi- vidual or department within the entity. Examples of such requests include an order for sup- plies from an office supervisor and an order for newspaper advertising space from a marketing manager. In EarthWear’s purchasing system, the design department would generate purchase requisitions to acquire goods for sale.

Final PDF to printer

392 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 392 09/30/15 03:01 PM

Purchase Order This document includes the description, quality, and quantity of, and other information on, the goods or services being purchased. The purchase order also indi- cates who approved the acquisition and represents the authorization to purchase the goods or services. The purchase order may be mailed, faxed, or placed by telephone with the supplier or vendor. At EarthWear some purchase orders may be generated by the design department, reviewed by a purchasing agent, and then sent to a vendor using the entity’s EDI system.

Receiving Report This document records the receipt of goods. Normally, the receiving report is a copy of the purchase order with the quantities omitted. This procedure encour- ages receiving department personnel to make an adequate, independent count of the goods received. Receiving department personnel record the date, description, quantity, and other information on this document. In some instances, the quality of the goods is determined by receiving department personnel. In other cases, an inspection department determines whether the goods meet the required specifications. The receiving report is important because receiv- ing goods is generally the event that leads to recognition of the liability by the entity.

Vendor Invoice This document is the bill from the vendor. The vendor invoice includes the description and quantity of the goods shipped or services provided, the price including freight, the terms of trade including cash discounts, and the date billed.

Voucher This document is frequently used by entities to control payment for acquired goods and services. This document serves as the basis for recording a vendor’s invoice in the voucher register or purchases journal. In many purchasing systems, such as EarthWear’s, the voucher is attached to the purchase requisition, purchase order, receiving report, and vendor invoice to create a voucher packet. The voucher packet thus contains all the relevant documen- tation supporting a purchase transaction.

Voucher Register/Purchases Journal A voucher register is used to record the vouchers for goods and services. The voucher register contains numerous columns for recording the account classifications for the goods or services, including a column for recording credits to accounts payable, and columns for recording debits to asset accounts such as inventory and expense accounts such as repairs and maintenance. The voucher register also contains columns for miscellaneous debits and credits. Some entities use a purchases journal instead of a voucher register. With a purchases journal, either vouchers or vendors’ invoices may be used to record the liability. The major difference between a voucher register and a purchases journal is in the way individual vouchers or vendor invoices are summarized. When a voucher register is used, the details of accounts payable are normally represented by a list of unpaid vouchers. With a purchases journal, subsidiary records are normally maintained by the vendor in much the same manner as an accounts receivable subsidiary ledger. However, in a com- puterized environment, a vendor number can be assigned to each voucher and the voucher register can be sorted by vendor to produce a subsidiary ledger for accounts payable.

Accounts Payable Subsidiary Ledger When a purchases journal is utilized, this subsid- iary ledger records the transactions with, and the balance owed to, a vendor. When a voucher register system is used, the subsidiary ledger is a listing of the unpaid vouchers. The total in the subsidiary ledger should equal the balance in the general ledger accounts payable account.

Vendor Statement This statement is sent monthly by the vendor to indicate the beginning balance, current-period purchases and payments, and ending balance. The vendor’s state- ment represents the purchase activity recorded on the vendor’s records. It may differ from the entity’s records because of errors or, more often, timing differences due to delays in shipping goods or recording cash receipts. The entity verifies the accuracy of its records by comparing vendor statements with the accounts payable records.

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 393

mes32502_ch11_386-421.indd 393 09/30/15 03:01 PM

Check or Electronic Funds Transfer (EFT) These disbursements, approved by an autho- rized individual, pay for goods or services.

Cash Disbursements Journal/Check Register This journal records disbursements made by check and electronic funds transfer. It is sometimes referred to as a check register. The cash disbursements journal contains columns for recording credits to cash and debits to accounts payable and cash discounts. Columns may also record miscellaneous debits and credits. Pay- ments recorded in the cash disbursements journal are also recorded in the voucher register or in the accounts payable subsidiary ledger, depending on which system is used by the entity.

The Major Functions The principal business objectives of the purchasing process are acquiring goods and services at the lowest cost consistent with quality and service requirements and effectively using cash resources to pay for those goods and services. Table 11–2 lists the functions that are normally part of the purchasing process.

Requisitioning The initial function in the purchasing process is a request for goods or services by an authorized individual from any department or functional area within the entity (see Figure 11–1). The important issue is that the request meets the authorization procedures implemented by the entity. One frequent organizational control is the establishment of autho- rization dollar limits for different levels of employees and executives. For example, depart- ment supervisors may be authorized to acquire goods or services up to $1,000, department managers up to $5,000, and divisional heads up to $25,000, while any expenditure greater than $100,000 requires approval by the board of directors.

LO 11-5

Practice I N S I G H T

Electronic forms, stored in digital format databases, allow for automatic information routing and inte- gration into other information systems applications. The use of electronic forms is ideal for track- ing and managing processes when human oversight, approvals, or information input needs to be combined with standard elements of information. For example, supplies may be requisitioned by an employee and automatically forwarded to a manager for approval. Once approved, the order may then be input into an EDI translator and forwarded to the appropriate vendor by means of a structured XML EDI transaction. Electronic forms add value to the organization, but the auditor must understand these IT systems and test the e-commerce, general, and application controls.

Functions of the Purchasing Process

Requisitioning Initiation and approval of requests for goods and services by authorized individuals consistent with management criteria.

Purchasing Approval of purchase orders and proper execution as to price, quantity, quality, and vendor.

Receiving Receipt of properly authorized goods or services. Invoice processing Processing of vendor invoices for goods and services received; also, processing of

adjustments for allowances, discounts, and returns. Disbursements Processing of payment to vendors. Accounts payable Recording of all vendor invoices, cash disbursements, and adjustments in individual

vendor accounts. General ledger Proper accumulation, classification, and summarization of purchases, cash

disbursements, and payables in the general ledger.

T A B L E 1 1 – 2

Purchasing The purchasing function executes properly authorized purchase orders. This function is normally performed by a purchasing department (see Figure 11–1), which is headed by a purchasing manager (or agent) and has one or more buyers responsible for spe- cific goods or services. The purchasing function ensures that goods and services are acquired in appropriate quantities and at the lowest price consistent with quality standards and delivery

Final PDF to printer

394 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 394 09/30/15 03:01 PM

schedules. Using multiple vendors and requiring competitive bidding are two ways the pur- chasing function can achieve its objectives.

Receiving The receiving function is responsible for receiving, counting, and inspecting goods received from vendors. The personnel in the receiving department complete a receiving report that is forwarded to the accounts payable function.

Invoice Processing The accounts payable department (see Figure 11–1) processes invoices to ensure that all goods and services received are recorded as assets or expenses and that the corresponding liability is recognized. This function involves matching purchase orders to receiving reports and vendor invoices as to terms, quantities, prices, and extensions. The invoice-processing function also compares the account distributions with established account classifications.

The invoice-processing function is also responsible for purchased goods returned to ven- dors. Appropriate records and control activities must document the return of the goods and initiate any charges back to the vendor.

Disbursements The disbursement function is responsible for preparing and signing checks for paying vendors and authorizing electronic funds transfers. Adequate supporting documentation must verify that the disbursement is for a legitimate business purpose, that the transaction was properly authorized, and that the account distribution is appropriate. To reduce the possibility that the invoice will be paid twice, all documentation (such as purchase order, receiving report, and vendor invoice) should be marked “CANCELED” or “PAID” by the cashier’s department. Finally, if checks are used, they should be mailed to the vendor by the cashier’s department or treasurer.

If IT is used to prepare checks and EFTs, adequate user controls must ensure that only authorized transactions are submitted for payment. Adequate control totals should also be used to agree the amount of payables submitted with the amount of cash disbursed. Checks over a specified limit should be reviewed. For example, in EarthWear’s system (see Figure 11–1), the accounts payable department matches the purchase order to the receiving report and the vendor’s invoice. The voucher is then input into the accounts payable program. When the vouchers are due for payment, they are printed out on a cash disbursement report. Accounts payable personnel review the items to be paid and input them into the cash disbursement program. The checks are forwarded to the cashier’s department for review and mailing to ven- dors. If a signature plate is used for signing checks, it must be properly controlled within the cashier’s department or by the treasurer.

Practice I N S I G H T

Fraudulent disbursements may include payments made to shell companies or ghost vendors, com- mission expense schemes, purchases made by employees for personal benefit, duplicate expense reimbursements, and other fictitious expenses.

Accounts Payable The accounts payable department (see Figure 11–1) is also responsible for ensuring that all vendor invoices, cash disbursements, and adjustments are recorded in the accounts payable records. In IT systems, these entries may be made directly as part of the normal processing of purchase, cash disbursement, or returns and allowances transactions. Proper use of control totals and daily activity reports provides controls for proper recording.

General Ledger The main objective of the general ledger function for the purchasing pro- cess is to ensure that all purchases, cash disbursements, and payables are properly accumu- lated, classified, and summarized in the accounts. In an IT system, such as at EarthWear, the use of control or summary totals ensures that this function is performed correctly. The accounting department is normally responsible for this function.

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 395

mes32502_ch11_386-421.indd 395 09/30/15 03:01 PM

The Key Segregation of Duties As discussed in previous chapters, proper segregation of duties is one of the most impor- tant control activities in any accounting system. Duties should be assigned so that no one individual can control all phases of processing a transaction in a way that permits errors or fraud to go undetected. Because of the potential for theft and fraud in the purchasing process, individuals responsible for requisitioning, purchasing, and receiving should be segregated from the invoice-processing, accounts payable, and general ledger functions. If IT is used in the purchasing process, there should be proper segregation of duties in the IT department. Table 11–3 shows the key segregation of duties for the purchasing process and examples of possible errors or fraud that can result from conflicts in duties.

Table 11–4 shows the proper segregation of duties for purchasing and accounts payable functions across the various departments that process purchase transactions.

Stop and Think: Using Tables 11–3 and 11–4, briefly analyze EarthWear’s flowchart as shown in Figure 11–1. Evaluate whether EarthWear has sufficient segregation of duties and, if not, what errors or fraud could occur because of those conflicts of duties.

LO 11-6

Key Segregation of Duties in the Purchasing Process and Possible Errors or Fraud

Segregation of Duties Possible Errors or Fraud Resulting from Conflicts of Duties

The purchasing function should be segregated from the requisitioning and receiving functions.

If one individual is responsible for the requisition, purchasing, and receiving functions, fictitious or unauthorized purchases can be made. This can result in the theft of goods and, possibly, payment for unauthorized purchases.

The invoice-processing function should be segregated from the accounts payable function.

If one individual is responsible for the invoice-processing and the accounts payable functions, purchase transactions can be processed at the wrong price or terms, or a cash disbursement can be processed for goods or services not received. This can result in overpayment for goods and services or the theft of cash.

The disbursement function should be segregated from the accounts payable function.

If one individual is responsible for the disbursement function and has access to the accounts payable records, unauthorized checks supported by fictitious documents can be issued, and unauthorized transactions can be recorded. This can result in theft of the entity’s cash.

The accounts payable function should be segregated from the general ledger function.

If one individual is responsible for the accounts payable records and for the general ledger, that individual can conceal any defalcation that would normally be detected by reconciling subsidiary records with the general ledger control account.

T A B L E 1 1 – 3

Segregation of Duties for the Purchasing Process Functions by Department

Department

Purchasing Process Functions Purchasing Receiving Accounts Payable Cashier IT

Preparation and approval of purchase order X Receipt, counting, and inspection of purchased materials X Receipt of vendor invoices and matching them with supporting

documents X

Coding (or checking) of account distributions X Updating of accounts payable records X X Preparation of vendor checks X Signing and mailing of vendor checks X Preparation of voucher register X Reconciliation of voucher register to general ledger X

T A B L E 1 1 – 4

Final PDF to printer

396 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 396 09/30/15 03:01 PM

Inherent Risk Assessment

At the beginning of the audit of the purchasing process and its related accounts, the audi- tor should consider the relevant inherent risk factors that may impact the transactions pro- cessed and the financial statement accounts. As mentioned previously, most business risks are viewed as inherent risks. The following factors taken from Chapter 4 should be considered by the auditor in assessing the inherent risk for the purchasing process.

Industry-Related Factors When auditing the purchasing process, the auditor should consider two important industry- related factors in assessing inherent risk: whether the supply of raw materials is adequate and how volatile raw material prices are. If the entity deals with many vendors and prices tend to be relatively stable, there is less risk that the entity’s operations will be affected by raw mate- rial shortages or that production costs will be difficult to control.

Some industries, however, are subject to such industry-related factors. For example, in the high-technology sector, there have been situations in which an entity was dependent on a single vendor to supply a critical component, such as a specialized computer chip. When the vendor has been unable to provide the component, the entity suffered production short- ages and shipping delays that significantly affected financial performance. Other industries that produce basic commodities such as oil, coal, and precious metals can find their financial results significantly affected by swings in the prices and availability of their products. The auditor needs to assess the effects of such industry-related inherent risk factors in terms of assertions such as valuation.

Misstatements Detected in Prior Audits Generally, the purchasing process and its related accounts are not difficult to audit and do not result in contentious accounting issues. However, auditing research has shown that the pur- chasing process and its related accounts are likely to contain material misstatements.1 The auditor’s previous experience with the entity’s purchasing process should be reviewed as a starting point for determining inherent risk.

Control Risk Assessment

The discussion of control risk assessment follows the framework outlined in Chapter 6 on internal control and Chapter 10 on the revenue process. Again it is assumed that the auditor has decided to rely on controls (follow a reliance strategy). Figure 11–2 summarizes the major steps involved in setting control risk for the purchasing cycle.

Understand and Document Internal Control In order to set control risk for the purchasing process, the auditor must understand the five components of internal control.

Control Environment Table 6–3 in Chapter 6 lists factors that affect the control environ- ment. Two factors are particularly important when the auditor considers the control envi- ronment and the purchasing process: the entity’s organizational structure and its methods of assigning authority and responsibility. The entity’s organizational structure for purchasing may impact the auditor’s assessment of control risk because control activities are implemented

LO 11-7

1For example, see A. Eilifsen and W. F. Messier, Jr., “Auditor Detection of Misstatements: A Review and Integration of Empirical Research,” Journal of Accounting Literature 2000 (19), pp. 1–43, for a detailed review of audit research studies that have examined sources of accounting errors.

LO 11-8

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 397

mes32502_ch11_386-421.indd 397 09/30/15 03:01 PM

within an organizational structure. Authority and responsibility for purchasing are usually granted via procedures that limit the amount of purchases that can be made by various levels of authority within the entity. The remaining discussions of the purchasing process assume that the control environment factors are reliable.

The Entity’s Risk Assessment Process The auditor must understand how manage- ment weighs the risks that are relevant to the purchasing process, estimates their significance, assesses the likelihood of their occurrence, and decides what actions to take to address those risks. Some of these risks include a new or revamped information system, rapid growth, and new technology. Each of these factors can represent a serious risk to an entity’s internal con- trol system over purchases.

Control Activities When a reliance strategy is adopted for the purchasing process, the auditor needs to understand the controls that exist to ensure that management’s objectives are being met. More specifically, the auditor identifies the controls that assure the auditor that the assertions are being met.

Information Systems and Communication For each major class of transactions in the purchasing process, the auditor again needs to obtain the following information:

∙ How purchases, cash disbursements, and purchase return transactions are initiated. ∙ The accounting records, supporting documents, and accounts that are involved in

processing purchases, cash disbursements, and purchase return transactions. ∙ The flow of each type of transaction from initiation to inclusion in the financial

statements, including computer processing of the data. ∙ The process used to estimate accrued liabilities.

The auditor develops an understanding of the purchasing process by conducting a walk- through. In the case of a continuing audit, the auditor has the prior years’ documentation of the process to assist in the walkthrough, although the possibility of changes in the system must be considered. If the system has been changed substantially or the audit is for a new entity, the auditor should document the system.

Monitoring of Controls The auditor needs to understand the entity’s monitoring processes over the purchasing process, including how management assesses the design and operation of

Understand and document the purchasing process based on

a reliance strategy.

Plan and perform tests of controls on purchase transactions.

Set and document the control risk for the purchasing process.

Major Steps in Setting Control Risk for the Purchasing ProcessF I G U R E 1 1 – 2

Final PDF to printer

398 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 398 09/30/15 03:01 PM

controls. It also involves understanding how supervisory personnel within the process review the personnel who perform the controls and evaluating the performance of the entity’s IT system.

The auditor can document the purchasing process using procedures manuals, narrative descriptions, an internal control questionnaire, and a flowchart. For example, the following partial questionnaire (template) could be used to record the auditor’s documentation of the information about the controls in the purchasing process. A “Yes” response would indicate that the control was present.

Question Yes No

1. Are there written purchasing policies and procedures?

2. Are purchase requisitions approved in accordance with management’s authorization?

3. Are purchases made from approved vendors?

4. Are price quotations requested for purchases over an established amount?

5. Do purchase orders include adequate descriptions, terms, and instructions?

6. Are purchase orders approved by authorized personnel before issuance?

Plan and Perform Tests of Controls The auditor systematically analyzes the purchasing process in order to identify controls that ensure that material misstatements are prevented or are detected and corrected. Such controls can be relied upon by the auditor to reduce control risk. For example, the entity may have for- mal procedures for authorizing the acquisition of goods and services. The auditor may decide to rely on these controls to reduce control risk for the authorization assertion. Tests of controls would then be necessary to verify that this control is operating effectively. The auditor would examine a sample of purchase transactions to determine if the acquisition of the goods or ser- vices is consistent with the entity’s authorization policy.

Set and Document Control Risk After the controls are tested, the auditor sets the achieved level of control risk. When tests of controls support the planned level of control risk, no modifications are normally necessary to the planned level of detection risk, and the auditor may proceed with the planned substantive procedures. When the tests of controls do not support the planned level of control risk, the auditor must set a higher level of control risk. This results in a lower level of detection risk and leads to more substantive procedures than originally planned.

As discussed earlier, the auditor should document the achieved level of control risk. Documentation of the control risk for the purchasing process might include a flowchart, the results of tests of controls, and a memorandum indicating the auditor’s overall conclusion about the control risk.

Control Activities and Tests of Controls—Purchase Transactions

Table 11–5 presents the assertions about transactions and events, while Table 11–6 sum- marizes the assertions for purchase transactions along with some examples of possible mis- statements. For each of these misstatements we have included one or two possible control activities that management could implement to mitigate the risk as well as some example tests of controls that the auditor could use to test those controls. This table is not an exhaustive list of misstatements, control activities, or tests of controls for purchase transactions; rather, it provides some specific examples by assertion to help you understand the underlying concepts. Most of these controls exist within EarthWear’s purchasing process (see Figure 11–1). The following sections also discuss control activities and tests of controls that are relevant for EarthWear’s purchasing process.

LO 11-9

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 399

mes32502_ch11_386-421.indd 399 09/30/15 03:01 PM

Assertions about Classes of Transactions and Events for the Period under Audit

• Occurrence. All purchase and cash disbursement transactions and events that have been recorded have occurred and pertain to the entity.

• Completeness. All purchase and cash disbursement transactions and events that should have been recorded have been recorded.

• Authorization. All purchase and cash disbursement transactions and events are properly authorized. • Accuracy. Amounts and other data relating to recorded purchase and cash disbursement transactions and events

have been recorded appropriately. • Cutoff. Purchase and cash disbursement transactions and events have been recorded in the correct accounting period. • Classification. Purchase and cash disbursement transactions and events have been recorded in the proper accounts.

T A B L E 1 1 – 5

Occurrence of Purchase Transactions The auditor’s concern in testing the occurrence of purchase transactions is that fictitious or nonexistent purchases may have been recorded in the entity’s records. If fraudulent transac- tions are recorded, assets or expenses will be overstated. A liability will also be recorded and a resulting payment made, usually to the individual who initiated the fictitious purchase trans- actions. Proper segregation of duties is the major control for preventing fictitious purchases. The critical segregation of duties is the separation of the requisitioning and purchasing func- tions from the accounts payable and disbursement functions.

The risk of purchase transactions being recorded without the goods or services being received can also be reduced if purchase transactions are not recorded without an approved purchase order and a receiving report. The presence of an approved purchase order ensures that the purchase was authorized, and the presence of a receiving report indicates that the goods were received. In an IT environment, such as EarthWear’s, the auditor can test the application controls to ensure that purchases are recorded only after an approved purchase order has been entered and the goods received. Accounting for the numerical sequence of receiving reports and vouchers can be accomplished either manually or by the computer. This control prevents the recording of fictitious purchase transactions through the use of receiving documents or vouchers that are numbered outside the sequence of properly autho- rized documents. You should keep in mind that there are some types of transactions that are processed through the purchasing process that will not be accompanied by a purchase requisition and receiving report. For example, services for utilities and advertising would not use a receiving report.

Completeness of Purchase Transactions If the entity fails to record a purchase that has been made, assets or expenses will be under- stated, and the corresponding accounts payable will also be understated. Controls that ensure that the completeness assertion is being met include accounting for the numerical sequences of purchase orders, receiving reports, and vouchers and matching receiving reports with ven- dor invoices.

Tests of controls for these control activities are listed in Table 11–6. For example, the auditor can trace a sample of receiving reports to their corresponding vendor invoices and vouchers. The vouchers can then be traced to the voucher register to ensure that each voucher was recorded. Again, these tests can be performed either manually or with CAATs. If each receiving report is matched to a vendor invoice and voucher, and the voucher was included in the voucher register, the auditor has a high level of assurance as to the com- pleteness assertion.

The auditor’s concern with the completeness assertion also arises when the accounts pay- able and accrued expenses accounts are audited at year-end. If the entity has strong controls for the completeness assertion, the auditor can reduce the scope of the search for unrecorded liabilities at year-end. This issue is discussed in more detail later in this chapter.

Final PDF to printer

400 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 400 09/30/15 03:01 PM

Summary of Assertions, Possible Misstatements, Example Control Activities, and Example Tests of Controls for Purchase Transactions

Assertion Possible Misstatement Example Control Activity Example Tests of Controls

Occurrence Purchase recorded, goods or services not ordered or received

Segregation of duties Observe and evaluate proper segregation of duties.

Purchase not recorded without approved purchase order and receiving report

Test a sample of vouchers for the presence of an authorized purchase order and receiving report; if IT application, examine application controls.

Accounting for numerical sequence of receiving reports and vouchers

Review and test entity procedures for accounting for numerical sequence of receiving reports and vouchers; if IT application, examine application controls.

Completeness Purchases made but not recorded Accounting for numerical sequence of purchase orders, receiving reports, and vouchers

Review the entity’s procedures for accounting for numerical sequence of purchase orders, receiving reports, and vouchers; if IT application, examine application controls.

Receiving reports matched to vendor invoices and entered in the purchases journal

Trace a sample of receiving reports to their respective vendor invoices and vouchers.

Trace a sample of vouchers to the purchases journal.

Authorization Purchase of goods or services not authorized

Approval of acquisitions consistent with the entity’s authorization dollar limits

Review the entity’s dollar limits authorization for acquisitions.

Approved purchase requisition and purchase order

Examine purchase requisitions or purchase orders for proper approval; if IT is used for automatic ordering, examine application controls.

Purchase of goods or services at unauthorized prices or on unauthorized terms

Competitive bidding procedures followed Review the entity’s competitive bidding procedures.

Accuracy Vendor invoice improperly priced or incorrectly calculated

Mathematical accuracy of vendor invoice verified

Purchase order agreed to receiving report and vendor’s invoice for product, quantity, and price

Recompute the mathematical accuracy of vendor invoice.

Agree the information on a sample of voucher packets for product, quantity, and price.

Purchase transactions not posted to the purchases journal, the accounts payable subsidiary records, or the general ledger

Vouchers reconciled to daily accounts payable listing (or daily postings to purchases journal) and then reconciled with postings to accounts payable subsidiary records

Examine reconciliation of vouchers to daily accounts payable report (or reconciliation of entries in purchases journal with entries to accounts payable subsidiary records); if IT application, examine application controls.

Voucher register or accounts payable subsidiary records reconciled to general ledger control account

Review reconciliation of subsidiary records to general ledger control account; if IT application, examine application controls.

Cutoff Purchase transactions recorded in the wrong period

All receiving reports forwarded to the accounts payable department daily

Compare the dates on receiving reports with the dates on the relevant vouchers.

Existence of procedures that require recording the purchases as soon as possible after goods or services are received

Compare the dates on vouchers with the dates they were recorded in the purchases journal.

Classification Purchase transaction not properly classified

Chart of accounts Review purchases journal and general ledger for reasonableness.

Independent approval and review of accounts charged for acquisitions

Examine a sample of vouchers for proper classification.

Note: Receiving reports are used to acknowledge the receipt of tangible goods such as raw materials, office supplies, and equipment. For services such as utilities and advertising, receiving reports are not used.

T A B L E 1 1 – 6

Authorization of Purchase Transactions Possible misstatements due to improper authorization include the purchase of unauthor- ized goods and services and the purchase of goods or services at unauthorized prices or terms. The primary control to prevent these misstatements is the use of an authoriza- tion schedule or table that stipulates the amount that different levels of employees are authorized to purchase. Tests of controls include examination of purchase requisitions and purchase orders for proper approval consistent with the authorization table. If the

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 401

mes32502_ch11_386-421.indd 401 09/30/15 03:01 PM

entity uses a sophisticated production system that reorders goods automatically, the audi- tor should examine and test the programmed controls. Competitive bidding procedures should be followed to ensure that goods and services are acquired at competitive prices and on competitive terms.

Accuracy of Purchase Transactions A possible misstatement for the accuracy assertion is that purchase transactions may be recorded at incorrect amounts due to improper pricing or erroneous calculations. The pur- chase order should contain the expected price for the goods or services being purchased, based on price quotes obtained by the purchasing agents or prices contained in catalogs or published price lists. If the goods or services are purchased under a contract, the price should be stipulated in the contract. For example, an accounts payable clerk should compare the purchase order with the receiving report and vendor invoice (see Figure 11–1) and investigate significant differences in quantities, prices, and freight charges. The accounts payable clerk also checks the mathematical accuracy of the vendor invoice. The auditor’s test of controls for this assertion involves reperforming the accounts payable clerk’s duties on a sample of voucher packets.

The accuracy assertion is also concerned with proper posting of information to the pur- chases journal, accounts payable subsidiary records, and general ledger. Control totals should be used to reconcile vouchers to the daily accounts payable listing, or else the daily postings to the purchases journal should be reconciled to the accounts payable subsidiary records. In addition, the voucher register or accounts payable subsidiary ledger should be reconciled to the general ledger control account. If these control activities are performed manually, the auditor can review and examine the reconciliations prepared by the entity’s personnel. In an IT application, such controls would be programmed and reconciled by the control groups in the IT and accounts payable departments. The auditor can examine the programmed controls and review the reconciliations.

Cutoff of Purchase Transactions The entity should have controls to ensure that purchase transactions are recorded promptly and in the proper period. For example, the entity’s procedures should require that all receiv- ing reports be forwarded to the accounts payable department daily. There should also be a requirement in the accounts payable department that receiving reports be matched on a timely basis with the original purchase order and the related vendor invoice. In EarthWear’s system, the receiving department forwards the receiving report to the accounts payable department daily. Within the accounts payable department, the vendor invoices are matched immediately with the original purchase orders and the receiving reports. The auditor can test these control activities by comparing the date on the receiving report with the date on the voucher. There should seldom be a long period between the two dates. The auditor also wants to ensure that the vouchers are recorded in the accounting records in the correct period. This can be tested by comparing the dates on vouchers with the dates the vouchers were recorded in the voucher register.

Classification of Purchase Transactions Proper classification of purchase transactions is an important assertion for the purchasing process. If purchase transactions are not properly classified, asset and expense accounts will be misstated. Two main controls are used for ensuring that purchase transactions are properly classified. First, the entity should use a chart of accounts. Second, there should be independent approval and review of the general ledger accounts charged for the acquisition. A typical procedure is for the department or function that orders the goods or services to indicate which general ledger account to charge. Accounts payable department personnel then review the account distribution for reasonableness (see Figure 11–1). A test of controls for this assertion involves examining a sample of voucher packets for proper classification.

Final PDF to printer

402 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 402 09/30/15 03:01 PM

Control Activities and Tests of Controls—Cash Disbursement Transactions

Table 11–7 summarizes the assertions for cash disbursement transactions along with some examples of possible misstatements. For each of these misstatements we have included one or two possible control activities that management could implement to mitigate the risk as well as some example tests of controls that the auditor could use to test those controls. This table is not an exhaustive list of misstatements, control activities, or tests of controls for cash disbursement transactions; rather, it provides some specific examples by assertion to help you understand the underlying concepts.

Occurrence of Cash Disbursement Transactions For the occurrence assertion, the auditor is concerned with a misstatement caused by a cash disbursement being recorded in the entity’s records when no payment has actually been made. A number of possibilities exist for the cause of this misstatement. For example, a check may be lost or stolen before it is mailed. The primary control activities used to prevent such mis- statements include proper segregation of duties, independent reconciliation and review of vendor statements, and monthly bank reconciliations. In the purchasing system shown in Figure 11–1, checks are distributed by the cashier’s department, which is independent of the accounts payable department (the department authorizing the payment).

Table 11–7 lists tests of controls that the auditor can use to verify the effectiveness of the entity’s controls. For example, the auditor can observe and evaluate the entity’s segregation of duties and review the entity’s procedures for reconciling vendor statements and monthly bank statements.

Completeness of Cash Disbursement Transactions The major misstatement related to the completeness assertion is that a cash disbursement is made but not recorded in the entity’s records. In addition to the control activities used for the occurrence assertion, accounting for the numerical sequence of checks and reconcilia- tion of the daily cash disbursements with postings to the accounts payable subsidiary records (see Figure 11–1) helps ensure that all cash disbursements are recorded. The auditor’s tests of controls may include reviewing and testing the entity’s procedures for accounting for the sequence of cash disbursements and reviewing the entity’s reconciliation procedures.

Authorization of Cash Disbursement Transactions Proper segregation of duties reduces the likelihood that unauthorized cash disbursements are made. It is important that an individual who approves a purchase not have direct access to the cash disbursement for it. Additionally, the individuals in the accounts payable department who initiate payment should not have access to the checks after they are prepared. In Earth- Wear’s purchasing process, the purchasing department functions are segregated from those of the accounts payable and cashier’s departments. Checks are forwarded directly from the IT department to the cashier’s department for mailing to the vendors.

The other major control over unauthorized cash disbursements is that checks or EFTs are not prepared unless all source documents (purchase requisition, purchase order, receiving report, and vendor’s invoice) are included in the voucher packet and approved. For Earth- Wear’s purchasing process, a complete voucher packet must be present in order to record the liability and authorize payment.

Accuracy of Cash Disbursement Transactions The potential misstatement related to the accuracy assertion is that the payment amount is recorded incorrectly. To detect such errors, the entity’s personnel should reconcile the total

LO 11-9

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 403

mes32502_ch11_386-421.indd 403 09/30/15 03:01 PM

of the checks and EFTs issued on a particular day with the daily cash disbursements report. The entity’s control activities should require monthly reconciliation of vendor statements to the accounts payable records. Each of these reconciliations should be independently reviewed by the entity’s personnel. The auditor’s test of controls involves reviewing the various reconciliations.

Another possible misstatement is that cash disbursements are not properly posted to the cash disbursement journal, accounts payable subsidiary records, or general ledger. The reconciliation of vendors’ monthly statements is an effective control procedure for detecting payments posted to the wrong vendor accounts. Agreement of the monthly cash disburse- ments journal to general ledger postings and reconciliation of the accounts payable subsidiary records to the general ledger control account are effective control activities for preventing summarization and posting errors (see Figure 11–1). The auditor’s tests of controls would include checking postings to the general ledger and reviewing the various reconciliations.

Cutoff of Cash Disbursement Transactions The entity should establish procedures to ensure that when a cash disbursement is prepared, it is recorded on a timely basis in the cash disbursements journal and the accounts payable

Summary of Assertions, Possible Misstatements, Example Control Activities, and Example Tests of Controls for Cash Disbursement Transactions

Assertion Possible Misstatement Example Control Activity Example Tests of Controls

Occurrence Cash disbursement recorded but not made

Segregation of duties Observe and evaluate proper segregation of duties.

Vendor statements independently reviewed and reconciled to accounts payable records

Review the entity’s procedures for reconciling vendor statements.

Monthly bank reconciliations prepared and reviewed

Review monthly bank reconciliations for indication of independent review.

Completeness Cash disbursement made but not recorded

Same as above Same as above.

Accounting for the numerical sequence of checks Review and test the entity’s procedures for numerical sequence of checks; if IT application, test application controls.

Daily cash disbursements reconciled to postings to accounts payable subsidiary records

Review procedures for reconciling daily cash disbursements with postings to accounts payable subsidiary records; if IT application, test application controls.

Authorization Cash disbursement not authorized

Segregation of duties Evaluate segregation of duties.

Checks prepared only after all source documents have been independently approved

Examine indication of approval on voucher packet.

Accuracy Cash disbursement recorded at incorrect amount

Daily cash disbursements report reconciled to checks and EFTs issued

Review reconciliation.

Vendor statements reconciled to accounts payable records and independently reviewed

Review reconciliation.

Cash disbursements not properly posted to cash disbursements journal, accounts payable subsidiary records, or to the general ledger

Cash disbursement report reconciled with postings to cash disbursement journal and accounts payable subsidiary records

Monthly cash disbursements journal agreed to general ledger posting

Accounts payable subsidiary records reconciled to general ledger control account

Review and testing of reconciliation; if IT application, testing of application controls for posting.

Review of posting from cash disbursements journal to the general ledger.

Examination of reconciliation of accounts payable subsidiary records to general ledger control account.

Cutoff Cash disbursement recorded in wrong period

Daily reconciliation of checks issued with postings to the cash disbursements journal and accounts payable subsidiary records

Review daily reconciliations.

Classification Cash disbursement charged to wrong account

Chart of accounts Review cash disbursements journal for reasonableness of account distribution.

Independent approval and review of general ledger account on voucher packet

Review general ledger account code on voucher packet for reasonableness.

T A B L E 1 1 – 7

Final PDF to printer

404 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 404 09/30/15 03:01 PM

subsidiary records. As shown in Figure 11–1, when a cash disbursement is prepared, it is simultaneously recorded in the accounting records by the application programs that control transaction processing. The auditor’s tests of controls include reviewing the reconciliation of cash disbursements with postings to the cash disbursements journal and accounts payable subsidiary records. The auditor also tests cash disbursements before and after year-end to ensure transactions are recorded in the proper period.

Classification of Cash Disbursement Transactions The auditor’s concern with proper classification is that a cash disbursement may be charged to the wrong general ledger account. In most purchasing systems, purchases are usually recorded through the voucher register or purchases journal. Thus, the only entries into the cash dis- bursements journal are debits to accounts payable and credits to cash. If these procedures are followed, proper classification of cash disbursements is not a major concern.

Sometimes an entity pays for goods and services directly from the cash disbursements journal without recording the purchase transaction in the purchases journal. If an entity pays for goods and services directly from the cash disbursements journal, controls must be present to ensure proper classification. The use of a chart of accounts, as well as independent approval and review of the account code on the voucher packet, should provide an adequate control. The auditor can review the cash disbursements journal for reasonableness of account distribu- tion as well as the account codes on a sample of voucher packets.

Control Activities and Tests of Controls—Purchase Return Transactions

The number and magnitude of purchase return transactions are not material for most entities. However, because of the possibility of manipulation the auditor should, at a minimum, inquire about how the entity controls purchase return transactions. When goods are returned to a ven- dor, the entity usually prepares a document (sometimes called a debit memo) that reduces the amount of the vendor’s accounts payable. This document is processed through the purchasing process in a manner similar to the processing of a vendor invoice.

Because purchase returns are often few in number and not material, the auditor normally does not test controls of these transactions. Substantive analytical procedures are usually per- formed to test the reasonableness of purchase returns. For example, comparison of purchase returns as a percentage of revenue to prior years’ and industry data may disclose any material misstatement in this account.

Relating the Assessed Level of Control Risk to Substantive Procedures

The decision process followed by the auditor is similar to that discussed in Chapter 10 for the revenue process. If the results of the tests of controls support the planned level of control risk, the auditor conducts substantive procedures at the planned level. However, if the results of the tests of controls do not support the planned level of control risk, detection risk has to be set lower and substantive procedures increased.

The main accounts affected by the auditor’s achieved control risk for the purchasing pro- cess include accounts payable, accrued expenses, and most of the expense accounts in the income statement. Additionally, the tests of controls over purchase transactions affect the assessment of detection risk for other business processes. For example, purchase transactions for the acquisition of inventory and property, plant, and equipment are subject to the controls included in the purchasing process. If those controls are reliable, the auditor may be able to increase the detection risk for the affected financial statement accounts and therefore reduce the number of substantive procedures needed.

LO 11-9

LO 11-10

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 405

mes32502_ch11_386-421.indd 405 09/30/15 03:01 PM

Auditing Accounts Payable and Accrued Expenses

The assessment of the risk of material misstatement (inherent risk and control risk) for the purchasing process is used to determine the level of detection risk for conducting sub- stantive procedures for accounts payable and accrued expenses. Accounts payable gener- ally represent normal recurring trade obligations. Accrued expenses represent expenses that have been incurred during the period but that have not been billed or paid for as of the end of the period. These include accruals for taxes, interest, royalties, and professional fees. A number of accrued expenses are also related to payroll. Because there is little difference between accounts payable and accrued expenses, they are covered together in this section.

Substantive analytical procedures and tests of details of account balances and disclosures are used to test accounts payable and accrued expenses. Substantive analytical procedures are used to examine plausible relationships among accounts payable and accrued expenses. In the purchasing process, substantive tests of transactions focus mainly on the purchases and cash disbursement transactions. Tests of details of account balances concentrate on the detailed amounts or estimates that make up the ending balance for accounts payable and accrued expenses. Tests of details of disclosures are concerned with the presentation and disclosures related to accounts payable and accrued expenses.

Table 11–8 lists the assertions for account balances and disclosures as they apply to accounts payable and accrued expenses. You should note that the auditor may test assertions related to transactions (substantive tests of transactions) in conjunction with testing internal controls. If the tests of controls indicate that the controls are not operating effectively, the auditor may need to test transactions at the date the account balance is tested.

Substantive Analytical Procedures

Substantive analytical procedures can be useful substantive procedures for examin- ing the reasonableness of accounts payable and accrued expenses. Substantive analyti- cal procedures can effectively identify accounts payable and accrual accounts that are misstated, as well as provide evidence regarding the fairness of the recorded accounts. Table 11–9 contains some examples of substantive analytical procedures that can be used in the auditing of accounts payable and accrued expenses. Table 11–9 is not an exhaus- tive list; rather, it provides some specific examples by account to help you understand the underlying concepts.

LO 11-11

Management Assertions about Account Balances, and Disclosures for Accounts Payable and Accrued Expenses

Assertions about account balances at the period end: • Existence. Accounts payable and accrued expenses are valid liabilities. • Rights and obligations. Accounts payable and accrued expenses are the obligations of the entity. • Completeness. All accounts payable and accrued expenses have been recorded. • Valuation and allocation. Accounts payable and accrued expenses are included in the financial statements at

appropriate amounts, and any resulting valuation or allocation adjustments are appropriately recorded.

Assertions about presentation and disclosure: • Occurrence and rights and obligations. All disclosed events, transactions, and other matters relating to accounts

payable and accrued expenses have occurred and pertain to the entity. • Completeness. All disclosures relating to accounts payable and accrued expenses that should have been included

in the financial statements have been included. • Classification and understandability. Financial information relating to accounts payable and accrued expenses is

appropriately presented and described, and disclosures are clearly expressed. • Accuracy and valuation. Financial and other information relating to accounts payable and accrued expenses are

disclosed fairly and in appropriate amounts.

T A B L E 1 1 – 8

Final PDF to printer

406 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 406 09/30/15 03:01 PM

Stop and Think: Calculate the payables turnover (cost of goods sold ÷ accounts pay- able) and days outstanding in accounts payable (365 days ÷ payables turnover) using EarthWear’s financial statements as presented earlier in the book. Do your findings provide evidence in support of the fair statement of accounts payable or suggest that additional audit work is necessary?

For 2015, payables turnover is 8.74 times and days outstanding in accounts payable are 41.8 days. For 2014, comparable ratios are 9.76 and 37.4 days. Both ratios indicate EarthWear is reducing payables at a slower rate over time. The auditor should determine the cause of the change in the ratios (e.g., entity may be slowing down payments because of decline in profits and cash flow from operations) and compare these ratios to industry data.

Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Table 11–10 presents examples of tests of details of transactions, account balances, and dis- closures for assertions related to accounts payable and accrued expenses. This table should not be construed as an exhaustive list of substantive audit procedures for accounts payable and accrued expenses. As discussed previously, substantive tests of transactions are tests conducted to detect monetary misstatements in the individual transactions processed through all accounting applications, are often conducted at the same time as tests of controls, and are often difficult to distinguish from a test of controls because the specific audit proce- dure may both test the operation of a control procedure and test for monetary misstatement. Table 11–10 presents a substantive test of transactions for each assertion for purchase trans- actions. Normally, most of these tests are conducted as tests of controls. However, if the con- trols are not operating effectively or if the auditor did not rely on those controls, substantive tests of transactions may be necessary for the auditor to reach an appropriate level of evi- dence. The cutoff assertion is the one that is most often conducted as a substantive procedure.

The discussion that follows focuses on tests of details of account balances of accounts payable and accrued expenses. We begin with the completeness assertion for the accounts payable balance because the auditor must establish that the detailed records agree to the gen- eral ledger. Note that we do not cover all the assertions listed in Table 11–10 because they are not applicable to EarthWear Clothiers or they would have been conducted as tests of controls.

Completeness The completeness of accounts payable is first determined by obtaining a listing of accounts payable, footing the listing, and agreeing it to the general ledger control account. The items included on this listing are the unpaid individual vouchers (when a voucher system is used)

LO 11-12

Examples of Substantive Analytical Procedures Used in Auditing Accounts Payable and Accrued Expenses

Example Substantive Analytical Procedure Possible Misstatement Detected

Compare payables turnover and days outstanding in accounts payable to previous years’ and industry data.

Under- or overstatement of liabilities and expenses.

Compare current-year balances in accounts payable and accruals with prior years’ balances. Under- or overstatement of liabilities and expenses. Compare amounts owed to individual vendors in the current year’s accounts payable listing

to amounts owed in prior years. Under- or overstatement of liabilities and expenses.

Compare purchase returns and allowances as a percentage of revenue or cost of sales to prior years’ and industry data.

Under- or overstatement of purchase returns.

T A B L E 1 1 – 9

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 407

mes32502_ch11_386-421.indd 407 09/30/15 03:01 PM

Summary of Assertions and Related Tests of Transactions, Account Balances, and Disclosures—Accounts Payable and Accrued Expenses

Assertions about Classes of Transactions Example Substantive Tests of Transactions*

Occurrence Test a sample of vouchers for the presence of an authorized purchase order and receiving report. Completeness Tracing of a sample of vouchers to the purchases journal. Authorization Test a sample of purchase requisitions for proper authorization. Accuracy Recompute the mathematical accuracy of a sample of vendors’ invoices. Cutoff Compare dates on a sample of vouchers with the dates transactions were recorded in the

purchases journal. Test transactions around year-end to determine if they are recorded in the proper period.

Classification Verify classification of charges for a sample of purchases transactions.

Assertions about Account Balances Example Tests of Details of Account Balances

Existence Vouch selected amounts from the accounts payable listing and schedules for accruals to voucher packets or other supporting documentation.

Obtain selected vendors’ statements and reconcile to vendor accounts. Confirmation of selected accounts payable.†

Rights and obligations Review voucher packets for presence of purchase requisition, purchase order, receiving report, and vendor invoice.

Completeness Obtain listing of accounts payable and agree total to general ledger.† Search for unrecorded liabilities by inquiring of management and examining post-balance sheet

transactions. Obtain selected vendors’ statements and reconcile to vendor accounts. Confirmation of selected accounts payable.†

Valuation and allocation Obtain listing of accounts payable and account analysis schedules for accruals; foot listing and schedules and agree totals to general ledger.†

Trace selected items from the accounts payable listing to the subsidiary records† and voucher packets.

Review results of confirmations of selected accounts payable. Obtain selected vendors’ statements and reconcile to vendor accounts.

Assertions about Presentation and Disclosure Example Tests of Details of Disclosures

Occurrence and rights and obligations Inquire about accounts payable and accrued expenses to ensure that they are properly disclosed. Completeness Complete financial reporting checklist to ensure that all financial statement disclosures related to

accounts payable and accrued expenses have been disclosed. Classification and understandability Review listing of accounts payable for material debits, long-term payables, and nontrade payables.

Determine whether such items require separate disclosure on the balance sheet. Read footnotes to ensure that required disclosures are understandable.

Accuracy and valuation Read footnotes and other information to ensure that the information is accurate and properly presented at the appropriate amounts.

*These tests of details of transactions are commonly conducted as dual-purpose tests (i.e., in conjunction with tests of controls). †These tests can be conducted manually or using CAATs.

T A B L E 1 1 – 1 0

or the balance in the individual vendor accounts in the subsidiary records (when a purchases journal is used). Exhibit 11–2 presents an example of the accounts payable listing for Earth- Wear in which the information is summarized by vendor from the accounts payable subsidiary ledger. Selected vouchers or vendor accounts are traced to the supporting documents or sub- sidiary accounts payable records to verify the accuracy of the details making up the listing. For example, the tick mark next to the balance for Aarhus Industries indicates that the auditor has verified the account by tracing the balance to the accounts payable subsidiary records.

For accrued expense accounts, the auditor obtains a detailed account analysis schedule. For example, Exhibit 11–3 shows an account analysis schedule for accrued real estate taxes. The credits to the accrual account represent the recognition of real estate taxes owed at the end of each month. This amount should agree to the amount of real estate taxes expense shown in the income statement. The debits to the account are payments. This schedule is footed and agreed to the accrued real estate taxes account in the general ledger.

Final PDF to printer

408 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 408 09/30/15 03:01 PM

Example of an Accounts Payable Listing Working PaperE X H I B I T 1 1 – 2

N10 DLJ

2/3/2016 Vendor Name Amount Due

Aarhus Industries $ 52,758†V Anderson Clothes, Inc. 237,344V

• • • •

Washington Mfg., Inc. 122,465†V Zantec Bros. 7,750 Total $62,509,740

F T/B

F = Footed.

† = Traced to accounts payable subsidiary records. V = Voucher packets examined for transaction validity. No exceptions. T/B = Agreed to trial balance.

EARTHWEAR CLOTHIERS Accounts Payable Listing

12/31/15

Account Analysis for the Accrued Real Estate Taxes Account Working Paper

E X H I B I T 1 1 – 3

N21 DLJ

2/5/2016

Cash disbursements for real estate tax payments

233,911Γ

Beginning balance 12 monthly accruals for real

estate taxes Ending balance

$ 22,333‡

235,245 $ 23,667L✓

F = Footed. ‡ = Agreed to prior year’s working papers. ✓ = Amount of real estate taxes accrued appears reasonable. Γ = Payments traced to real estate tax bills and cash disbursements journal. L = Agreed to general ledger.

EARTHWEAR CLOTHIERS Analysis of Accrued Real Estate Taxes

12/31/15

The second major test of the completeness assertion for accounts payable and accruals is concerned with unrecorded liabilities. Auditors frequently conduct extensive tests to ensure that all liabilities are recorded. Such tests are commonly referred to as a search for unrecorded liabilities. The following audit procedures may be used as part of the search for unrecorded liabilities:

1. Ask management about control activities used to identify unrecorded liabilities and accruals at the end of an accounting period. These controls should be part of the closing process.

2. Vouch large-dollar items from the purchases journal and cash disbursements journal for a limited time after year-end; examine the date on each receiving report or vendor invoice to determine if the liability relates to the current audit period.

3. Examine the files of unmatched purchase orders, receiving reports, and vendor invoices for any unrecorded liabilities.

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 409

mes32502_ch11_386-421.indd 409 09/30/15 03:01 PM

Other audit procedures the auditor might perform for testing completeness include con- firming vendor accounts including accounts with small or zero balances and reconciling cop- ies of vendors’ monthly statements to the entity’s accounts payable records.

Existence The auditor’s major concern with the existence assertion is whether the recorded liabilities are valid obligations of the entity. To verify the validity of liabilities, the auditor can vouch a sample of the items included on the listing of accounts payable, or the accrued account analy- sis, to voucher packets or other supporting documents. If adequate source documents are pres- ent, the auditor has evidence that the amounts represent valid liabilities (see Exhibit 11–2). In some circumstances, the auditor may obtain copies of the monthly vendor statements or send confirmation requests to vendors to test the validity of the liabilities. Confirmation of accounts payable is discussed later in this chapter.

Cutoff The cutoff assertion attempts to determine whether all purchase transactions and related accounts payable are recorded in the proper period. While the auditor can obtain assurance about the cutoff assertion for purchases by conducting tests of controls, in most cases cutoff tests are conducted as substantive tests of transactions or as a dual-purpose test. On most audits, purchase cutoff is coordinated with the entity’s physical inventory count. Proper cutoff should also be determined for purchase return transactions.

The entity should have control activities to ensure that a proper purchase cutoff takes place. The auditor can test purchase cutoff by first obtaining the number of the last receiving report issued in the current period. A sample of voucher packets is selected for a few days before and after year-end. The receiving reports contained in the voucher packets are exam- ined to determine if the receipt of the goods is consistent with the recording of the liability. For example, suppose that the last receiving report issued by EarthWear in 2015 was number 15,755. A voucher packet recorded in the voucher register or accounts payable in 2015 should have a receiving report numbered 15,755 or less. If the auditor finds a voucher packet recorded in 2015 with a receiving report number higher than 15,755, the liability has been recorded in the wrong period. Accounts payable for 2015 should be adjusted and the amount included as a liability in the next period. For voucher packets recorded in 2016, the receiving reports should be numbered 15,756 or higher. If the auditor finds a voucher packet with a receiving report with a number less than 15,756, the liability belongs in the 2015 accounts payable.

Purchase returns seldom represent a material amount in the financial statements. If the entity has adequate control activities for processing purchase return transactions, the auditor can use substantive analytical procedures to satisfy the cutoff assertion for purchase returns. For example, the prior-year and current-year amounts for purchase returns as a percentage of revenue or cost of sales can be compared. If the results of the substantive analytical proce- dures are consistent with the auditor’s expectation, no further audit work may be necessary.

Rights and Obligations Generally, there is little risk related to this assertion because entities seldom have an incentive to record liabilities that are not obligations of the entity. Review of the voucher packets for adequate supporting documents relating liabilities to the entity provides sufficient evidence to support this assertion.

Valuation The valuation of individual accounts payable is generally not a difficult assertion to test. Accounts payable are recorded at either the gross amount of the invoice or the net of the cash discount if the entity normally takes a cash discount. The tests of details of account bal- ances noted in Table 11–10 normally provide sufficient evidence as to the proper valuation of accounts payable.

Final PDF to printer

410 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 410 09/30/15 03:01 PM

The valuation of accruals depends on the type and nature of the accrued expenses. Most accruals are relatively easy to value, and proper valuation can be tested by examining the underlying source documents. Real estate taxes and interest are examples of accruals that are generally easy to value. In the first case, real estate appraisals or bills usually serve as the basis for the accrual amount (see Exhibit 11–3). In the second case, the amount of interest accrued relates directly to the amount of debt and the interest rate stipulated in the loan agree- ment. Other accruals, however, may require the auditor to verify the entity’s estimates. Audit- ing standards provide the auditor with guidance in auditing an entity’s estimates. Examples of such estimates include accruals for vacation pay, pension expense, warranty expense, and income taxes. The Advanced Module in this chapter provides a discussion of auditing the income tax provision and related balance sheet accounts.

Classification and Understandability The major issues related to the presentation and disclosure assertion about classification are (1) identifying and reclassifying any material debits contained in accounts payable, (2) seg- regating short-term and long-term payables, and (3) ensuring that different types of payables are properly classified. Proper classification can usually be verified by reviewing the accounts payable listing and the general ledger accounts payable account. If material debits are present, they should be reclassified as receivables or as deposits if the amount will be used for future purchases. Any long-term payables should be identified and reclassified to the long-term lia- bility section of the balance sheet. Also, if payables to officers, employees, or related parties are material, they should not be included with the trade accounts payable. The auditor should also ensure that accrued expenses are properly classified.

Other Presentation Disclosure Assertions Even though management is responsible for the financial statements, the auditor must ensure that all necessary financial statement disclosures are made for accounts payable and accrued expenses. Again, a reporting checklist is a useful tool. Table 11–11 presents examples of items that should be disclosed for accounts payable and accrued expenses.

Two disclosures are particularly important. The auditor must ensure that all related-party purchase transactions have been identified. If material, such related-party purchase transac- tions should be disclosed. The other major disclosure issue is purchase commitments. When the entity has entered into a formal long-term purchase contract, adequate disclosure of the terms of the contract should be provided in a footnote. Exhibit 11–4 provides a sample disclo- sure for a purchase commitment.

Examples of Disclosure Items for Purchasing Process and Related Accounts

Payables by type (trade, officers, employees, affiliates, and so on). Short- and long-term payables. Long-term purchase contracts, including any unusual or adverse purchase commitments. Purchases from and payables to related parties. Dependence on a single vendor or a small number of vendors. Costs by reportable segment of the business.

T A B L E 1 1 – 1 1

A Sample Disclosure for Purchase Commitments

The company has various agreements that provide for the purchase at market prices of wood chips, bark, and other residual fiber from trees.

The company also has an agreement to purchase at market prices through 2019 the entire production of an unbleached kraft paper–making machine at Johnson Forest Products Company. The capacity of this machine is estimated to be 30,000 tons a year.

E X H I B I T 1 1 – 4

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 411

mes32502_ch11_386-421.indd 411 09/30/15 03:01 PM

Accounts Payable Confirmations

Chapter 10 discussed the confirmation process in general and accounts receivable confirmations specifically. This section expands that discussion to include confirmation of accounts payable. Accounts payable confirmations are used less frequently by auditors than accounts receivable con- firmations because the auditor can test accounts payable by examining vendor invoices, monthly vendor statements, and payments made by the entity subsequent to year-end. Because vendor invoices and statements originate from sources external to the entity, this evidence is viewed as reliable. However, if the entity has weak internal control, vendor statements may not be available to examine. In such a case, confirmations may be used as an important source of evidence.

While accounts payable confirmations provide evidence on a number of assertions, the asser- tion of primary interest with liabilities is the completeness assertion. If the entity has strong control activities for ensuring that liabilities are recorded and the auditor has tested those controls, the audi- tor may be able to focus on confirmation of large-dollar accounts. However, because the possibility of unrecorded liabilities is usually considered an important concern, the auditor often also confirms balances with regular vendors that have small or zero balances because the entity may owe such vendors for purchases but the amounts may not be recorded in the entity’s accounting records.

When confirming accounts payable, auditors generally use a form of positive confirma- tion referred to as a blank or zero-balance confirmation. This type of positive confirmation does not state the balance owed. Instead, the confirmation requests that the recipient fill in the amount or furnish other information. Exhibit 11–5 presents an example of an accounts

LO 11-13

Example of an Accounts Payable Confirmation Request

EARTHWEAR CLOTHIERS

January 7, 2016 Zantec Bros. P.O. Box 1469 Macon, GA 35792

Gentlemen:

Our auditors, Willis & Adams, are conducting an audit of our financial statements as of December 31, 2015. Please confirm to them the amount of our accounts payable. Additionally, please provide the following information as of that date:

1. An itemized statement of our account. 2. A list of any notes payable to you including any discounted notes. Please include the original dates and

amounts, due dates, and amounts still outstanding. 3. A list of any consigned inventory held by us.

Sincerely,

Sally Jones Controller, EarthWear Clothiers

Willis & Adams P.O. Box 4080 Boise, Idaho 79443-4080

We confirm that EarthWear Clothiers’ accounts payable balance at

December 31, 2015, is _____________. Signature ___________________________ Position ___________________________

E X H I B I T 1 1 – 5

Final PDF to printer

412 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 412 09/30/15 03:01 PM

payable confirmation request. Note that the confirmation requests the balance owed and a detailed statement of the account. The confirmation also requests additional information on notes payable and consigned inventory.

If vendors do not respond to the accounts payable confirmation, the auditor should exam- ine subsequent cash disbursements, or correspondence from third parties and other records, such as receiving reports and statements that the entity receives from vendors providing evi- dence for the completeness assertion.

Generally, accounts payable confirmations are mailed at year-end rather than at an interim date because of the auditor’s concerns about unrecorded liabilities. The selection and mailing of accounts payable confirmations should be controlled using the procedures outlined in Chapter 10. When accounts payable confirmations are received, the amounts provided by the vendors must be reconciled with the entity’s records. Differences are often due to the same types of timing differences noted in Chapter 10 for accounts receivable confirmations. The two major timing differences are due to inventory in transit to the entity and cash paid by the entity but not yet received by the vendor. Any inconsistencies not due to timing differences normally result in adjustments to the entity’s records.

Evaluating the Audit Findings—Accounts Payable and Related

As discussed in previous chapters, when the auditor has completed the planned substantive procedures, all identified misstatements should be aggregated, including factual misstatement detected by the auditor and projected misstatements plus an allowance for sampling risk. The aggregate misstatement is then compared to tolerable misstatement. If the aggregate misstate- ment is less than the tolerable misstatement, the auditor has evidence that the account is fairly presented. Conversely, if the aggregate misstatement exceeds the tolerable misstatement, the auditor should conclude that the account is not fairly presented.

For example, in Chapter 3, EarthWear’s tolerable misstatement was $900,000. Exhibit 3–3 showed that Willis & Adams detected a misstatement in recording inventory that amounted to a $227,450 understatement of accounts payable. Because this misstatement of $227,450 is less than the tolerable misstatement of $900,000, Willis & Adams can conclude that the audit evidence supports fair presentation. However, if the misstatement were greater than the tolerable misstatement, the evidence would not support fair presentation. If the misstatement were greater than the tolerable misstatement, the auditor would have two choices: adjust the accounts to reduce the misstatement to an amount less than the tolerable misstatement or qualify the audit report.

The auditor should again analyze the misstatements discovered through the application of substantive procedures because these misstatements may provide additional evidence as to the control risk. For example, if most misstatements identified indicate that accounts payable are not properly valued, the auditor may reassess the control activities used by the entity for ensuring proper valuation. If the auditor concludes that the audit risk is unacceptably high, additional audit procedures should be performed, or the auditor must be satisfied that the entity has adjusted the related financial statement accounts to an acceptable level. If the entity does not adjust the accounts, the auditor should qualify the audit report.

Advanced Module: Auditing the Tax Provision and Related Balance Sheet Accounts

The tax provision and related balance sheet accounts are usually material elements in the financial statements. The income tax provision (the amount that shows up on the income statement) is an estimate of the taxes that will ultimately be paid to the government on the current-year financial income reported in the financial statements. The income tax payable is

LO 11-14

LO 11-15

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 413

mes32502_ch11_386-421.indd 413 09/30/15 03:01 PM

the estimate of the taxes that the entity will actually pay the government based on the taxable income reported in the current-year tax return less any estimated tax payment made during the year. Because there are significant differences between how revenue and expenses are treated for financial statements prepared according to GAAP and tax returns prepared accord- ing to IRS guidelines, there are significant differences between the current year tax provision and the current year income tax liability on the tax return. These differences are categorized as either temporary or permanent.

Temporary differences are simply timing differences between the recognition of revenue or expense under GAAP and tax and are ultimately expected to reverse. For example, the tax code and GAAP often depreciate capital assets over different time periods. Permanent differences are fundamental differences in what constitutes revenue or expense for GAAP and tax purposes. For example, interest on municipal bonds is income for GAAP purposes, but the interest is non- taxable income, so this represents a permanent difference between GAAP and tax accounting. Deferred taxes recorded on the balance sheet are the estimate of the tax to be paid or recovered in future periods as a result of reversals of existing temporary book/tax differences.

Another important area in the accounting for income taxes is the consideration of uncer- tain tax positions that have been taken by the entity on its tax return. For example, an entity may choose to take a research and development credit on its tax return, but uncertainty exists as to whether the project costs qualify for the credit. FASB ASC Topic 740, “Income Taxes,” provides guidance on accounting for uncertain tax positions and requires that the entity determine the likelihood that an aggressive tax position would be sustained if specifically investigated by the Internal Revenue Service. If there is considerable doubt that the IRS will agree with the entity’s position, the entity is not allowed to recognize the related tax benefit (through lower income tax expense) in its financial statements. When it is determined that the benefit of an uncertain tax position should not be recognized, the entity records a liability in the financial statements for the amount of the uncertain tax benefit included in the tax return.

Properly accounting for the income tax provision and related balance sheet accounts is a complex area as evidenced by the large number of public companies reporting material weak- nesses in internal control over financial reporting and financial statement restatements that occurred in the mid 2000s related to the accounting for income taxes.

Multinational corporations face additional complexities in accounting for income taxes such as varying tax rates in different countries, determination of where the taxes will be paid, and the recording of and control over intercompany transactions that affect transfer pricing and effective tax rates. In order to properly audit the tax provision and related balance sheet accounts, the auditor must be familiar with both the GAAP and tax accounting for revenue and expense items. Because of the technical complexities and ever-changing nature of the guidance in both accounting standards and the tax code, auditors are typically not capable of being expert in both areas simultaneously. In addition, auditors need to stay current in audit- ing methodology, auditing standards, and changes in information technology. Nonetheless, the auditor is ultimately responsible for opining on the fairness of the financial statements, including the tax provision.

For smaller entities with straightforward tax provisions, the auditor often can obtain suf- ficient appropriate evidence without the assistance of a tax specialist. However, for most large entities or for entities with complicated tax strategies, the auditor will seek the help of a tax specialist to gather sufficient appropriate audit evidence that the tax provision and related bal- ance sheet accounts are fairly stated.

Examples of indicators suggesting the auditor should involve a tax specialist include

∙ Multiple locations with significant foreign operations and related foreign tax credits/ deductions.

∙ Business combinations and/or subsidiary dispositions. ∙ Material uncertain income tax positions with a governmental authority. ∙ Significant changes in ownership, business operations, or tax status. ∙ Significant deferred tax assets for which the future realization of the recorded value is

in question.

Final PDF to printer

414 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 414 09/30/15 03:01 PM

The involvement of tax specialists in the audit should take into consideration the com- plexity of the audit, the experience of both the audit and tax personnel, the size of the entity, the sensitivity of historical and current tax issues, and the level of recurring tax involvement with the entity. When the auditor determines that a tax specialist should be involved, the spe- cialist will typically help gather evidence relating to the entity’s controls and processes in the tax accounting area as well as evidence to support the tax accounts reported in the financial statements. The tax provision process is normally a significant process because of its com- plexity and importance to external financial reporting. The auditor and tax specialist need to understand the entity’s tax provision process in order to identify and test controls that are most relevant to financial statement risks.

While the auditor will not possess as much tax accounting expertise as the tax specialist, the auditor must have enough knowledge of tax accounting and the entity’s specific tax issues to adequately supervise the work performed by the tax specialist. See additional discussion of the use of specialists in Chapter 3.

Some of the typical procedures that might be applied to the audit of the tax provision by the auditors and/or tax specialist include

∙ Compare the size and trend in the tax provision and related balance sheet accounts over time.

∙ Perform walkthroughs and test the design and operating effectiveness of internal controls over the income tax provision (required for an integrated audit). Identify issues that should be given particular attention in substantive testing and evaluate the entity’s documentation.

∙ Document the testing performed to evaluate the design and operating effectiveness of internal controls over the income tax process (primarily integrated audits).

∙ Test the mathematical accuracy of the computations supporting the tax provision and related balance sheet accounts and vouch underlying data to supporting documentation.

∙ Identify and test significant permanent and temporary differences in the tax provision calculation.

∙ Review and evaluate management’s position on significant uncertain tax positions for appropriate disclosure and accounting under FASB ASC Topic 740.

∙ Consider the realizability of net deferred tax assets and adequacy of related valuation allowances.

∙ Test the reconciliation of income taxes payable, deferred income tax assets/liabilities (including any related valuation allowances), and tax liabilities to supporting documentation, including the general ledger, financial statements, and related footnote disclosure.

∙ Ensure proper documentation in the audit working papers to allow for reperformance of the audit procedures applied to the tax accounts.

KEY TERMS

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 415

mes32502_ch11_386-421.indd 415 09/30/15 03:01 PM

Blank or zero-balance (positive) confirmation. A confirmation request on which the recipi- ent fills in the amount or furnishes the information requested. Exception. A response that indicates a difference between information requested to be con- firmed, or contained in the entity’s records, and information provided by the confirming party. General controls. Controls that relate to the overall information-processing environment and have a pervasive effect on the entity’s computer operations. Positive confirmation request. A request that the confirming party respond directly to the auditor by providing the requested information or indicating whether the confirming party agrees or disagrees with the information in the request. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of controls in preventing or detecting material misstatements at the relevant assertion level. Tests of details of account balances and disclosures. Tests that concentrate on the details of amounts contained in an account balance and related footnotes. Walkthrough. A transaction being traced by an auditor from origination through the entity’s information system until it is reflected in the entity’s financial reports. It encompasses the entire process of initiating, authorizing, recording, processing, and reporting individual trans- actions and controls for each of the significant processes identified.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 11-1 11-1 Distinguish among the three categories of expenses. Provide an example of each type of expense.

LO 11-2, 11-3 11-2 What major types of transactions occur in the purchasing process? What financial statement accounts are affected by each type of transaction?

LO 11-4 11-3 Briefly describe each of the following documents or records: purchase requisition, purchase order, receiving report, vendor invoice, and voucher. Why would an entity combine all documents related to a purchase transaction into a “voucher packet”?

LO 11-5, 11-6 11-4 List the key segregation of duties in the purchasing process. What errors or fraud can occur if such duties are not segregated?

LO 11-7 11-5 List two inherent risk factors that directly affect the purchasing process. Why should auditors be concerned about issues such as the supply of raw materials and the vola- tility of prices?

LO 11-9 11-6 What control activities typically ensure that the occurrence, authorization, and com- pleteness assertions are met for a purchase transaction? What tests of controls are performed for each of these assertions?

LO 11-9 11-7 Identify two tests of controls that could be performed using computer-assisted audit techniques (CAATs) for purchase transactions.

LO 11-11 11-8 List two substantive analytical procedures that can test accounts payable. What potential errors or fraud can be identified by each analytical procedure?

LO 11-12 11-9 List the procedures an auditor might use to search for unrecorded liabilities. LO 11-12 11-10 Identify four possible disclosure issues related to the purchasing process and related

accounts. LO 11-13 11-11 What are the differences between accounts receivable and accounts payable

confirmations? LO 11-15 11-12 What are some of the typical procedures that might be applied to the audit of the tax

provision by an auditor and/or tax specialist?

Final PDF to printer

416 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 416 09/30/15 03:01 PM

MULTIPLE-CHOICE QUESTIONS

All applicable questions are available with Connect.

LO 11-2, 11-4, 11-9 11-13 In a properly designed accounts payable system, a voucher is prepared after the invoice, purchase order, requisition, and receiving report are verified. The next step in the system is

a. Cancelation of the supporting documents. b. Entry of the check amount in the check register. c. Entering of the voucher into the voucher register. d. Approval of the voucher for payment.

LO 11-2, 11-4, 11-9 11-14 When goods are received, the receiving clerk should match the goods with a. The purchase order and the requisition form. b. The vendor invoice and the purchase order. c. The vendor shipping document and the purchase order. d. The vendor invoice and the vendor shipping document.

LO 11-2, 11-4, 11-9 11-15 Internal control is strengthened when the quantity of merchandise ordered is omitted from the copy of the purchase order sent to the

a. Department that initiated the requisition. b. Receiving department. c. Purchasing agent. d. Accounts payable department.

LO 11-5, 11-6, 11-9 11-16 Which of the following control activities is not usually performed in the accounts payable department?

a. Matching the vendor’s invoice with the related receiving report. b. Approving vouchers for payment by having an authorized employee sign the

vouchers. c. Indicating the asset and expense accounts to be debited. d. Accounting for unused prenumbered purchase orders and receiving reports.

LO 11-5, 11-6, 11-9 11-17 In a properly designed purchasing process, the same employee most likely would match vendors’ invoices with receiving reports and

a. Post the detailed accounts payable records. b. Recompute the calculations on vendors’ invoices. c. Reconcile the accounts payroll ledger. d. Cancel vendors’ invoices after payment.

LO 11-5, 11-6, 11-9 11-18 For effective internal control purposes, which of the following individuals should be responsible for mailing signed checks?

a. Receptionist. b. Treasurer. c. Accounts payable clerk. d. Payroll clerk.

LO 11-4, 11-9, 11-12 11-19 To determine whether accounts payable are complete, an auditor performs a test to verify that all merchandise received is recorded. The population of documents for this test consists of all

a. Vendor invoices. b. Purchase orders. c. Receiving reports. d. Canceled checks.

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 417

mes32502_ch11_386-421.indd 417 09/30/15 03:01 PM

LO 11-9, 11-12 11-20 Which of the following audit procedures is best for identifying unrecorded trade accounts payable?

a. Examination of unusual relationships between monthly accounts payable bal- ances and recorded cash payments.

b. Reconciliation of vendors’ statements to the file of receiving reports to identify items received just prior to the balance sheet date.

c. Investigation of payables recorded just prior to and just subsequent to the balance sheet date to determine whether they are supported by receiving reports.

d. Review of cash disbursements recorded subsequent to the balance sheet date to determine whether the related payables apply to the prior period.

LO 11-9, 11-12 11-21 Purchase cutoff procedures should be designed to test whether all inventory a. Purchased and received before the end of the year was paid for. b. Ordered before the end of the year was received. c. Purchased and received before the end of the year was recorded. d. Owned by the entity is in the possession of the entity at the end of the year.

LO 11-12 11-22 Which of the following procedures is least likely to be performed before the balance sheet date?

a. Test of internal control over cash. b. Confirmation of receivables. c. Search for unrecorded liabilities. d. Observation of inventory.

LO 11-13 11-23 When using confirmations to provide evidence about the completeness assertion for accounts payable, the appropriate population most likely would be

a. Vendors with whom the entity has previously done business. b. Amounts recorded in the accounts payable subsidiary ledger. c. Payees of checks drawn in the month after year-end. d. Invoices filed in the entity’s open invoice file.

PROBLEMS All applicable problems are available with Connect.

LO 11-11 11-24 You are the auditor for KPDZ Corporation. You gathered comparative information for inventory and accounts payable and calculated the days purchases in accounts payable.

2014 2015

Inventory $34,270 $57,921 Accounts payable $ 8,295 $10,628 Days purchases in accounts payable

(365 days/payables turnover) 44.2 days 44.6 days

Required: Prepare a list of possible concerns that you might have about potential misstatements in both accounts.

LO 11-2, 11-4, 11-5, 11-25 The flowchart shown below depicts the activities relating to the purchasing, 11-6, 11-9 receiving, and accounts payable departments of Model Company, Inc.

Final PDF to printer

418 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 418 09/30/15 03:01 PM

Purchasing Receiving

From dept. head

From vendor

To general acctg.

Approved requisition

form in duplicate

Assures best price is

obtained and request is

within budget limits

Verifies adequacy of vendor's past

record and prepares five- copy purchase

order

P.O.5

Requisition2

P.O.4

P.O.3

Requisition1

P.O.2

Purchase order1

(prenumbered)

Receiving report1

(prenumbered)

Rec. report 2

Rec. report3

P.O.4

Rec. report4

Voucher1

Invoice

P.O.2

Requisition1

Rec. report2

To vendor

To dept. head

To dept. head for

count and quantity check

To accounts payable

To purchasing

To receiving

dept.

By P.O. # By P.O. #

Purchase order4

with quantity blacked out

Goods received and counted

independently in secure

facility

Prepares four-copy receiving

report

From purchasing

From receiving

P.O.2

Requisition1 Rec. Report 2 Invoice

By vendor pending invoice receipt

Accounts Payable

Matches four docs. and recomputes

math accuracy of

invoices

Compares invoice quantity and price to P.O.

and rec. report quantity

Approves and prepares three-copy

voucher (prenumbered)

Voucher3 Voucher2

Recorded in voucher register and

independently reconciled monthly to

control accounts

By voucher #

Required: Based only on the flowchart, describe the control activities that most likely would provide reasonable assurance that specific assertions regarding purchases and accounts payable will be achieved. Do not describe weaknesses in internal control.

(AICPA, adapted)

LO 11-2, 11-5, 11-26 In 2015 Kida Company purchased more than $10 million worth of office equipment 11-6, 11-9 under its “special” ordering system, with individual orders ranging from $5,000 to

$30,000. “Special” orders entail low-volume items that have been included in an authorized user’s budget. Department heads include in their annual budget requests for the types of equipment and their estimated cost. The budget, which limits the types and dollar amounts of office equipment a department head can requisition, is approved at the beginning of the year by the board of directors. Department heads prepare purchase requisition forms for equipment and forward them to the purchas- ing department. Kida’s “special” ordering system functions as follows:

∙ Purchasing: Upon receiving a purchase requisition, one of five buyers verifies that the person requesting the equipment is a department head. The buyer selects the appropriate vendor by searching the various vendor catalogs on file. The buyer then phones the vendor, requests a price quotation, and gives the vendor a verbal order. A prenumbered purchase order is processed with the original sent to

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 419

mes32502_ch11_386-421.indd 419 09/30/15 03:01 PM

the vendor, a copy to the department head, a copy to receiving, a copy to accounts payable, and a copy filed in the open requisition file. When the buyer is orally informed by the receiving department that the item has been received, the buyer transfers the purchase order from the unfilled file to the filled file. Once a month the buyer reviews the unfilled file to follow up on and expedite open orders.

∙ Receiving: The receiving department receives a copy of the purchase order. When equipment is received, the receiving clerk stamps the purchase order with the date received and, if applicable, in red pen prints any differences between the quan- tity shown on the purchase order and the quantity received. The receiving clerk forwards the stamped purchase order and equipment to the requisitioning depart- ment head and orally notifies the purchasing department.

∙ Accounts payable: Upon receiving a purchase order, the accounts payable clerk files it in the open purchase order file. When a vendor invoice is received, the invoice is matched with the applicable purchase order, and a payable is set up by debiting the equipment account of the department requesting the items. Unpaid invoices are filed by due date, and at the due date a check is prepared. The invoice and purchase order are filed by purchase order number in a paid invoice file, and the check is then forwarded to the treasurer for signature.

∙ Treasurer: Checks received daily from the accounts payable department are sorted into two groups: those over $10,000 and those $10,000 and less. Checks for $10,000 and less are machine-signed. The cashier keeps the key and signa- ture plate to the check-signing machine and records all use of the check-signing machine. All checks over $10,000 are signed by the treasurer or the controller.

Required: a. Prepare a flowchart of Kida Company’s purchasing and cash disbursements

system. b. Describe the internal control weaknesses relating to purchases of and payments

for “special” orders of Kida Company for the purchasing, receiving, accounts payable, and treasurer functions.

(AICPA, adapted)

LO 11-11, 11-12 11-27 Following are audit procedures that are normally conducted in the purchasing pro- cess and related accounts.

1. Test a sample of purchase requisitions for proper authorization. 2. Test transactions around year-end to determine if they are recorded in the proper

period. 3. Review results of confirmation of selected accounts payable. 4. Compare payables turnover to previous years’ data. 5. Obtain selected vendors’ statements and reconcile to vendor accounts. 6. Compare purchase returns and allowances as a percentage of revenue or cost of

sales to industry data.

Required: Identify whether the tests listed above are substantive analytical procedures, tests of details of transactions, or tests of details of account balances.

LO 11-11, 11-12, 11-13 11-28 Coltrane, CPA, is auditing Jang Wholesaling Company’s financial statements and is about to perform substantive audit procedures on Jang’s trade accounts payable balances. After obtaining an understanding of Jang’s internal control for accounts payable, Coltrane assessed control risk at low. Coltrane requested and received from Jang a schedule of the trade accounts payable prepared using the trade accounts pay- able subsidiary ledger (voucher register.)

Final PDF to printer

420 Part 5 Auditing Business Processes

mes32502_ch11_386-421.indd 420 09/30/15 03:01 PM

Required: Describe the substantive audit procedures Coltrane should apply to Jang’s trade accounts payable balances. Do not include procedures that would be applied only in the audit of related-party payables, amounts withheld from employees, and accrued expenses such as pensions and interest.

(AICPA, adapted)

LO 11-12, 11-13 11-29 In obtaining evidence in support of financial statement assertions, the auditor devel- ops specific audit procedures to access those assertions.

Required: All’s Fair Appliance Company is an appliance wholesaler. Select the most appropri- ate audit procedure from the list below and enter the number in the appropriate place on the grid. (An audit procedure may be selected once, more than once, or not at all.)

Audit Procedure: 1. Compare selected amounts from the accounts payable listing with the voucher and

supporting documents. 2. Review drafts of the financial statements. 3. Search for unrecorded liabilities. 4. Select a sample of receiving documents for a few days before and after year-end. 5. Obtain a listing of the accounts payable and agree total to general ledger control

account. Specific Assertion Audit Procedure

a. Verify that recorded accounts payable include all amounts owed to vendors. (completeness)

b. Verify that all accounts payable are recorded in the correct period. (cutoff)

c. Determine whether accounts payable have been prop- erly accumulated from the journal to the general ledger. (accuracy)

d. Determine whether recorded accounts payable are valid. (existence/occurrence)

Selections from the December 2015 Purchase Journal

Date RR# Vendor Name Amount Explanation

a. 12/30 49,742 Allen Chem. $ 29,875 Chemicals purchased for manufacturing process. b. 12/31 none Khan Consulting $ 45,000 Payment for consulting services for the three-month

period beginning December 1, 2015. The $45,000 was charged to consulting expenses.

c. 12/31 49,744 Goff Materials $205,000 Raw materials used in the manufacturing process.

Selections from the January 2016 Purchase Journal

Date RR# Vendor Name Amount Explanation

d. 1/01 49,746 Temper Trucks $75,985 Purchase of a new forklift. e. 1/02 49,743 Pack Products $42,000 Paper products used in manufacturing process. f. 1/02 none Telecom Inc. $32,450 December 2015 telephone bill.

LO 11-12 11-30 You are engaged to perform an audit of the Giordani Corporation for the year ended December 31, 2015. You have decided to perform the following cutoff test for pay- ables and accruals. Select all items greater than $25,000 for two business days before and after year-end from the purchases journal and ensure that all transactions are recorded in the proper period.

During your firm’s observation of Giordani’s physical inventory you obtained the following cutoff information: the last receiving report number in 2015 was 49,745. Your audit work identified the following items for further investigation:

Final PDF to printer

Chapter 11 Auditing the Purchasing Process 421

mes32502_ch11_386-421.indd 421 09/30/15 03:01 PM

Required: For each of the six items provided in the table above, consider whether there is evi- dence of proper cutoff of payables and accruals (i.e., the transaction is recorded in the proper period). If the item is not properly recorded, prepare the necessary adjust- ing entries at December 31, 2015.

DISCUSSION CASE

LO 11-12, 11-13 11-31 Mincin, CPA, is the auditor of the Raleigh Corporation. Mincin is considering the audit work to be performed in the accounts payable area for the current year’s engagement. The prior year’s working papers show that confirmation requests were mailed to 100 of Raleigh’s 1,000 suppliers. The selected suppliers were based on Mincin’s sample, which was designed to select accounts with large-dollar balances. A substantial number of hours was spent by Raleigh and Mincin in resolving rela- tively minor differences between the confirmation replies and Raleigh’s accounting records. Alternative audit procedures were used for suppliers who did not respond to the confirmation requests.

Required: a. Discuss the accounts payable assertions that Mincin must consider in determining

the audit procedures to be followed. b. Discuss situations in which Mincin should use accounts payable confirmations,

and discuss whether Mincin is required to use them. c. Discuss why the use of large-dollar balances as the basis for selecting accounts

payable for confirmation might not be the most efficient approach, and indicate what more efficient procedures could select accounts payable for confirmation.

(AICPA, adapted)

INTERNET ASSIGNMENTS

LO 11-1, 11-2 11-32 Visit the website of a catalog retailer similar to EarthWear Clothiers, and determine how it processes purchase transactions and recognizes expenses. Note that you may have to examine the entity’s annual report and 10-K.

LO 11-1, 11-2 11-33 Visit the SEC’s website (www.sec.gov), and identify a company that has been recently cited for financial reporting problems related to the recognition of expenses. Prepare a memo summarizing the expense issues for the company.

HANDS-ON CASES

EarthWear Online

Search for Unrecorded Liabilities In this activity you will perform a search for potential unrecorded liabilities. You will recommend specific transactions that require further investigation or follow-up with the client based on the results of the pro- cedures you perform.

Visit Connect to download detailed instructions and required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch12_422-449.indd 422 09/30/15 03:03 PM

CHAPTER

12 12-1 Develop an understanding of the human resource

management process. 12-2 Be familiar with the types of transactions in the human

resource management process and the financial statement accounts affected.

12-3 Know and describe the types of documents and records used in the payroll process.

12-4 Understand the functions in the human resource management process.

12-5 Know the appropriate segregation of duties for the human resource management process.

12-6 Know and evaluate inherent risks relevant to the human resource management process.

12-7 Assess control risk for a human resource management process.

12-8 Know key internal controls and develop relevant tests of controls for payroll transactions.

12-9 Understand how to relate the assessment of control risk to substantive procedures.

12-10 Be familiar with substantive analytical procedures used to audit payroll expense and payroll-related accrued expenses.

12-11 Be familiar with substantive tests of transactions and tests of details of account balances and disclosures used to audit payroll expense and payroll-related accrued expenses.

12-12 Understand how to evaluate the audit findings and reach a final conclusion on payroll expense and payroll-related accrued expenses.

FASB ASC Topic 505, Equity FASB ASC Topic 715, Compensation—Retirement Benefits FASB ASC Topic 718, Compensation—Stock Compensation AT 801, Reporting on Controls at a Service Organization AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

423

mes32502_ch12_422-449.indd 423 09/30/15 03:03 PM

Auditing the Human Resource Management Process

C ompensation and related employee benefit costs represent major expenses for most entities. As a result, organizations tend to have strong control activities for processing payroll transactions. Additionally,

because of the routine nature of these transactions, an entity’s payroll is nor- mally maintained on an IT system, or an outside service bureau is contracted to process the payroll.

This chapter starts with an overview of the human resource management process and then discusses the components of the audit risk model. Specifi- cally, the inherent risks that affect the human resource management process are addressed followed by a discussion of the auditor’s control risk assess- ment. While the main focus of this chapter is auditing the human resource management process for a financial statement audit, the concepts covered for setting control risk are applicable to an audit of internal control over finan- cial reporting for public companies under Auditing Standard No. 5 (AS5). Last, the chapter covers substantive procedures for detection risk for payroll and related accounts. The Advanced Module contains a discussion of accounting for and auditing share-based compensation.

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

424 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 424 09/30/15 03:03 PM

Overview of the Human Resource Management Process

The human resource process starts with the establishment of sound policies for hiring, training, evaluating, counseling, promoting, compensating, and taking remedial actions for employees. Once an individual has been hired as an employee, the main transaction that affects the financial statement accounts is a payroll (payment) transaction. A payroll transaction usually begins with an employee performing some job and recording the time spent on a time card or time sheet (often in electronic form). The time card or time sheet is approved by a supervisor before being forwarded to the payroll department. The data are then reviewed and sent to the IT department for processing. Finally, payment is made directly to the employee or deposited in the employee’s bank account.

Figure 12–1 presents a flowchart of EarthWear’s payroll system that serves as a frame- work for discussing control activities and tests of controls. Although the description of Earth- Wear’s payroll system is fairly typical, the reader should focus on the basic concepts so that they can be applied to the specific payroll systems encountered. The following topics related to the human resource management process are covered:

∙ Types of transactions and financial statement accounts affected. ∙ Types of documents and records. ∙ The major functions. ∙ The key segregation of duties.

Operating Departments

Human Resource Department Payroll Department IT Department

Initiate personnel changes

Approved by

supervisor

Reviews master file changes

Error corrections

Review

Time sheets

Error report

General ledger

Payroll master file changes report

Payroll master file changes

Review

By date

Periodic payroll reports

Various tax reports and forms

Payroll master file

Payroll reporting program

*Distributed by paymaster

Input

Payroll master file changes

Time sheets

Payroll register

Payroll master file changes report

Payroll register

Payroll checks* or

direct deposit

Payroll- processing

program

LO 12-1

Flowchart of the Human Resource Management Process—EarthWear ClothiersF I G U R E 1 2 – 1

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 425

mes32502_ch12_422-449.indd 425 09/30/15 03:03 PM

Types of Transactions and Financial Statement Accounts Affected Two main types of transactions processed through the human resource management process are

∙ Payments to employees for services rendered. ∙ Accrual and payment of payroll-related liabilities arising from employees’ services,

including liabilities for Social Security and unemployment taxes.

The discussion of internal control focuses on payments to employees, including a descrip- tion of how such transactions are processed and the key control activities that should be pres- ent to ensure that no material misstatements occur. The audit of payroll-related accruals is discussed later in the chapter.

The financial statement accounts that are generally affected by the two types of payroll- related transactions are provided in the table below:

LO 12-2

Type of Transaction Account Affected

Payroll transaction Cash Inventory Direct and indirect labor expense accounts Various payroll-related liability and expense accounts

Accrued payroll liability transactions Cash Various accruals (such as payroll taxes and pension costs)

Types of Documents and Records Table 12–1 lists the important documents and records that are normally involved in the pay- roll application. Each of these items is briefly discussed here. The use of IT systems may affect the form of the documents and the auditor’s approach to testing the payroll application.

Personnel Records, Including Wage-Rate or Salary Authorizations Personnel records contain information on each employee’s work history, including hiring date, salary or wage rate, payroll deduction authorization forms, salary and wage-rate adjustment authoriza- tions, performance evaluations, and termination notice, if applicable. Personnel records are normally maintained in the human resource department.

W-4 and Other Deduction Authorization Forms The employee must authorize deduc- tions from his or her pay. The organization should therefore use authorization forms to docu- ment such deductions. For example, the employee must complete a W-4 form to authorize the withholding of federal and state income tax. Similar forms should be used for deductions for medical insurance, retirement contributions, and other benefits.

Time Card/Time Sheet Such documents record the hours worked by the employee, includ- ing the time the employee has started and stopped work. In some cases the employee fills in the time worked (typically in an electronic database); in other cases, the employee swipes

LO 12-3

Documents and Records Involved in the Payroll Application

Personnel records, including wage-rate or salary authorizations W-4 and other deduction authorization forms Time card/time sheet Payroll check/direct deposit records Payroll register Payroll master file Payroll master file changes report Periodic payroll reports Various tax reports and forms

T A B L E 1 2 – 1

Final PDF to printer

426 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 426 09/30/15 03:03 PM

an employee identification card, or enters an employee identification number into an elec- tronic keypad when he or she arrives and leaves work, and the time-tracking system records and accumulates the hours worked.

Payroll Check/Direct Deposit Records These records indicate the amount paid to the employee for services rendered. The amount paid is the gross pay less any deductions. In many cases, the employee’s pay is directly deposited into the individual’s bank account, and the company produces a listing of employees’ payments that were sent to their bank accounts.

Payroll Register This document, which is also referred to as the payroll journal, summa- rizes all payroll payments issued to employees. A payroll register normally indicates employ- ees’ gross pay, deductions, and net pay. In an IT environment, the details for this document are maintained in the payroll master file.

Payroll Master File This computer file maintains all the entity’s records related to payroll, including information on each employee such as name, Social Security number, pay rate, and authorized deductions.

Payroll Master File Changes Report This report contains a record of the changes made to the payroll master file. The human resource department reviews this report to ensure that all authorized changes have been properly made.

Periodic Payroll Reports At the end of each week or month, a number of summary pay- roll reports may be prepared. The type of reports prepared depends on the type of organiza- tion. A manufacturing entity might have a payroll expense report that showed the allocation of direct labor to various products. EarthWear Clothiers reports a summary of payroll by vari- ous job classifications and departments. Department heads use this report to monitor payroll expense variances.

Various Tax Reports and Forms Most companies are required to prepare various payroll tax reports for both the federal and state governments. Unemployment compensation forms must also be completed periodically. Additionally, an entity must provide each employee with a W-2 form at the end of the year. Compensation paid to a consultant or an independent con- tractor must be reported on an IRS 1099 form.

The Major Functions The principal objectives of the human resource management process are to (1) record pro- duction and other types of payroll costs in the accounts; (2) ensure that payroll costs are for legitimate entity activities; and (3) accrue liabilities for salaries and wages, payroll taxes, and various employee benefit programs. Table 12–2 lists the functions that are normally part of the payroll application.

Human Resources The human resources function is responsible for managing the per- sonnel needs of the organization. This includes hiring and terminating employees, setting wage rates and salaries, and establishing and monitoring employee benefit programs. Most large organizations centralize these activities in a human resource department. However, in a small organization, these activities may be combined with the duties of selected operating and administrative personnel. In such organizations, control over human resource activities may not be as strong as when such activities are centralized. The human resource depart- ment maintains employees’ personnel records. The human resource department may also be responsible for defining job requirements and descriptions, administering union contracts, and developing performance criteria and employee evaluation procedures.

LO 12-4

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 427

mes32502_ch12_422-449.indd 427 09/30/15 03:03 PM

Supervision Supervisors within operating and supporting departments are responsible for reviewing and approving employees’ attendance and time information. When time sheets or other documents are used to record an employee’s time worked and job classification, the supervisor approves this information before processing by the payroll function. Additionally, supervisors should monitor labor productivity and labor cost variances. Standardized labor performance measures, such as standard productivity and wage rates, improve the monitoring of payroll costs. Labor cost variances should be investigated by supervisory personnel and communicated to upper-level management. When employees are not required to complete time cards/sheets or job classification documents, the entity needs to have control activities to notify the timekeeping or payroll-processing function about employees’ absences and changes in employees’ job classifications. This might be accomplished by having the supervisor sub- mit a periodic attendance and job classification report.

Timekeeping The timekeeping function prepares employees’ time information for payroll processing. When payroll cost distribution is determined at the operating department level, the timekeeping function reviews this information before processing. Otherwise, the time- keeping function should be responsible for coding the payroll costs to appropriate accounts. In some organizations, a separate timekeeping department handles these functions. At Earth- Wear (see Figure 12–1), the operating and supporting departments are responsible for the timekeeping function.

Payroll Processing The payroll-processing function is responsible for computing gross pay, deductions, and net pay. This function is also responsible for recording and summarizing payments and verifying account distribution. When IT is used to process payroll, as at Earth- Wear, the entity must have strong application controls to ensure proper payroll processing.

Some entities outsource their payroll processing to a third-party provider such as ADP™. These third-party providers can provide a range of services from basic payroll processing to full human resources services from employee hire to retirement. When an entity uses a third party to process payroll, the auditor will obtain evidence for important assertions associated with the data transferred to the service provider. The auditor must also consider the third- party services as part of the entity’s information system. Because the third-party provider provides services to many entities, the third-party provider will obtain a Type 1 or Type 2 Service Organization Controls 1 (or SOC1) attestation report on the controls at the service organization that the other entity’s auditors can rely on.1 See Chapter 6 for a discussion of SOC1 reports and auditing accounting applications processed by service organizations.

Disbursement The disbursement function is responsible for paying employees for ser- vices and benefits. In particular, this function oversees the preparation and distribution of payroll checks. Check preparation normally occurs in the IT department. Therefore, it is

1Type 1 and Type 2 SOC1 reports on controls at a service organization used to be known as “SAS 70 Reports.” Such reports are now issued under the standards for attestation engagements, AT 801, Reporting on Controls at a Service Organization. See Chapter 21 for a discussion of the attestation standards.

Functions in the Payroll Application

Human resources Authorization of hiring, firing, wage-rate and salary adjustments, salaries, and payroll deductions.

Supervision Review and approval of employees’ attendance and time information; monitoring of employee scheduling, productivity, and payroll cost variances.

Timekeeping Processing of employees’ attendance and time information and coding of account distribution.

Payroll processing Computation of gross pay, deductions, and net pay; recording and summarization of payments and verification of account distribution.

Disbursement Payment of employees’ compensation and benefits. General ledger Proper accumulation, classification, and summarization of payroll in the general ledger.

T A B L E 1 2 – 2

Final PDF to printer

428 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 428 09/30/15 03:03 PM

necessary to have control activities over access to blank checks and check signature plates. Checks are normally distributed by a paymaster, who is typically a member of the treasurer’s department. When payments are directly deposited into employees’ bank accounts, strong IT application controls are necessary. If payroll disbursements are handled by a third-party service provider, assurance over IT controls is provided in the Type 1 or Type 2 attestation report (see Chapter 6).

General Ledger The general ledger function for the human resource management process is responsible for properly accumulating, classifying, and summarizing payroll and benefit transactions in the general ledger. When IT is used to process payroll transactions, control totals can help ensure that this function is performed properly. This function is normally per- formed by the general accounting department.

The Key Segregation of Duties As discussed in prior chapters, proper segregation of duties is one of the most important control activities in any accounting system. Duties should be assigned to individuals in such a way that no one individual can control all phases of processing a transaction, thus permitting misstatements to go undetected.

Stop and Think: Please look back at EarthWear’s flowchart in Figure 12–1 in order to identify one or two duties that EarthWear segregates. What could happen if the duties you identified were not segregated?

Individuals responsible for supervision and timekeeping should be segregated from the personnel, payroll-processing, and general ledger functions. If IT is used extensively in the payroll application, duties should be properly segregated in the IT department. Table 12–3 contains some of the key segregation of duties for the human resource management process and examples of possible errors or fraud that can result from conflicts in duties.

Table 12–4 shows more detailed segregation of duties for individual payroll functions across the various departments that are involved in processing payroll transactions.

Returning to EarthWear’s flowchart (Figure 12–1), we see EarthWear has separated, for example, the supervising function performed by each operating department from the person- nel records and the payroll-processing functions, which are performed by the human resources and IT departments, respectively. For checks, EarthWear has also separated processing and preparation of the checks and distribution. However for direct deposit, IT both prepares and distributes the checks. Although not uncommon, the auditor would want to examine and test controls around the payroll preparation and direct deposit processes, particularly controls designed to ensure distributions are made only to valid employees.

LO 12-5

Key Segregation of Duties in the Human Resource Management Process and Possible Errors or Fraud

Segregation of Duties Possible Errors or Fraud Resulting from Conflicts of Duties

The supervision function should be segregated from the personnel records and payroll-processing functions.

If one individual is responsible for the supervision, personnel records, and payroll- processing functions, fictitious employees can appear on the payroll records or unauthorized payments can be made. This can result in unauthorized payments to existing employees or payments to fictitious employees.

The disbursement function should be segregated from the personnel records, supervision, and payroll-processing functions.

If one individual is responsible for the disbursement function and has the authority to hire and fire employees, approve time reports, or prepare payroll checks, unauthorized payroll checks can be issued.

The payroll-processing function should be segregated from the general ledger function.

If one individual is responsible for processing payroll transactions and for the general ledger, that individual can conceal any defalcation that would normally be detected by independent review of accounting entries made to the general ledger.

T A B L E 1 2 – 3

Final PDF to printer

mes32502_ch12_422-449.indd 429 09/30/15 03:03 PM

Inherent Risk Assessment

With the exception of executive and share-based compensation (see Exhibit 12–1 and the Advanced Module), few inherent risk factors directly affect the human resource management process and its related accounts for nonofficers. Some factors the auditor might consider are the effect of economic conditions on payroll costs and the supply of skilled workers. Earth- Wear is a seasonal business and experiences relatively high turnover in its seasonal employees with a workforce that fluctuates between 3,500 and 5,300 employees.

Stop and Think: How might seasonal employee turnover impact the inherent risk assessment for payroll?

High turnover increases the inherent risk assessment due to the level of employee additions and terminations and the risk associated with processing. For example, there is a greater risk that pay will be inappropriately dispersed to terminated or fictitious employees. Additionally, the presence of labor contracts and legislation such as the Occupational Safety and Health Act may also affect the auditor’s assessment of inherent risk. Because the payroll system and its related accounts generally contain few inherent risks, the auditor is normally able to set the inherent risk as low.

The inherent risk associated with executive compensation is frequently not set at low because, as illustrated in Exhibit 12–1, officers may have motive and opportunity to take advantage of their high-ranking offices in the form of excessive compensation. Due to the complexity of accounting and disclosures associated with stock-based compensation (e.g., stock options, stock appreciation rights), combined with the degree of judgment and estima- tion involved in option-valuation models, there can also be substantial inherent risk associ- ated with stock-based or share-based compensation. The Advanced Module in this chapter discusses share-based compensation.

LO 12-6

Segregation of Duties for Payroll Functions by Department

Department

Payroll Function Operating or Supporting Human Resource Timekeeping Payroll IT Treasurer

Initiation of wage or salary changes X Initiation of employee hiring and firing X Approval of wage or salary changes X Updating of personnel records X Updating of payroll records X Approval of time sheets and job classification X Review of time data and payroll distribution X Preparation of payroll X X Preparation and signing of payroll checks X Distribution of payroll checks X Updating of general ledger for payroll activity X Comparison of monthly departmental payroll

expense to budget X

Calculation and recording of payroll taxes X

T A B L E 1 2 – 4

Practice I N S I G H T

It is not uncommon for executives of large public companies to be paid tens of millions of dollars each year which can be over 300 times the average worker’s salary. The Dodd-Frank Act of 2010 included a provision requiring the SEC to rule that public companies disclose the level of CEO total compensation relative to a typical employee. The pay-ratio proposal led to heated debates. The SEC received over 287,000 comment letters on the proposal. In 2015, the SEC implemented a rule requir- ing companies to disclose the median of the total annual compensation of all their employees except the CEO; the annual total compensation of the CEO; and the ratio of the two amounts. The rule takes effect in 2017. Two of the five SEC commissioners voted against the rule and in their dissenting opin- ions they called the pay-ratio rule a political ploy to shame companies into lowering CEO pay.

Final PDF to printer

430 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 430 09/30/15 03:03 PM

Control Risk Assessment

The discussion of control risk assessment follows the framework outlined in previous chapters. However, the discussion is not as in depth as the discussion of the revenue or purchasing pro- cesses because it is assumed that the reader has now developed a reasonable understanding of the decision process followed by the auditor when setting control risk. Figure 12–2 summarizes the three major steps involved in setting control risk for the human resource management process.

Understand and Document Internal Control The level of understanding of the internal control components should be similar to that obtained for the other processes. The auditor’s understanding of the human resource management process is normally gained by conducting a walkthrough of the system to gather evidence about the vari- ous functions that are involved in processing the transactions through the system. For an ongoing audit, this process merely involves updating prior years’ documentation of the payroll system by noting any changes that have occurred. For a new engagement, or if the system has under- gone major changes, more time and effort are needed to document the understanding of internal control. The auditor’s understanding of internal control for the payroll system should be docu- mented in the working papers using flowcharts, internal control questionnaires, and memoranda.

Because the control environment pervasively affects all accounting applications, includ- ing the payroll system, two factors in particular should be considered. First, the entity’s

LO 12-7

Executive Compensation Abuses at Tyco

Tyco International Ltd.’s Dennis Kozlowski looms large as a rogue CEO for the ages. His $6,000 shower curtain and vodka-spewing, full-size ice replica of Michelangelo’s David were symbols of excess and greed. In essence, prosecutors accused Kozlowski and former Chief Financial Officer Mark Swartz of run- ning a criminal enterprise within Tyco’s executive suite. The two were hit with 38 felony counts for pilfer- ing $170 million directly from the company and for pocketing an additional $430 million through tainted sales of stock. Ironically, both Kozlowski and Swartz were former auditors; Kozlowski has become the personification of the widespread irrational exuberance of the late 1990s. Kozlowski handpicked some of the members of the compensation committee, and the changes worked to his benefit as his total compen- sation rose from $8.8 million in 1995 to $67 million in 1998 to $170 million in 1999. The more he was paid as a reward for Tyco’s soaring stock price, the more he spent on luxuries—and the more he stole.

Kozlowski also ran up a $242 million tab at Tyco under a loan program designed to finance the pur- chase of company stock. Rather than use the money to buy Tyco stock, he used it to purchase fine art and antiques, a yacht, and a Nantucket estate. The loans were forms of compensation, but characterizing the compensation as a loan provided significant tax and accounting benefits to the executive and the corpora- tion. Tyco’s board approved some, but not all, of the forms of compensation Kozlowski had tapped into.

When Congress learned of the level of abuse in corporate loans, it was shocked. In the Sarbanes- Oxley Act of 2002, Congress forbids public companies to make or even arrange new loans to executives or to modify or renew old ones. The penalties for a violation are up to 20 years in jail and fines reaching $5 million for executives and $25 million for companies.

In June 2005, Kozlowski and Swartz were each convicted on 22 criminal charges relating to their mis- deeds at Tyco. Both were sentenced to serve up to 25 years in prison and pay fines and restitution totaling $240 million. Kozlowski served over 6 years in prison and 3 years in work release on parole. After serving his time Kozlowski said, “I was piggy, but I’m not that person anymore.”

As a result of abuses, public companies are now required to provide a “readable” explanation of how executive compensation was determined in the “Executive Compensation Discussion & Analysis” section in SEC filings. There are also tools online that pull executive compensation numbers from SEC filings in order for investors to make comparisons between companies.

Sources: Ashlea Ebeling, “The Lending Game,” Forbes (May 10, 2004); Anthony Bianco, William Symonds, Nanette Byrnes, and David Polek, “The Rise and Fall of Dennis Kozlowski,” BusinessWeek (December 12, 2002); Mark Maremont, “Tyco Figures Will Be Jailed at Least 7 Years,” The Wall Street Journal (September 20, 2005); Jennifer Levitz, “Former Tyco CEO to Settle Tax Case in New York State,” The Wall Street Journal (May 13, 2006); and David Kaplan, “Post-Prison, ex-Tyco Chief Dennis Kozlowski Living a Modest Life,” New York Times (March 2, 2015).

E X H I B I T 1 2 – 1

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 431

mes32502_ch12_422-449.indd 431 09/30/15 03:03 PM

organizational structure, its personnel practices, and its methods of assigning authority and responsibility must be examined. The proper organizational structure for processing payroll transactions was discussed in the previous section. Second, the entity should have sound policies for hiring, training, promoting, and compensating employees. These policies should include specific authority and responsibility for hiring and firing employees, for setting wage rates and making salary changes, and for establishing benefits.

Plan and Perform Tests of Controls For audits of public companies subject to AS5 or when a reliance strategy is followed, the auditor must identify the control activities that ensure that material misstatements are either prevented or detected and corrected. For example, the entity may have formal procedures for classifying payroll costs in appropriate accounts. The auditor may decide to rely on this control activity to reduce the control risk for the classification assertion. In this case, the entity’s procedures for classifying payroll transactions by types of payroll costs should be examined by the auditor.

Set and Document the Control Risk After the tests of controls are completed, the auditor sets the level of control risk and docu- ments that assessment. The documentation supporting the achieved level of control risk for the payroll system might include a flowchart, the results of tests of controls, and a memoran- dum indicating the overall conclusion about control risk. If control deficiencies are detected at a public company, the auditor would need to evaluate the likelihood and magnitude of the potential weakness (see Chapter 7).

Table 12–5 summarizes the assertions and possible misstatements for payroll transactions. The table also includes examples of control activities for each assertion and examples of tests of controls that can test the effectiveness of the control activities. The discussion that follows focuses only on the most important assertions for the payroll system. EarthWear’s payroll system contains all of the relevant control activities.

Control Activities and Tests of Controls—Payroll Transactions

LO 12-8

Understand and document the human resource management process

based on a reliance strategy.

Plan and perform tests of controls on payroll transactions.

Set and document the control risk for the human

resource management process.

Major Steps in Setting Control Risk for the Human Resource Management Process

F I G U R E 1 2 – 2

Final PDF to printer

432 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 432 09/30/15 03:03 PM

Summary of Assertions, Possible Misstatements, Example Control Activities, and Example Tests of Controls for Payroll Transactions

Assertion Possible Misstatement Example Control Activity Example Tests of Controls

Occurrence Payments made to fictitious employees

Segregation of duties Observe and evaluate proper segregation of duties.

Payments made to terminated employees

Adequate personnel files Review and test personnel files.

Payments made to valid employees who have not worked

Initiation of changes in employment status, wages or salaries, and benefits made by operating departments reported to the office of human resources

Review and test entity’s procedures for changing employees records; if IT application, test application controls.

Time clocks used to record time Observe employees use of time clock. Time sheets approved by supervisors Inspect time sheets presented for approval by

supervisor. Only employees with valid employee

numbers paid Review and test entity’s procedures for entering

and removing employee numbers from the payroll master file; if IT application, test application controls.

Use of payroll budgets with review by department supervisors

Review entity’s budgeting procedures.

Completeness Employee services provided but not recorded

Prenumbered time sheets accounted for by entity personnel

Check numerical sequence of time sheets; if IT application, test application controls.

Verification that all employees in the master payroll file submitted a time sheet for the pay period

Review and test entitys verification procedures; if IT application, test application controls.

Authorization Unauthorized payments made to employees

Payments made to employees at a rate in excess of authorized amount or for unauthorized employee benefits

Authorization procedures for • Hiring and terminating employees • Time worked • Wage, salary, and commission rates • Withholdings • Benefits • Issuing payroll check

Review and test authorization procedures for each point of authorization in the payroll cycle; if IT application, test application controls.

Accuracy Employee compensation and payroll deductions computed incorrectly

Verification of payroll amounts and benefit calculations

Review and test entity’s verification procedures; if IT application, test application controls.

Review of payroll register for unusual amounts

If IT-prepared, use computer-assisted audit techniques to test computer program logic for calculating amounts.

Use of payroll budgets with review by department supervisors

Review entitys budgeting procedures.

Payroll transactions not posted correctly to the payroll journal or the general ledger

Changes to master payroll file verified through “before and after” reports and then reconciled to general ledger

Test reconciliation of “before and after” reports to payroll master file, and review reconciliation of master file to general ledger; if IT application, test application controls.

Cutoff Payroll transactions recorded in the wrong period

Notices of additions, terminations, and changes to salaries, wages, and deductions reported promptly to the payroll processing function, after which the changes are updated promptly on the master payroll file

Review and test entity’s procedures for changes to master payroll file; if IT application, test application controls.

All time sheets forwarded to the payroll department weekly

Review and test procedures for processing time sheets.

Procedures that require recording payroll liabilities as soon as possible after they are incurred

Review and test procedures for recording payroll liabilities.

Classification Payroll transactions not properly classified

Chart of accounts Review chart of accounts.

Independent approval and review of accounts charged for payroll

Review and test procedures for classifying payroll costs.

Use of payroll budgets with review by department supervisors

Review entity’s budgeting procedures.

T A B L E 1 2 – 5

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 433

mes32502_ch12_422-449.indd 433 09/30/15 03:03 PM

Occurrence of Payroll Transactions The auditor wants assurance that payments for payroll-related services are being made to valid employees for time actually worked. Thus, the entity needs control activities that prevent payments to fictitious employees and to valid employees who have not worked. Controls must also ensure that payroll payments stop once an employee is terminated.

Stop and Think: Using your developing auditor expertise, what controls would you expect to see at a company like EarthWear to ensure payments are not made to termi- nated or fictitious employees?

Proper segregation of duties provides the main control against payments to fictitious employees. As noted in Table 12–4, proper segregation of duties among operating and sup- porting departments, the human resource department, and the payroll department minimizes the possibility of fictitious employees existing within the system. The maintenance of ade- quate personnel files should also prevent such misstatements. For example, a listing of termi- nated employees could be used to verify that no terminated employees are still listed in the active payroll master file.

The human resource department approves the termination of an employee and ensures that he or she is removed from the master payroll file. Required completion and approval of a time card/time sheet also prevent payments to terminated employees. Proper review and approval of time cards/sheets by supervisors should prevent valid employees from being paid for work not performed.

Practice I N S I G H T

When an external payroll service provider is used to process the audit entity’s payroll, the controls of the provider must be understood and tested by the audit firm, or by the service provider’s auditor in accordance with attestation standard AT 801 (see Chapter 21), before the controls of the payroll service provider can be relied on.

Finally, when payroll transactions are processed by an IT system, a payroll check should not be prepared unless the employee transaction has a valid employee number. Review and observation are the main tests of controls the auditor uses to examine the control activities shown in Table 12–5.

Authorization of Payroll Transactions As in the discussion of the authorization assertion for other accounting applications, there are key authorization points within the payroll system. The entity should have authorization procedures for hiring and terminating employees, setting pay rates, making withholdings, awarding benefits, and issuing payroll checks. For example, the department supervisor should approve the amount of time reported by an employee on his or her time card/sheet. Similarly, hiring and termination of employees and changes in pay rates should be authorized by the human resource department consistent with union contracts or corporate policies. Last, a pay- roll check should not be issued unless an employee’s time card/sheet has been approved and that employee has a valid employee number on the payroll master file.

Accuracy of Payroll Transactions The main concern related to the accuracy assertion is that an employee’s gross pay and pay- roll deductions may be incorrectly computed. For example, an employee may be paid at an improper rate or payroll deductions may be incorrectly computed. The entity should maintain verification procedures to ensure correct payroll and benefit calculations. The auditor can review the entity’s verification procedures as a test of control. When IT is used to prepare the payroll, the auditor can use computer-assisted audit techniques (CAATs) to test the program logic for proper calculations. In a manual system, or if a service bureau is used, the auditor can recompute the payroll calculations for a sample of payroll transactions.

Final PDF to printer

434 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 434 09/30/15 03:03 PM

Classification of Payroll Transactions Because classification is an important assertion for payroll transactions, control activities must ensure that the appropriate payroll accounts are charged. If payroll expense is charged to the wrong accounts, the financial statements may be misstated. For example, if payroll expense is not properly classified between direct and indirect labor, inventory and cost of goods sold may not be valued properly. The use of an adequate chart of accounts is one control activity that helps prevent misclassification. Additionally, the timekeeping function should review the payroll categories assigned by the operating departments. Budgets that compare actual payroll costs to budgeted payroll costs by each category of labor also provide a control over proper classification of payroll. The auditor can review and test the entity’s control activities for classifying payroll costs.

Relating the Assessed Level of Control Risk to Substantive Procedures

If the results of the tests of controls for the payroll system support the planned level of control risk, the auditor conducts substantive procedures of payroll-related accounts at the assessed level. EarthWear, for example, has a strong set of control procedures for processing payroll transactions. If the auditor’s tests of EarthWear’s controls indicate that the controls are operat- ing effectively, then no adjustment of detection risk is necessary. However, if the results of the control tests do not support the planned level of control risk for EarthWear’s payroll system, the detection risk will have to be set lower. This would require that the nature and extent of substantive testing of payroll-related accounts be increased.

Auditing Payroll-Related Accounts

Two categories of substantive procedures for auditing payroll expense and payroll-related liabilities are discussed here: (1) substantive analytical procedures and (2) tests of details of account balances and disclosures. Table 12–6 presents the assertions for classes of trans- actions and events, account balances, and disclosures as they apply to payroll expense and payroll-related liabilities, which are often called accrued payroll expenses. You should note that the auditor may obtain assurance for assertions related to transactions (substantive tests of transactions) in conjunction with testing the internal controls. If the tests of controls indi- cate that the controls are not operating effectively, the auditor may need to test transactions at the date the account balance is tested.

Substantive Analytical Procedures

Substantive analytical procedures can be useful substantive tests for examining the reason- ableness of payroll expenses and payroll-related accrual accounts. When utilized as part of planning, preliminary analytical procedures can effectively identify payroll expense accounts and accrual accounts that may be misstated.

Stop and Think: What comparisons and reasonableness tests could you develop to obtain assurance that payroll expense appears reasonable and that wages payable at the end of the year is accurately stated?

Table 12–7 shows examples of substantive analytical procedures that can be used for auditing payroll. Two examples will help demonstrate their application in practice. First, the auditor can compare budgeted payroll costs with actual payroll costs. Variances due to quan- tity and wage differences should show up in the entity’s cost-accounting system (on weekly or monthly reports). If the variances are immaterial, the auditor has some evidence that payroll

LO 12-9

LO 12-10

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 435

mes32502_ch12_422-449.indd 435 09/30/15 03:03 PM

costs are reasonable. If the variances are material, the auditor should investigate the poten- tial causes of the differences. This substantive analytical procedure also helps the auditor determine the proper valuation of inventory when standard costs are used to value inventory. Second, the auditor can test the reasonableness of certain accrual balances. For example, if accrued wages represent payroll for two days, the auditor can multiply the total weekly payroll by 40 percent (2 days ÷ 5 days). If the auditor’s calculation is close to the accrued amount, no further audit work may be required on the accrued wages account.

Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Table 12–6 presents the assertions for payroll expense and payroll-related liabilities. The intended purpose of substantive tests of transactions is to detect monetary misstatements in the individual transactions processed through the payroll application. As previously mentioned, tests of transactions are often conducted in conjunction with tests of controls. Table 12–8

LO 12-11

Assertions about Classes of Transactions and Events, Account Balances, and Disclosures for Payroll Expense and Payroll-Related Accruals

Assertions about Classes of Transactions and Events: • Occurrence. Payroll transactions and events are valid. • Completeness. All payroll transactions and events have been recorded. • Authorization. All payroll transactions and events are properly authorized. • Accuracy. Payroll transactions have been properly computed and recorded. • Cutoff. Payroll expense and related accruals are recorded in the correct accounting period. • Classification. Payroll expense and related accruals have been recorded in the proper accounts.

Assertions about Account Balances at the Period End: • Existence. Payroll expense is a valid expense and related accruals are valid liabilities. • Rights and obligations. The payroll-related accruals are the obligations of the entity. • Completeness. All payroll expense and related accruals have been recorded. • Valuation and allocation. Payroll expense and related accruals are included in the financial statements at appropriate amounts, and any resulting

valuation or allocation adjustments are appropriately recorded.

Assertions about Presentation and Disclosure: • Occurrence and rights and obligations. All disclosed events, transactions, and other matters relating to payroll expense and related accruals have

occurred and pertain to the entity. • Completeness. All disclosures relating to payroll expense and related accruals that should have been included in the financial statements have been

included. • Classification and understandability. Financial information relating to payroll expense and related accruals is appropriately presented and described,

and disclosures are clearly expressed. • Accuracy and valuation. Financial and other information relating to payroll expense and related accruals are disclosed fairly and in appropriate amounts.

T A B L E 1 2 – 6

Example Substantive Analytical Procedures for Auditing Payroll Accounts and Payroll-Related Accruals

Example Substantive Analytical Procedures Possible Misstatement Detected

Payroll Expense Accounts Compare current-year quarterly balances in the various payroll expense accounts with

prior year’s quarterly balances after adjustment for pay changes and number of employees. Over- or understatement of payroll expense.

Compare payroll costs as a percentage of sales with prior years and industry data. Over- or understatement of payroll expense. Compare labor utilization rates and statistics with industry data. Over- or understatement of payroll expense. Compare budgeted payroll expenses with actual payroll expenses. Over- or understatement of payroll expense. Estimate sales commissions by applying commission formulas to recorded sales totals. Over- or understatement of sales commissions.

Payroll-Related Accrual Accounts Compare current-year balances in payroll-related accrual accounts with prior year’s

balances after adjusting for changes in conditions. Over- or understatement of accrued liabilities.

Test reasonableness of accrual balances. Over- or understatement of accrued liabilities.

T A B L E 1 2 – 7

Final PDF to printer

436 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 436 09/30/15 03:03 PM

presents examples of substantive tests of transactions, account balances, and disclosures for assertions related to payroll. The discussion that follows focuses on tests of details of account balances of payroll expense and accrued payroll liabilities.

Payroll Expense Accounts Payroll transactions affect many expense accounts, including direct and indirect manufactur- ing expense, general and administrative salaries, sales salaries, commissions, and payroll tax expenses. Some companies account for such expenses by product line or division. In addition, fringe benefits such as medical and life insurance may be paid at least partly by the organization. If the entity’s internal control is reliable, the auditor generally does not need to conduct detailed tests of these payroll expense accounts. On such audits, sufficient evidence can be gathered through an understanding of internal control, tests of controls, substantive tests of transactions, and substan- tive analytical procedures. Additional detail testing is necessary only when control weaknesses exist or when the other types of audit tests indicate that material misstatements may be present.

Several payroll expense accounts may still be examined even when control risk is low. For example, it is common to verify the compensation paid to officers of the company because information on executive salaries and bonuses is needed for the SEC Form 10-K,

Examples of Payroll Tests of Transactions, Account Balances, and Disclosures

Assertions about Classes of Transactions Example Substantive Tests of Transactions

Occurrence Trace a sample of payroll checks to the master employee list to verify validity.* Completeness Tracing of a sample of time cards/sheets to the payroll register.* Authorization Test a sample of payroll checks for the presence of an authorized time card/sheet.* Accuracy Recompute the mathematical accuracy of a sample of payroll checks: CAATs may be

used to test the logic of the computer programs for proper calculation of gross pay, deductions, and net pay.

Cutoff Trace a sample of time cards/sheets before and after period end to the appropriate weekly payroll report, and trace the weekly payroll report to the general ledger to verify payroll transactions are recorded in the proper period.*

Classification Examine a sample of payroll checks for proper classification into expense accounts.*

Assertions about Account Balances at Period End Example Tests of Details of Account Balances

Existence Vouch selected amounts from the account analysis schedules for the accruals to supporting documentation (payroll tax returns, corporate benefit policies, etc.).

Rights and obligations Review supporting documentation to determine that the entity is legally obligated to pay the liability.

Test a sample of bank reconciliations for the payroll bank account (see Chapter 16). Completeness Search for unrecorded liabilities (see Chapter 11).

Use CAATs to foot weekly payroll reports and reconcile the total to the general ledger (payroll expense and related accruals).

Valuation and allocation Obtain an account analysis schedule for accrued payroll liabilities; foot schedules and agree total to general ledger.

Compare amounts accrued to supporting documentation, such as payroll tax returns.

Assertions about Presentation and Disclosure Example Tests of Details of Disclosures

Occurrence, and rights and obligations Inquire about accruals to ensure that they are properly disclosed. Completeness Complete financial reporting checklist to ensure that all financial statement disclosures

related to payroll expense and related accruals have been made. Classification and understandability Review accrued payroll liabilities for proper classification between short-term and long-

term liabilities. Read footnotes to ensure that required disclosures are understandable.

Accuracy and valuation Review benefit contracts for proper disclosure of pension and postretirement benefits. Read footnotes and other information to ensure that the information is accurate and

properly presented at the appropriate amounts.

*These substantive tests of transactions are commonly conducted as dual-purpose tests (i.e., in conjunction with tests of controls).

T A B L E 1 2 – 8

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 437

mes32502_ch12_422-449.indd 437 09/30/15 03:03 PM

proxy statements, and the federal tax return. Limits may also be placed on officers’ salaries and bonuses as part of lending agreements. If such limits are exceeded, the entity may be in default on the debt. Officers’ compensation is also examined because, as noted earlier, offi- cers are in a position to override the control activities and pay themselves more than they are authorized to receive (see Exhibit 12–2). Officers’ compensation expense can be verified by comparing the amounts shown in the payroll records with the amounts authorized in either board of directors’ minutes or employment contracts and by searching for other cash pay- ments made to the officer, his or her family, or related parties.

Accrued Payroll Liabilities An entity incurs a number of payroll-related liabilities. In addition to these accrued expenses, the entity also withholds various amounts from an employee’s pay. These withholdings include payroll taxes (federal and state income taxes and FICA), medical and life insurance premiums, pension, and other miscellaneous deductions. Some examples of accrued payroll liabilities include

∙ Accrued wages and salaries. ∙ Accrued payroll taxes. ∙ Accrued commissions. ∙ Accrued bonuses. ∙ Accrued benefits such as vacation and sick pay.

In auditing accrued payroll liabilities, the auditor is concerned mainly with five audit assertions: existence, completeness, valuation, cutoff, and presentation and disclosure asser- tion of completeness. When control risk is low or the amounts in the accounts are relatively small, the auditor can verify accrued payroll liabilities using substantive analytical proce- dures. For example, the auditor can compare the prior year’s balance in each accrual with the current year’s balance after considering changing conditions.

For accrued payroll liability accounts for which the control risk is high or whose amounts are material, the auditor can obtain a detailed account analysis schedule. For example, Exhibit 12-3 shows an account analysis schedule for EarthWear’s accrued payroll taxes. The credits to the account represent the recognition of payroll tax expense at the end of each pay period. These amounts can be traced to the various payroll tax returns or other documentation filed by the entity and should agree with the amount of payroll tax expense included in the income state- ment. The debits to the account represent payments made to relevant government agencies. These payments can be verified by tracing the amounts to the cash disbursements journal.

Executive Compensation at Embattled MF Global

Shortly after MF Global filed for bankruptcy in October 2011, Jon S. Corzine, former governor of New Jersey, resigned as chairman and chief executive. At the time of his resignation, MF Global faced federal investigations into $630 million in missing customer money. Corzine had been with the firm less than 2 years, but during that time he transformed the sleepy brokerage firm by aggressively buying up Euro- pean sovereign debt, betting that the troubled countries would not default. During his short time at MF Global he was paid more than $4 million. At the time of his resignation, Corzine said he would not seek the $12.1 million in severance compensation MF Global owed him. Later, forensic accountants found that the amount of customer money that could not be accounted for was closer to $1.2 billion, which was believed to be inappropriately used to prop up the company. Investors say Corzine should face criminal charges, though his role in the lost funds is unclear. Corzine has denied wrongdoing. Federal lawsuits claiming Corzine illegally transferred funds continue. As of 2014, former executives had spent over $47 million on their legal defense.

Sources: B. Protess and K. Roose, “Corzine Resigns from MF Global,” New York Times (November 4, 2011); Nick Brown, “MF Global Judge Nixes Customer Group’s Bid to Depose Corzine,” Reuters (January 8, 2013); and Joseph Checkler, “Judge Allows Corzine and Others to Tap MF Global Insurance,” The Wall Street Journal (September 5, 2014).

E X H I B I T 1 2 – 2

Final PDF to printer

438 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 438 09/30/15 03:03 PM

An interesting aspect of this type of accrual account is that it periodically “clears out” the accrued amount. For example, if the entity has to make payments for payroll taxes to the government on the 15th of each month, the accrued payroll taxes account will have a zero balance after the payment. Thus, at the end of any month, the accrued payroll taxes account should contain only an accrual for payroll taxes since the last payment (approximately two weeks). In many organizations, these costs are broken down into the various types of payroll taxes (employer’s FICA and federal and state unemployment taxes).

Cutoff The auditor also wants to determine whether all payroll-related liabilities are recorded in the proper period. An examination of supporting documentation for the accruals provides evidence on the proper period for recording the expense or liability. For example, an examination of the entity’s unemployment tax invoices should allow the auditor to determine if a proper accrual for unemployment tax has been made in the current period.

Existence and Valuation The existence and valuation assertions can generally be tested at the same time. The auditor’s concerns are whether the recorded liabilities are valid obliga- tions of the entity and whether they are included in the financial statements at the appropriate amount. To verify the existence and valuation of an accrued payroll liability, the auditor can generally trace the amounts included on the account analysis working paper to supporting documentation such as payroll tax reports. If adequate documentation is present, the auditor has evidence that the amount represents a valid liability. The auditor can usually verify the accuracy of the amounts by recalculating the figures.

Completeness The auditor wants to make sure that all payroll-related liabilities are recorded. The auditor should be aware of the normal payroll-related taxes that are paid by the entity and therefore should be able to determine if accruals have been made for payroll taxes such as Social Security taxes and unemployment insurance. In some instances, the auditor’s search for unrecorded liabilities, which was discussed in Chapter 11, may provide evidence that all payroll-related liabilities are recorded.

Presentation and Disclosure: Completeness The auditor must ensure that all neces- sary financial statement disclosures for the human resource management process are made. Table 12–9 presents examples of items that should be disclosed.

Accounting standards require substantial disclosure. FASB ASC Topic 718 requires detailed disclosures of pension costs, postretirement benefits, and share-based compensation (see the Advanced Module in this chapter for a discussion of share-based compensation).

Account Analysis for Accrued Payroll Taxes AccountE X H I B I T 1 2 – 3

N25 DLJ

2/04/16

Disbursements for payment of payroll taxes $253,275£

Beginning balance Weekly accruals for payroll tax expense Ending balance

$9,450ϕ

253,540✓ $9,715λL

F = Footed. ϕ = Traced to prior year’s working papers. L = Agreed to general ledger. ✓ = Traced three weeks’ (2/14, 4/25, and 9/5) payroll expense accruals to weekly payroll records. £ = Traced three payments of payroll taxes to the cash disbursements journal. λ = Recomputed amount of unpaid payroll taxes for two weeks at the end of December 2015.

EARTHWEAR CLOTHIERS Analysis of Accrued Payroll Taxes

12/31/15

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 439

mes32502_ch12_422-449.indd 439 09/30/15 03:03 PM

Although a thorough discussion of the audit of these items is beyond the scope of this text, the reader should be aware that such disclosures are important to the fairness of the financial statements. Profit-sharing plans and deferred compensation arrangements also require disclo- sure in the footnotes.

Practice I N S I G H T

In early 2006 the SEC began a probe to detect possible stock-option abuses, particularly the impec- cable timing of granting stock options to corporate executives. Analysis of stock price patterns and grant dates suggested that companies were backdating the grant date of stock options to a low in the stock price so that executives and employees could benefit from sharp stock appreciation. One popular technology company involved in backdating was Apple Inc. In 2006, Apple disclosed that thousands of option grants between 1997 and 2002, including those to CEO Steve Jobs, were improperly dated. The SEC sued Apple’s former CFO and general counsel alleging involvement in backdating; the lawsuits were settled out of court for $5.7 million. In a related shareholder lawsuit, Steve Jobs and other Apple executives agreed to settle claims about their alleged participation for $14 million. In July 2006, the SEC adopted new rules requiring detailed disclosure of stock-option grants. For a summary of the new disclosure requirements see www.sec.gov. Sources: Charles Forelle and James Bandler, “Stock-Options Criminal Charge: Slush Fund and Fake Employees,” The Wall Street

Journal (August 10, 2006); and Nick Wingfield and Justin Scheck, “Jobs, Apple Executive Settle Suit,” The Wall Street Journal

(September 11, 2008).

Sample Disclosure Items for the Human Resource Management Process

Pension benefits Postretirement benefits Stock-based compensation Profit-sharing plans Deferred compensation arrangements

T A B L E 1 2 – 9

Evaluating the Audit Findings— Payroll-Related Accounts

When the auditor has completed the planned substantive procedures of the payroll-related accounts, all the identified misstatements should be aggregated. The likely misstatement is compared to the tolerable misstatement allocated to the payroll-related accounts. If the likely misstatement is less than the tolerable misstatement, the auditor may accept the accounts as fairly presented. Conversely, if the likely misstatement exceeds the tolerable misstatement, the auditor should conclude that the accounts are not fairly presented.

For example, in Chapter 3 the tolerable misstatement for EarthWear was set at $900,000. Exhibit 3–3 showed that Willis & Adams detected a misstatement in recording payroll expense and bonuses that amounted to a $215,000 understatement of accrued liabilities. Because this misstatement is less than the tolerable misstatement of $900,000, Willis & Adams can con- clude that the audit evidence supports fair presentation. However, if the misstatement were greater than the tolerable misstatement, the evidence would not support fair presentation. In this case the auditor would have two choices: adjust the accounts to reduce the misstatement to an amount less than the tolerable misstatement or qualify the audit report.

The auditor should again analyze the misstatements discovered through the application of substantive procedures because these misstatements may provide additional evidence on the control risk for the payroll system. If the auditor concludes that the audit risk is unaccept- ably high, additional audit procedures should be performed, or the auditor must be satisfied that the entity has adjusted the payroll-related financial statement accounts to an acceptable level. For example, suppose the auditor’s substantive analytical procedures indicate that commissions expense is overstated. The auditor might perform detailed computations of

LO 12-12

Final PDF to printer

440 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 440 09/30/15 03:03 PM

commissions expense or request that the entity adjust the account by the amount of the esti- mated misstatement.

Advanced Module: Share-Based Compensation

Accounting for stock options and similar compensation has been a controversial area for many years. In 1995 the FASB issued Statement No. 123, “Share-Based Compensation,” which encouraged but did not mandate the use of the fair value method to determine compensation expense on the income statement. Initially, nearly all companies continued to use the intrinsic value method to report compensation expense, which typically resulted in zero compensation expense. After the accounting scandals of the early 2000s, some companies (e.g., Amazon, Coca-Cola) decided voluntarily to use the fair value method to determine share-based com- pensation expense as a way of signaling the high quality of their financial reporting to the capital markets. Within a few years, over 700 companies in the United States voluntarily applied the fair value method. The FASB revisited the issue of share-based compensation, and in December 2004 the FASB issued Statement No. 123R, “Share-Based Payment,” requiring the expensing of the fair value of stock options granted and other share-based payments as compensation. Statement No. 123R (now found in FASB ASC Topic 718) became effective in 2006 for most public companies.

The determination of the fair value for share-based payments will require the use of an option-pricing model for most companies. The most common models are the Black- Scholes- Merton model and the binomial model. These models incorporate a variety of factors, including

∙ The exercise price of the option. ∙ The term of the option. ∙ The current market price of the underlying stock. ∙ Expected volatility. ∙ Expected dividends. ∙ Expected risk-free rate.

Many of these factors are complex and involve forward-looking information. In addi- tion to FASB ASC Topic 718, entities and auditors must also consider guidance found in FASB ASC Subtopic 505-50, “Equity Based Payments to Non-employees.” As noted in the chapter, accounting for share-based payments often presents high inherent risk because of the complexity of the accounting rules and the degree of judgment and estimation that must go into the fair value determination. Audit firms develop extensive audit programs to help audit teams ensure that an entity is appropriately accounting for stock-based compensation. While detailed coverage of auditing for share-based compensation is beyond the scope of this book, we provide a brief overview of issues and procedures.

Once the auditor has a general sense for the extent to which share-based compensation is used by the company, he or she would normally perform procedures such as

∙ Read all applicable share-based plans and inquire of management whether other documents (e.g., employment agreements) contain relevant information.

∙ Understand policies, processes, and controls around share-based compensation. ∙ Test design and operating effectiveness of controls, including a determination that the

transactions have been properly authorized. ∙ Obtain and verify the accuracy of schedules supporting the granting of share-based

compensation awards. ∙ Review board of directors’ minutes to ensure completeness of the supporting

schedules and to identify modifications to the terms of outstanding awards or existing plans (e.g., exercise price or date).

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 441

mes32502_ch12_422-449.indd 441 09/30/15 03:03 PM

∙ Perform analytical procedures to identify unusual fluctuations in compensation expense as well as related income/expense accounts.

∙ Determine if any awards were exercised for other than cash (e.g., loans) or if employees were offered the opportunity to replace an out-of-the-money award for another award.

In addition to these procedures the auditor would obtain evidence to support the fair value measurements or option pricing. With the movement in accounting standards toward more fair value accounting, auditors will need improved understanding of valuation issues. Because auditing fair value is further addressed in the Advanced Module in Chapter 16, “Auditing Fair Value Measurements,” the discussion here will be brief. To obtain sufficient appropriate evidence on the fair value of options, the auditor is not required to become an option-pricing expert. If the entity is using an approved model (e.g., Black-Scholes-Merton or binomial), the auditor would verify the mathematical accuracy of the entity’s calculations, tie the output of the model to the financial statements, and tie the known inputs (e.g., term, stock price) to relevant source documents. For forward-looking inputs (e.g., expected volatility, dividends, interest rate), the auditor would perform procedures to test the reasonableness of these inputs. The entity should have a verifiable and consistent method to estimate these parameters.

Often the auditor will use the work of a valuation specialist to obtain evidence regarding fair value measurements. When specialists are used, the auditor is required to evaluate the specialist’s qualifications and objectivity. The auditor also must determine if the valuation model used by the specialist is appropriate and consistent with GAAP, and the auditor must understand and agree with the reasonableness of the underlying assumptions.

KEY TERMS

Analytical procedures. Evaluations of financial information through analysis of plausible relationships among both financial and nonfinancial data. Application controls. Controls that apply to the processing of specific computer applications and are part of the computer programs used in the accounting system. Assertions. Expressed or implied representations by management that are reflected in the financial statement components. General controls. Controls that relate to the overall information-processing environment and have a pervasive effect on the entity’s computer operations. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the relevant assertion level. Tests of details of account balances and disclosures. Substantive tests that concentrate on the details of items contained in the account balance and disclosures.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

Final PDF to printer

442 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 442 09/30/15 03:03 PM

REVIEW QUESTIONS

LO 12-1 12-1 In addition to policies and processes around payroll transactions, what other policies and processes are involved in the human resource management process?

LO 12-2 12-2 What are the two major types of transactions that occur in the payroll system? What financial statement accounts are affected by each of these types of transactions?

LO 12-3 12-3 Briefly describe each of the following documents or records: payroll register, payroll master file, and payroll master file changes report.

LO 12-4 12-4 What duties are performed within the human resource, timekeeping, and payroll- processing functions?

LO 12-5 12-5 List the key segregation of duties in the human resource management process. What errors or fraud can occur if such duties are not segregated?

LO 12-6 12-6 What risk factors associated with human resource management could pose signifi- cant inherent risks?

LO 12-7, 12-8 12-7 Discuss two control environment factors that have a pervasive effect on the human resource management process that an auditor should consider.

LO 12-8 12-8 What are the key authorization points in a payroll system? LO 12-8 12-9 Why is it important for the entity to establish control activities over the classification

of payroll transactions? LO 12-8, 12-11 12-10 What is an example of a test of control or substantive test of transactions that can be

performed using CAATs for payroll transactions? LO 12-10 12-11 List two substantive analytical procedures that can be used to provide audit evidence

related to the payroll expense accounts and the payroll-related liabilities. LO 12-11 12-12 Discuss how an auditor would audit the accrued payroll taxes account. LO 12-11 12-13 Identify three possible disclosure issues for payroll expense and payroll-related

liabilities.

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 12-3, 12-8 12-14 During the year being audited, the Matthews Corporation changed from a system of recording time worked on clock cards to an IT payroll system in which employees record time in and out with magnetic cards. The IT system automatically updates all payroll records. Because of this change

a. A generalized computer audit program must be used. b. Without paper clock cards, part of the audit trail is altered. c. The potential for payroll-related fraud is diminished. d. Transactions must be processed in batches.

LO 12-3, 12-5, 12-8 12-15 Which of the following procedures would most likely be considered a weakness in an entity’s internal controls over payroll?

a. A voucher for the amount of the payroll is prepared in the general accounting department based on the payroll department’s payroll summary.

b. Payroll checks are prepared by the payroll department and signed by the treasurer. c. The employee who distributes payroll checks returns unclaimed payroll checks to

the payroll department. d. The personnel department sends employees’ termination notices to the payroll

department.

LO 12-4, 12-5, 12-8 12-16 In meeting the control objective of safeguarding of assets, which department should be responsible for the following?

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 443

mes32502_ch12_422-449.indd 443 09/30/15 03:03 PM

LO 12-5 12-17 For an appropriate segregation of duties, journalizing and posting summary payroll transactions should be assigned to

a. The treasurer’s department. b. General accounting. c. Payroll accounting. d. The timekeeping department.

LO 12-5 12-18 The purpose of segregating the duties of hiring personnel and distributing payroll checks is to separate the

a. Human resource function from the controllership function. b. Administrative controls from the internal accounting controls. c. Authorization of transactions from the custody-related assets. d. Operational responsibility from the record-keeping responsibility.

LO 12-8 12-19 An auditor who is testing IT controls in a payroll system would most likely use test data (discussed in Advanced Module 2 in Chapter 7) that contain conditions such as

a. Deductions not authorized by employees. b. Overtime not approved by supervisors. c. Time cards with invalid job numbers. d. Payroll checks with unauthorized signatures.

LO 12-8 12-20 It would be appropriate for the payroll department to be responsible for which of the following functions?

a. Approval of employee time records. b. Preparation of periodic governmental reports as to employees’ earnings and with-

holding taxes. c. Maintenance of records of employment, discharges, and pay increases. d. Distribution of paychecks to employees.

LO 12-8 12-21 Which of the following audit tests would most likely be used to test the occurrence assertion for payroll transactions?

a. Trace a sample of time sheets to the payroll register. b. Recompute the mathematical accuracy of a sample of payroll checks. c. Trace a sample of payroll checks to the approved time sheet summary and the

master employee list to verify validity. d. Test a sample of time sheets for the presence of authorization.

LO 12-8 12-22 Effective control activities over the payroll function may include a. Reconciliation of totals on job time cards with job reports by employees respon-

sible for those specific jobs. b. Verification of agreement of job time cards with employee clock card hours by a

payroll department employee. c. Preparation of payroll transaction journal entries by an employee who reports to

the supervisor of the personnel department. d. Custody of rate authorization records by the supervisor of the payroll department.

Distribution of Paychecks Custody of Unclaimed Paychecks

a. Treasurer Treasurer

b. Payroll Treasurer

c. Treasurer Payroll

d. Payroll Payroll

Final PDF to printer

444 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 444 09/30/15 03:03 PM

LO 12-9, 12-10, 12-11 12-23 An auditor is most likely to perform substantive tests of details on payroll transac- tions and balances when

a. Cutoff tests indicate a substantial amount of accrued payroll expense. b. The level of control risk relative to payroll transactions is set at low. c. Substantive analytical procedures indicate unusual fluctuations in recurring pay-

roll entries. d. Accrued payroll expense consists primarily of unpaid commissions.

PROBLEMS All applicable problems are available with Connect.

LO 12-4, 12-5 12-24 You have been hired by Morris & Son, Inc., to manage its human resource depart- ment. As a first step, you want to determine personnel needs and assigned duties in order to prevent errors and fraud in the financial statements.

Required: How many people would you utilize and what duties would you assign to each per- son hired to best help prevent errors and fraud in the financial statements? Be sure to explain your answer.

LO 12-4, 12-5, 12-7, 12-25 A CPA’s audit documentation (working papers) contains a narrative description of a 12-8 segment of the Croyden Factory, Inc., payroll system and an accompanying

flowchart (see below).

Narrative The internal control system with respect to the personnel department functions well and is not included in the accompanying flowchart.

At the beginning of each workweek, payroll clerk 1 reviews the payroll depart- ment files to determine the employment status of factory employees and then pre- pares time cards and distributes them as each individual arrives at work. This payroll clerk, who is also responsible for custody of the signature stamp machine, verifies the identity of each payee before delivering signed checks to the foreman.

At the end of each workweek, the foreman distributes the payroll checks for the preceding workweek. Concurrent with this activity, the foreman reviews the current week’s employee time cards, notes the regular and overtime hours worked on a sum- mary form, and initials the time cards. The foreman then delivers all time cards and unclaimed payroll checks to payroll clerk 2.

Required: a. Based on the narrative and the flowchart, what are the weaknesses in internal

control? b. Based on the narrative and the accompanying flowchart, what inquiries should be

made to clarify possible additional weaknesses in internal control? Do not discuss the internal control system of the personnel department.

(AICPA, adapted)

LO 12-10, 12-11 12-26 McCarthy, CPA, was engaged to audit the financial statements of Kent Company, a continuing audit client. McCarthy is about to audit Kent’s payroll transactions. Kent uses an in-house payroll department to process payroll data and to prepare and dis- tribute payroll checks.

During the planning process, McCarthy determined that the inherent risk of over- statement of payroll expense is high. In addition, McCarthy obtained an understand- ing of internal control and set the control risk for payroll-related assertions at the maximum level.

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 445

mes32502_ch12_422-449.indd 445 09/30/15 03:03 PM

Copy

Factory Employees

Factory Foreman Personnel

Payroll Clerk 1

Payroll Clerk 2 Bookkeeping

Payroll update and withholding

forms

File reviewed weekly, clock

cards prepared

Time clock punched in

and out daily

Identity of payee verified, checks

signature stamped

Delivered to payroll clerk

No. 2

Checks delivered to

factory foreman

Payroll checks distributed

Employment status, wage rate, and

authorized payroll deductions

checked

Gross and net payroll computed,

payroll register

prepared

Column totals cross-footed

Gross pay, net pay, and

numerical sequence of

checks verified

Regular and overtime

hours verified

Sequentially numbered

payroll checks

prepared

Regular and overtime hours computed and

noted on clock cards

Copy

Clock cards E

Clock cards F

Payroll checks

Clock cards F

Payroll checks

Foreman

Employees

Payroll register

Time clock punched in

and out daily

Clock cards reviewed and initialed, summary of regular and

overtime hours

prepared

Foreman

Employees

Clock cards

Clock cards submitted

for approval weekly

Clock cards F

Summary of regular and

overtime hours

Croyden Factory, Inc., Payroll System

Final PDF to printer

446 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 446 09/30/15 03:03 PM

Required: Describe several audit procedures McCarthy should consider performing in the audit of Kent’s payroll transactions to address the risk of overstatement. Do not discuss Kent’s internal control.

(AICPA, adapted)

LO 12-10, 12-11 12-27 James, who was engaged to examine the financial statements of Talbert Corporation, is about to audit payroll. Talbert uses a computer service center to process weekly payroll as follows.

Each Monday Talbert’s payroll clerk inserts data in appropriate spaces on the pre- printed service center–prepared input form and sends it to the service center via mes- senger. The service center extracts new permanent data from the input form and updates its master files. The weekly payroll data are then processed. The weekly payroll register and payroll checks are printed and delivered by messenger to Talbert on Thursday.

Part of the sample selected for audit by James includes the data from the “payroll input” table and payroll register, which are provided below followed by the Talbert payroll register.

Required: a. Describe how James should verify the information in the payroll input form

shown. b. Describe (but do not perform) the procedures that James should follow in examin-

ing the November payroll register shown below. (AICPA, adapted)

TALBERT CORPORATION Payroll Input

Week Ending Friday, November 25

Employee Data—Permanent File Current Week’s Payroll Data

Hours Special Deductions

Name Social Security Number

W-4 Information

Hourly Rate Regular Overtime Bonds Union Other

A. Bell 999-99-9991 M-1 $10.00 35 5 $18.75 B. Carioso 999-99-9992 M-2 10.00 35 4 C. Deng 999-99-9993 S-1 10.00 35 6 18.75 $4.00 D. Ellis 999-99-9994 S-1 10.00 35 2 4.00 $50.00 E. Flaherty 999-99-9995 M-4 10.00 35 1 4.00 F. Gillis 999-99-9996 M-4 10.00 35 4.00 G. Hua 999-99-9997 M-1 7.00 35 2 18.75 4.00 H. Jones 999-99-9998 M-2 7.00 35 4.00 25.00 I. King 999-99-9999 S-1 7.00 35 4 4.00

New Employee: J. Smith 999-99-9990 M-3 7.00 35

DISCUSSION CASES

LO 12-7, 12-8, 12-9 12-28 Service Corporation hired an independent computer programmer to develop a simplified payroll application for its newly purchased computer. The programmer developed an online database microcomputer system that minimized the level of knowledge required of the operator. It was based on typing answers to input cues that appeared on the terminal’s viewing screen, examples of which follow:

A. Access routine: 1. Operator access number to payroll file? 2. Are there new employees?

Final PDF to printer

Chapter 12 Auditing the Human Resource Management Process 447

mes32502_ch12_422-449.indd 447 09/30/15 03:03 PM

TA LB

E R

T C

O R

P O

R A

T IO

P a

yr o

ll R

e g

is te

r N

o ve

m b

e r

2 5

Em pl

oy ee

So ci

Se cu

rit y

N um

be r

H o

u rs

P a

yr o

ll G

ro ss

yr ol

Ta xe

s W

ith he

ld O

th er

ith he

ld N

Pa y

C he

N um

be r

Re gu

la r

O ve

rt im

e Re

gu la

r O

ve rt

im e

FI C

A Fe

de ra

l St

at e

Be ll

99 9-

99 -9

99 1

35 5

$ 3

50 .0

0 $

75 .0

0 $

4 25

.0 0

$ 26

.0 5

$ 7

6. 00

$ 2

7. 40

$ 1

8. 75

$ 2

76 .8

0 14

99 B.

ar io

so 99

9- 99

-9 99

2 35

4 35

0. 00

60 .0

0 41

0. 00

25 .1

3 65

.0 0

23 .6

0 29

6. 27

15 00

C .

D en

g 99

9- 99

-9 99

3 35

6 35

0. 00

90 .0

0 44

0. 00

26 .9

7 10

0. 90

28 .6

0 22

.7 5

26 0.

78 15

01 D

. El

lis 99

9- 99

-9 99

4 35

2 35

0. 00

30 .0

0 38

0. 00

23 .2

9 80

.5 0

21 .7

0 54

.0 0

20 0.

51 15

02 E.

ah er

ty 99

9- 99

-9 99

5 35

1 35

0. 00

15 .0

0 36

5. 00

22 .3

7 43

.5 0

15 .9

0 4.

00 27

9. 23

15 03

G ill

is 99

9- 99

-9 99

6 35

35 0.

00 35

0. 00

21 .4

6 41

.4 0

15 .0

0 4.

00 26

8. 14

15 04

G .

H ua

99 9-

99 -9

99 7

35 2

24 5.

00 21

.0 0

26 6.

00 16

.3 1

34 .8

0 10

.9 0

22 .7

5 18

1. 24

15 05

H .

Jo ne

s 99

9- 99

-9 99

8 35

24 5.

00 24

5. 00

15 .0

2 26

.4 0

8. 70

29 .0

0 16

5. 88

15 06

I. Ki

ng 99

9- 99

-9 99

9 35

4 24

5. 00

42 .0

0 28

7. 00

17 .5

9 49

.4 0

12 .2

0 4.

00 20

3. 81

15 07

Sm ith

99 9-

99 -9

99 0

35 24

5. 00

24 5.

00 15

.0 2

23 .0

0 7.

80 19

9. 18

15 08

To ta

l 35

0 24

$3 ,0

80 .0

0 $3

33 .0

0 $3

,4 13

.0 0

$2 09

.2 1

$5 40

.9 0

$1 71

.8 0

$1 59

.2 5

$2 ,3

31 .8

Final PDF to printer

448 Part 5 Auditing Business Processes

mes32502_ch12_422-449.indd 448 09/30/15 03:03 PM

B. New employee routine: 1. Employee name? 2. Employee number? 3. Social Security number? 4. Rate per hour? 5. Single or married? 6. Number of dependents? 7. Account distribution? C. Current payroll routine: 1. Employee number? 2. Regular hours worked? 3. Overtime hours worked? 4. Total employees this payroll period? The independent auditor is attempting to verify that certain input validation (edit)

checks exist to ensure that errors resulting from omissions, invalid entries, or other inaccuracies are detected during the typing of answers to the input cues.

Required: a. Discuss the various types of input validation (edit) controls that the independent

auditor would expect to find in the IT system. b. Describe the assurances provided by each identified validation check. (AICPA, adapted)

INTERNET ASSIGNMENT

LO 12-6, 12-10, 12-29 Search the Internet for information on labor costs in the retail catalog industry (e.g., LO 12-11 labor costs as a percentage of sales). Executive compensation ballooned in the 1990s, and as highlighted in

Exhibit 12-1, there were notable compensation abuses. The most popular form of executive compensation in the 1990s was company stock (or options to purchase stock). Designers of these compensation plans argue that by compensating officers with stock, the officers will take actions in the best interest of the shareholders. Critics claim executive compensation is often too high in proportion to average salaries at companies and that the compensation levels motivate officers to take selfish actions.

Required: a. Research executive compensation of some well-known companies. (You can find

executive compensation in SEC filings on EDGAR at www.sec.gov or on a vari- ety of Internet sites, such as www.aflcio.org/corporatewatch.) Use your best judg- ment to compute the proportion of executive compensation to average employee salary (i.e., are executives earning 5 times, or 10 times, or 100 times the average employee). In your opinion, are the executives worth it?

b. In your opinion, what are the costs and benefits associated with compensating executives with stock or options to purchase stock?

c. What do you believe are the most effective audit procedures to use to identify executive compensation abuse or fraud? Please explain why.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch12_422-449.indd 449 09/30/15 03:03 PM

Final PDF to printer

mes32502_ch13_450-479.indd 450 09/30/15 03:04 PM

CHAPTER

13 13-1 Develop an understanding of the inventory management

process. 13-2 Be able to identify and describe the types of documents

and records used in the inventory management process. 13-3 Understand the functions in the inventory management

process. 13-4 Know the appropriate segregation of duties for the

inventory management process. 13-5 Be able to identify and evaluate inherent risks relevant to

the inventory management process. 13-6 Know how to assess control risk for the inventory system. 13-7 Know key internal controls and develop relevant tests of

controls for inventory transactions.

13-8 Understand how to relate the assessment of control risk to substantive procedures.

13-9 Be familiar with substantive analytical procedures used to audit inventory and related accounts.

13-10 Know how to audit standard costs. 13-11 Know how to observe physical inventory. 13-12 Be familiar with tests of transactions and tests of details

used to audit inventory and related accounts. 13-13 Understand how to evaluate the audit findings and reach

a final conclusion on inventory and related accounts.

FASB ASC 330, Inventory AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 501, Audit Evidence—Specific Considerations for Selected Items AU-C 505, External Confirmations AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 620, Using the Work of an Auditor’s Specialist PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

451

mes32502_ch13_450-479.indd 451 09/30/15 03:04 PM

Auditing the Inventory Management Process

F or most manufacturing, wholesale, and merchandising (retail) entities, inventory is a major component of the balance sheet. The complex- ity of auditing inventory may be affected by the degree of processing

required to manufacture products. In a merchandising business, products are purchased directly from vendors with little or no additional processing by the entity before sale. In such cases, verifying inventory is relatively straightfor- ward. On the other hand, determining a proper inventory value may be more difficult when the production process involves numerous steps. The presen- tation in this chapter mainly discusses inventory in terms of a merchandising company. However, the audit approach followed for merchandising entities is easily adapted to other types of inventory processes.

The coverage of the inventory management process follows the com- ponents of the audit risk model. An overview of the inventory management process is presented first, followed by discussion of the risk of material mis- statement, specifically inherent risk factors and control risk assessment. While the main focus of this chapter is auditing the inventory management process for a financial statement audit, the concepts covered for setting control risk are applicable to an audit of internal control over financial reporting for public companies. The last part of the chapter discusses the substantive procedures for inventory with particular emphasis on auditing standard costs and observ- ing physical inventory.

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

452 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 452 09/30/15 03:04 PM

The inventory management process is affected by the control activities previously discussed for the revenue, purchasing, and payroll processes. Figure 13–1 shows how each of these processes interacts with the inventory management process. The acquisition of and payment for inventory are controlled via the purchasing process. The cost of both direct and indirect labor assigned to inventory is controlled through the payroll process. Last, finished goods are sold and accounted for as part of the revenue process. Thus, the “cradle-to-grave” cycle for inventory begins when goods are purchased and stored and ends when the finished goods are shipped to customers.

Inventory can represent one of the most complex parts of the audit. For example, while determining the quantity of inventory on hand is usually an easy audit step to complete, assigning costs to value those quantities is more difficult. Additionally, there may be other troublesome valuation issues related to inventory such as obsolescence and lower-of-cost-or- market value.

Exhibit 13–1 describes EarthWear’s inventory system, while Figure 13–2 flowcharts the system. This description and flowchart provide a framework for discussing the control

LO 13-1

Overview of the Inventory Management Process

The Relationship of the Inventory Management Process to Other Accounting Processes

F I G U R E 1 3 – 1

Purchasing process

Human resource management

process

Revenue process

• Purchase of raw materials • Payment of manufacturing overhead costs

• Sale of goods

Inventory management

process

• Assignment of direct and indirect labor costs

Description of EarthWear’s Inventory System*

Clothing and other products sold by EarthWear are developed by the company’s design department. All goods are produced by independent manufacturers, except for most of EarthWear’s soft luggage. The company purchases merchandise from more than 200 domestic and foreign manufacturers. For many major suppliers, goods are ordered and paid for through the company’s electronic data interchange (EDI) system. The computerized inventory control system handles the receipt of shipments from manufacturers. Goods are received at the receiving department, where the information is agreed to the purchase order (receiving report) and entered into the inventory control system.

The company’s sales representatives enter orders into an online order entry and inventory control system; customers using the company’s Internet site complete a computer screen that enters the orders. Computer processing of orders is performed each night on a batch basis, at which time shipping tickets are printed with bar codes for optical scanning. Inventory is picked based on the location of individual products rather than orders, followed by computerized sorting and transporting of goods to multiple pack- ing stations and shipping zones.

*For simplicity of presentation, we have not included inventory processes at EarthWear’s outlet stores.

E X H I B I T 1 3 – 1

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 453

mes32502_ch13_450-479.indd 453 09/30/15 03:04 PM

activities and tests of controls for the inventory management process in more detail. However, because of differences in products and their subsequent processing, the inventory system usu- ally differs from one entity to the next. The reader should concentrate on understanding the basic concepts of internal control. The following topics related to the inventory management process are discussed: ∙ Types of documents and records. ∙ The major functions. ∙ The key segregation of duties.

Types of Documents and Records Table 13–1 lists the more important documents and records that are normally involved in the inventory system. Not all of these documents are presented in Figure 13–2. They are dis- cussed here to give the reader information on documents and records that might exist in an inventory management process of a manufacturing company. The reader should keep in mind that in an IT system some of these documents and records may exist for only a short time or only in digital form.

LO 13-2

Flowchart of the Inventory Management Process—EarthWear ClothiersF I G U R E 1 3 – 2

Production Management Department Inventory Department IT Department

To purchase department

(see purchasing process)

Reviewed

Transfer goods to shipping

department

From purchasing process

Inventory master file

General ledger

master file Purchase order file

Inventory program

From human resource management process

Labor distribution

file

From revenue process

(See Exhibit 13–1)

General ledger

program

General ledger

To General Accounting1

Purchase requisition

Inventory status report

Shipping order

Receiving report

Inventory status report

Input

Prepare production schedule

Documents and Records Included in the Inventory Management Process

Production schedule Production data information Receiving report Cost accumulation and variance report Materials requisition Inventory status report Inventory master file Shipping order

T A B L E 1 3 – 1

Final PDF to printer

454 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 454 09/30/15 03:04 PM

Production Schedule A production schedule is normally prepared periodically based on the expected demand for the entity’s products. The expected demand may be based on the current backlog of orders or on sales forecasts from the sales or marketing department. In EarthWear’s system, this schedule is prepared by the design department. Production sched- ules determine the quantity of goods needed and the time at which goods must be ready in order to meet demand. Many organizations use material requirements planning or just-in-time inventory programs to assist with production planning. Production schedules give the auditor information on the planned level of operating activity.

Receiving Report The receiving report records the receipt of goods from vendors. This document was discussed as part of the purchasing process. It is reconsidered in the inventory management process because a copy of this document accompanies the goods to the inventory department and is used to update the entity’s perpetual inventory records. Note in Figure 13–2 that the data from the receiving report are input into the inventory program to update the inven- tory master file, which contains the information on the entity’s perpetual records.

Materials Requisition Materials requisitions are normally used to track materials during the production process. Materials requisitions are normally prepared by department personnel as needed for production purposes. For example, the materials requisition is the document that authorizes the release of raw materials from the raw materials department. A copy of the materials requisition may be maintained in the raw materials department, and another copy may accompany the goods to the production departments.

Inventory Master File The inventory master file contains all the important information related to the entity’s inventory, including the perpetual inventory records. In sophisticated inventory systems such as EarthWear’s, the inventory master file also contains information on the costs used to value inventory. In a manufacturing company, it would not be unusual for the inventory master file to contain the standard costs used to value the inventory at various stages of production.

Production Data Information In a manufacturing company, production information about the transfer of goods and related cost accumulation at each stage of production should be reported. This information updates the entity’s perpetual inventory system. It is also used as input to generate the cost accumulation and variance report that is produced by the inven- tory system.

Cost Accumulation and Variance Report Most inventory control systems in a manu- facturing setting produce reports similar to a cost accumulation and variance report. Material, labor, and overhead costs are charged to inventory as part of the manufacturing process. The cost accumulation aspect of the report summarizes the various costs charged to departments and products. The variance aspect of the report presents the results of inventory processing in terms of actual costs versus standard or budgeted costs. The cost accounting and manufactur- ing departments review the report for appropriate charges.

Inventory Status Report The inventory status report shows the type and amount of prod- ucts on hand. Such a report is basically a summary of the perpetual inventory records. This report can also be used to determine the status of goods in process.

Shipping Order This document was discussed as part of the revenue process. It is recon- sidered here because a copy of this document is used to remove goods from the entity’s per- petual inventory records. Note in Figure 13–2 that the inventory master file is updated when a receiving report is processed or when a shipping order is generated.

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 455

mes32502_ch13_450-479.indd 455 09/30/15 03:04 PM

The Major Functions Table 13–2 summarizes the functions that normally take place in a typical inventory manage- ment process.

Inventory Management In a manufacturing company, a production management depart- ment would be responsible for managing inventory through planning and scheduling manu- facturing activities. At EarthWear, the inventory management function is performed by the design department. This department is responsible for maintaining inventory at appropriate levels. It issues purchase requisitions to the purchasing department and thus represents the point at which the inventory management process integrates with the purchasing process.

Raw Materials Stores The raw material stores function is responsible for the receipt, cus- tody, and issuance of raw materials. When goods are received from vendors, they are trans- ferred from the receiving department to the raw materials stores department. Once goods arrive in the raw materials storage area, they must be safeguarded against pilferage or unau- thorized use. Finally, when goods are requested for production through the issuance of a mate- rials requisition, this function issues the goods to the appropriate manufacturing department.

Manufacturing The main objective of the manufacturing function is to produce the prod- uct. From an auditing perspective, there must be adequate control over the physical flow of the goods and proper accumulation of the costs attached to inventory. The manner in which costs are accumulated varies substantially from one entity to another. Entities may produce goods using a job order cost system, a process cost system, or some combination of both.

Finished Goods Stores The finished goods stores function is responsible for the storage of and control over finished goods. When goods are completed by the manufacturing function, they are transferred to finished goods stores. Again, there must be adequate safeguards against pilferage or unauthorized use. When goods are ordered by a customer, a shipping order is produced by the revenue process and forwarded to the finished goods stores department. The goods are then transferred to the shipping department for shipment to the customer. Because EarthWear is a merchandising company, it maintains only finished goods (see Figure 13–2).

Cost Accounting Cost accounting is responsible for ensuring that costs are properly attached to inventory as goods are processed through the manufacturing function. Cost accounting reviews the cost accumulation and variance reports after such data are processed into the accounting records.

General Ledger The main objective of the general ledger function is to ensure that all inventory and costs of production are properly accumulated, classified, and summarized in the general ledger accounts. In an IT system, control or summary totals ensure that this func- tion is performed correctly. One important control performed by the general ledger function is the reconciliation of the perpetual inventory records to the general ledger inventory accounts.

LO 13-3

Functions in the Inventory Management Process

Inventory management Authorization of production activity and maintenance of inventory at appropriate levels; issuance of purchase requisitions to the purchasing department (see Chapter 11 on the purchasing process).

Raw materials stores Custody of raw materials and issuance of raw materials to manufacturing departments.

Manufacturing Production of goods. Finished goods stores Custody of finished goods and issuance of goods to the shipping department

(see Chapter 10 on the revenue process). Cost accounting Maintenance of the costs of manufacturing and inventory in cost records. General ledger Proper accumulation, classification, and summarization of inventory and related

costs in the general ledger.

T A B L E 1 3 – 2

Final PDF to printer

456 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 456 09/30/15 03:04 PM

The Key Segregation of Duties Segregation of duties is a particularly important control in the inventory management process because of the potential for theft and fraud. Therefore, individuals involved in the inventory management and inventory stores functions should not have access to the inventory records, the cost-accounting records, or the general ledger. When the inventory accounting records are maintained in an IT environment, there should be proper segregation of duties within the IT department. Table 13–3 shows the key segregation of duties for the inventory management process and examples of possible errors or fraud that can result from conflicts in duties. Table 13–4 shows the proper segregation of duties for individual inventory functions across the various departments that control inventory processing.

Stop and Think: Before reading further, take a look at EarthWear’s flowchart in Figure 13–2 and consider how EarthWear implements segregation of duties.

LO 13-4

Key Segregation of Duties in the Inventory Management Process and Possible Errors or Fraud

Segregation of Duties Possible Errors or Fraud Resulting from Conflicts of Duties

The inventory management function should be seg- regated from the cost-accounting function.

If the individual responsible for inventory management also has access to the cost- accounting records, production and inventory costs can be manipulated. This may lead to an over- or understatement of inventory and net income.

The inventory stores function should be segregated from the cost-accounting function.

If one individual is responsible for both controlling and accounting for inventory, unauthorized shipments can be made or theft of goods can be covered up.

The cost-accounting function should be segregated from the general ledger function.

If one individual is responsible for the inventory records and for the general ledger, it is pos- sible for that individual to conceal unauthorized shipments. This can result in the theft of goods, leading to an overstatement of inventory.

The responsibility for supervising physical inventory should be separated from the inventory manage- ment and inventory stores functions.

If the individual responsible for production management or inventory stores function is also responsible for the physical inventory, it is possible that inventory shortages can be covered up through the adjustment of the inventory records to the physical inventory, resulting in an overstatement of inventory.

T A B L E 1 3 – 3

Segregation of Duties for Inventory Functions by Department

Department

Inventory Function Inventory

Management Raw Materials

Stores Finished Goods

Stores Cost

Accounting IT

Preparation of production schedules X Issuance of materials requisitions that accompany goods

to the manufacturing department X

Updating of cost records with materials, labor, and overhead usage

X X

Updating of inventory records X X Release of goods to the shipping department X Approval and issuance of purchase requisitions X

T A B L E 1 3 – 4

Inherent Risk Assessment

In examining the inventory management process, the auditor needs to consider the inherent risk factors that may affect the transactions processed by the system and the financial state- ment accounts affected by those transactions. The auditor should consider industry-related factors and operating and engagement characteristics (see Chapter 4) when assessing the pos- sibility of a material misstatement.

LO 13-5

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 457

mes32502_ch13_450-479.indd 457 09/30/15 03:04 PM

Industry-Related Factors A number of industry factors may indicate the presence of material misstatements in inven- tory. For example, if industry competition is intense, there may be problems with the proper valuation of inventory in terms of lower-of-cost-or-market values. Changes in technology or a drop in customer demand may also result in a material misstatement due to obsolescence (see Exhibit 13–2).

Engagement and Operating Characteristics A number of engagement and operating characteristics are important to the assessment of inherent risk for inventory. First, the type of product sold by the entity can increase the poten- tial for defalcation. For example, products that are small and of high value, such as jewelry, are more susceptible to theft than large products are. Second, inventory is often difficult to audit, and its valuation may result in disagreements with the entity. Finally, the auditor must be alert to possible related-party transactions for acquiring raw materials and selling the fin- ished product. For example, the entity may purchase raw materials from a company controlled by the chief executive officer at prices in excess of market value. In such a case, the value of inventory will be overstated, and cash will have been misappropriated from the entity.

Audit research has also shown that there is a relatively high risk that inventory contains material misstatements.1 In fact, some of the most notorious accounting frauds in history have involved inventory manipulations. For example, in the 1990s management of Phar-Mor, a dis- count store retail chain, committed a $500 million fraud and much of it had to do with inven- tory accounting. For example, the fraudsters recorded a debit to a fraudulent holding account rather than to cost of goods sold when inventory was sold. Then just before year-end, Phar-Mor accountants emptied the contents of the fraudulent holding account and allocated it to stores as fictitious inventory (see a detailed description of the Phar-Mor fraud and related trial on Connect). Exhibit 13–3 describes the inventory fraud at Centennial Technologies, Inc.

Prior-year misstatements are good indicators of potential misstatements in the current year; thus, auditors should carefully consider if misstatements found in the prior years’ audit may be present in the current inventory and plan the audit accordingly.

1A. Eilifsen and W. F. Messier, Jr., “Auditor Detection of Misstatements: A Review and Integration of Empirical Research,” Journal of Accounting Literature 2000 (19), pp. 1–43.

Huge Surface Write-Down

In 2013 Microsoft shares dropped 11 percent on the news that the company was taking an inventory write- down of nearly $1 billion due to poor adoption of the Microsoft Surface RT tablet; Microsoft’s first PC. The write-down was triggered when Microsoft announced it was knocking $150 off the $500 sales price of the tablet only months after it’s debut. By the 3rd quarter of 2014, Microsoft’s Surface did finally turn a profit, after two years and nearly $2 billion in losses.

Sources: Adrian Covert, “Microsoft Sinks 11% on Earnings Miss and Huge Surface Write-Down,” CNN Money (July 19, 2013); and Gregg Keizer, “Microsoft’s Surface Turns First Profit in 2 years,” Computerworld (October 25, 2014).

E X H I B I T 1 3 – 2

Control Risk Assessment

The auditor may follow a substantive strategy when auditing inventory and cost of goods sold. When this is done, the auditor places no reliance on the control activities in the inven- tory management process and sets the level of control risk at the maximum. The auditor then

LO 13-6

Final PDF to printer

458 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 458 09/30/15 03:04 PM

Inventory Scams at Centennial Technologies

Background Centennial Technologies designed, manufactured, and marketed an extensive line of PC cards: rugged, lightweight, credit card–sized devices inserted into a dedicated slot in a broad range of electronic equipment that contain microprocessors, such as portable computers, telecommunications equipment, and manufacturing equipment. The company’s customer list included companies such as Philips Electron- ics, Sharp Electronics Corporation, and Xerox Corporation.

Emanuel Pinez was the CEO of technology highflier Centennial Technologies, Inc., in the mid-1990s. In 1996, Centennial’s surging stock graduated to the New York Stock Exchange just two years after going public. It finished 1996 as the best-performing stock on the big board, up a stunning 451 percent. Just before the fraud was uncovered, analysts still had “strong buy” recommendations outstanding.

Pinez had an impressive résumé, but it turns out much of it was false. After the scandal broke, investors and the auditors learned what Pinez’s wife knew, that he was a “pathological liar.” For example, as a young man he claimed to have set a world record in an international swimming competition across the English Channel. The reports were published, and Pinez was hailed briefly as a national hero—until the truth came out that there was no such competition or record. Pinez constantly made aggressive estimates regarding Centennial’s growth, and in 1996 he began telling investors that Centennial was negotiating an order worth more than $300 million with AT&T (no such deal ever took place or apparently even existed).

Card Scam Centennial’s growth attracted several sophisticated institutional investors, such as Oppenheimer Funds Inc. and Fidelity Investments. Some investors started to crave a firsthand look at Centennial’s operations. One investor sent an analyst to meet with Pinez and tour the headquarters in Billerica, Massachusetts. Although the analyst noticed some computer equipment in the administrative offices, he was somewhat surprised that there was none in Pinez’s office. During a tour of Centennial’s manufacturing facilities, he saw “a room full of people banging on cards with rubber mallets. I had a bad feeling.” He returned to his firm and “dumped the Centennial shares immediately.”

In truth, Pinez had enlisted a handful of employees in the company’s Billerica manufacturing plant to assemble fake memory cards by simply welding the casings together and leaving out a critical silicon computer chip. These fake cards made their way into inventory and sales.

Flash 98 Scam In the fourth quarter of 1996 Centennial began shipping a new product called “Flash 1998.” It was a miniature memory card for notebook computers. Sales for fiscal year 1996 amounted to about $2 million. The company told the auditors that it wanted to keep the details of the card relatively quiet for a few more months for competitive reasons. Pinez indicated that due to design advances developed by Cen- tennial’s research and development team, these new cards had an extremely low production cost, about 10 cents, with a sales price of a whopping $500. It turns out there was no such product. All sales were to one company, BBC. The company was run by a close personal friend of Pinez. To fool the auditors into thinking an actual sale took place, Pinez wired $1 million of his own personal funds to a third com- pany, St. Jude Management Corp., which then paid Centennial on behalf of BBC for its Flash 98 purchases. After the fraud was uncovered, the auditors, Coopers & Lybrand, claimed that the Flash 98 scam was a “unique” fraud because it appeared that a product was going out and cash was coming in.

Aftermath From his prison cell, Pinez denied any wrongdoing and indicated that his actions were undertaken to benefit the company. Pinez attributed his problems to the scrutiny that inevitably comes with success: “You get lightning when you’re very high.”

Sources: M. Beasley, F. Buckless, S. Glover, and D. Prawitt, Auditing Cases: An Interactive Learning Approach, 6th ed., Prentice Hall, 2015; and J. Auerbach, “How Centennial Technologies, a Hot Stock, Cooled,” The Wall Street Journal (April 11, 1997).

E X H I B I T 1 3 – 3

relies on substantive procedures to determine the fairness of inventory. Such a strategy may be appropriate when internal control is not adequate.

In many cases, however, the auditor can rely on internal control for inventory. This normally occurs when the entity has an integrated cost-accounting/inventory management system. For discussion purposes, we will walk through the major steps in setting control risk assuming that the auditor has decided to follow a reliance strategy. Figure 13–3 sum- marizes the three steps for setting the control risk following this strategy. Each of these steps is only briefly reviewed within the context of the inventory management process because the reader should thoroughly understand the control risk setting process followed by auditors.

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 459

mes32502_ch13_450-479.indd 459 09/30/15 03:04 PM

Understand and Document Internal Control In order to set the control risk for the inventory management process, the auditor must under- stand the internal control components. Two points should be mentioned. First, if the entity uses IT for monitoring the flow of goods and accumulating costs, the auditor will need to evaluate both the general IT controls and the inventory application controls. Second, the audi- tor will need a thorough understanding of the process used by the entity to value inventory.

Plan and Perform Tests of Controls In performing this step, the auditor again must identify the relevant control activities within the entity’s inventory system that ensure that material misstatements are either prevented or detected and corrected. Audit procedures used to test the entity’s control activities in the inventory management process are discussed in subsequent sections.

Set and Document the Control Risk Once the controls in the inventory system have been tested, the auditor sets the level of control risk. The auditor should document the achieved level of control risk using either quantitative amounts or qualitative terms. The documentation supporting the achieved level of control risk for the inventory management process might include a flowchart (such as the one shown in Figure 13–2), the results of the tests of controls, and a memorandum indicating the overall conclusions about control risk.

Major Steps in Setting the Control Risk in the Inventory Management ProcessF I G U R E 1 3 – 3

Understand and document the inventory management process based

on a reliance strategy.

Plan and perform tests of controls on inventory transactions.

Set and document the control risk for the

inventory management process.

Control Activities and Tests of Controls— Inventory Transactions

Table 13–5 provides a summary of the possible misstatements, examples of control activities, and examples of selected tests of controls for inventory transactions. The discussion includes control activities that are present in a manufacturing setting. Because EarthWear is a retailer, the controls over the production process are not relevant. A number of control activities in the revenue and purchasing processes provide assurance for selected assertions for inventory. The discussion that follows is limited to the more important assertions.

LO 13-7

Final PDF to printer

460 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 460 09/30/15 03:04 PM

Summary of Assertions, Possible Misstatements, Example Control Activities, and Example Tests of Controls for Inventory Transactions

Assertion Possible Misstatement Example Control Activity Example Tests of Controls

Occurrence Fictitious inventory

Inventory recorded but not on hand due to theft

Segregation of duties

Inventory transferred to inventory department using an approved, prenumbered receiving report

Inventory transferred to manufacturing using prenumbered materials requisitions

Accounting for numerical sequence of materials requisitions

Physical safeguards over inventory

Observe and evaluate proper segregation of duties

Review and test procedures for the transfer of inventory

Review and test procedures for issuing materials to manufacturing departments

Review and test entity procedures for accounting for numerical sequence of materials requisitions

Observe the physical safeguards over inventory

Completeness Inventory received but not recorded

Consigned goods not properly accounted for

The same as the control activities for completeness in the purchasing process (see Table 11–6)

Procedures to include goods out on consignment and exclude goods held on consignment

The same as the tests of controls performed on the control procedures in the purchasing process (see Table 11–6)

Review and test entity’s procedures for consignment goods

Authorization Unauthorized production activity, resulting in excess levels of inventory

Inventory obsolescence

Preparation and review of authorized purchase or production schedules

Use of material requirements planning and/or just-in-time inventory systems

Review of inventory levels by design department

Review authorized production schedules

Review and test procedures for developing inventory levels and procedures used to control them

Accuracy Inventory quantities recorded incorrectly

Inventory and cost of goods sold not properly costed

Inventory obsolescence

Inventory transactions not posted correctly to the perpetual inventory records or the general ledger

Periodic or annual comparison of goods on hand with amounts shown in perpetual inventory records

Standard costs that are reviewed by management

Review of cost accumulation and variance reports

Inventory management personnel review inventory for obsolete, slow-moving, or excess quantities

Perpetual inventory records reconciled to general ledger control account monthly

Review and test procedures for taking physical inventory

Review and test procedures used to develop standard costs

Review and test cost accumulation and variance reports

Review and test procedures for identify- ing obsolete, slow-moving, or excess quantities

Review the reconciliation of perpetual inventory to general ledger control account

Cutoff Inventory transactions recorded in the wrong period

All receiving reports processed daily by the IT department to record the receipt of inventory

All shipping documents processed daily to record the shipment of finished goods

Review and test procedures for pro- cessing inventory included on receiv- ing reports into the perpetual records

Review and test procedures for remov- ing inventory from perpetual records based on shipment of goods

Classification Inventory transactions not properly classified among raw materials, work in process, and finished goods

Materials requisitions and production data forms used to process goods through manufacturing

Review the procedures and forms used to classify inventory

T A B L E 1 3 – 5

Occurrence of Inventory Transactions The auditor’s main concern is that all recorded inventory transactions actually occurred. The major control activity for preventing fictitious inventory transactions from being recorded is proper segregation of duties, in which the inventory management and inventory stores functions are separated from the departments responsible for inventory and cost-accounting records. This control prevents operating personnel from having access to both inventory and

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 461

mes32502_ch13_450-479.indd 461 09/30/15 03:04 PM

the perpetual inventory records. Additionally, prenumbered documents to handle the receipt, transfer, and withdrawal of inventory may prevent the recording of fictitious inventory in the accounting records.

The auditor should also be concerned that goods may be stolen. The auditor’s concern about theft of goods varies, depending upon the type of product sold or manufactured by the entity. Products that are large or cumbersome may be difficult to steal. However, products that are small and of high value, such as jewelry or computer memory chips, are more susceptible to theft. The entity should maintain physical safeguards over inventory that are consistent with the susceptibility and value of the goods.

Stop and Think: What controls does EarthWear have in place to address the occur- rence assertion? How would you gather audit evidence regarding the effectiveness of these controls?

Review and observation are the main tests of controls used by the auditor to test the control activities shown in Table 13–5. For example, the auditor can observe and evaluate the employees’ segregation of duties. The auditor can also review and test the entity’s procedures for the transfer of raw materials from the receiving department and their issuance to the manu- facturing departments.

Completeness of Inventory Transactions The control activities for the completeness assertion relate to recording inventory that has been received. Typically, the control activities for this assertion are contained within the purchasing process. These control activities and the related tests of controls were presented in Table 11–6 in Chapter 11. For example, in some instances, additional control activities may be used in the raw materials stores department to ensure that the goods are recorded in the perpetual inventory records. This might include comparing a summary of the receiving reports to the inventory status report.

If goods are consigned, the entity must have control activities to ensure that goods held on consignment by other parties are included in inventory and goods held on consignment for others are excluded from inventory. The auditor can review the entity’s procedures for includ- ing or excluding consigned goods.

Authorization of Inventory Transactions The control activities for the purchase of materials were discussed in Chapter 11 on the pur- chasing process. The auditor’s concern with authorization in the inventory system is with unauthorized purchase or production activity that may lead to excess levels of certain types of finished goods. If such goods can quickly become obsolete, ending inventory may be over- stated. The preparation and review of authorized purchase schedules by EarthWear’s design department should prevent such misstatements. The use of some type of inventory-planning system, such as a material requirements planning system or a just-in-time inventory system, may also limit unauthorized production.

Accuracy of Inventory Transactions Accuracy is an important assertion because inventory transactions that are not properly recorded result in misstatements that directly affect the amounts reported in the financial statements for cost of goods sold and inventory. The accurate processing of inventory pur- chase transactions involves applying the correct price to the actual quantity received. Simi- larly, when inventory is shipped, accurate processing requires that the actual number of items shipped be removed from inventory and that the proper cost be recorded to cost of goods sold. The use of a perpetual inventory system in conjunction with a periodic or annual physi- cal inventory count should result in the proper quantities of inventory being shown in the entity’s perpetual inventory records. EarthWear maintains the purchase cost of its products

Final PDF to printer

462 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 462 09/30/15 03:04 PM

in its master inventory file. Many manufacturing companies use standard cost systems to value their inventory. Standard costs should approximate actual costs, and the presence of large variances is one signal that the inventory may not be valued appropriately. Auditing the entity’s physical inventory and standard costs is discussed in more detail later in the chapter.

Management should also have controls in place to consider inventory obsolescence. Inventory management personnel should periodically review inventory on hand for obsolete, slow-moving, or excess inventory. Such inventory should be written down to its fair market value. The auditor can review the entity’s procedures for identifying obsolete, slow-moving, or excess inventory. EarthWear’s design department closely monitors its products to iden- tify any end-of-season merchandise or overstocks, which are then sold at liquidation prices through special catalog inserts.

Cutoff of Inventory Transactions Inventory transactions recorded in the improper period could affect a number of accounts, as illustrated by this simple inventory computation:

Beginning inventory + Purchases – Cost of goods sold = Ending inventory

The cutoff risks, control activities, and tests of controls associated with inventory transac- tions were already addressed in Chapters 10 and 11, since the sale of inventory involves the rev- enue process and purchase of inventory involves the purchasing process. For sold (purchased) inventory, a common test of the entity’s controls to ensure transactions are recorded in a timely manner is to compare the date on the shipping document (receiving report) with the date in the sales journal (payment voucher). There should not be a long period between these two dates. As discussed later, auditors also often focus tests of details on transactions near year-end.

It is important to understand that failure to record inventory in the proper period can result in misstatements on both the balance sheet and income statement. For example, if items shipped FOB–destination point are recorded as sold before they are received by the customer, then revenue, costs of goods sold, and receivables will be overstated and inventory will be understated.

Stop and Think: Considering what you know about EarthWear’s business, how impor- tant do you think the classification assertion is for EarthWear’s inventory compared to inventory at a typical manufacturing company?

Classification of Inventory Transactions Classification is not an important assertion for EarthWear’s inventory because all goods are finished and ready for sale. However, in a manufacturing company, the entity must have con- trol activities to ensure that inventory is properly classified as raw materials, work in process, or finished goods. This can usually be accomplished by determining which departments in the manufacturing process are included in raw materials, work in process, and finished goods inventory. Thus, by knowing which manufacturing department holds the inventory, the entity is able to classify it by type.

Relating the Assessed Level of Control Risk to Substantive Procedures

The same judgment process is followed in setting control risk in the inventory management process that was used with other processes. For example, EarthWear has strong controls over the processing of inventory transactions. The auditor can rely on those controls if tests

LO 13-8

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 463

mes32502_ch13_450-479.indd 463 09/30/15 03:04 PM

of controls indicate that the controls are operating effectively. If the results of the tests of controls for the inventory system do not support the planned level of control risk, the auditor would set control risk higher and set detection risk lower. This would lead to increased sub- stantive procedures.

Auditing Inventory

The discussion of the audit of inventory follows the process outlined in prior chapters. Two categories of substantive procedures are discussed: substantive analytical procedures and tests of details of account balances and disclosures. Table 13–6 presents the assertions for classes of transactions, events, account balances, and disclosures as they apply to inventory. You should note that the auditor may gather evidence about assertions related to transactions (sub- stantive tests of transactions) in conjunction with testing the internal controls. If the tests of controls indicate that the controls are not operating effectively, the auditor may need to test transactions at the date the account balance is tested.

Assertions about Classes of Transactions, Events, Account Balances, and Disclosures for Inventory

Assertions about Classes of Transactions and Events: • Occurrence. Inventory transactions and events are valid. • Completeness. All inventory transactions and events have been recorded. • Authorization. All inventory transactions and events are properly authorized. • Accuracy. Inventory transactions have been properly computed and recorded. • Cutoff. Inventory receipts and shipments are recorded in the correct accounting period. • Classification. Inventory is recorded in the proper accounts (e.g., raw materials, work in process, or finished goods).

Assertions about Account Balances at the Period End: • Existence. Inventory recorded on the books and records actually exists. • Rights and obligations. The entity has the legal right (i.e., ownership) to the recorded inventory. • Completeness. All inventory is recorded. • Valuation and allocation. Inventory is properly recorded in accordance with GAAP (e.g., lower of cost or market).

Assertions about Presentation and Disclosure: • Occurrence and rights and obligations. All disclosed events, transactions, and other matters relating to inventory

have occurred and pertain to the entity. • Completeness. All disclosures relating to inventory that should have been included in the financial statements have

been included. • Classification and understandability. Financial information relating to inventory is appropriately presented and

described, and disclosures are clearly expressed. • Accuracy and valuation. Financial and other information relating to inventory are disclosed fairly and in

appropriate amounts.

T A B L E 1 3 – 6

Practice I N S I G H T

Many companies rely on spreadsheets to reconcile accounts and to derive and support final inven- tory balances that are recorded in the general ledger and financial statements. Companies indicate that they are reluctant to automate processes because they are not convinced that software exists to meet their company’s specific needs. Spreadsheets may include complex calculations with multiple- linked supporting spreadsheets. The importance of the integrity and reliability of the information generated by such spreadsheets increases as the complexity increases from low to high and as usage increases. Every year it seems there is a news article about large spreadsheet errors. The auditor should evaluate the controls over the inventory spreadsheets. Because spreadsheets can be generated by multiple users, can be easily changed, and may lack appropriate controls, the use of spreadsheets can increase inherent risk of misstatement.

Final PDF to printer

464 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 464 09/30/15 03:04 PM

Substantive analytical procedures are useful audit tests for examining the reasonableness of inventory and cost of goods sold. When performed as part of audit planning, preliminary analytical procedures can effectively identify whether the inventory and cost of goods sold accounts contain material misstatements. Final analytical procedures are useful as an over- all review for inventory and related accounts to identify obsolete, slow-moving, and excess inventory. Substantive analytical procedures are useful for obtaining assurance on the valua- tion assertion for inventory. Such procedures can also identify problems with improper inclu- sion or exclusion of costs in overhead.

For example, inventory turnover (cost of goods sold ÷ inventory) can be compared over time or to the industry average.

Stop and Think: From an auditor’s perspective, what questions, concerns, or risks are suggested by the pattern of data below?

LO 13-9

Substantive Analytical Procedures

2013 2014 2015 Industry Average

Inventory (in millions) $14.8 $16.5 $26.3 Inventory Turnover 13 12 9 18

The pattern above of a significant increase in inventory coupled with substantially slower inventory turnover may indicate the presence of slow-moving or obsolete inventory. The auditor would seek an explanation for the pattern from the entity and the auditor may need to revise the audit plan for the physical inventory observation and detail testing over the inventory valuation assertion (inventory observation and detail testing are discussed later in the chapter).

Another common analytical procedure involves the gross profit percentages. The gross profit percentage can also be compared to previous years’ or industry data and may provide valuable evidence on unrecorded inventory (an understatement) or fictitious inventory (an overstatement). This ratio may also provide information on the proper valuation of inventory. For example, a small or negative gross profit margin may indicate issues related to the lower- of-cost-or-market valuation of inventory. It is important that the auditor use sufficiently dis- aggregated analytical procedures in order to identify unusual patterns like the one illustrated in Figure 5–8, in Chapter 5. Table 13–7 lists examples of substantive analytical procedures that are useful in auditing inventory and related accounts at either the planning stage or as an overall review.

Prior to presenting the tests of account balances for inventory, this chapter discusses two significant audit procedures: auditing standard costs and observing physical inventory.

Examples of Substantive Analytical Procedures Used in Testing Inventory and Related Accounts

Example Substantive Analytical Procedure Possible Misstatement Detected

Compare raw material, finished goods, and total inventory turnover to previous years and industry averages

Obsolete, slow-moving, or excess inventory

Compare days outstanding in inventory to previous years and industry average Obsolete, slow-moving, or excess inventory Compare quarterly gross profit percentage by product line with quarterly values in previous

years and industry data Unrecorded or fictitious inventory

Compare actual cost of goods sold to budgeted amounts Over- or understated inventory Compare current-year standard costs with prior years after considering current conditions Over- or understated inventory Compare quarterly actual manufacturing overhead costs with quarterly budgeted or standard

manufacturing overhead costs Inclusion or exclusion of overhead costs

T A B L E 1 3 – 7

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 465

mes32502_ch13_450-479.indd 465 09/30/15 03:04 PM

Many manufacturing entities use a standard cost system to measure performance and to value inventory. If a standard cost system is integrated with the general accounting records, cost accumulation and variance reports are direct outputs of the entity’s inventory-accounting system.

For accuracy and proper valuation, standard costs should approximate actual costs. To test the standard costs, the auditor should first review the entity’s policies and procedures for constructing standard costs. Once the policies and procedures are understood, the audi- tor normally tests the component cost buildup for a representative sample of standard prod- uct costs.

Three components make up the cost of producing a product: materials, labor, and over- head. For discussion purposes, suppose that Calabro Wireless Services assembles five types of wireless devices. Recall that Calabro is a business services company that uses wireless communications technology to develop solutions for businesses (Calabro company back- ground is provided in Chapter 8). Assume further that all parts used in the devices are pur- chased from outside vendors. The process followed in auditing the three components that make up the standard costs for a type of device follows. (Similar auditing techniques would be used for other entities with production processes.)

Materials Determining the materials costs requires examining the quantity and type of materials included in the product and the price of the materials. The quantity and type of materials are tested by reviewing the engineering specifications for the product. For example, in the case of wireless devices, the auditor can obtain a set of engineering specifications that includes a blueprint and a list of materials needed to manufacture a particular device. The auditor can compare the list of materials with the standard cost documentation used to support the cost accumulation. The prices used on the standard cost documentation can be traced to vendors’ invoices as a test of actual costs.

Labor The determination of labor costs requires evidence about the type and amount of labor needed for production and the labor rate. Following our example, the amount of labor necessary to assemble a wireless device can be determined by reviewing engineering estimates, which may be based on time-and-motion studies or on historical information. The labor rates for each type of labor necessary to assemble a device can be tested by examining a schedule of authorized wages. Labor costs included in inventory are often tested in conjunction with payroll expense.

Overhead The auditor gathers evidence regarding overhead costs by reviewing the entity’s method of overhead allocation for reasonableness, compliance with GAAP, and consistency. The audi- tor can examine the costs included in overhead to be sure that such costs can appropriately be assigned to the product. The inclusion or exclusion of such costs should be consistent from one period to the next. Using the wireless device example, the auditor would obtain a listing of expense accounts used to make up the overhead pool of costs. The auditor can compare the actual costs for the period to the budgeted costs. The auditor can also compare the costs included in the current year’s listing with those in the prior year’s listing.

LO 13-10

Auditing Standard Costs

Final PDF to printer

466 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 466 09/30/15 03:04 PM

The auditor’s observation of inventory is a generally accepted auditing procedure. However, the auditor is not required to observe all inventory, but only inventory that is material. Inter- nal auditors may also observe the physical inventory. The primary reason for observing the entity’s physical inventory is to establish the existence of the inventory. The observation of the physical inventory also provides evidence on the accuracy, rights and obligations, and valuation assertions. Based on the physical inventory count, the entity compiles the physical inventory. While the form of compilation may differ among entities, it normally contains a list of the items by type and quantity, the assigned cost for each item, the inventory value for each item, and a total for the inventory.

Prior to the physical count of inventory, the auditor should be familiar with the inventory locations, the major items in inventory, and the entity’s inventory management processes and instructions for counting inventory. During the observation of the physical inventory count, the auditor should do the following:

∙ Ensure that no production is scheduled. If production is scheduled, ensure that proper controls are established for movement between departments in order to prevent double counting.

∙ Ensure that there is no movement of goods during the inventory count. If movement is necessary, the auditor and entity personnel must ensure that the goods are not double counted and that all goods are counted.

∙ Make sure that the entity’s count teams are following the inventory count instructions. If the count teams are not following the instructions, the auditor should notify the entity representative in charge of the area.

∙ Ensure that inventory tags are issued sequentially to individual departments. For many inventory counts, the goods are marked with multicopy inventory tags. The count teams record the type and quantity of inventory on each tag, and one copy of each tag is then used to compile the inventory. If the entity uses another method of counting inventory, such as detailed inventory listings or handheld computers, the auditor should obtain copies of the listings or files prior to the start of the inventory count.

∙ Perform test counts and record a sample of counts in the working papers. This information will be used to evaluate the accuracy and completeness of the entity’s inventory compilation.

∙ Obtain tag control information for testing the entity’s inventory compilation. Tag control information includes documentation of the numerical sequence of all inventory tags and accounting for all used and unused inventory tags. If inventory listings are used by the entity, copies of the listings will accomplish the objective of documenting the entire inventory count.

∙ Obtain cutoff information, including the number of the last shipping and receiving documents issued on the date of the physical inventory count.

∙ Observe the condition of the inventory for items that may be obsolete, slow-moving, or carried in excess quantities.

∙ Inquire about goods held on consignment for others or held on a “bill-and-hold” basis. The auditor must inquire about goods held on consignment (for sale by others) on behalf of the entity. These goods should be included in the inventory count. In some industries, goods are sold on a “bill-and-hold” basis. In cases where revenue recognition requirements are properly met for bill-and-hold sales (i.e., there is a substantial and legitimate business purpose), the goods are treated as a sale, but the entity holds the goods until the customer needs them. The bill-and-hold items should be segregated and not included in the entity’s inventory.

If these audit procedures are followed, the auditor has reasonable assurance that a proper inventory count has been taken.

LO 13-11

Observing Physical Inventory

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 467

mes32502_ch13_450-479.indd 467 09/30/15 03:04 PM

Some companies choose to count their inventory on a cyclical basis throughout the year instead of just once at the end of the year. They may choose to only count part of the ware- house each cycle and ensure that the entire warehouse is counted at least once each year. If the auditor observes one or more of these interim cycle counts, the entity must have a reliable perpetual inventory system so that the auditor can examine activity (on a test basis) between the count date(s) and year-end in order to obtain appropriate evidence about the year-end inventory balance.

Practice I N S I G H T

One of the most effective ways for the auditor to evaluate the possibility of inventory fraud is to physically examine the entity’s inventory when an inventory count is being performed. But even physical examination procedures do not eliminate the risk of misstatement due to fraud, since the entity can perpetrate fraud such as

• obtaining advance notice of the timing and location of the count, which can permit the entity to conceal fictitious inventory at locations not visited;

• stacking empty containers at a warehouse where container contents are not checked during the count;

• falsifying shipping documents to show that inventory is in transit from one company location to another; and

• falsifying documents to show that inventory is located at a public warehouse or other location not controlled by the company.

If the auditor does not properly maintain control of a copy of the entity’s final count sheets to tie into final inventory records, the entity can also fraudulently overstate inventory by

• following the auditor during the count and adding fictitious inventory to items not tested by the auditor or

• entering additional quantities on manual and/or electronic inventory sheets that do not exist or adding a digit in front of the actual count.

Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Table 13–6 presents the assertions for inventory. The intended purpose of substantive tests of transactions is to detect monetary misstatements in the inventory account. The auditor may conduct substantive tests of transactions specifically for inventory. However, because the inventory management process interacts with the revenue, purchasing, and human resource management processes, transactions involving the receipt of goods, shipment of goods, and assignment of labor costs are normally tested as part of those processes. For example, receiv- ing department personnel prepare a receiving report that includes the quantity and type of goods received. The receiving report and vendor invoice are then used to record the accounts payable. If the auditor intends to obtain substantive evidence on the perpetual inventory records, the tests of receipt and shipment of goods can be extended by tracing the transactions into the perpetual inventory records. For example, the receiving report is generally used by the entity to record the goods in the perpetual inventory records or inventory master file (see Figure 13–2). The auditor can perform a substantive test of transactions by tracing a sample of receiving reports into the perpetual inventory records. Labor costs can also be traced to individual inventory transactions and into the cost-accounting records.

As previously mentioned, substantive tests of transactions are often conducted in con- junction with tests of controls. Table 13–8 presents examples of tests of transactions, account balances, and disclosures for assertions related to inventory. The discussion that follows focuses primarily on tests of details of account balances of inventory. Accuracy is the first assertion discussed because the auditor must establish that the detailed records that support the inventory account agree with the general ledger account.

LO 13-12

Final PDF to printer

468 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 468 09/30/15 03:04 PM

Examples of Inventory Tests of Transactions, Account Balances, and Disclosures

Assertions about Classes of Transactions Example Substantive Tests of Transaction*

Occurrence Vouch a sample of inventory additions (i.e., purchases) to receiving reports and purchase requisitions.

Completeness Trace a sample of receiving reports to the inventory records (i.e., master file, status report). Authorization Test a sample of inventory shipments to ensure there are approved shipping tickets and

customer sales. Accuracy Recompute the mathematical accuracy of a sample of inventory transactions

(i.e., price × quantity). Audit standard costs or other methods used to price inventory (see discussion in the

chapter for the audit procedures used to audit standard costs). Trace costs used to price goods in the inventory compilation to standard costs or vendors’

invoices. Cutoff Trace a sample of time cards before and after period end to the appropriate weekly

inventory report, and trace the weekly inventory report to the general ledger to verify inventory transactions are recorded in the proper period.

Classification Examine a sample of inventory checks for proper classification into expense accounts.

Assertions about Account Balances at Period End Example Tests of Details of Account Balances

Existence Observe count of physical inventory (see discussion in chapter for proper inventory observation procedures).

Rights and obligations Verify that inventory held on consignment for others is not included in inventory. Verify that “bill-and-hold” goods are not included in inventory.

Completeness Trace test counts and tag control information to the inventory compilation. Valuation and allocation Obtain a copy of the inventory compilation and agree totals to general ledger.

Trace test counts and tag control information to the inventory compilation. Test mathematical accuracy of extensions and foot the inventory compilation. Inquire of management concerning obsolete, slow-moving, or excess inventory. Review book-to-physical adjustment for possible misstatements (see Table 13–9).

Assertions about Presentation and Disclosure Example Tests of Details of Disclosures

Occurrence, and rights and obligations Inquire of management and review any loan agreements and board of directors’ minutes for any indication that inventory has been pledged or assigned.

Inquire of management about issues related to warranty obligations. Completeness Complete financial reporting checklist to ensure that all financial statement disclosures

related to inventory are made. Classification and understandability Review inventory compilation for proper classification among raw materials, work in

process, and finished goods. Read footnotes to ensure that required disclosures are understandable.

Accuracy and valuation Determine if the cost method is accurately disclosed (e.g., LIFO). Inquire of management about issues related to LIFO liquidations. Read footnotes and other information to ensure that the information is accurate and

properly presented at the appropriate amounts.

*Many of these substantive tests of transactions are commonly conducted as dual-purpose tests (i.e., in conjunction with tests of controls).

T A B L E 1 3 – 8

Accuracy Gathering evidence on the accuracy of inventory requires obtaining a copy of the compilation of the physical inventory that shows inventory quantities and prices.

The inventory compilation is footed, and the mathematical extensions of quantity multi- plied by price are verified. Additionally, test counts made by the auditor during the physical inventory and tag control information are traced into the compilation.

Many times the entity has adjusted the general ledger inventory balance to agree to the physical inventory amounts (referred to as book-to-physical adjustment) before the auditor begins the substantive tests of account balances. If the entity has made the book-to-physical adjustment, the totals from the compilation for inventory should agree with the general ledger.

When the entity maintains a perpetual inventory system, the totals from the inventory compilation should also be agreed to these records. The auditor can use computer-assisted audit techniques to accomplish these audit steps. For example, the auditor can use a generalized

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 469

mes32502_ch13_450-479.indd 469 09/30/15 03:04 PM

or custom audit software package to trace costs used to price goods in the inventory compila- tion to standard cost files. The extensions and footing can also be tested at the same time.

Cutoff In gathering evidence on the cutoff assertion for inventory, the auditor attempts to determine whether all sales of finished goods and purchases of raw materials are recorded in the proper period. For sales cutoff, the auditor can examine a sample of shipping documents for a few days before and after year-end for recording of inventory shipments in the proper period. For purchases cutoff, the auditor can examine a sample of receiving documents for a few days before and after year-end for recording of inventory purchases in the proper period. Chapters 10 and 11 discuss sales and purchases cutoff.

Existence Existence is one of the more important assertions for the inventory account. The observation of the physical inventory is the primary audit step used to verify this assertion. The auditor obtains information regarding existence by observing inventory items in the entity’s ware- house and understanding and testing the entity’s count procedures addressing validity, and through the auditor’s test counts. If the auditor is satisfied with the entity’s physical inventory count, the auditor has sufficient, appropriate evidence on the existence of recorded inventory.

Completeness The auditor must determine whether all inventory has been included in the inventory com- pilation and the general ledger inventory account. The tests related to the observation of the physical inventory count provide assurance that all goods on hand are included in inventory. Observing that count teams have placed count tags on all inventory items provides evidence regarding completeness of the count. Tracing test counts and tag control information into the inventory compilation provide assurance that the inventory counted during the physical inven- tory observation is included in the compilation. In some cases, inventory is held on consign- ment by others or is stored in public warehouses. The auditor normally confirms or physically observes such inventory.

Practice I N S I G H T

Auditors should investigate significant differences between the physical count and detailed per- petual inventory records before the accounting and inventory records are adjusted to match the physical count. Understanding the nature of the significant difference may indicate problems with either the physical count, the perpetual system, or shrinkage (unaccounted reduction in inventory due to theft or damage).

Rights and Obligations The auditor must determine whether the recorded inventory is actually owned by the entity. Two issues related to ownership can arise. First, the auditor must be sure that the inventory on hand belongs to the entity. If the entity holds inventory on consignment, such inventory should not be included in the physical inventory. Second, for goods sold on a “bill-and-hold” basis, the auditor must be certain that such goods are segregated and not counted at the time of the physical inventory (again assuming revenue recognition requirements are properly met for bill-and-hold sales).

Valuation and Allocation A number of important valuation issues are related to inventory. The first issue relates to the costs used to value the inventory items included in the compilation. When an entity, such as EarthWear, purchases inventory, valuation of the inventory can normally be accomplished

Final PDF to printer

470 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 470 09/30/15 03:04 PM

by vouching the costs to vendors’ invoices. When the entity uses standard costs, the audi- tor audits the standard costs as discussed previously. The second valuation issue relates to the lower-of-cost-or-market tests for inventory. The auditor normally performs such tests on large-dollar items or on the entity’s various product lines. At EarthWear, the auditors would likely perform the lower-of-cost-or-market test on merchandise noted by management for liq- uidation. A third valuation issue relates to obsolete, slow-moving, or excess inventory. Inven- tory management personnel should periodically review inventory on hand for slow-moving, excess inventory or inventory that is obsolete. Such inventory should be written down to its fair market value. The auditor can review the entity’s procedures for identifying obsolete, slow-moving, or excess inventory. EarthWear’s design department closely monitors its prod- ucts to identify any end-of-season merchandise or overstocks, which are then sold at liquida- tion prices through special catalog inserts. The auditor should ask management about their procedures to identify obsolete, slow-moving, or excess inventory, and if it is determined that such inventory exists the auditor should determine whether the inventory has been prop- erly written down. Finally, the auditor should investigate any large adjustments between the amount of inventory shown in the general ledger account and the amount determined from the physical inventory count (book-to-physical adjustments) for possible misstatements. Potential reasons for book-to-physical differences include unreported spoilage, cutoff errors, and theft.

Classification and Understandability The presentation and disclosure assertion of classification of inventory for EarthWear is not an issue because the company sells only finished products. However, in a manufacturing company, the auditor must determine that inventory is properly classified as raw materials, work in pro- cess, or finished goods. In most manufacturing companies, proper classification can be achieved by determining which manufacturing processing department has control of the inventory on the date of the physical count. For example, if inventory tags are used to count inventory and they are assigned numerically to departments, classification can be verified at the physical inventory. The auditor can ensure that each department is using the assigned tags. The tag control informa- tion by department can be compared to the information on the inventory compilation to ensure that it is properly classified among raw materials, work in process, and finished goods.

Other Presentation and Disclosure Assertions Several important disclosure issues are related to inventory. Table 13–9 presents some exam- ples of disclosure items for inventory and related accounts. For example, management must disclose the cost method, such as LIFO or FIFO, used to value inventory. Management must also disclose the components (raw materials, work in process, and finished goods) of inven- tory either on the face of the balance sheet or in the footnotes. Finally, if the entity uses LIFO to value inventory and there is a material LIFO liquidation, footnote disclosure is normally required (FASB ASC 330).

Exhibit 13–4 presents EarthWear’s financial statement disclosure for inventory. Note that the company uses LIFO to value inventory, and it discloses the approximate inventory value if FIFO had been used.

Examples of Disclosure Items for Inventory and Related Accounts

Cost method (FIFO, LIFO, retail method) Components of inventory Long-term purchase contracts Consigned inventory Purchases from related parties LIFO liquidations Pledged or assigned inventory Disclosure of unusual losses from write-downs of inventory or losses on long-term purchase commitments Warranty obligations

T A B L E 1 3 – 9

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 471

mes32502_ch13_450-479.indd 471 09/30/15 03:04 PM

When the auditor has completed the planned substantive tests of the inventory account, all the identified misstatements should be aggregated. The likely misstatement is compared to the tolerable misstatement allocated to the inventory account. If the likely misstatement is less than the tolerable misstatement, the auditor may accept the inventory account as fairly pre- sented. Conversely, if the likely misstatement exceeds the tolerable misstatement, the auditor should conclude that the inventory account is not fairly presented.

For example, in Chapter 3, tolerable misstatement was $900,000. Exhibit 3–3 showed that Willis & Adams detected two misstatements in inventory: one that resulted in an over- statement of inventory by $312,500 based on a projection of a sample and one misstate- ment that understated inventory by $227,450 due to inventory in transit. Because neither of these misstatements is greater than the tolerable misstatement, Willis & Adams can conclude that the audit evidence supports fair presentation. However, if these misstatements, either individually or in aggregate, had been greater than the tolerable misstatement, the evidence would not support fair presentation. In this case the auditor would have two choices: adjust the accounts to reduce the misstatement to an amount less than the tolerable misstatement or qualify the audit report.

The auditor should again analyze the misstatements discovered through the application of substantive procedures, because these misstatements may provide additional evidence on the control risk for the inventory management process. If the auditor concludes that the audit risk is unacceptably high, additional audit procedures should be performed, or the auditor must be satisfied that the entity has adjusted the related financial statement accounts to an acceptable level.

LO 13-13

EarthWear’s Financial Statement Disclosure for Inventory

Inventory is stated at the last-in, first-out (LIFO) cost, which is lower than market. If the first-in, first- out method of accounting for inventory had been used, inventory would have been approximately $10.8 million and $13.6 million higher than reported at December 31, 2015 and 2014, respectively.

E X H I B I T 1 3 – 4

Practice I N S I G H T

A large firm PCAOB inspection report identified audit deficiencies in the work performed on inven- tory. The auditor failed to sufficiently test the valuation and existence assertions related to the issuer’s inventory balance. The audit deficiency included failing to test key inputs used in calculating LIFO, failing to perform inventory price testing, and failing to test key assumptions used to calculate the inventory obsolescence reserve (www.pcaob.org).

Evaluating the Audit Findings—Inventory

KEY TERMS

Analytical procedures. Evaluations of financial information made through analysis of plau- sible relationships among both financial and nonfinancial data. Application controls. Controls that apply to the processing of specific computer applications and are part of the computer programs used in the accounting system. Assertions. Expressed or implied representations by management regarding the recognition, measurement, presentation, and disclosure of information in the financial statements and related disclosures. Computer-assisted audit techniques (CAATs). Computer programs that allow auditors to test computer files and databases.

Final PDF to printer

472 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 472 09/30/15 03:04 PM

General controls. Controls that relate to the overall information-processing environment and have a pervasive effect on the entity’s computer operations. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Standard costs. Costs assigned to products based on expected costs, which may differ from actual costs. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of con- trols in preventing, or detecting and correcting, material misstatements at the relevant asser- tion level.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 13-1 13-1 Why does inventory represent one of the more complex parts of the audit? LO 13-1 13-2 How does the inventory management process relate to the revenue, purchasing, and

payroll processes? LO 13-2 13-3 Briefly describe each of the following documents or records: production schedule,

materials requisition, inventory master file, production data information, and cost accumulation and variance report.

LO 13-3 13-4 What duties are performed within the inventory management, raw material stores, and cost-accounting functions?

LO 13-4 13-5 List the key segregation of duties in the inventory management process. What errors or fraud can occur if such segregation of duties is not present?

LO 13-5 13-6 List the inherent risk factors that affect the inventory management process. LO 13-6 13-7 List the three major steps in setting control risk in the inventory management process. LO 13-7 13-8 What control activities can an entity use to prevent unauthorized inventory production? LO 13-9 13-9 List three substantive analytical procedures that can test the fairness of inventory and

related accounts. LO 13-10 13-10 Describe how an auditor audits standard costs. LO 13-11 13-11 List the procedures the auditor should perform during the count of the entity’s physi-

cal inventory. LO 13-12 13-12 What are some possible causes of book-to-physical inventory differences? LO 13-12 13-13 List five items for inventory and related accounts that may require disclosure.

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 13-1, 13-3 13-14 The objectives of internal control for an inventory management process are to pro- vide assurance that transactions are properly authorized and recorded and that

a. Independent internal verification of activity reports is established. b. Transfers to the finished goods department are documented by a completed pro-

duction report and a quality control report. c. Production orders are prenumbered and signed by a supervisor. d. Custody of work in process and finished goods is properly maintained.

LO 13-2, 13-7 13-15 Which of the following control activities would be most likely to assist in reducing the control risk related to the occurrence of inventory transactions?

a. Inventory manager does not have ability to record inventory transactions.

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 473

mes32502_ch13_450-479.indd 473 09/30/15 03:04 PM

b. Summary of the receiving reports is independently compared to the inventory status report.

c. Inventory is periodically reviewed for slow-moving or obsolete items, which may require a write-down.

d. Subsidiary ledgers are periodically reconciled with inventory control accounts.

LO 13-4, 13-7 13-16 Which of the following would most likely be an internal control activity designed to detect errors and fraud concerning the custody of inventory?

a. Periodic reconciliation of work in process with job cost sheets. b. Segregation of functions between general accounting and cost accounting. c. Independent comparisons of finished goods records with counts of goods on

hand. d. Approval of inventory journal entries by the storekeeper.

LO 13-4, 13-7 13-17 Independent internal verification of inventory (i.e., proper segregation of duties) occurs when employees who

a. Issue raw materials obtain materials requisitions for each issue and prepare daily totals of materials issued.

b. Compare records of goods on hand with physical quantities do not maintain the records or have custody of the inventory.

c. Obtain receipts for the transfer of completed work to finished goods prepare a completed production report.

d. Are independent of issuing production orders update records from completed job cost sheets and production cost reports on a timely basis.

LO 13-7 13-18 An auditor’s tests of controls over the issuance of raw materials to production would most likely include

a. Reconciliation of raw materials and work-in-process perpetual inventory records to general ledger balances.

b. Inquiry of the custodian about the procedures followed when defective materials are received from vendors.

c. Observation that raw materials are stored in secure areas and that storeroom secu- rity is supervised by a responsible individual.

d. Examination of materials requisitions and reperformance of entity controls designed to process and record issuances.

LO 13-7 13-19 Which of the following internal control activities is most likely to address the com- pleteness assertion for inventory?

a. The work-in-process account is periodically reconciled with subsidiary records. b. Employees responsible for custody of finished goods do not perform the receiv-

ing function. c. Receiving reports are prenumbered and periodically reconciled. d. There is a separation of duties between payroll department and inventory account-

ing personnel.

LO 13-8, 13-11, 13-20 An entity maintains perpetual inventory records in both quantities and dollars. If the 13-12 level of control risk were set at high, an auditor would probably a. Insist that the entity perform physical counts of inventory items several times dur-

ing the year. b. Apply gross profit tests to ascertain the reasonableness of the physical counts. c. Increase the extent of tests of controls of the inventory system. d. Request that the entity schedule the physical inventory count at the end of the

year.

LO 13-11 13-21 After accounting for a sequence of inventory tags, an auditor traces a sample of tags to the physical inventory listing to obtain evidence that all items

a. Included in the listing have been counted. b. Represented by inventory tags are included in the listing.

Final PDF to printer

474 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 474 09/30/15 03:04 PM

c. Included in the listing are represented by inventory tags. d. Represented by inventory tags are bona fide.

LO 13-11, 13-12 13-22 When auditing merchandise inventory at year-end, the auditor performs a purchase cutoff test to obtain evidence that

a. All goods purchased before year-end are received before the physical inventory count.

b. No goods held on consignment for customers are included in the inventory balance.

c. Goods observed during the physical count are pledged or sold. d. All goods owned at year-end are included in the inventory balance.

LO 13-11, 13-12 13-23 Inquiries of warehouse personnel concerning possibly obsolete or slow-moving inventory items provide assurance about management’s assertion of

a. Completeness. b. Existence. c. Presentation. d. Valuation.

LO 13-11, 13-12 13-24 Periodic or cycle counts of selected inventory items are made at various times during the year rather than via a single inventory count at year-end. Which of the following is necessary if the auditor plans to observe inventory at interim dates?

a. Complete recounts are performed by independent teams. b. Perpetual inventory records are maintained. c. Unit cost records are integrated with production-accounting records. d. Inventory balances are rarely at low levels.

LO 13-12 13-25 An auditor would probably be least interested in which of the following fields in an electronic perpetual inventory file?

a. Economic reorder quantity. b. Warehouse location. c. Date of last purchase. d. Quantity sold.

LO 13-12 13-26 Which of the following audit procedures would probably provide the most reli- able evidence concerning the entity’s assertion of rights and obligations related to inventory?

a. Tracing of test counts noted during the entity’s physical count to the entity’s sum- marization of quantities.

b. Inquiry of management to determine whether there are significant purchase com- mitments that should be considered for disclosure.

c. Selection of the last few shipping advices used before the physical count and determination of whether the shipments were recorded as sales.

d. During physical observation of inventory verify that “bill-and-hold” inventory is segregated and not included in the ending inventory count.

PROBLEMS All applicable problems are available with Connect.

LO 13-1, 13-3, 13-27 Yardley, CPA, prepared the flowchart below, which portrays the raw materials 13-7 purchasing function of one of Yardley’s entities, a medium-size manufacturing com-

pany, from the preparation of initial documents through the vouching of invoices for payment. The flowchart represents a portion of the work performed on the audit engagement to evaluate internal control.

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 475

mes32502_ch13_450-479.indd 475 09/30/15 03:04 PM

Required: Identify and explain the control weaknesses evident from the flowchart. Include the internal control weaknesses resulting from activities performed or not performed. All documents are prenumbered.

(AICPA, adapted)

Date Prepared by Approved by

Medium-Sized Manufacturing Company Flowchart of Raw Materials Purchasing Function

Manufacturing Division Accounts Payable

Controller's DivisionStores Purchasing O�ce Receiving Room

3 By

requisition no.

Purchase requisition

Purchase order

Requisition

{

EXPLANATORY NOTES A • Prepare purchase requisition (3 copies) as needed. B • Prepare purchase order (6 copies). C • Attach purchase requisition to purchase order. D • Merchandise is received and counted, and receiving report (3 copies) is prepared based on count and purchase order. E • Match purchase order, purchase requisition, receiving report, and invoice. F • Prepare voucher after comparing data on purchase order, invoice, and receiving report. G • To cash disbursements in controller's division for payment.

To vendor

By vendor

Receiving report

{

{ 5

Purchase order 3

Invoice

Purchase order

Purchase requisition

By requisition

no.

Purchase order 5

Purchase requisition

Purchase order 1

Purchase requisition

Purchase order

By purchase

order

Purchase requisition

By purchase

order

4 Purchase

order

By vendor

Voucher with

documents

E Invoice

Requisition

From vendor

By purchase

order

Invoice

Purchase order

Receiving report

Requisition 1

{

Purchase

6 Receiving

report 2

Final PDF to printer

476 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 476 09/30/15 03:04 PM

LO 13-1, 13-6, 13-28 Rasch is the partner-in-charge of the audit of Bonner Distributing Corporation, a 13-11, 13-12 wholesaler that owns one warehouse containing 80 percent of its inventory. Rasch

is reviewing the working papers that were prepared to support the firm’s opinion on Bonner’s financial statements, and Rasch wants to be certain that essential audit tests are well documented.

Required: 1. What evidence should Rasch find in the working papers to support the fact that the

audit was adequately planned and the assistants were properly supervised? 2. What substantive tests should Rasch expect to find in the working papers to docu-

ment management’s assertion about completeness as it relates to the inventory quantities at the end of the year?

(AICPA, adapted)

LO 13-11 13-29 Abbott Corporation does not conduct a complete annual physical count of purchased parts and supplies in its principal warehouse but instead uses statistical sampling to estimate the year-end inventory. Abbott maintains a perpetual inventory record of parts and supplies and believes that statistical sampling is highly effective in deter- mining inventory values and is sufficiently reliable to make a physical count of each item of inventory unnecessary.

Required: a. Identify the audit procedures that should be used by the independent auditor that

change, or are in addition to, normal required audit procedures when an entity utilizes statistical sampling to determine inventory value and does not conduct a 100 percent annual physical count of inventory items.

b. List at least 10 normal audit procedures that should be performed to verify physi- cal quantities whenever an entity conducts a periodic physical count of all, or part, of its inventory.

(AICPA, adapted)

LO 13-11, 13-12 13-30 Kachelmeier, CPA, is auditing the financial statements of Big Z Wholesaling, Inc., a continuing audit client, for the year ended January 31, 2015. On January 5, 2015, Kachelmeier observed the tagging and counting of Big Z’s physical inventory and made appropriate test counts. These test counts have been recorded on a computer file. As in prior years, Big Z gave Kachelmeier two computer files. One file repre- sents the perpetual inventory (FIFO) records for the year ended January 31, 2015. The other file represents the January 5 physical inventory count.

Assume that 1. Kachelmeier issued an unqualified opinion on the prior year’s financial statements. 2. All inventory is purchased for resale and located in a single warehouse. 3. Kachelmeier has appropriate computerized audit software. 4. The perpetual inventory file contains the following information in item number

sequence: ∙ Beginning balances at February 1, 2014: item number, item description, total

quantity, and price ∙ For each item purchased during the year: date received, receiving report num-

ber, vendor item number, item description, quantity, and total dollar amount ∙ For each item sold during the year: date shipped, invoice number, item number,

item description, quantity, and dollar amount ∙ For each item adjusted for physical inventory count differences: date, item

number, item description, quantity, and dollar amount 5. The physical inventory file contains the following information in item number

sequence: tag number, item number, item description, and quantity.

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 477

mes32502_ch13_450-479.indd 477 09/30/15 03:04 PM

(AICPA, adapted)

LO 13-12 13-32 In obtaining evidential matter in support of financial statement assertions, the audi- tor develops specific audit procedures to address those assertions.

Required: Hillmart is a retail department store that purchases all goods directly from wholesal- ers or manufacturers. Select the most appropriate audit procedure from the list below and enter the number in the appropriate place on the grid. (An audit procedure may be selected once, more than once, or not at all.)

Required: Describe the substantive auditing procedures Kachelmeier may consider per- forming with computerized audit software using Big Z’s two computer files and Kachelmeier’s computer file of test counts. The substantive auditing procedures described may indicate the reports to be printed out for Kachelmeier’s follow-up by subsequent application of manual procedures. Group the procedures by those using (a) the perpetual inventory file and (b) the physical inventory and test count files. Do not describe subsequent manual auditing procedures.

(AICPA, adapted)

LO 13-11, 13-12 13-31 An auditor is examining the financial statements of a wholesale cosmetics distribu- tor with an inventory consisting of thousands of individual items. The distributor keeps its inventory in its own distribution center and in two public warehouses. An electronic inventory file is maintained on a computer disk, and at the end of each business day the file is updated. Each record of the inventory file contains the fol- lowing data:

∙ Item number. ∙ Location of item. ∙ Description of item. ∙ Quantity on hand. ∙ Cost per item. ∙ Date of last purchase. ∙ Date of last sale. ∙ Quantity sold during year. The auditor plans to observe the distributor’s physical count of inventory as of a

given date. The auditor will have available the inventory file on the date of the physi- cal count and a generalized audit software package.

Required: The auditor is planning to perform basic inventory-auditing procedures. Identify the basic inventory-auditing procedures and describe how the use of the generalized audit software package and the tape of the inventory file data might help the auditor perform such auditing procedures. Organize your answer as follows:

Basic Inventory-Auditing Procedure

How a Generalized Audit Software Package and Tape of the Inventory

File Data Might Be Helpful

1. Observation of the physical count, making and recording test counts where applicable

1. By determining which items are to be test counted by selecting a random sample of a representative number of items from the inventory file as of the date of the physical count?

Final PDF to printer

478 Part 5 Auditing Business Processes

mes32502_ch13_450-479.indd 478 09/30/15 03:04 PM

DISCUSSION CASE

LO 13-9, 13-11, 13-33 Ando Company, a diversified manufacturer, has six divisions that operate throughout 13-12, 13-13 the United States and Puerto Rico. Ando has historically allowed its divisions to

operate autonomously. Ando does not have an internal audit department and cor- porate intervention occurs only when planned results were not obtained. Ando has a policy of hiring competent people. Management is fairly conservative in terms of accounting principles and practices, but employee compensation depends on in large part on performance.

JP Kumar is the general manager of the Appliance Division that produces a vari- ety of appliances. Kumar has been able to improve profitability of the division each of the prior 5 years. Much of the improvement came through cost cutting, including a substantial reduction in control activities over inventory. Recently a new competi- tor has entered the market and has offered substantial price discounts in an effort to grab market share. Kumar is concerned because if profitability is not maintained, his bonus will be reduced.

Kumar decided that the easiest way to make the Appliance Division appear more profitable was through manipulating the inventory, which was the largest asset on the books. Kumar found that by increasing inventory by 4 percent, income could be increased by 8 percent. With the weakness in inventory control, he felt it would be easy to overstate inventory. Employees count the goods using count sheets, and Kumar was able to add two fictitious sheets during the physical inventory, even though the audi- tors were present and were observing the inventory. A significant amount of inventory was stored in racks that filled the warehouse. Because of their height and the diffi- culty of test-counting them, Kumar was able to cover an overstatement of inventory in the upper racks.

After the count was completed, Kumar added four additional count sheets that added $950,000, or 8.6 percent, to the stated inventory. Kumar notified the auditors of the “omission” of the sheets and convinced them that they represented overlooked legitimate inventory.

The auditors traced the items on these additional sheets to purchase invoices to verify their existence and approved the addition of the $950,000 to the inven- tory. They did not notify management about the added sheets. In addition, Kumar

Audit Procedure: 1. Examine current vendor price lists. 2. Review drafts of the financial statements. 3. Select a sample of items during the physical inventory count and determine that

they have been included on count sheets. 4. Select a sample of recorded items and examine supporting vendor invoices and

contracts. 5. Select a sample of recorded items on count sheets during the physical inventory

count and determine that items are on hand. 6. Review loan agreements and minutes of board of directors’ meetings.

Specific Assertion Audit Procedure

a. Ensure that the entity has legal title to inventory (rights and obligations). b. Ensure that recorded inventory quantities include all products on hand

(completeness). c. Verify that inventory has been reduced, when appropriate, to replacement

cost or net realizable value (valuation). d. Verify that the cost of inventory has been properly determined (accuracy). e. Verify that the major categories of inventory and their bases of valuation

are adequately reported in the financial statements (completeness and accuracy and valuation for presentation and disclosure).

Final PDF to printer

Chapter 13 Auditing the Inventory Management Process 479

mes32502_ch13_450-479.indd 479 09/30/15 03:04 PM

altered other count sheets before sending them to the auditors by changing unit des- ignations (for example, “six motor mounts” became six “motors”), raising counts, and adding fictitious line items to completed count sheets. These other fictitious changes added an additional $375,000 to the inflated inventory. None of them was detected by the auditors.

Required: a. What audit procedures did the auditors apparently not follow that should have

detected Kumar’s fraudulent increase of inventory? b. What implications would there be to an auditor of failure to detect material fraud

as described here? c. What responsibility did the auditors have to discuss their concerns with the

entity’s audit committee?

INTERNET ASSIGNMENT

LO 13-7, 13-9, 13-34 Search the SEC’s website (www.sec.gov) or elsewhere on the Internet to identify 13-12, 13-13 a company that has been recently cited by the SEC for financial reporting prob-

lems related to inventory. Prepare a memo summarizing the inventory issues for the company.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch14_480-505.indd 480 09/30/15 03:05 PM

CHAPTER

14 14-1 Know the various types of prepaid expenses and deferred

charges. 14-2 Understand the auditor’s approach to auditing prepaid

insurance. 14-3 Know the various types of intangible assets. 14-4 Understand the auditor’s approach to auditing intangible

assets. 14-5 Develop an understanding of the property management

process. 14-6 Know the types of transactions in the property

management process.

14-7 Be familiar with the inherent risks for property, plant, and equipment.

14-8 Assess control risk for property, plant, and equipment. 14-9 Know the appropriate segregation of duties for property,

plant, and equipment. 14-10 Know the substantive analytical procedures used to audit

property, plant, and equipment. 14-11 Know the tests of details of account balances and

disclosures used to audit property, plant, and equipment. 14-12 Understand how to evaluate audit findings and reach a

final conclusion on property, plant, and equipment.

FASB Statement of Financial Accounting Concepts No. 6, Elements of Financial Statements FASB ASC Topic 350, Intangibles—Goodwill and Other FASB ASC Topic 360, Property, Plant, and Equipment FASB ASC Topic 835, Interest FASB ASC Topic 805, Business Combinations FASB ASC Topic 840, Leases FASB ASC Topic 985, Software AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 620, Using the Work of an Auditor’s Specialist PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230)

PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements PCAOB Auditing Standard No. 8, Audit Risk (AU-200) PCAOB Auditing Standard No. 9, Audit Planning (AU-C 300) PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit (AU-C 320) PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 14, Evaluating Audit Results (AU-C 450) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

481

mes32502_ch14_480-505.indd 481 09/30/15 03:05 PM

Auditing the Financing/Investing Process: Prepaid Expenses, Intangible Assets, and Property, Plant, and Equipment

T his chapter examines the audit of selected asset accounts. Three cat- egories of asset accounts—prepaid expenses, intangibles, and property, plant, and equipment—are used as examples. While the audit approach

taken for each category is similar, differences exist between these three cat- egories of asset accounts. For example, while transactions for all three catego- ries are subject to the control activities in the purchasing process, transactions involving intangible assets or property, plant, and equipment are likely to be subject to additional control activities because of their complexity or material- ity. Additionally, prepaid expenses are normally classified as current assets, while intangibles and property, plant, and equipment are classified as noncur- rent assets.

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

482 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 482 09/30/15 03:05 PM

For many entities, accounts receivable and inventory represent the major current assets included in the financial statements. Also included in most financial statements are accounts that are referred to as other assets. When such assets provide economic benefit for less than a year, they are classified as current assets. A common type of other asset is a prepaid expense. Examples of prepaid expenses include

∙ Prepaid insurance. ∙ Prepaid rent. ∙ Prepaid interest.

One major difference between asset accounts such as accounts receivable or inventory and prepaid expenses is the materiality of the account balances. On many engagements, pre- paid expenses, deferred charges, and intangible assets are not highly material. As a result, substantive analytical procedures are often used to verify these account balances.

LO 14-1

Auditing Prepaid Expenses

Inherent Risk Assessment—Prepaid Expenses

The inherent risk for prepaid expenses such as prepaid insurance would generally be assessed as low because these accounts do not involve any complex or contentious accounting issues. Moreover, misstatements that may have been detected in prior audits would generally be immaterial in amount.

Control Risk Assessment—Prepaid Expenses

Prepaid expenses are typically processed through the purchasing process. Common prepaid expenses include prepaid insurance, prepaid rent, prepaid maintenance or other service, and prepaid interest. The remaining discussion focuses on the prepaid insurance account as an illustration of auditing prepaid expenses because it is encountered on virtually all engage- ments. Prepaid insurance may relate to an insurance policy on a building or equipment. If, for example, the entity borrowed money to purchase equipment, the creditor may have a lien on the equipment (i.e., the equipment is used as collateral for the loan). A lien gives the credi- tor the right to sell the equipment if the entity fails to meet the obligations of a loan contract. When there is a lien on an entity’s building or equipment, the creditor typically requires the entity to carry an insurance policy listing the creditor as the beneficiary (i.e., rightful recipient of insurance proceeds).

Part of the auditor’s assessment of control risk for prepaid insurance transactions is based on the effectiveness of the control activities in the purchasing process. For example, the con- trol activities in the purchasing process should ensure that new insurance policies are properly authorized and recorded.

Additional control activities may be used to control insurance transactions and informa- tion. For example, an insurance register may be maintained as a separate record of all insur- ance policies in force. The insurance register contains important information such as the coverage and expiration date of each policy. This register should be reviewed periodically by an independent person to verify that the entity has insurance coverage consistent with its needs.

The entity also needs to maintain controls over the systematic allocation of prepaid insur- ance to insurance expense. At the end of each month, entity personnel should prepare a journal entry to recognize the expired portion of prepaid insurance. In some cases, entities use esti- mated amounts when recording these journal entries during the year. At the end of the year, the prepaid insurance account is adjusted to reflect the actual amount of unexpired insurance.

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 483

mes32502_ch14_480-505.indd 483 09/30/15 03:05 PM

On many audits the auditor can gather sufficient, appropriate evidence on prepaid insur- ance by performing substantive analytical procedures. Substantive tests of transactions, if performed at all, are conducted as part of testing the purchasing process. Detailed tests of balances of the prepaid insurance balance are typically necessary only when misstatements are expected.

Substantive Analytical Procedures for Prepaid Insurance Because there are generally few transactions in the prepaid insurance account and because the amount reported in the financial statements for prepaid insurance is usually immaterial, sub- stantive analytical procedures are effective for verifying the account balance. The following substantive analytical procedures are commonly used to test prepaid insurance:

∙ Compare the current-year balance in prepaid insurance and insurance expense with the prior years’ balances, taking into account any changes in operations.

∙ Compute the ratio of insurance expense to assets or sales and compare it with the prior years’ ratios.

∙ Compute an estimate of the ending prepaid account balance(s) using the current premium and the amount of time remaining on the policy at the end of the period.

Stop and Think: Using the third technique above, do the ending balances in Exhibit 14–1 appear reasonable?

Applying the third substantive analytical technique listed above to the Fire & Casualty policy, the ending balance of $8,400 appears reasonable ($8,400 = $33,600 × 3/12).

LO 14-2

Substantive Procedures—Prepaid Insurance

Example of an Account Analysis Working Paper for Prepaid InsuranceE X H I B I T 1 4 – 1

G10 DLJ

2/15/16

Insurance Company

Policy

Number

Coverage

Term

Premium

Beginning Balance

1/1/15

Additions

Expense

Ending Balance 12/31/15

Babcock, Inc.C

Evans & SmithC

Nat’l InsuranceC

Total

46-2074

47801-X7

8945-X7

Liability Umbrella Policy

Fire & Casualty

Key Executive Term Life Insurance

1/15/15 1/15/16 3/30/15 3/30/16 9/30/15

9/30/16

$55,000

33,600

15,000

$ 2,100

7,500

11,250

$20,850¶

$ 55,000V

33,600V

15,000V

$103,600

$ 54,800

32,700

15,000

$102,500L

$ 2,300Ψ

8,400Ψ

11,250Ψ

$21,950LF

F = Footed and crossfooted. C = Information agreed to insurance company confirmation. L = Agreed to general ledger. ¶ = Agreed to prior year’s working papers. V = Agreed to insurance company invoice. Ψ = Amount recomputed by auditor.

Reconciliation of insurance expense accounts: Merchandise overhead insurance expense General and administrative overhead insurance expense

Total

$ 69,700L 32,800L

$102,500

EARTHWEAR CLOTHIERS Analysis of Prepaid Insurance

12/31/15

Final PDF to printer

484 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 484 09/30/15 03:05 PM

Tests of Details of the Prepaid Insurance Tests of details of balances for prepaid insurance and insurance expense may be necessary when the auditor suspects misstatements based on prior years’ audits or when substantive analytical procedures indicate that the account balance may be misstated. The auditor begins testing the prepaid insurance account balance by obtaining a schedule from the entity that contains a detailed analysis of the policies included in the prepaid insurance account.

Exhibit 14–1 presents a prepaid insurance schedule for EarthWear Clothiers. The accu- racy and completeness of this schedule are tested by footing it and tracing the ending bal- ance to the prepaid insurance account in the general ledger. The auditor’s work then focuses on testing the existence, completeness, rights and obligations, valuation, and disclosure- classification assertions. No footnote disclosures are generally necessary for prepaid insur- ance. These steps, along with other audit work, are documented in Exhibit 14–1.

Existence and Completeness The auditor can test the existence and completeness of insurance policies included in the account analysis by sending a confirmation to the entity’s insurance brokers, requesting infor- mation on each policy’s number, coverage, expiration date, and premiums. This is an effective and efficient way of obtaining evidence on these two assertions. An alternative approach is examination of the underlying supporting documents such as the insurance bills and poli- cies. The auditor can also obtain evidence regarding completeness by comparing the detailed policies in the current year’s insurance register with the policies included in the prior year’s insurance register.

Rights and Obligations The beneficiary of the policy can be identified by requesting such information on the con- firmations sent to the insurance brokers or by examining the insurance policies. If the ben- eficiary is someone other than the entity, this could indicate an unrecorded liability or that another party has a claim against the insured assets.

Valuation The auditor is concerned with whether the unexpired portion of prepaid insurance, and thus insurance expense, is properly valued. Evidence regarding proper valuation can be easily obtained by recomputing the unexpired portion of insurance after considering the premium paid and the term of the policy. By verifying the unexpired portion of prepaid insurance, the auditor also verifies the total amount of insurance expense. This is shown in Exhibit 14–1.

Classification The auditor’s concern with classification is that the different types of insurance are properly allocated to the various insurance expense accounts. Normally, an examination of the insurance policy’s coverage indicates the nature of the insurance. For example, a fire insurance policy on the main manufacturing and administrative facilities should be charged both to the manufactur- ing overhead insurance expense account and to the general and administrative insurance expense account. Note in Exhibit 14–1 that the various insurance accounts included in the general ledger are reconciled to total insurance expense. One final procedure that the auditor should perform is to ask the entity or its insurance broker about the adequacy of the entity’s insurance coverage.

Auditing Intangible Assets

Intangible assets are assets that provide economic benefit for longer than a year but lack physical substance. The following list includes examples of six general categories of intangible assets: 1. Marketing— trademark, brand name, and Internet domain names.

LO 14-3

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 485

mes32502_ch14_480-505.indd 485 09/30/15 03:05 PM

Inherent Risk Assessment—Intangible Assets

The nature of the judgments involved in accounting for intangible assets raises serious inherent risk considerations. The accounting rules are complex and the transactions are difficult to audit.

Stop and Think: If EarthWear were to acquire another successful clothing company and record goodwill as part of the purchase, how would this change your audit plan and why?

Judgment is required to initially value assets such as trademarks, customer relations, copy- rights, customer order backlogs (i.e., backlogs represent expected future revenue), and good- will when one company acquires another. Both the entity and the auditor often use valuation specialists to assist in determining fair values. Considerable judgment is also required to deter- mine useful lives for patents, copyrights, and order backlogs. Finally, testing asset impairment and determining the amount of impairment loss are complex procedures that involve judg- ment and estimation. Accounting standards (FASB ASC Topic 350) provide the option of using a quantitative or qualitative impairment test annually. The quantitative test involves similar computations as those used to determine fair value. However, the quantitative assess- ment is not necessary unless a qualitative assessment indicates that an asset is more likely than not impaired. In doing the qualitative assessment, the entity considers factors such as

∙ Declining trends in revenues, earnings, or cash flows used to value the intangible asset. ∙ Cost increases that could negatively affect future cash flows used to value the asset. ∙ Legal, regulatory, political, business, industry, competition, demand or other factors

that could negatively affect inputs used to value the asset. ∙ Other events such as general economic downturns or changes in management,

contemplation of bankruptcy, or litigation that could negatively affect inputs used to value the asset.

2. Customer—customer lists, order backlogs, and customer relationships. 3. Artistic—items protected by copyright. 4. Contract—licenses, franchises, and broadcast rights. 5. Technology—patented and unpatented technology. 6. Goodwill—the difference between the acquisition price for a company and the fair

values of the identified tangible and intangible assets.

Accounting standards do not allow companies to record internally generated intangibles as assets on the balance sheet. Rather, intangibles are recorded when the assets are acquired through a purchase or acquisition (FASB ASC Topic 350).1

Some intangible assets are amortized over time, while others like broadcast licenses, trademarks, and goodwill are considered to have indefinite lives and are not amortized. How- ever, all intangibles must be tested for impairment at least annually, as well as on an interim basis. If the test indicates that there has been a decline in the remaining market value of an intangible asset below its net recorded or carrying amount, the asset has been impaired and an impairment expense is recognized in the current period.

1There are some notable exceptions to the general rule that internally generated intangibles are expensed. For exam- ple, once internally developed software has reached the technological feasibility stage, FASB ASC Topic 985 pro- vides separate and specific accounting provisions that allow capitalization of further development costs. Also, legal and administrative fees associated with obtaining a trademark, copyright, or patent can be capitalized. Further discus- sion of these exceptions is beyond the scope of this book.

Final PDF to printer

486 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 486 09/30/15 03:05 PM

Practice I N S I G H T

FASB ASC Topic 350 requires the aggregate amount of goodwill impairment losses from continuing operations to be reported as a separate line item before income from continuing operations. Notice that in order to properly audit an entity’s impairment testing, the auditor needs expertise in both evi- dence evaluation and in financial reporting requirements.

Control Risk Assessment—Intangible Assets

Management is responsible for making the fair value measurements and disclosures and therefore must establish an accounting and reporting process for determining the fair value measures, selecting the appropriate valuation methods, identifying and supporting significant assumptions used, and preparing the valuation and disclosures in accordance with GAAP.

Intangible asset transactions and initial valuation are typically processed through the entity’s business acquisition processes. To rely on controls in this process, the auditor needs to understand, document, and test the design and operating effectiveness of key controls. For public companies that are actively acquiring other companies or that engage in large-scale acquisitions, the business acquisition process would be considered a significant process for the audit of internal controls over financial reporting (see Chapter 7). For example, the control activities in the business acquisition process should ensure that all identifiable asset catego- ries are separately valued and that any valuation specialists used are qualified and objective.

Additional control activities are required for impairment testing. For example, the enti- ty’s policies and procedures should properly capture and evaluate potential events that may trigger impairment (e.g., significant change in market price or in the way the asset is being used), ensure that all intangible assets are tested for impairment at least annually, and verify that the impairment-testing policies and procedures are in compliance with GAAP.

In assessing control risk, the auditor considers factors such as

∙ The expertise and experience of those determining the fair value of the asset. ∙ Controls over the process used to determine fair value measurements, including

controls over data and segregation of duties between those committing the entity to the purchase and those undertaking the valuation.

∙ The extent to which the entity engages or employs valuation specialists. ∙ The significant management assumptions used in determining fair value. ∙ The integrity of change controls and security procedures for valuation models and

relevant information systems, including approval processes.

Substantive Procedures—Intangible Assets

Substantive Analytical Procedures for Intangible Assets While analytical procedures help direct the auditor’s attention to situations needing additional investigation (e.g., potential asset impairment), unlike with prepaids, the principal substan- tive evidence regarding intangible assets is typically obtained via tests of details. Substantive analytical procedures generally are not useful in gathering sufficient, appropriate evidence regarding the assertions of primary interest for intangibles (valuation, existence, complete- ness, rights and obligations, and classification). As such, the discussion below is limited to substantive tests of details.

LO 14-4

Accounting standards require different asset impairment tests for different classes of intan- gible assets (FASB ASC Topic 350). With the judgment and complexity associated with valu- ation and impairment testing of intangible assets, the auditor is likely to assess the inherent risk of significant intangibles as high, particularly if the assets might be impaired.

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 487

mes32502_ch14_480-505.indd 487 09/30/15 03:05 PM

Tests of Details of Intangible Assets Tests of details associated with valuation and impairment of intangible assets are often nec- essary because the complexity and degree of judgment increase the risk of material mis- statement. Further, auditing standards require some substantive evidence for all significant accounts, and, as noted above, substantive analytical procedures are not likely to provide suf- ficient, appropriate evidence for significant transactions involving intangible assets.

Existence and Completeness The auditor normally tests for the existence of intangible assets at the time they are acquired. For assets such as patents, copyrights, licenses, broadcast rights, and trademarks, the auditor would examine legal documentation supporting the validity of the asset. Similarly, customer backlogs can be validated by examining customer order infor- mation or by sending confirmations to customers requesting information on their order status.

The auditor’s primary concern relative to the completeness assertion for intangible assets is to ensure that the entity’s impairment-testing procedures include all intangible assets. To test this assertion, the auditor would obtain a copy of the entity’s detail listing of intangible assets, which should agree with the total amount of intangible assets reported on the entity’s balance sheet. The auditor would also examine the entity’s impairment documentation to ensure that each asset is subject to the appropriate impairment testing in accordance with GAAP.

Valuation2 It should be no surprise that valuation is the most important assertion associated with intangible assets. The initial valuation of assets typically involves an allocation of pur- chase price in proportion to fair values. Once an intangible asset is determined to be impaired, the current fair value must be determined to compute the impairment loss. When there is a market price for the intangible assets, the valuation issues are relatively straightforward. How- ever, in the majority of the situations involving valuation of intangible assets, a readily deter- mined market price is not available. The Advanced Module to Chapter 16 covers four important areas in the auditing of fair value measurements provided in AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures.

Accounting standards describe different acceptable valuation methods, but if a market price is not available, all remaining methods rely heavily on assumptions, likelihood assess- ments, and estimation. With the movement toward more fair value accounting, auditors need improved understanding of valuation issues. However, to obtain sufficient appropriate evi- dence on the valuation of intangible assets (either for initial valuation or after an impairment), the auditor is not required to become an expert in valuation. Rather, the auditor will typically rely on the help of a valuation specialist. When specialists are used to obtain audit evidence, the auditor is required to evaluate the specialist’s qualifications and objectivity. The auditor also must determine if the valuation model used by the specialist is appropriate and consistent with GAAP, and the auditor must understand and verify the reasonableness of the underlying data and assumptions.

In addition to initial valuation and impairment testing, the auditor would also test the rea- sonableness of the useful lives used for amortizing intangible assets that have definite lives. For example, even though a patent may have a legal life of 20 years, if the competitive advan- tages associated with the patent are expected to last only five years, the patent cost should be amortized over a shorter useful life.

2See American Institute of Certified Public Accountants, Auditing Fair Value Measurements and Disclosures: A Tool- kit for Auditors, for detailed guidance on auditing fair value measurements required by FASB ASC Topic 350, 360.

Practice I N S I G H T

During a recent inspection of one of the Big 4 firms, the PCAOB identified deficiencies in the audit of intangible assets. There was no evidence that the audit firm evaluated whether goodwill should have been recorded. In this audit, the entity acquired another company and recorded substantial goodwill despite the fact that it discontinued the established business of the acquired company to start a new, unproven business (www.pcaob.org).

Final PDF to printer

488 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 488 09/30/15 03:05 PM

Rights and Obligations Litigation regarding the rights associated with intangible assets such as trademarks, patents, copyrights, licenses, and Internet domains is relatively common. The auditor normally examines supporting legal and contractual documentation to verify the entity’s legal rights to these assets. The auditor also reads the minutes of board of directors meetings and communicates with the entity’s counsel to determine if there is pending liti- gation regarding legal rights (attorney’s letters are discussed in Chapter 17). As mentioned above, the auditor needs to understand and test the entity’s business acquisition processes as well as the entity’s allocation of purchase price to various intangible assets.

Practice I N S I G H T

Recent examples of impairment losses recorded by public companies include:

• Research In Motion, maker of the Blackberry phone, recognized an impairment of $335 million to write-down the entire carrying value of its goodwill in 2013 due to the competitive challenges to the company’s business and decline in the Company’s market value (Research In Motion Limited’s Form 40-F filed with the SEC March 2013).

• Eastman Kodak Company reported a goodwill impairment of $626 million associated with its Film, Photofinishing, and Entertainment Group (Eastman Kodak’s Form 8-K filed with the SEC February 2011).

Classification The auditor’s concern with classification is that the different types of intan- gible assets are properly identified and are accounted for separately. As with the initial valua- tion, the identification of intangible assets is typically performed at the time an entity acquires another business interest. Multiple intangible assets are typically acquired simultaneously in one purchase.

Auditing the Property Management Process

For most entities, property, plant, and equipment represent a material amount in the finan- cial statements. When the audit is an ongoing engagement, the auditor is able to focus his or her efforts on the current year’s activity because the assets acquired in earlier years were subjected to audit procedures at the time of acquisition. However, on a new engagement the auditor has to verify the assets that make up the beginning balances in the entity’s property, plant, and equipment accounts.

The size of the entity may also affect the auditor’s approach. If the entity is relatively small with few asset purchases during the period, it is generally more cost-effective for the auditor to follow a substantive strategy. Following this strategy, the auditor conducts substan- tive analytical procedures and direct tests of the account balances. Large entities, on the other hand, are likely to have formal procedures for budgeting for and purchasing capital assets. While routine purchases might be processed through the purchasing process, as described in Chapter 11, acquisition or construction of specialized assets may be subject to different requisition and authorization procedures. When a private entity has a formal control system over the property management process, the auditor may choose to follow a reliance strategy and test controls. When the entity is a public company, the entity should have a formal control system and the auditor will test the design and operating effectiveness of key controls as part of the integrated audit.

Types of Transactions Four types of property, plant, and equipment transactions may occur:

∙ Acquisition of capital assets for cash or nonmonetary considerations. ∙ Disposition of capital assets through sale, exchange, retirement, or abandonment. ∙ Depreciation of capital assets over their useful economic life. ∙ Leasing of capital assets.

LO 14-5

LO 14-6

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 489

mes32502_ch14_480-505.indd 489 09/30/15 03:05 PM

Overview of the Property Management Process Larger entities generally use IT systems to process property, plant, and equipment transactions, maintain subsidiary records, and produce required reports. Figure 14–1 presents a flowchart of EarthWear’s accounting system for the property management process. Transactions are periodically entered both from the purchasing process and through direct input into the sys- tem. The property, plant, and equipment master file is then updated, and a number of reports are produced. The periodic report for property, plant, and equipment transactions is reviewed for proper recording by the physical plant department. The property, plant, and equipment subsidiary ledger is a record of all capital assets owned by the entity. It contains information on the cost of the asset, the date acquired, the method of depreciation, and accumulated depre- ciation. The subsidiary ledger also includes the calculation of depreciation expense for both financial statement and income tax purposes. The general ledger is posted to reflect the new property, plant, and equipment transactions and depreciation expense. The subsidiary ledger is reconciled to the general ledger control account monthly.

Flowchart of the Property Management Process—EarthWear ClothiersF I G U R E 1 4 – 1

Specialized PP&E

transactions

General ledger report

PP&E transaction

report

PP&E subledger

PP&E transaction

report

PP&E subledger

Review for proper

recording

Reconcile to general

ledger

PP&E program

General ledger program

Physical Plant Department IT Department

Monthly

From purchasing

process

General ledger

master file

PP&E master

file

PP&E transaction

file

Input

Final PDF to printer

490 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 490 09/30/15 03:05 PM

Misstatements Detected in Prior Audits If the auditor has detected misstatements in prior audits, the assessment of inherent risk should be set higher than if few or no misstatements had been found in the past.3 For example, in prior years the auditor may have found numerous misstatements in the entity’s accumulat- ing costs for valuing self-constructed capital assets. Unless the entity has established new control activities over cost accumulation, the auditor should also expect to find misstatements during the current year’s audit and therefore set inherent risk as high.

3Research has shown that property, plant, and equipment accounts frequently contain misstatements. See A. Eilifsen and W. F. Messier, Jr., “Auditor Detection of Misstatements: A Review and Integration of Empirical Research,” Journal of Accounting Literature 2000 (19), pp. 1–43, for a review of the audit research studies that have indicated that property, plant, and equipment accounts are likely to contain misstatements.

The assessment of inherent risk for the purchasing process provides a starting point for assess- ing inherent risk for property, plant, and equipment. The following three inherent risk factors classified as operating characteristics require consideration by the auditor:

∙ Complex accounting issues. ∙ Difficult-to-audit transactions. ∙ Misstatements detected in prior audits.

Complex Accounting Issues A number of different types of property, plant, and equipment transactions involve com- plex accounting issues. Lease accounting, self-constructed assets, and capitalized interest are examples of such issues. For example, in the case of a lease transaction the auditor must evaluate the entity’s decision either to capitalize the lease or to treat it as an operating lease. Because of the complexity of the capitalization decision and the subjectivity involved in assessing the capitalization criteria, it is not uncommon for such transactions to be accounted for incorrectly by the entity. For example, EarthWear leases store and office space accounted for as operating leases. Willis & Adams must be sure that these leases do not qualify as capital leases.

Difficult-to-Audit Transactions The majority of additions to property, plant, and equipment are relatively easy to audit because they are purchased directly from vendors. For such purchases the auditor is able to obtain evidence for most assertions by examining the source documents. However, transac- tions involving donated assets, nonmonetary exchanges, and self-constructed assets are often difficult to audit. For example, it may be difficult to verify the trade-in value of an asset exchanged or to properly audit the cost accumulation of self-constructed assets. The presence of these types of transactions should lead to a higher inherent risk assessment. It is certainly worth noting that one of the largest accounting frauds in history, WorldCom, involved the improper capitalization of operating expenses as property, plant, and equipment to overstate income. See Exhibit 14–2 for a more detailed description of the company, the fraud, and how the fraud was uncovered.

LO 14-7

Practice I N S I G H T

One way to overstate the net carrying value of plant or equipment is to inappropriately extend the assets’ depreciable life. Waste Management used such an approach to fraudulently boost profits. Management has considerable latitude in choosing a depreciation method. Changes to either the useful lives or depreciation methods should be scrutinized for both their purpose and financial effect.

Inherent Risk Assessment—Property Management Process

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 491

mes32502_ch14_480-505.indd 491 09/30/15 03:05 PM

WorldCom Overstates PP&E and Net Income

WorldCom started as a mom-and-pop long-distance company in 1983. But in the 1990s, it matured into a powerhouse. In 1997 it shocked the industry with an unsolicited bid to take over MCI, a company more than three times its size. In 1998 CFO Magazine named WorldCom’s CFO, Scott Sullivan, one of the coun- try’s best CFOs. At age 37 he was earning $19.3 million a year. In 1999 WorldCom founder Bernie Ebbers moved the company to Clinton, Mississippi, his old college town. The stock price went through the roof. However, by early 2001, overexuberance for the telecom market had created a glut of companies like WorldCom, and earnings started to fall.

In March 2002, Cynthia Cooper, a WorldCom vice president and head of internal audit, was informed by a worried executive in the wireless division that corporate accounting had taken $400 million out of his reserve account and used it to boost WorldCom’s income. When Cooper went to WorldCom’s external auditors, Arthur Andersen, to inquire about the maneuver, she was told matter-of-factly that it was not a problem. When she didn’t relent, Sullivan angrily told Cooper that everything was fine and she should back off. He was furious at her, according to a person involved in the matter. Says Cooper, “When some- one is hostile, my instinct is to find out why.”

As the weeks went on, Cooper directed her team members to widen their net. Having watched the Enron implosion and Andersen’s role in it, she was worried they could not necessarily rely on the account- ing firm’s audits. So the internal auditors decided to reaudit some areas. She and her team began working late into the night, keeping their project secret. In late May, Cooper and her group discovered a gaping hole in the books. In public reports, the company had classified billions of dollars as property, plant, and equipment in 2001, meaning the costs could be stretched out over a number of years into the future. How- ever, these expenditures were for regular fees WorldCom paid to local telephone companies to complete calls and therefore were operating costs, which should be expensed in full each year. It was as if an ordi- nary person had paid his or her phone bills but written down the payments as if he or she were building a long-term asset, like a phone tower, in his or her backyard. The trick allowed WorldCom to turn a loss into a $2.4 billion profit in 2001.

Internal audit began looking for ways to somehow justify what it had found in the books. Finally, the internal auditors confronted WorldCom’s controller, David Myers, who admitted the accounting could not be justified. Within days, the company fired its famed chief financial officer, Scott Sullivan, and told the world that it had inflated its profits by $3.8 billion. After additional investigation, the number grew to over $9 billion, the largest accounting fraud ever up to that date.

Source: Amanda Ripley, “The Night Detective (Persons of the Year),” Time (December 30, 2002–January 6, 2003).

E X H I B I T 1 4 – 2

Control Risk Assessment—Property Management Process

Although auditors typically follow a substantive strategy when auditing the property manage- ment process, an understanding of internal control is still required on all audits, and obviously AS5 also requires design evaluation and testing of operating effectiveness of key controls for significant account balances and processes for public companies. The presentation that fol- lows focuses on the major assertions, key control activities, and tests of controls that relate directly to the property management process. Other control activities related to the property management process were discussed as part of the purchasing process. Important examples of segregation of duties are also presented.

Occurrence and Authorization The control activities for the occurrence and authorization assertions are normally part of the purchasing process. Purchase requisitions are initiated in relevant departments and autho- rized at the appropriate level within the entity. However, large capital asset transactions may be subject to control activities outside the purchasing process. For example, highly spe- cialized technical equipment is likely to be purchased only after passing through a specific

LO 14-8

Final PDF to printer

492 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 492 09/30/15 03:05 PM

capital-budgeting process, which might require that purchase of equipment meet predefined internal rate-of-return criteria. The purchase of equipment may also require that highly skilled engineers approve the technical specifications for the equipment. For such transactions, the auditor may need to examine more than the vendor’s invoice to test validity. A review of addi- tional documentation, such as capital-budgeting documents and engineering specifications, may be needed.

Most entities have some type of authorization table based on the size of capital asset transactions. The entity should have control activities to ensure that the authorization to purchase capital assets is consistent with the authorization table. For example, the con- trol activities should specify dollar limits at each managerial level to ensure that larger projects are brought to the attention of higher levels of management for approval before commitments are made. Lease transactions should be subject to similar control activities. The entity also needs to have control activities for authorizing the sale or other disposition of capital assets. This should include a level of authorization above the department initiat- ing the disposition. Control activities should also identify assets that are no longer used in operations because they may require different accounting treatment. Finally, all major maintenance or improvement transactions should be properly authorized by an appropriate level of management.

Completeness Most entities use software to maintain detailed electronic property records (see Figure 14–1). The property, plant, and equipment subsidiary ledger usually includes the following informa- tion for each capital asset:

∙ Description, location, and ID number. ∙ Date of acquisition and installed cost. ∙ Depreciation methods for book and tax purposes, salvage value, and estimated

useful life.

The control activities used in the purchasing process for ensuring completeness provide some assurance that all capital asset transactions are recorded in the property, plant, and equipment subsidiary ledger and general ledger. One procedure that helps to ensure that this assertion is met is periodic reconciliation of the property, plant, and equipment subsidiary ledger to the general ledger control accounts. Figure 14–1 shows this control activity as it is performed by EarthWear’s physical plant department.

Another control activity that an entity may use to ensure that all capital assets are recorded is periodic comparison of the detailed records in the subsidiary ledger with the existing capi- tal assets. This may be done in a number of ways. The entity may make a complete physical examination of property, plant, and equipment on a periodic or rotating basis and compare the physical assets to the property, plant, and equipment subsidiary ledger. Alternatively, the physical examination may be limited to major capital assets or assets that are subject to loss. In both instances the entity’s internal auditors may test the reliability of the subsidiary ledger. Larger entities sometimes employ outside specialists to physically examine property, plant, and equipment.

Segregation of Duties The existence of adequate segregation of duties for the property management process depends on the volume and significance of the transactions processed. For example, if an entity pur- chases large quantities of machinery and equipment, or if it has large capital projects under construction, it will likely have a formal control process. On the other hand, if an entity has few capital asset purchases, it will generally not have a formal control system over such trans- actions. Table 14–1 shows the key segregation of duties for the property management process and examples of possible errors or fraud that can result from conflicts in duties.

LO 14-9

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 493

mes32502_ch14_480-505.indd 493 09/30/15 03:05 PM

As mentioned earlier, when the number of transactions is small, auditors often follow a sub- stantive strategy when auditing property, plant, and equipment. Therefore, a detailed discus- sion of the substantive procedures for property, plant, and equipment is provided next. The discussion focuses on substantive analytical procedures and tests of details of transactions, account balances, and disclosures.

Substantive Analytical Procedures—Property, Plant, and Equipment The following list provides examples of substantive analytical procedures that can be used in the audit of property, plant, and equipment:

∙ Compare prior-periods’ balances in property, plant, and equipment and depreciation expense with current-period balances, taking into account any changes in conditions or asset composition.

∙ Compute the ratio of depreciation expense to the related property, plant, and equipment accounts and compare to prior years’ ratios.

∙ Compute the ratio of repairs and maintenance expense to the related property, plant, and equipment accounts and compare to prior years’ ratios.

∙ Compute the ratio of insurance expense to the related property, plant, and equipment accounts and compare to prior years’ ratios.

∙ Review capital budgets and compare the amounts spent with amounts budgeted.

Stop and Think: For the first two procedures listed above, pause and consider what potential misstatements these procedures may help identify.

In thinking of possible misstatements that substantive analytical procedures could detect, if, for example, the ratio of depreciation expense to the related property, plant, and equipment accounts is less than prior years’ and few assets have been disposed of, the auditor might be concerned that depreciation has not been taken on some assets included in the account and additional audit procedures would be performed.

LO 14-10

Key Segregation of Duties and Possible Errors or Fraud—Property Management Process

Segregation of Duties Possible Errors or Fraud Resulting from Conflicts of Duties

The function of initiating a capital asset acquisition should be segregated from the final approval function.

If one individual is responsible for initiating a capital asset transaction and has final approval, fictitious or unauthorized purchases of assets can occur. This can result in purchases of unnecessary assets, assets that do not meet the company’s quality control standards, or illegal payments to suppliers or contractors.

The property, plant, and equipment records function should be segregated from the general ledger function.

If one individual is responsible for the property, plant, and equipment records and for the general ledger functions, that individual can conceal any defalcation that would normally be detected by reconciling subsidiary records with the general ledger control account.

The property, plant, and equipment records function should be segregated from the custodial or safe- guarding function.

If one individual is responsible for the property, plant, and equipment records and has custo- dial responsibility for the related assets, tools and equipment can be stolen, and the theft can be concealed by adjustment of the accounting records.

If a periodic physical inventory of property, plant, and equipment is taken, the individual respon- sible for the inventory should be independent of the custodial and record-keeping functions.

If the individual who is responsible for the periodic physical inventory of property, plant, and equipment is also responsible for the custodial and record-keeping functions, theft of the entity’s capital assets can be concealed.

T A B L E 1 4 – 1

Substantive Procedures—Property, Plant, and Equipment

Final PDF to printer

494 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 494 09/30/15 03:05 PM

Tests of Details of Transactions, Account Balances, and Disclosures—Property, Plant, and Equipment Table 14–2 summarizes examples of substantive tests for the property, plant, and equipment accounts for each assertion relating to transactions and balances. The discussion that follows focuses on the major audit procedures conducted by the auditor. Completeness and accuracy are discussed first because the auditor must establish that the detailed property, plant, and equipment records are accurate and agree with the general ledger account.

Completeness and Accuracy The auditor verifies the accuracy of property, plant, and equipment by obtaining a lead schedule and detailed schedules for additions and dispositions of assets. The lead schedule is footed, and the individual accounts are agreed to the general ledger. The detailed schedules are also tested for accuracy. Exhibit 14–3 presents a lead sched- ule for EarthWear’s property, plant, and equipment.

Stop and Think: Take a look at Exhibit 14–3 and ask yourself, “If I were EarthWear’s auditor, where would I focus my tests of details?”

The auditor has some assurance about the completeness assertion from the control activi- ties in the purchasing process and, if present, the additional control activities discussed pre- viously in this chapter. If the auditor still has concerns about the completeness assertion, he or she can physically examine a sample of assets and trace them into the property, plant, and equipment subsidiary ledger. If the assets are included in the subsidiary ledger, the auditor has sufficient evidence supporting the completeness assertion.

A common cause of an understated property, plant, and equipment account is the incor- rect classification of plant and equipment additions as repairs and maintenance (see the Clas- sification assertion in Table 14–2).

LO 14-11

Examples of Tests of Transactions and Account Balances for Property, Plant, and Equipment (PP&E)

Assertions about Classes of Transactions Example Substantive Tests of Transactions*

Occurrence Vouch significant additions and dispositions to vendor invoices or other supporting documentation. Review lease agreements to ensure that lease transactions are accounted for properly.

Completeness Trace a sample of purchase requisitions to loading dock reports and to the PP&E records (i.e., transaction and master file).

Authorization Vouch a sample of PP&E additions to documentation indicating proper authorization. Accuracy For assets written off, test amounts charged against income and accumulated depreciation. Cutoff Examine the purchases and sales of capital assets for a few days before and after year-end. Classification Vouch transactions included in repairs and maintenance for items that should be capitalized.

Review lease transactions for proper classification between operating and capital leases. Existence Verify the existence of major additions by physically inspecting the capital asset. Rights and obligations Examine or confirm deeds or title documents for proof of ownership. Completeness Obtain a lead schedule of property, plant, and equipment; foot schedule and agree totals to the general ledger.

Obtain detailed schedules for additions and dispositions of property, plant, and equipment; foot schedule; agree amounts to totals shown on lead schedule.

Physically examine a sample of capital assets and trace them into the property, plant, and equipment subsidiary ledger.

Valuation and allocation Evaluate fixed assets for significant write-offs or impairments by performing procedures such as • Identify the event or change in circumstance indicating that the carrying value of the asset may not be

recoverable. • Verify impairment loss by determining the sum of expected future cash flows and comparing that sum to the car-

rying value. • Examine the entity’s documentation supporting impairment of write-off. Test depreciation calculations for a sample of capital assets.

*These tests of details of transactions are commonly conducted as dual-purpose tests (i.e., in conjunction with tests of controls).

T A B L E 1 4 – 2

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 495

mes32502_ch14_480-505.indd 495 09/30/15 03:05 PM

A n

E xa

m p

le o

f a

L e

a d

S ch

e d

u le

f o

r P

ro p

e rt

y, P

la n

t, a

n d

E q

u ip

m e

n t

K L

e a

JL J

15 /1

6 d

E X

H I

B I

1 4

– 3

C o

st A

cc u

m u

la te

D e

p re

ci a

ti o

Ac co

un t

W /P

R ef

. Be

gi nn

in g

Ba la

nc e

Ad di

tio ns

D el

et io

ns En

di ng

la nc

e Be

gi nn

in g

la nc

e Ad

di tio

ns D

el et

io ns

En di

Ba la

nc e

La nd

K1 0

6 ,5

93 ,0

00 ¶

$ 2,

11 2,

85 2

$ 1,

78 6,

85 2

$ 6,

91 9,

00 0L

Bu ild

in gs

K2 0

60 ,2

11 ,2

50 ¶

6, 11

2, 60

0 2,

32 4,

95 0

63 ,9

98 ,9

00 L

$ 23

,6 38

,3 00

¶ $

3 ,4

11 ,4

93 $

6 53

,7 88

$ 26

,3 96

,0 05

L Fi

xt ur

es , C

om pu

te rs

, an

d Eq

ui pm

en t

K3 0

11 4,

34 2,

05 0¶

19 ,7

91 ,7

63 1,

63 4,

98 8

$1 32

,4 98

,8 25

L 51

,1 62

,4 50

¶ 8,

28 5,

36 0

1, 53

3, 34

8 57

,9 14

,4 62

L Le

as eh

ol d

Im pr

ov em

en ts

K4 0

2, 89

4, 10

0¶

0, 11

66 4,

59 5

00 9,

62 0L

$ 1

,4 55

,5 00

41 3,

95 2

94 ,0

1 ,6

75 ,4

33 L

To ta

ls $

18 4,

04 0,

40 0

$2 8,

79 7,

33 0

$ 6,

41 1,

38 5

$ 20

6, 42

6, 34

5 $

7 6,

25 6,

25 0

$1 2,

11 0,

80 5

$2 ,3

81 ,1

55 $

8 5,

98 5,

90 0

F F

F =

F oo

te d

an d

cr os

sf oo

te d.

L =

A gr

ee d

to g

en er

al le

dg er

. ¶

= A

gr ee

d to

p rio

r y ea

r’s w

or ki

ng p

ap er

E A

R T

H W

E A

R C

LO T

H IE

R S

a d

S h

e e

t— P

ro p

e rt

y, P

la n

t, a

n d

E q

u ip

m e

n t

12 /3

1/ 2

0 15

Final PDF to printer

496 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 496 09/30/15 03:05 PM

Cutoff On most engagements, cutoff is tested as part of the audit work in accounts pay- able and accrued expenses. By examining a sample of vendor invoices from a few days before and after year-end, the auditor can determine if capital asset transactions are recorded in the proper period. Inquiry of entity personnel and a review of lease transactions for the same period can provide evidence on proper cutoff for leases.

Classification First, the classification of a transaction into the correct property, plant, and equipment account is normally examined as part of the testing of the purchasing process. The auditor’s tests of controls and substantive tests of transactions provide evidence as to the effectiveness of the control activities for this assertion.

Second, the auditor should examine selected expense accounts such as repairs and main- tenance to determine if any capital assets have been incorrectly recorded in these accounts. An account analysis of transactions included in the repairs and maintenance account is obtained, and selected transactions are vouched to supporting documents. In examining the supporting documents, the auditor must determine if the transactions are truly expense items or whether it would be more appropriate to capitalize the costs. For example, the auditor may examine an invoice from a plumbing contractor that shows that the water pipe system for a building has been replaced during the current period. If the amount of this transaction was material and improved the building, it should not be expensed as a repair but rather should be capitalized as a building improvement.

Last, the auditor should examine each material lease agreement to verify that the lease is properly classified as an operating or capital lease.

Stop and Think: Before continuing to read, use your developing audit knowledge to think of ways, beyond physical inspection, to obtain evidence on the existence of prop- erty, plant, and equipment.

Existence To test existence, the auditor obtains a listing of all major additions and vouches them to supporting documents such as vendors’ invoices. If the purchase was properly autho- rized and the asset has been received and placed in service, the transaction is valid. In addi- tion, the auditor may want to verify that assets recorded as capital assets actually exist. For major acquisitions, the auditor may physically examine the capital asset.

Similarly, disposition of assets must be properly authorized, and the supporting docu- mentation such as sales receipts should indicate how the disposal took place. Generally, the auditor obtains a schedule of all major dispositions and verifies that the asset was removed from the property, plant, and equipment records. If the disposition is the result of a sale or exchange, the auditor would verify the cash receipt for the sale of the asset or documentation that another asset was received in exchange.

The auditor must also ascertain the validity of lease transactions by examining the lease agreements entered into by the entity. If the lease agreement is properly authorized and the asset is placed in service, the evidence supports the validity of the recorded asset.

Rights and Obligations The auditor can test for rights or ownership by examining the vendor invoices or other supporting documents. In some instances, the auditor may examine or confirm property deeds or title documents for proof of ownership.

Valuation and Allocation Capital assets are valued at acquisition cost plus any costs nec- essary to make the asset operational. The auditor tests the recorded cost of new assets by examining the vendor invoices and other supporting documents used by the entity to establish the recorded value of the assets. If the entity has material self-constructed assets, the auditor conducts detailed audit work on the construction-in-process account. This includes ensuring that interest is properly capitalized as a cost of the asset.

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 497

mes32502_ch14_480-505.indd 497 09/30/15 03:05 PM

FASB ASC Topic 360, “Property, Plant, and Equipment,” requires that long-lived assets be reviewed for impairment whenever events or changes in circumstances indicate that the assets’ carrying amount may not be recoverable. In reviewing for recoverability, the entity should estimate future (undiscounted) cash flows from use and eventual disposition of the assets. If the sum of those future cash flows is less than the assets’ carrying amount, the assets should be written down to their fair value and a loss recognized. The standards provide guid- ance and illustrations on how to estimate future cash flows, but obviously this area requires substantial judgment and expertise. Typically, the auditor gathers evidence on the valuation of property, plant, and equipment through a variety of procedures (e.g., understanding of the business and industry and current events that may lead to impairment, tests of controls over the entity’s impairment evaluation, inquiry and observation regarding the condition and usefulness of long-lived assets, and tests of details of balances, such as those described in Table 14–2).

The other valuation issue the auditor must address is the recognition of depreciation expense. If the entity uses IT to process and account for capital assets, the auditor may be able to use CAATs to verify the calculation of depreciation for various assets. Alternatively, the auditor may recompute the depreciation expense for a sample of capital assets. In making this calculation, the auditor considers the reasonableness of the estimated life of the asset, the depreciation methods used for book and tax purposes, and any expected salvage value.

Disclosure Issues Table 14–3 shows a number of important items that may require dis- closure as part of the audit of property, plant, and equipment. Some of these disclosures are made in the “summary of significant accounting policies” footnote, while other items may be disclosed in separate footnotes. Exhibit 14–4 is a sample disclosure for an entity’s decision to discontinue operations at one of its operating facilities.

Examples of Items Requiring Disclosure—Property, Plant, and Equipment

Classes of capital assets and valuation bases Depreciation methods and useful lives for financial reporting and tax purposes Nonoperating assets Construction or purchase commitments Liens and mortgages Acquisition or disposal of major operating facilities Capitalized and other lease arrangements

T A B L E 1 4 – 3

Sample Disclosure of Nonoperating Property

In March 2015 the company decided to temporarily idle the Southern Alabama Mill. The decision was made in response to adverse industry conditions, mainly reduced selling prices and increased raw mate- rial costs. In September 2015 it was further determined that because of continued deterioration of selling prices and the level of expenditures required to meet environmental restrictions, the Southern Alabama Mill would not resume operations. The assets of the mill cannot be sold for their historical cost, and in the third quarter the company recorded a $15.6 million loss on the mill.

E X H I B I T 1 4 – 4

Evaluating the Audit Findings—Property, Plant, and Equipment

The process for evaluating the audit findings for property, plant, and equipment is the same as was discussed in previous chapters. The auditor aggregates the likely misstatements and compares this amount to the tolerable misstatement. If the likely misstatement is less than the tolerable misstatement, the evidence indicates that the property, plant, and equipment accounts are not materially misstated. This is the case with EarthWear, as no misstatements were detected for property, plant, and equipment (see Exhibit 3–3).

LO 14-12

Final PDF to printer

498 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 498 09/30/15 03:05 PM

KEY TERMS

Analytical procedures. Evaluations of financial information made through analysis of plau- sible relationships among both financial and nonfinancial data. Auditor specialist. An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor in obtaining sufficient appropriate audit evidence. An auditor’s specialist may be either an audi- tor’s internal specialist (who is a partner or staff, including temporary staff, of the auditor’s firm or a network firm) or an auditor’s external specialist. Intangible asset. An asset that is not physical in nature. Corporate intellectual property (items such as patents, trademarks, copyrights), goodwill, and brand recognition are common intangible assets. Lien. When a creditor or bank has the right to sell the mortgaged or collateral property of those who fail to meet the obligations of a loan contract. Prepaid expense. A type of asset that arises on a balance sheet as a result of a business mak- ing payments for goods and services to be received in the near future. While prepaid expenses are initially recorded as assets, their value is expensed over time as the benefit is received. Property, plant, and equipment (PP&E). An asset that is vital to business operations but cannot be easily liquidated (e.g., warehouse, manufacturing equipment). Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of con- trols in preventing, or detecting and correcting, material misstatements at the relevant asser- tion level. Tests of details of account balances and disclosures. Substantive tests that concentrate on the details of items contained in the account balance and disclosure.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 14-1, 14-2 14-1 Distinguish between prepaid expenses and intangible assets. Give two examples of each.

LO 14-1, 14-3 14-2 Prepaid expenses are generally assessed to have a low inherent risk. Why would intangible assets present serious inherent risk consideration?

LO 14-2 14-3 How does the purchasing process affect prepaid insurance and property, plant, and equipment transactions?

LO 14-2 14-4 Identify two substantive analytical procedures that can be used to audit prepaid insurance.

LO 14-2 14-5 Confirmation is a useful audit procedure for verifying information related to prepaid insurance. What type of information would be requested from an entity’s insurance broker in such a confirmation?

LO 14-3, 14-6 14-6 List four categories of intangible assets and four types of property, plant, and equip- ment transactions.

LO 14-3, 14-7 14-7 Describe two or more factors that the auditor should consider in assessing the inher- ent risk for (a) intangible assets and (b) the property management process.

LO 14-8 14-8 What is a typical control over authorization of capital asset transactions? LO 14-9 14-9 What is one of the key segregation of duties for the property management process?

What errors or fraud can occur if such segregation is not present?

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 499

mes32502_ch14_480-505.indd 499 09/30/15 03:05 PM

LO 14-10 14-10 Identify three substantive analytical procedures that can be used to audit property, plant, and equipment.

LO 14-11 14-11 What procedures would an auditor use to verify the completeness, rights and obliga- tions, and valuation assertions for property, plant, and equipment?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 14-2 14-12 When auditing prepaid insurance, an auditor discovers that the original insurance policy on a key piece of manufacturing equipment is not available for inspection. The policy’s absence most likely indicates the possibility of a(n)

a. Insurance premium due but not recorded. b. Fictitious piece of equipment. c. Third-party lien holder with a secured interest in the equipment. d. Understatement of insurance expense.

LO 14-5, 14-8 14-13 Which of the following internal controls is most likely to justify a reduction of con- trol risk concerning plant and equipment acquisitions?

a. Periodic physical inspection and reconciliation of plant and equipment to the detailed accounting records by the internal audit staff.

b. Comparison of current-year plant and equipment account balances with prior- year actual balances.

c. Review of prenumbered purchase orders to detect unrecorded trade-ins. d. Approval of periodic depreciation entries by a supervisor independent of the

accounting department.

LO 14-5, 14-8 14-14 To strengthen control over the custody of heavy mobile equipment, the entity would most likely institute a policy requiring a periodic

a. Increase in insurance coverage. b. Inspection of equipment and reconciliation with accounting records. c. Verification of liens, pledges, and collateralizations. d. Accounting for work orders.

LO 14-5, 14-8 14-15 Due to a weakness observed in an entity’s control over recording retirement of equip- ment, the auditor may decide to

a. Trace additions to the “other assets” account to search for equipment that is still on hand but no longer being used.

b. Select certain items of equipment from the accounting records and locate them in the plant.

c. Inspect certain items of equipment in the plant and trace those items to the accounting records.

d. Review the subsidiary ledger to ascertain whether depreciation was taken on each item of equipment during the year.

LO 14-5, 14-8, 14-9 14-16 Which of the following procedures is most likely to prevent the improper disposition of equipment?

a. Separation of duties between those authorized to dispose of equipment and those authorized to approve removal work orders.

b. The use of serial numbers to identify equipment that could be sold. c. Periodic comparison of removal work orders to authorizing documentation. d. Periodic analysis of the scrap sales and the repairs and maintenance accounts.

LO 14-5, 14-8, 14-9 14-17 Property acquisitions that are misclassified as maintenance expense would most likely be detected by an internal control system that provides for

a. Investigation of variances within a formal budgeting system.

Final PDF to printer

500 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 500 09/30/15 03:05 PM

b. Review and approval of the monthly depreciation entry by the plant supervisor. c. Segregation of duties of employees in the accounts payable department. d. Examination by the internal auditor of vendor invoices and canceled checks for

property acquisitions.

LO 14-3 14-18 Which of the following situations would not support the auditor’s decision to reduce control risk below maximum for the audit of intangible assets?

a. The entity employs a qualified specialist who reviews the value of the intangible assets on an annual basis for impairment.

b. The auditor documented, tested, and developed an understanding of the acquisi- tion process and found the key controls to be effective.

c. The IT system that maintains the records for intangible assets has adequate con- trols to prevent unauthorized access.

d. The company has made no acquisitions of other companies during the fiscal year under audit.

LO 14-5, 14-8, 14-11 14-19 Which of the following control activities would most likely allow for a reduction in the scope of the auditor’s tests of depreciation expense?

a. Review and approval of the periodic equipment depreciation entry by a supervi- sor who does not actively participate in its preparation.

b. Comparison of equipment account balances for the current year with the current- year budget and prior-year actual balances.

c. Review of the miscellaneous income account for salvage credits and scrap sales of partially depreciated equipment.

d. Authorization of payment of vendor’s invoices by a designated employee who is independent of the equipment-receiving function.

LO 14-8, 14-10, 14-11 14-20 When there are numerous property and equipment transactions during the year, an auditor who plans to set the control risk at a low level usually performs

a. Substantive analytical procedures for property and equipment balances at the end of the year.

b. Tests of controls and extensive tests of property and equipment balances at the end of the year.

c. Substantive analytical procedures for current-year property and equipment transactions.

d. Tests of controls and limited tests of current-year property and equipment transactions.

LO 14-11 14-21 An auditor analyzes repairs and maintenance accounts primarily to obtain evidence in support of the assertion that all

a. Noncapitalizable expenditures for repairs and maintenance have been properly charged to expense.

b. Expenditures for property and equipment have not been charged to expense. c. Noncapitalizable expenditures for repairs and maintenance have been recorded in

the proper period. d. Expenditures for property and equipment have been recorded in the proper

period.

LO 14-11 14-22 Which of the following combinations of procedures would an auditor be most likely to perform to obtain evidence about fixed-asset additions?

a. Inspecting documents and physically examining assets. b. Recomputing calculations and obtaining written management representations. c. Observing operating activities and comparing balances to prior-period balances. d. Confirming ownership and corroborating transactions through inquiries of entity

personnel.

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 501

mes32502_ch14_480-505.indd 501 09/30/15 03:05 PM

PROBLEMS All applicable problems are available with Connect.

LO 14-1, 14-2 14-23 Natherson, CPA, is engaged to audit the financial statements of Lewis Lumber for the year ended December 31. Natherson obtained and documented an understand- ing of internal control relating to the purchasing process and set control risk at the maximum level. Natherson requested and obtained from Lewis a schedule analyzing prepaid insurance as of December 31 and sent confirmation requests to Lewis’ insur- ance broker.

Required: a. Identify two substantive analytical procedures that Natherson could use to verify

prepaid insurance. b. What substantive audit procedures should Natherson conduct on the schedule of

prepaid insurance?

LO 14-3,14-4 14-24 Taylor, CPA, has been engaged to audit the financial statements of Palmer Company, a continuing audit client. Taylor is about to perform substantive audit procedures on Palmer’s goodwill (excess of cost over fair value of net assets purchased) and trade- mark assets that were acquired in prior years’ business combinations. An industry slowdown has occurred recently, and the operations purchased have not met profit expectations.

During the planning process, Taylor determined that there was a high risk that goodwill and the trademark are impaired and may be materially misstated. Taylor obtained an understanding of internal control and set the control risk at the maxi- mum level for the assertions related to intangible assets.

Required: a. Describe the substantive audit procedures Taylor should consider performing in

auditing Palmer’s goodwill and trademark assets. Do not discuss Palmer’s inter- nal controls.

b. If Taylor engages a valuation specialist, describe what the auditor’s responsibility is if the work of the specialist will be used as audit evidence.

LO 14-8, 14-9 14-25 Nakamura, CPA, has accepted an engagement to audit the financial statements of Grant Manufacturing Company, a new client. Grant has an adequate control environ- ment and a reasonable segregation of duties. Nakamura is about to set the control risk for the assertions related to Grant’s property and equipment.

Required: Describe the key internal controls related to Grant’s property, equipment, and related transactions (additions, transfers, major maintenance and repairs, retirements, and dispositions) that Nakamura may consider in setting the control risk.

(AICPA, adapted)

LO 14-6, 14-8, 14-26 Gonzales, CPA, is the auditor for a manufacturing company with a balance sheet that 14-11, 14-12 includes the entry “Property, plant, and equipment.” Gonzales has been asked by

the company’s management if audit adjustments or reclassifications are required for the following material items that have been included in or excluded from “Property, plant, and equipment”:

1. A tract of land was acquired during the year. The land is to be the future site of the entity’s new headquarters, which will be constructed next year. Commis- sions were paid to the real estate agent used to acquire the land, and expenditures

Final PDF to printer

502 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 502 09/30/15 03:05 PM

were made to relocate the previous owner’s equipment. These commissions and expenditures were expensed and are excluded from “Property, plant, and equipment.”

2. Clearing costs were incurred to ready the land for construction. These costs were included in “Property, plant, and equipment.”

3. During the land-clearing process, timber and gravel were recovered and sold. The proceeds from the sale were recorded as other income and are excluded from “Property, plant, and equipment.”

4. A group of machines was purchased under a royalty agreement that provides roy- alty payments based on units of production from the machines. The costs of the machines, freight costs, unloading charges, and royalty payments were capitalized and are included in “Property, plant, and equipment.”

Required: a. Describe the general characteristics of assets, such as land, buildings, improve-

ments, machinery, equipment, fixtures, and so on, that should normally be clas- sified as “Property, plant, and equipment,” and identify assertions in connection with the examination of “Property, plant, and equipment.” Do not discuss specific audit procedures.

b. Indicate whether each of the items numbered 1 to 4 requires one or more audit adjustments or reclassifications, and explain why such adjustments or reclassifi- cations are required or not required. Organize your answer as follows:

Item Number

Is Auditing Adjustment or Reclassification Required?

(Yes or No)

Reasons Why Audit Adjustments or Reclassifications Are Required

or Not Required

(AICPA, adapted)

LO 14-10, 14-11 14-27 To support financial statement assertions, an auditor develops specific substantive procedures to satisfy or address each assertion.

Required: Items (a) through (c) represent assertions for the property and equipment accounts. Select the most appropriate audit procedure from the following list and enter the number in the appropriate place on the grid. (An audit procedure may be selected once or not at all.)

Audit Procedure: 1. Trace opening balances in the summary schedules to the prior year’s audit work-

ing papers. 2. Review the provision for depreciation expense and determine that depreciable

lives and methods used in the current year are consistent with those used in the prior year.

3. Determine that the responsibility for maintaining the property and equip- ment records is segregated from the responsibility for custody of property and equipment.

4. Examine deeds and title insurance certificates. 5. Perform cutoff tests to verify that property and equipment additions are recorded

in the proper period. 6. Determine that property and equipment are adequately insured. 7. Physically examine all major property and equipment additions.

Final PDF to printer

Chapter 14 Auditing the Financing/Investing Process: Various Asset Accounts 503

mes32502_ch14_480-505.indd 503 09/30/15 03:05 PM

Specific Assertion Audit Procedure

a. Verify that the entity has the legal right to property and equipment acquired during the year (rights and obligations).

b. Verify that recorded property and equipment represent assets that actually exist at the balance sheet date (existence).

c. Verify that net property and equipment are properly valued at the balance sheet date (valuation and allocation).

(AICPA, adapted)

LO 14-10, 14-11 14-28 Pierce, an independent auditor, was engaged to examine the financial statements of Wong Construction, Inc., for the year ended December 31. Wong’s financial state- ments reflect a substantial amount of mobile construction equipment used in the firm’s operations. The equipment is accounted for in a subsidiary ledger. Pierce developed an understanding of internal control and set the control risk at moderate.

Required: Identify the substantive audit procedures Pierce should utilize in examining mobile construction equipment and related depreciation in Wong’s financial statements.

(AICPA, adapted)

DISCUSSION CASE

LO 14-11, 14-12 14-29 On January 15, 2015, Leno, Inc., which has a March 31 year-end, entered into a transaction to sell the land and building that contained its manufacturing operations for a total selling price of $19,750,000. The book value of the land and the building was $3,420,000. The final closing was not expected to occur until sometime between July 2016 and March 2017.

On March 16, 2015, Leno, Inc., received an irrevocable letter of credit, issued by a major bank, for $5,000,000, which represented more than 25 percent of the sales price. Leno, Inc., would collect the $5,000,000 and would keep the money even if the buyer decided not to complete the transaction. The letter of credit had an option for an extension for up to one year for a total period of two years. At closing, the entire selling price was to be paid in cash.

Leno, Inc., was going to continue its manufacturing operations in the building and would continue to be responsible for all normal occupancy costs until final closing, when it would move to another location. After the sale, the building would be torn down and replaced by a large office building complex.

Required: a. Based on relevant accounting pronouncements for the sale of real estate, how

should Leno, Inc., account for the transaction at March 31, 2015? b. What additional types of evidence should the auditor examine prior to recogniz-

ing any gain on the transaction?

INTERNET ASSIGNMENTS

LO 14-5, 14-6, 14-11 14-30 Visit the website of another catalog retailer similar to EarthWear Clothiers, and determine what useful lives and depreciation methods are used for property, plant, and equipment. Compare those methods to EarthWear, and, if different, consider the implications for using competitor data for preliminary or substantive analytical procedures. Note that you may have to examine the entity’s annual report or 10-K.

Final PDF to printer

504 Part 5 Auditing Business Processes

mes32502_ch14_480-505.indd 504 09/30/15 03:05 PM

LO 14-5, 14-6, 14-12 14-31 Visit the SEC’s website (www.sec.gov), and identify a company that has been recently cited for problems related to property, plant, and equipment or lease accounting (e.g., in years past, many retail companies had to restate earnings to com- ply with the SEC’s clarification of lease accounting). Prepare a memo summarizing the property, plant, and equipment or lease accounting issues for the company.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch14_480-505.indd 505 09/30/15 03:05 PM

Final PDF to printer

mes32502_ch15_506-527.indd 506 09/30/15 03:08 PM

CHAPTER

15 15-1 Understand the types and features of long-term debt. 15-2 Be familiar with assessing control risk for long-term debt. 15-3 Be familiar with key control activities for long-term debt. 15-4 Know how to conduct substantive audit procedures for

long-term debt. 15-5 Understand the types of stockholders’ equity transactions. 15-6 Be familiar with assessing control risk for stockholders’

equity. 15-7 Be familiar with key control activities for stockholders’

equity.

15-8 Know the appropriate segregation of duties for stockholders’ equity.

15-9 Know how to conduct substantive audit procedures for capital stock.

15-10 Know how to conduct substantive audit procedures for dividends.

15-11 Know how to conduct substantive audit procedures for retained earnings.

15-12 Know how to assess control risk and conduct substantive audit procedures for income statement accounts.

FASB ASC Topic 480, Distinguishing Liabilities from Equity FASB ASC Topic 505, Equity FASB ASC Topic 815, Derivatives and Hedging AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 505, External Confirmations AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 708, Consistency of Financial Statements PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

507

mes32502_ch15_506-527.indd 507 09/30/15 03:08 PM

Auditing the Financing/Investing Process: Long-Term Liabilities, Stockholders’ Equity, and Income Statement Accounts

T his chapter presents the audit of long-term liabilities, stockholders’ equity, and income statement accounts. Long-term debt and equity are the major sources of financing for most entities. A substantive audit strat-

egy is normally followed when long-term liabilities and stockholders’ equity accounts are audited, because although the number of transactions is small, each transaction is often highly material. For public companies required to have an audit of internal control over financial reporting, the auditor would also obtain evidence from tests of controls.

While the main focus of this chapter is auditing the long-term liabilities, stockholders’ equity, and income statement accounts for a financial state- ment audit, the concepts covered for setting control risk are applicable to an audit of internal control over financial reporting. This chapter also covers the audit of selected income statement accounts. The discussion of auditing the income statement focuses on how the auditor’s work on internal control and substantive analytical procedures provide evidence on income statement accounts and how many income statement accounts are audited at the same time as their related balance sheet accounts are audited.

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

508 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 508 09/30/15 03:08 PM

Common types of long-term debt financing include notes, bonds, and mortgages. Capital- ized lease obligations also represent a form of long-term debt. More sophisticated types of debt financing include collateralized mortgage obligations, repurchase and reverse repurchase agreements, interest-rate swaps, financial futures, and a myriad of other financial instru- ments and derivatives (see Exhibit 15–1). Accounting for and auditing such sophisticated debt instruments and financial instruments that have characteristics of both debt and equity can be complex and is beyond the scope of this text. While the concepts relating to the audit of most types of debt are similar, to simplify our discussion we focus on notes and bonds, including the audit of interest payable and interest expense.

Long-term debt may have a number of features that can affect the audit procedures used. For example, debt may be convertible into stock, or it may be combined with warrants, options, or rights that can be exchanged for equity. Debt may be callable under certain con- ditions, or it may require the establishment of a sinking fund, which is a pool of money set aside for repaying the debt or to repurchase a portion of the existing bonds every year. The sinking fund is often held by a bond trustee to ensure that the funds are only used for bond retirement. Finally, debt may be either unsecured or secured by assets of the entity.

The auditor’s consideration of long-term debt, however, is no different from that of any other financial statement account. The auditor must be assured that the amounts shown on the balance sheet for the various types of long-term debt are not materially misstated. This assurance extends to the proper recognition of interest expense relating to long-term debt in the financial statements.

LO 15-1

Auditing Long-Term Debt

Derivatives Lead to Losses at American International Group, Inc.

Derivatives are contracts that are written between two parties. The value of a derivative contract to one of the parties and the cost or obligation to the other is derived from the value of an underlying asset, such as currencies, equities, commodities, mortgages, interest rates, or from stock market or other indicators. While derivatives can be used wisely by management to hedge risk, they can also be used to create lever- age and thereby greatly increase risk.

American International Group, Inc. (AIG) identified a seemingly low-risk method of capitalizing on the housing boom in the mid-2000s. As the boom grew, fresh capital was needed to provide for the increased demand for home mortgages. A significant source of capital was obtained through the selling of pools of mortgages as bonds to investors (mortgages that are grouped and securitized are known as mortgage- backed securities or asset-backed securities). The mortgage holders selling the securitized bonds wanted a form of insurance that would cover their losses in case homeowners were to default on the underlying mortgages. This “insurance” was provided in the form of credit-default swaps (CDSs), which is a derivative contract, consisting basically of a promise to pay the value of the mortgage to the holder of the CDS in case of mortgage default. Many banks and institutions sold and purchased CDSs to hedge their exposure to potential losses on their investments in mortgage-backed securities. However, AIG only sold CDSs, which generated significant fee revenue at seemingly little risk . . . because everyone knows that housing prices always go up . . . well, not quite always, as AIG found out.

AIG’s CDS strategy initially paid off handsomely because mortgage defaults are uncommon when home prices are rapidly appreciating. The problem was that the rapid appreciation in home prices actually represented a speculative “bubble.” When the housing bubble burst and the subprime mortgage mar- ket collapsed, homeowners began defaulting on their mortgages in large numbers, and the value of the mortgage-backed securities plummeted. As the value of the bonds dropped, CDS holders demanded that AIG pay up in accordance with the contract. Because AIG had entered the CDS market in such an aggres- sive manner, the company’s exposure to CDS claims was huge. In 2007 and 2008, AIG recognized $11.47 and $28.6 billion, respectively, in charges related to its CDS portfolio and has survived with the help of a massive cash infusion from the federal government’s Troubled Asset Relief Program (TARP).

Source: AIG 2009 Form 10-K.

E X H I B I T 1 5 – 1

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 509

mes32502_ch15_506-527.indd 509 09/30/15 03:08 PM

Stop and Think: Which assertions will be more important in the audit of long-term debt?

The approach to the audit of long-term debt varies depending on the frequency of the entity’s financing activities. For entities that engage in frequent financing activities, the audi- tor may follow a reliance strategy under which internal control is formally evaluated and tests of controls are performed in order to set control risk. However, for the vast majority of entities where the auditor is not required to test internal controls over financial reporting, it is more efficient for the auditor to follow a substantive strategy and perform a detailed audit of long- term debt and the related interest accounts.

Practice I N S I G H T

It’s important for auditors to consider possible off-balance sheet financing. Such financing contrib- uted to the Enron Corporation accounting fraud. The fraud was revealed in October 2001 and led to the bankruptcy of Enron, a Houston-based energy company, and contributed to the ultimate dissolution of then Big 5 accounting firm Arthur Andersen. Enron had off-balance sheet financing through transactions with “Special Purpose Entities” (now known as Variable Interest Entities, or VIEs). There were legitimate situations for off-balance sheet financing. Enron did not consolidate these companies because the company claimed that the transactions with these VIEs were arm’s- length and complied with the accounting standards at the time. However, in Enron’s case some of the transactions involving VIEs were not arm’s-length because Enron was the underlying guarantor of the debt. In effect, by not consolidating the VIEs, Enron failed to report hundreds of millions in debt. The determination of whether an investment or entity should be consolidated with its parent company should be evaluated and special attention should be given to these inherently complex classes of transactions.

Inherent Risk Assessment—Long-Term Debt

Inherent risk for notes and bonds would normally be assessed as low to moderate because the volume of transactions is low, the accounting is usually not complex, and the entity often receives third-party statements or amortization schedules. However, the amounts involved are usually large, and, as noted in the chapter introduction, the financial markets have devel- oped very sophisticated instruments that can introduce an enormous amount of leverage and that can have characteristics of both debt and equity. The inherent risk associated with these sophisticated instruments is normally high. However, in this chapter we focus on notes and bonds.

Control Risk Assessment—Long-Term Debt

When a substantive strategy is followed, the auditor needs a sufficient understanding of the entity’s internal control system over debt transactions to be able to anticipate the types of mis- statements that may occur. The following discussion of control risk assessment for long-term debt focuses on the general types of control activities that should be present to minimize the likelihood of material misstatement. The assertions that are of primary concern to the auditor are occurrence, authorization, completeness, valuation, and disclosure-classification.

Assertions and Related Control Activities Following are some of the more common controls that should be present for the important assertions for long-term debt.

LO 15-2

LO 15-3

Final PDF to printer

510 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 510 09/30/15 03:08 PM

Occurrence and Authorization The entity should have controls to ensure that any transactions involving long-term financing are properly initiated by authorized individuals. First, adequate documentation must be developed and kept to verify that a note or bond was properly authorized. The presence of adequate documentation, such as a properly signed lending agreement, allows the auditor to determine if the transaction was properly executed. Second, any significant debt commitments should be approved by the board of directors or by executives who have been delegated this authority. Entities that engage in recurring borrowing activities should have both general and specific controls. The board of direc- tors should establish general controls to guide the entity’s financing activities. The specific controls for borrowing and repayment may be delegated to an executive, such as the chief financial officer. When the chief financial officer or similar executive is responsible for both executing and accounting for long-term debt transactions, another executive body, such as the finance committee of the board of directors, should provide overall review and approval in the minutes. If the entity has proper controls and documentation for debt transactions, it is generally easy for the auditor to obtain evidence on occurrence and authorization at the end of the period.

Completeness The entity should maintain detailed records of long-term debt transac- tions to ensure that all borrowings and repayments of principal and interest are recorded. One approach to handling detailed debt transactions is to maintain a subsidiary ledger that con- tains information about all the long-term debt owed by the entity. The debt amount recorded in the subsidiary ledger should be reconciled to the general ledger control account regularly.

Valuation Note and bond transactions are recorded in the accounting records at their face value plus or minus any premium or discount. Premiums or discounts should be amortized using the effective interest method1 to calculate interest expense. Sometimes an entity incurs “issuing costs” such as underwriter’s fees, legal fees, and accounting fees. Such costs should be recorded as deferred charges and amortized over the life of the debt. Valuation issues for sophisticated financial instruments are far more complex. Although the entity should have control activities to ensure that long-term debt is properly valued, outside specialists are often consulted.

Disclosure-Classification Controls should ensure that the proper disclosures are pro- vided for long-term debt. Common disclosures involve related-party transactions, restrictive debt covenants, and revolving lines of credit. Controls should also ensure that notes and bonds are properly classified in the financial statements. The major issue is that controls are in place to ensure that the portion of long-term debt that is due within the next year is properly classi- fied as a short-term liability.

One final issue related to control risk for long-term debt is that the entity should have adequate custodial procedures for any unissued notes or bonds to safeguard against loss from theft. Procedures should provide for periodic inspections by an individual who is independent of both the custodial and accounting responsibilities for long-term debt.

1The effective interest rate method amortizes the bond discount as interest expense each period over the life of the bond. The discount and additional interest expense are computed based on the market rate when the bond is issued.

Practice I N S I G H T

The completeness assertion can be difficult to test because it is inherently difficult to answer the question “what hasn’t been recorded?” Thus, it is particularly important that the auditor use a top- down approach when obtaining evidence on the completeness assertion for liabilities. The auditor must evaluate the incentives, pressures, and tone at the top to assess the potential threat for omitted liabilities. Too much focus on transaction-level control activities, to the exclusion of assessing the bigger picture, increases the risk that the auditor will get an inflated sense of comfort and assurance regarding the completeness of the reported liabilities.

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 511

mes32502_ch15_506-527.indd 511 09/30/15 03:08 PM

A substantive strategy for auditing long-term debt involves examining any new debt agreements, determining the status of prior debt agreements, and confirming balances and other relevant information with outside parties (debt agreements for bonds are called bond or trust indentures).

Substantive analytical procedures are useful in auditing interest expense because of the direct relationship between long-term debt and interest expense. For example, the auditor could estimate interest expense by multiplying the 12 monthly balances for long-term debt by the average monthly interest rate. The reasonableness of recorded interest expense could then be assessed by comparing this estimate to the interest expense amount recorded in the general ledger. If the two amounts are not materially different, the auditor can conclude that interest expense is fairly stated. If the estimated amount of interest expense is materially higher than the recorded amount, the auditor might conclude that the entity has failed to record a portion of interest expense. On the other hand, if the recorded amount of interest expense is materially higher than the estimated amount, the entity may have failed to record debt. Refer to Chapter 5 for an example of the use of a substantive analytical procedure to test the relationship between EarthWear’s short-term line of credit and related interest expense.

Table 15–1 provides examples of tests of transactions and account balances for the key assertions of long-term debt. The following discussion will help you understand the general approach to auditing long-term debt.

LO 15-4

EarthWear Substantive Procedures—Long-Term Debt

Examples of Tests of Transactions and Account Balances for Long-Term Debt

Assertions about Classes of Transactions Example Substantive Tests of Transactions*

Occurrence Examine copies of new note or bond agreements. Examine board of directors’ minutes for approval of new lending agreements.

Completeness Trace large cash receipts and payments to source documents and general ledger (see Chapters 11 and 16).

Review interest expense for payments to debt holders not listed on the debt analysis schedule. Review notes paid or renewed after the balance sheet date to determine if there are unrecorded

liabilities at year-end. Evaluate lease contracts to determine if leases are properly accounted for as an operating or capital

lease (i.e., if a lease should be a capital lease, it would likely require recognition of long-term debt). Authorization Examine board minutes for evidence of proper authorization of notes or bonds. Accuracy Test a sample of receipts and payments. Cutoff Review debt activity for a few days before and after year-end to determine if the transactions are

included in the proper period. Classification Examine the due dates on notes or bonds for proper classification between current and

long-term debt.

Assertions about Account Balances at Period End Example Tests of Details of Account Balances

Existence Confirm notes or bonds directly with creditors (in many instances, creditors are banks, insurance companies, or trustees representing the creditors).

Rights and obligations Examine copies of note and bond agreements. Completeness Obtain an analysis of notes payable, bonds payable, and accrued interest payable; foot schedule

and agree totals to the general ledger. Obtain a standard bank confirmation that requests specific information on notes from banks (see

Chapter 16 for further discussion of bank confirmations). Confirm notes or bonds with creditors. Inquire of management regarding the existence of off-balance sheet activities. Review board meeting minutes for debt-related activity.

Valuation and allocation Examine new debt agreements (e.g., bond indentures) to ensure that they were recorded at the proper value.

Confirm the outstanding balance for notes or bonds and the last date on which interest has been paid.

Recompute accrued interest payable. Verify computation of the amortization of premium or discount.

*These substantive tests of transactions are commonly conducted as dual-purpose tests (i.e., in conjunction with tests of controls).

T A B L E 1 5 – 1

Final PDF to printer

512 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 512 09/30/15 03:08 PM

The auditor generally begins the audit of long-term debt by obtaining an analysis sched- ule for notes payable, bonds payable, and accrued interest payable. Exhibit 15–2 presents an example of such a schedule. Because EarthWear does not have long-term debt, the example in Exhibit 15–2 is based on Calabro Wireless Services. If there are numerous transactions during the year, this schedule may include only the debt outstanding at the end of the period. Note that this schedule includes a considerable amount of information on each debt transac- tion, including the payee, date due, interest rate, original amount, collateral, and paid and accrued interest.

Exhibit 15–2 also indicates the audit procedures performed on the details of the debt schedule.

Stop and Think: Take a break from reading for a moment and look at the tick mark descriptions in Exhibit 15–2 and see if you can identify the assertion each procedure is addressing.

Evidence is gathered for the most important assertions as follows. Each debt instrument is confirmed with the debt holders and includes a request to verify the amount owed and last date on which interest has been paid.2 Confirmation of the debt and accrued interest provides evidence on the existence, completeness, and valuation assertions. If the entity’s debt is guar- anteed by another party, a confirmation should be sent to the guarantor to confirm the guarantee.

The auditor also examines the due dates for the debt to ensure proper classification between current and long-term liabilities. Last, the auditor examines the debt agreements for any restrictive covenants that require disclosure in the footnotes. Examples of such covenants include restrictions on the payment of dividends or the issuance of additional debt or equity, and the maintenance of certain financial ratios. Exhibit 15–3 provides an example of the dis- closure of restrictive covenants.

2The debt instrument can also be confirmed with the bond trustee, which is a financial institution given fiduciary powers by the debt holder to enforce the terms of the debt instrument. The trustee ensures that interest payments are made on time.

Auditing Stockholders’ Equity

For most entities, stockholders’ equity includes common stock, preferred stock, paid-in capital, and retained earnings. In recent years, numerous financial instruments have been developed that contain both debt and equity characteristics and that affect the audit of stock- holders’ equity. A host of stock option and compensation plans also impact the audit of stockholders’ equity. A discussion of these complex equity instruments and stock option plans is beyond the scope of this text (share-based compensation is discussed in the Advanced Module to Chapter 12).

Following are the three major types of transactions that occur in stockholders’ equity:

∙ Issuance of stock. This includes transactions such as sale of stock for cash; the exchange of stock for assets, services, or convertible debt; and issuance of stock in stock splits.

∙ Repurchase of stock. This includes the reacquisition of stock (referred to as treasury stock) and the retirement of stock.

∙ Payment of dividends. This includes the payment of cash dividends or issuance of stock dividends.

LO 15-5

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 513

mes32502_ch15_506-527.indd 513 09/30/15 03:08 PM

A n

a ly

si s

S ch

e d

u le

f o

r A

u d

it in

g L

o n

g -T

e rm

D e

b t

a n

d A

cc ru

e d

In te

re st

P a

ya b

le E

X H

I B

I T

5 –

P 10

D LJ

1/ 2

/1 6

Lo n

g -T

e rm

D e

b t

A cc

ru e

d In

te re

st P

a ya

b le

Pa ye

e D

ue D

at e

Fa ce

ou nt

Se cu

rit y

Be gi

nn in

Ba la

nc e

Ad di

tio ns

Pa ym

en ts

En di

Ba la

nc e

Be gi

nn in

g Ba

la nc

e Ex

pe ns

es Pa

id En

di ng

la nc

Fi rs

t N at

io na

l B an

k—

Li ne

o f c

re di

t 11

/1 /1

8 $

7, 00

0, 00

0 Al

l a ss

et sC

$ 2

00 ,0

00 $9

00 ,0

00 $3

00 ,0

00 Y

80 0,

00 0

$ 1

,8 75

$ 2

2, 50

0λ $

2 2,

81 5

$ 1

,5 60

8. 75

% le

as e

ob lig

at io

Pa tr

io t I

ns ur

an ce

C o.

12 /1

5/ 17

$ 2,

00 0,

00 0

C om

m un

ic at

io ns

ui pm

en tC

23 8,

63 7

48 ,2

30 Y

19 0,

40 7

5, 47

0 17

,5 41

λ 18

,4 61

4, 55

7% b

on ds

p ay

ab le

—

Al l A

m er

ic an

In su

ra nc

e 6/

30 /2

0 $1

0, 00

0 La

nd a

bu ild

in gs

C 3,

10 0,

00 0

20 0,

00 0Y

2, 90

0, 00

0 36

,8 50

22 4,

60 2λ

21 9,

82 0

41 ,6

To ta

l $3

,5 38

,6 37

$9 00

,0 00

$5 48

,2 30

$3 ,8

90 ,4

07 L

$4 4,

19 5

$2 64

,6 43

L $2

61 ,0

96 $4

7, 74

F F

Le ss

c ur

re nt

p or

tio n

of lo

ng -t

er m

d eb

4 24

,0 61

✓

$3 ,4

66 ,3

L =

A gr

ee d

to g

en er

al le

dg er

. Y

= T

ra ce

d pa

ym en

ts to

c as

h di

sb ur

se m

en ts

jo ur

na l.

λ =

R ec

om pu

te d

in te

re st

e xp

en se

. C

= A

gr ee

d al

l i nf

or m

at io

n to

c on

fir m

at io

n. F

= F

oo te

d. ✓

= T

es te

d am

ou nt

o f c

ur re

nt p

or tio

n of

lo ng

-t er

m d

eb t.

C A

LA B

R O

W IR

E LE

S S

S E

R V

IC E

S ch

e d

u le

o f

Lo n

g -T

e rm

D e

b t

a n

d A

cc ru

e d

In te

re st

P a

ya b

12 /3

1/ 15

Final PDF to printer

514 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 514 09/30/15 03:08 PM

Control Risk Assessment—Stockholders’ Equity

A substantive strategy is most often used to audit stockholders’ equity because the number of transactions is usually small and often the value is large. Although control risk can then be set at the maximum, the auditor must still understand the types of controls that are in place to prevent the misstatement of equity transactions. Further, the auditor must test the design and operating effectiveness of key controls over stockholders’ equity if the entity is a public company required to have an audit of internal controls over financial reporting.

Many large entities, such as publicly traded companies, use an independent registrar, transfer agent, and dividend-disbursing agent to process and record equity transactions. The registrar is responsible for ensuring that all stock issued complies with the corporate char- ter and for maintaining the control totals for total shares outstanding. The transfer agent is responsible for preparing stock certificates and maintaining adequate stockholders’ records. The dividend-disbursing agent prepares and mails dividend checks to the stockholders of record. When an entity uses an independent registrar, transfer agent, and dividend-disbursing agent, the auditor may be able to obtain sufficient evidence about stockholders’ equity by confirming the relevant information with those parties.

If an entity uses its own employees to perform the stock transfer and dividend disburse- ment functions, the auditor will need to understand and may test internal controls over stock and dividend transactions and the auditor will likely perform more detailed testing of the stock and dividend-related records and transactions. Next we’ll discuss the assertions, control activities, and segregation of duties that are relevant when entity personnel transfer stock and disburse dividends.

Assertions and Related Control Activities Following are the major evidence-gathering procedures and assertions for stockholders’ equity:

∙ Verify that stock and dividend transactions are valid and comply with the corporate charter (occurrence).

∙ Verify that all stock and dividend transactions have been properly posted and summarized in the accounting records (accuracy).

∙ Verify that stock and dividend transactions have been properly approved (authorization).

∙ Verify that stock and dividend transactions have been properly valued (valuation).

Occurrence One of the entity’s officers, such as the corporate secretary or legal counsel, should ensure that every stock or dividend transaction complies with the corporate charter or any regulatory requirement that affects the entity. This individual should also maintain the stockholders’ ledger, which contains the name of each stockholder and the number of shares held by that shareholder.

LO 15-6

LO 15-7

Sample Disclosure of Restrictive Loan Covenants

Our Credit Agreement with the bank contains customary negative covenants and financial covenants, including negative covenants that restrict the Company’s ability to: incur additional indebtedness, includ- ing guarantees; create, incur, assume or permit to exist liens on property and assets; declare or pay divi- dends and make distributions; enter into mergers and acquisitions; enter into sale-leaseback transactions; make optional prepayments of certain indebtedness; or, execute modifications to material contracts. The financial covenants include maintaining a Consolidated Interest Coverage Ratio, as defined, not less than 1 to 1 as of December 31, 2015. Management believes that the Company is in compliance with all cov- enants at December 31, 2015.

E X H I B I T 1 5 – 3

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 515

mes32502_ch15_506-527.indd 515 09/30/15 03:08 PM

Accuracy The control activities for this assertion include reconciliation of the stockhold- ers’ records with the number of shares outstanding and reconciliation of dividends paid with the total shares outstanding on the dividend record date.

Authorization For most entities, the board of directors or stockholders approve stock and dividend transactions. The authorization is normally documented in the minutes of the board of directors’ meetings. The auditor can examine the board of directors’ minutes for proper authorization.

Valuation Stock issuances, stock repurchases, and dividends should be recorded by the treasurer’s department at an amount that conforms to GAAP. The auditor can recompute the recording of the stock and dividend transactions.

Segregation of Duties If the entity has enough personnel, the following segregation of duties should be maintained:

∙ The individuals responsible for issuing, transferring, and canceling stock certificates should not have any accounting responsibilities.

∙ The individual responsible for maintaining the detailed stockholders’ records should be independent of the maintenance of the general ledger control accounts.

∙ The individual responsible for maintaining the detailed stockholders’ records should not also process cash receipts or disbursements.

∙ Appropriate segregation of duties should be established among the preparation, recording, signing, and mailing of dividend checks.

If the entity doesn’t have enough personnel to fully segregate all the duties, there should be compensating management review controls in place.

Stop and Think: Pause for a moment and consider what types of problems could occur if there were inadequate segregation of duties in each of the areas listed above.

LO 15-8

Auditing Capital-Stock Accounts

The capital-stock accounts include common stock, preferred stock, and paid-in capital. When auditing the capital-stock accounts, the auditor is normally concerned with the occurrence, completeness, valuation, and completeness of disclosures assertions. The auditor begins the audit of capital stock by obtaining a schedule of all activity in the accounts for the current period. The beginning balance is agreed to the prior year’s working papers, and the ending balance is agreed to the general ledger. The majority of the auditor’s work then focuses on the current-period activity in each account.

Occurrence and Completeness All valid capital-stock transactions must be approved by the board of directors. Therefore, the auditor can obtain assurance on the occurrence of capital-stock transactions by tracing the transactions recorded in the current year to the board of directors’ minutes. When an indepen- dent registrar and transfer agent are used by the entity, the auditor confirms the total number of shares outstanding at the end of the period. If the amount of shares listed as outstanding on the confirmation reconciles to the general ledger capital-stock accounts, the auditor has evidence that the total number of shares outstanding at the end of the year is correct.

LO 15-9

Final PDF to printer

516 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 516 09/30/15 03:08 PM

If the entity does not use outside agents, it will maintain a stock register and/or a stock certificate book. The auditor may perform the following procedures:

∙ Trace the transfers of shares between stockholders to the stock register and/or stock certificate book (accuracy and completeness).

∙ Foot the shares outstanding in the stock register and/or stock certificate book and agree them to total shares outstanding in the general ledger capital-stock accounts (completeness).

∙ Examine any canceled stock certificates (occurrence). ∙ Account for and inspect any unissued stock certificates in the stock certificate book

(completeness).

Valuation When capital stock is issued for cash, the assessment of proper valuation is straightforward. The par, or stated, value for the shares issued is assigned to the respective capital-stock account, while the difference between the price and par value is allocated to paid-in capital. The auditor can recompute the values assigned to each transaction. The proceeds from the sale of stock are normally traced to the cash receipts records.

The valuation issue is more complex when capital stock is issued in exchange for assets or services, for a merger or acquisition, for convertible securities, or for a stock dividend. For example, for small stock dividends where less than 20 to 25 percent of the shares outstanding will be issued, the dividend is recorded at the market value of the shares on the declaration date. The fair market value of the stock dividend is charged to retained earnings and credited to common stock and paid-in capital in excess of par. To obtain evidence on valuation, the auditor can recompute the stock dividend and trace the entries into the general ledger. Large stock dividends are recorded at par value.

Completeness of Disclosures A number of important disclosures are necessary for stockholders’ equity. Table 15–2 contains examples of stockholders’ equity disclosures. The normal sources of this information include the corporate charter, minutes of the board of directors’ meetings, and contractual agreements.

Examples of Disclosure Items for Stockholders’ Equity

Number of shares authorized, issued, and outstanding for each class of stock. Call privileges, prices, and dates for preferred stock. Preferred-stock sinking funds. Stock option or purchase plans. Restrictions on retained earnings and dividends. Any completed or pending transactions (such as stock dividends or splits) that may affect stockholders’ equity.

T A B L E 1 5 – 2

Auditing Dividends

Generally, all dividends that are declared and paid will be audited because of concerns with violations of corporate bylaws or debt covenants. When the entity uses an independent dividend-disbursing agent, the auditor can confirm the amount disbursed to the agent by the entity. This amount is agreed with the amount authorized by the board of directors. The audi- tor can recompute the dividend amount by multiplying the number of shares outstanding on the record date by the amount of the per-share dividend approved by the board of directors. This amount should agree to the amount disbursed to shareholders and accrued at year-end. If the auditor is concerned about the entity’s controls over dividend disbursements, he or she

LO 15-10

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 517

mes32502_ch15_506-527.indd 517 09/30/15 03:08 PM

may compare the payee names and amounts on the individual canceled checks with the stock register or stock certificate book. The auditor also reviews the entity’s compliance with any agreements that restrict the payments of dividends.

Practice I N S I G H T

A substantive approach is appropriate when auditing the retained earnings account for an entity not required to have an audit of internal control over financial reporting. Each transaction is often tested because there are relatively few transactions recorded in the retained earnings account. Because retained earnings is a “residual” account, auditors typically do not allocate materiality or tolerable misstatement to retained earnings.

Auditing Retained Earnings

Under normal circumstances, retained earnings are affected by the current year’s income or loss, as well as cash or stock dividends paid. However, certain accounting standards require that some transactions be recorded directly to retained earnings. Thus, additional audit procedures are sometimes required. Prior-period adjustments, correction of errors, stock retirements, and changes in appropriations of retained earnings are examples of such transactions.

The auditor begins the audit of retained earnings by obtaining a schedule of the account activity for the period. The beginning balance is agreed to the prior year’s working papers and financial statements. Net income or loss can be traced to the income statement. The amounts for any cash or stock dividends can be verified as described earlier. If there are any prior- period adjustments, the auditor must be certain that the transactions satisfy the requirements of the relevant accounting standards. Any new appropriations or changes in existing appro- priations should be traced to the relevant contractual agreements. Last, the auditor must make sure that all necessary disclosures related to retained earnings are made in the footnotes. For example, many debt agreements restrict the amount of retained earnings that is available for payment as dividends (see Exhibit 15–3).

LO 15-11

Auditing Income Statement Accounts

In auditing income statement accounts, the auditor must be satisfied that the revenue and expense accounts are not materially misstated and that they are accounted for in accordance with GAAP. For many companies, revenue is one of the largest accounts in the financial state- ments and it is an important driver of a company’s operating results. Revenue is typically deemed to be a significant account and due to complex accounting standards and the need for estimation, improper revenue recognition is an important fraud risk that auditors need to con- sider. The income statement is viewed as an important source of information by various users of the financial statements. For example, creditors or potential creditors look to an entity’s profitability as one indicator of the entity’s ability to repay debt. Potential investors look to the income statement when deciding whether to purchase the entity’s stock. Finally, vendors may examine the entity’s earnings potential in order to assess whether the entity will be able to pay for goods or services purchased on credit.

The audit of the revenue and expense accounts depends on the extent of work conducted by the auditor on the entity’s control system and on the entity’s balance sheet accounts. For example, the likelihood of material misstatement in the various revenue and expense accounts is a function of the entity’s controls. The level of control risk established for the different business processes directly affects the extent of testing that the auditor requires to audit the income statement accounts.

LO 15-12

Final PDF to printer

518 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 518 09/30/15 03:08 PM

Auditing the income statement includes consideration of the results of audit work con- ducted in other parts of the audit and completion of additional substantive procedures on selected income statement accounts, including the following:

∙ The results of testing controls for the various business processes. ∙ The results of the detailed tests of balance sheet accounts and the related income

statement accounts. ∙ Performance of substantive analytical procedures on income statement accounts. ∙ Detailed tests of selected income statement accounts.

Assessing Control Risk for Business Processes—Income Statement Accounts

In previous chapters, the auditor’s approach to setting the control risk for various business processes was discussed. To better understand the effect of a reduced control risk assessment on the audit of the revenue and expense accounts, consider the income statement accounts affected by the revenue and purchasing business processes. For example, a justifiably reduced control risk assessment for the revenue process provides evidence that the sales, accounts receivable, allowance for uncollectible accounts, and sales returns and allowances accounts are not materially misstated. Similarly, a reduced control risk assessment for the purchasing process provides evidence that financial statement accounts such as inventory; property, plant, and equipment; accounts payable; and most expense accounts are not materially misstated. The important point here is that the auditor already has reliable evidence on the accounts included in the income statement. Audit findings related to the purchasing process are par- ticularly relevant, since proper controls over that process provide evidence on most of the expense accounts. This allows the auditor to do considerably fewer substantive procedures for these income statement accounts.

Substantive Procedures—Income Statement Accounts

Direct Tests of Balance Sheet Accounts Income statement accounts are normally audited in the course of auditing the related balance sheet accounts. Table 15–3 lists balance sheet accounts and the related income statement accounts that are verified in this manner. For example, when the allowance for uncollectible accounts is audited, bad-debt expense is also tested. Similarly, when auditing notes receiv- able, the auditor can test interest income.

Substantive Analytical Procedures for Income Statement Accounts Substantive analytical procedures can be used extensively to provide assurance on the revenue and expense accounts. The auditing standard on the consideration of fraud risk indicates that the auditor should ordinarily presume that there is a risk of material misstatement due to fraud

Examples of Income Statement Accounts Audited in Conjunction with the Balance Sheet Account

Balance Sheet Account Audited Related Income Statement Account Audited

Accounts receivable/allowance for uncollectible accounts Bad-debt expense Notes receivable/investments/accrued interest receivable Interest income Property, plant, and equipment/accumulated depreciation Depreciation expense, gain/losses on sales or retirements of assets Prepaid insurance Insurance expense Long-term debt/accrued interest payable Interest expense

T A B L E 1 5 – 3

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 519

mes32502_ch15_506-527.indd 519 09/30/15 03:08 PM

relating to revenue recognition. Disaggregated analytical procedures are typically conducted on the revenue account to identify unusual or unexpected relationships that may be indicative of fraud.

One type of substantive analytical procedure involves comparing the current year’s dollar amount for each revenue and expense account (e.g., by product, business segment, or geo- graphic region) with the prior years’ balances. Any account that deviates from the prior years’ trend by more than a predetermined amount should be investigated. An alternative to this type of substantive analytical procedure involves calculating the ratio of individual expense accounts to net sales and comparing these percentages across years. The auditor can also com- pare these percentages to industry averages. Individual expense accounts that are judged by the auditor to be out of line are investigated further. While these types of substantive analyti- cal procedures are common, it is important that substantive analytical procedures designed to provide evidence regarding the fairness of revenue or other income statement accounts be conducted at a sufficiently disaggregated (i.e., monthly or weekly data versus annual data, by business segment or product) level to detect potential misstatements. As noted in Chapter 5, even relatively small percentage misstatements in large income statement accounts are often material, thus the need for precise substantive analytical procedures.3

Substantive analytical procedures can also be used to provide evidence of specific rev- enue or expense accounts. For example, the auditor can evaluate the reasonableness of sales commissions by using the entity’s commission schedule and multiplying commission rates by eligible sales. This estimate can be compared to the recorded commission expense. Other examples might include overall reasonableness tests for interest and depreciation expense.

3In recent years, the PCAOB has been critical of substantive analytical procedures applied to large income state- ment accounts. For a discussion of the issues and a potential path forward see, S. Glover, D. Prawitt, and M. Drake, “Between a Rock and a Hard Place: A Path Forward for Using Substantive Analytical Procedures in Auditing Large P&L Accounts,” Auditing: A Journal of Practice and Theory, vol. 34, 2015

Practice I N S I G H T

A review of actual audit working papers found that auditors often over-rely on weak analytical pro- cedures when a substantive analytical procedure is used as the primary substantive evidence for an income statement account. Research conducted to understand this finding suggests that auditors overestimate the quality and strength of evidence provided by a weak (i.e., highly aggregated) sub- stantive analytical procedure if the procedure yields a “favorable” result (i.e., if it indicates that there is no material misstatement). However, keep in mind that the quality and strength of the evidence provided by a substantive analytical procedure can and should be measured before the procedure is performed and are not affected by whether or not the procedure yields a favorable or an unfavor- able outcome. A weak analytical procedure is weak no matter the outcome of the test. See S. Glover, D. Prawitt, and J. Wilks, “Why Do Auditors Over-Rely on Weak Analytical Procedures? The Role of Outcome and Precision,” Auditing: A Journal of Practice & Theory, vol. 25, 2005.

Tests of Selected Account Balances Even though the auditor will have gathered considerable evidence about revenue and expense accounts based on the audit procedures just discussed, the auditor may want to examine some accounts further. For these accounts, the auditor typically analyzes in detail the transactions included in each account. The auditor verifies the transactions by examining (vouching) the supporting documentation. Accounts examined in this manner are generally accounts that are not directly affected by a business process, accounts that may contain sensitive information or unusual transactions, or accounts for which detailed information is needed for the tax return or other schedules included with the financial statements. Some examples of such accounts include legal and audit expense, travel and entertainment, charity expense, other income and expenses, and any account containing related-party transactions. Exhibit 15–4 presents an account analysis for EarthWear’s legal and audit expense. In auditing this account, the auditor vouches the transactions to the attorneys’ invoices. The auditor should examine the invoice not only for the amount but also for information on potential uncertainties, such as lawsuits against the entity.

Final PDF to printer

520 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 520 09/30/15 03:08 PM

Example of an Account Analysis Working PaperE X H I B I T 1 5 – 4

T20 SAA 2/4/16

Date Payee Amount Explanation

Feb. 2 Katz & Fritz $ 28,500.00V For services related to a patent infringement suit by Gough Mfg. Co. Lawsuit was dismissed.

April 10 Willis & Adams 2,250,000.00V Annual audit fee. Oct. 1 Katz & Fritz 26,200.00V Legal fee for patent infringement suit against Weshant, Inc. Oct. 20 Smoothe, Sylk, Fiels,

Goode & Associates 2,100.00V Legal services for a purchase contract with McDonald

Merchandise, Inc.

$2,306,800.00

FT/B

Tick Mark Legend

V = Examined payees’ bills for amount and description. F = Footed. T/B = Agreed to trial balance.

Conclusion: Based on the audit work performed, EarthWear’s legal and audit expense account is not materially misstated.

EARTHWEAR CLOTHIERS Analysis of Legal and Audit Expense

12/31/15

KEY TERMS

Analytical procedures. Evaluations of financial information made through analysis of plau- sible relationships among both financial and nonfinancial data. Assertions. Expressed or implied representations by management regarding the recognition, measurement, presentation, and disclosure of information in the financial statements and related disclosures. Confirmation. The process of obtaining and evaluating direct communication from a third party in response to a request for information about a particular item affecting financial state- ment assertions. Derivative. A derivative is a contract between two or more parties and its value is determined by fluctuations in the underlying asset. The price of a derivative is dependent upon or derived from one or more underlying assets. Common underlying assets include commodities, stocks, bonds, and interest rates. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of con- trols in preventing, or detecting and correcting, material misstatements at the relevant assertion level. Tests of details of account balances and disclosures. Substantive tests that concentrate on the details of items contained in the account balance and disclosure.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 521

mes32502_ch15_506-527.indd 521 09/30/15 03:08 PM

REVIEW QUESTIONS

LO 15-1, 15-4, 15-1 Why does the auditor generally follow a substantive strategy when auditing long-term 15-5, 15-9 debt and capital accounts? Under what conditions might the auditor follow a reliance

strategy? LO 15-2, 15-3 15-2 What are the most important assertions for long-term debt? What documents would

normally contain the authorization to issue long-term debt? LO 15-4 15-3 Describe how substantive analytical procedures may be used to provide evidence on

the reasonableness of interest expense. LO 15-4 15-4 Confirmations of long-term debt provide evidence about which assertions? LO 15-5 15-5 What are the functions of the registrar, the transfer agent, and the dividend-disbursing

agent? LO 15-8 15-6 What is the major segregation of duties that should be maintained when the entity

does not use a registrar or transfer agent and sufficient personnel are available to perform the stock transactions?

LO 15-9 15-7 List two common disclosures for stockholders’ equity and why such disclosures are necessary.

LO 15-10, 15-11 15-8 Describe common audit procedures to audit dividends and retained earnings. LO 15-12 15-9 List three substantive analytical procedures that the auditor might use in auditing the

income statement. LO 15-12 15-10 Why might the auditor do an account analysis and vouch selected transactions in

income statement accounts such as legal expense, travel and entertainment, and other income/expenses?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 15-3 15-11 Which of the following questions would an auditor most likely include on a control questionnaire for notes payable?

a. Are assets that collateralize notes payable critically needed for the entity’s contin- ued existence?

b. Are two or more authorized signatures required on checks that repay notes payable? c. Are the proceeds from notes payable used to purchase noncurrent assets? d. Are direct borrowings on notes payable authorized by the board of directors?

LO 15-4 15-12 An auditor’s primary purpose in examining a letter received from the bank shortly after the balance sheet date that renews and extends an entity’s note payable is most likely to obtain evidence concerning management’s assertions about

a. Existence. b. Presentation and disclosure-classification. c. Accuracy. d. Valuation and allocation.

LO 15-4 15-13 An audit program for long-term debt would most likely include steps that require a. Comparing the carrying amount of the debt to its year-end market value. b. Correlating the interest expense recorded for the period with the debt outstanding

for the period. c. Verifying the existence of the holders of the debt by direct confirmation. d. Inspecting the accounts payable subsidiary ledger for unrecorded long-term debt.

LO 15-4 15-14 An entity has established a bond sinking fund to repurchase a portion of the out- standing bonds each year. The auditor can best verify the entity’s bond sinking fund transactions and year-end bond balance by

a. Confirmation of retired bonds with individual holders. b. Confirmation with the bond trustee.

Final PDF to printer

522 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 522 09/30/15 03:08 PM

c. Recomputation of interest expense, interest payable, and amortization of bond discount or premium.

d. Examination and count of the bonds retired during the year.

LO 15-7, 15-8, 15-9 15-15 When an entity does not maintain its own stock records, the auditor should obtain written confirmation from the transfer agent and registrar concerning

a. Restrictions on the payment of dividends. b. The number of shares issued and outstanding. c. Guarantees of preferred stock liquidation value. d. The number of shares subject to agreements to repurchase.

LO 15-6, 15-7, 15-8 15-16 The primary responsibility of a bank acting as a registrar of capital stock is to a. Ascertain that dividends declared do not exceed the statutory amount allowable in

the state of incorporation. b. Account for stock certificates by comparing the total shares outstanding to the

total in the shareholders’ subsidiary ledger. c. Act as an independent third party between the board of directors and outside

investors concerning mergers, acquisitions, and the sale of treasury stock. d. Verify that stock has been issued in accordance with the authorization of the

board of directors and the articles of incorporation.

LO 15-9 15-17 To obtain evidence on the authorization assertion, an auditor should trace corporate stock issuances and treasury stock transactions to the

a. Numbered stock certificates. b. Articles of incorporation. c. Transfer agent’s records. d. Minutes of the board of directors.

LO 15-9 15-18 Although the quantity and content of audit working papers vary with each particular engagement, an auditor’s permanent files most likely include

a. Schedules that support the current year’s adjusting entries. b. Prior years’ accounts receivable confirmations that were classified as exceptions. c. Documentation indicating that the audit work was adequately planned and

supervised. d. Information regarding the different classes of stock and the number of shares of

each class that are authorized to be issued.

LO 15-12 15-19 An auditor compares the current-year revenues and expenses with those of the prior year and investigates all changes exceeding 5 percent. By this procedure, the auditor would be most likely to learn that

a. Fourth-quarter payroll taxes in the current year were not paid. b. The entity changed its capitalization policy for small tools in the current year. c. A current-year increase in property tax rates has not been recognized in the entity’s

accrual. d. The current-year provision for uncollectible accounts is inadequate because of

worsening economic conditions.

LO 15-12 15-20 Which of the following comparisons would be most useful to an auditor in evaluat- ing the overall financial results of an entity’s operations?

a. Prior-year accounts payable to current-year accounts payable. b. Prior-year payroll expense to budgeted current-year payroll expense. c. Current-year revenue to budgeted current-year revenue. d. Current-year warranty expense to current-year contingent liabilities.

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 523

mes32502_ch15_506-527.indd 523 09/30/15 03:08 PM

PROBLEMS All applicable problems are available with Connect.

LO 15-4 15-21 Maslovskaya, CPA, has been engaged to examine the financial statements of Broad- wall Corporation for the year ended December 31, 2015. During the year, Broadwall obtained a long-term loan from a local bank pursuant to a financing agreement that provided that

1. The loan was to be secured by the company’s inventory and accounts receivable. 2. The company was not to pay dividends without permission from the bank. 3. Monthly installment payments were to commence July 1, 2015. In addition, dur-

ing the year, the company borrowed various short-term amounts from the presi- dent of the company, including substantial amounts just prior to year-end.

Required: a. For purposes of the audit of the financial statements of Broadwall Corporation,

what procedures should Maslovskaya employ in examining the described loans? b. The loans from the president represent a related-party transaction. What financial

statement disclosures do you believe would be appropriate for the loans from the president?

(AICPA, adapted)

LO 15-4 15-22 The Brant Group reported total interest expense for the year of $2,000. The table below provides the monthly balance of their long-term debt. Interest is paid monthly on the average daily balance during the month. The annual interest rate for the debt is 6%.

Balance of long-term debt @ Jan 31 100,000

Balance of long-term debt @ Feb 28 90,000

Balance of long-term debt @ Mar 31 80,000

Balance of long-term debt @ Apr 30 70,000

Balance of long-term debt @ May 31 90,000

Balance of long-term debt @ June 30 85,000

Balance of long-term debt @ July 31 80,000

Balance of long-term debt @ Aug 31 70,000

Balance of long-term debt @ Sept 30 60,000

Balance of long-term debt @ Oct 31 65,000

Balance of long-term debt @ Nov 30 75,000

Balance of long-term debt @ Dec 31 50,000

Required: Based on the data provided, if you were auditing The Brant Group would you con-

sider the reported interest expense fairly stated? Why or why not?

LO 15-4 15-23 The long-term debt working paper shown below was prepared by entity personnel and audited by Andy Fogelman, an audit assistant, during the calendar year 2015 audit of American Widgets, Inc., a continuing audit client. The engagement supervi- sor is reviewing the working paper thoroughly.

Required: There are a number of deficiencies in the working paper. For example, the subject of

the working paper is not properly indicated in the title and there is no indication that

Final PDF to printer

524 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 524 09/30/15 03:08 PM

A M

ER IC

A N

W ID

G ET

S, IN

C .

W or

ki ng

P ap

D ec

em be

r 3

1 , 2

0 1

Le nd

er In

te re

Ra te

Pa ym

en t T

er m

s C

ol la

te ra

l Ba

la nc

12 /3

1/ 14

20 15

rr ow

in gs

20 15

du ct

io ns

Ba la

nc e

/3 1/

15 In

te re

Pa id

Ac cr

ue d

te re

Pa ya

bl e

/3 1/

15 C

om m

en ts

Fi rs

t C om

m er

ci al

nk ϕ

12 %

In te

re st

o nl

y on

2 5t

h of

on th

, p rin

ci pa

l du

e in

fu ll

1/ 1/

19 ;

no p

re pa

ym en

t p en

al ty

In ve

nt or

ie s

50 ,0

00 ✓

$3 00

,0 00

1/ 31

/1 5

$ 10

0, 00

0❂

6/ 30

/1 5

$ 2

50 ,0

00 C

X 12

/2 5/

15 $2

,5 00

N R

D iv

id en

d of

$ 80

,0 00

id 9

/2 /1

5 (W

/P N

-3 )

vi ol

at es

a p

ro vi

si on

o f

th e

de bt

a gr

ee m

en t,

w hi

ch th

er eb

y pe

rm its

nd er

to d

em an

im m

ed ia

te p

ay m

en t;

nd er

h as

re fu

se d

w ai

ve th

is v

io la

tio n.

Le nd

er ’s

C ap

ita l

Pr im

e pl

us In

te re

st o

nl y

on la

st 2n

d m

or tg

ag e

00 ,0

00 ✓

,0 00

—

00 ,0

00 C

12 /3

1/ 15

— Pr

im e

ra te

w as

8 %

C or

po ra

tio n

G ig

an tic

B ui

ld in

g &

an A

ss oc

ia tio

n ϕ

da y

of m

on th

, p rin

ci pa

l du

e in

fu ll

3/ 5/

$5 ,0

00 p

rin ci

pa l p

lu s

te re

st d

ue o

n 5t

h of

on th

, d ue

in fu

12 /3

1/ 24

on P

ar k

St re

Bu ild

in g

t m or

tg ag

on P

ar k

St re

Bu ild

in g

20 ,0

00 ✓

28 /1

—

,0 00

60 ,0

00 C

12 /5

/1 5

5, 64

9% d

ur in

g th

e ye

ar .

Re cl

as si

fic at

io n

en tr

fo r c

ur re

nt p

or tio

pr op

os ed

(s ee

R JE

-3 ).

J. L

ot t,

m aj

or ity

oc kh

ol de

r ϕ 0%

D ue

in fu

ll 12

/3 1/

18 U

ns ec

ur ed

00 ,0

00 ✓

—

10 0,

00 0N

12 /3

1/ 15

00 ,0

00 C

—

Bo rr

ow ed

a dd

iti on

$1 00

,0 00

fr om

J . L

ot t

on 1

/7 /1

$1 ,1

70 ,0

00 ✓

$3 50

,0 00

$ 26

0, 00

0 $1

,3 10

,0 00

T/ B

$8 ,1

42 T/

Ti ck

M ar

k Le

ge nd

C =

C on

fir m

ed w

ith ou

t e xc

ep tio

n, W

/P K

-2 .

In te

re st

c os

ts fr

om lo

ng -t

er m

d eb

F =

F oo

ts c

or re

ct ly

In te

re st

e xp

en se

fo r y

ea r

$ 2

81 ,3

33 T/

C X

= C

on fir

m ed

w ith

e xc

ep tio

n, W

/P K

-3 .

er ag

e lo

an b

al an

ce o

ut st

an di

ng $

1, 40

6, 66

N R

= D

oe s

no t r

ec om

pu te

c or

re ct

ly .

A =

A gr

ee d

to lo

an a

gr ee

m en

t, va

lid at

ed b

an k

de po

si t t

ic ke

t, an

d bo

ar d

of d

ire ct

or s’

a ut

ho riz

at io

n, W

/P W

-7 .

Fi ve

-y ea

r m at

ur iti

es (f

or d

is cl

os ur

e pu

rp os

es )

θ =

A gr

ee d

to c

an ce

le d

ch ec

ks a

nd le

nd er

’s m

on th

ly s

ta te

m en

ts .

ar -e

nd 12

/3 1/

16 $

,0 00

N =

A gr

ee d

to c

as h

di sb

ur se

m en

ts jo

ur na

l a nd

c an

ce le

d ch

ec k

da te

d 12

/3 1/

15 , c

le ar

in g

1/ 8/

16 .

12 /3

1/ 17

60 ,0

T/ B

= T

ra ce

d to

w or

ki ng

tr ia

l b al

an ce

. 12

/3 1/

2 60

,0 00

✓ =

A gr

ee d

to 1

2/ 31

/1 4

w or

ki ng

p ap

er s.

12 /3

1/ 19

10 ,0

ϕ =

A gr

ee d

in te

re st

ra te

, t er

m , a

nd c

ol la

te ra

l t o

co py

o f n

ot e

an d

lo an

a gr

ee m

en t.

12 /3

1/ 20

60 ,0

❂ =

A gr

ee d

to c

an ce

le d

ch ec

k an

d bo

ar d

of d

ire ct

or s’

a ut

ho riz

at io

n, W

/P W

-7 .

Th er

ea fte

3 60

,0 00

$ 1,

31 0,

00 0

C on

cl us

io ns

: L on

g- te

rm d

eb t,

ac cr

ue d

in te

re st

p ay

ab le

, a nd

in te

re st

e xp

en se

a re

c or

re ct

a nd

c om

pl et

e at

1 2/

31 /1

iti al

s D

at e

P re

pa re

d B

y A

F 1

/2 2

/1 6

A pp

ro ve

d B

Final PDF to printer

Chapter 15 Auditing the Financing/Investing Process: Liabilities, Equity, Income Statement 525

mes32502_ch15_506-527.indd 525 09/30/15 03:08 PM

the unusually high average interest rate (20% = $281,333/$1,406,667) was noted or investigated. Identify at least five additional deficiencies that the engagement super- visor should discover.

(AICPA, adapted)

LO 15-8, 15-9 15-24 Lee, CPA, the continuing auditor of Wu, Inc., is beginning to audit the common stock and treasury stock accounts. Lee has decided to design substantive procedures without relying on the company’s internal control system.

Wu has no par and no stated-value common stock, and it acts as its own registrar and transfer agent. During the past year, Wu both issued and reacquired shares of its own common stock, some of which the company still owned at year-end. Additional common stock transactions occurred among the shareholders during the year.

Common stock transactions can be traced to individual shareholders’ accounts in a subsidiary ledger and to a stock certificate book. The company has not paid any cash or stock dividends. There are no other classes of stock, stock rights, warrants, or option plans.

Required: What substantive audit procedures should Lee apply in examining the common stock

and treasury stock accounts?

(AICPA, adapted)

DISCUSSION CASE

LO 15-4 15-25 On September 10, Melinda Johnson was auditing the financial statements of a new audit client, Mother Earth Foods, a health-food chain that has a June 30 year-end. The company is privately held and has just gone through a leveraged buyout with long-term financing that includes various restrictive covenants.

In order to obtain debt financing, companies often have to agree to certain condi- tions, some of which may restrict the way in which they conduct their business. If the borrower fails to comply with the stated conditions, it may be considered in default, which would give the lender the right to accelerate the due date of the debt, add other restrictions, waive the default for a stated period, or revise the covenants. Usually there is a grace period during which the borrower can cure the default.

Johnson believes that it is possible that at August 31 Mother Earth was in violation of the debt covenant restrictions, which became effective on that date. The debt cov- enants require the company to maintain a certain receivable turnover rate. Johnson is not certain, however, because the accounting records, including period-end cutoffs for sales and purchases, have not been well maintained. Nevertheless, Mother Earth’s executives assure Johnson that if they were in violation, the company will be able to obtain a waiver or modification of the covenant.

Required: a. Discuss the audit procedures that Johnson would conduct to determine if Mother

Earth violated the debt covenants. How would Johnson determine whether Mother Earth would be able to obtain a waiver, assuming that the company was in violation of the debt covenants?

b. Based on the case scenario and financial accounting pronouncements about the classification of obligations that are callable by the creditor, should Mother Earth continue to classify this debt as noncurrent? Justify your answer.

Final PDF to printer

526 Part 5 Auditing Business Processes

mes32502_ch15_506-527.indd 526 09/30/15 03:08 PM

INTERNET ASSIGNMENT

LO 15-1, 15-4 15-26 Diebold, Inc., a public company, is a maker of ATMs, bank security systems, and electronic voting machines. Research how Diebold accounted for liability accruals and capitalized expenses (“Division 35 and CAP 250”) to overstate income in the years 2002 to 2005. Also, research for legal actions against Diebold and its officers. Possible sources of information on these issues include websites for Diebold, the SEC, and various news stories in the business press.

Required: Write a brief memo describing (a) Diebold’s accounting for accrued liabilities and

capitalized expenses, (b) what the auditors could have done differently to identify the misstatements in the earlier years of the fraud, and (c) the results of the SEC’s and other legal actions against the company and the executives.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch15_506-527.indd 527 09/30/15 03:08 PM

Final PDF to printer

mes32502_ch16_528-560.indd 528 10/14/15 01:51 PM

CHAPTER

16 16-1 Understand the relationship of the various business

processes to cash. 16-2 Know the different types of bank accounts. 16-3 Know tests of details of transactions used to audit cash. 16-4 Be able to explain tests of details of account balances

used to audit cash. 16-5 Know how to audit a bank reconciliation. 16-6 Understand fraud-related audit procedures for cash.

16-7 Understand why entities invest in securities of other entities.

16-8 Be able to explain key controls for investments. 16-9 Know the appropriate segregation of duties for

investments. 16-10 Know tests of details of account balances used to audit

investments. 16-11 Understand how to audit fair value measurements.

FASB ASC Topic 230, Statement of Cash Flows FASB ASC Topic 320, Investments—Debt and Equity Securities FASB ASC Topic 718, Compensation—Stock Compensation FASB ASC Topic 820, Fair Value Measurements and Disclosures AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 501, Audit Evidence—Specific Considerations for Selected Items AU-C 505, External Confirmations AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

529

mes32502_ch16_528-560.indd 529 10/14/15 01:51 PM

Auditing the Financing/Investing Process: Cash and Investments

T his chapter covers the audit of cash and investments. These are the last accounts studied in our coverage of auditing business processes and related accounts because each of the other business processes inter-

acts with cash. Thus, the evidence gathered during the audit of other business processes affects the type and amount of evidence required to audit cash.

Proper management of cash and investments is essential to every entity. The principal goal of cash management is to ensure that sufficient cash is avail- able to meet the entity’s needs. Achieving this goal requires good forecasting of cash receipts and disbursements. By using sound cash-forecasting tech- niques, management can plan to invest excess cash and borrow at favorable interest rates when cash is required. Because cash and investments are so liquid, they normally represent critical audit areas. The Advanced Module dis- cusses auditing fair value measurements.

While the audit of cash is typically uneventful, certainly it wasn’t in the Parmalat audit you will read about in this chapter and it wasn’t for a former audi- tor we know who, many years ago, arrived at an entity’s location a day early to audit cash. The surprised CFO, who had been stealing funds from the entity, had the company’s accounting records for the cash accounts on his desk and he was working on hiding his fraud. When he saw the auditor, he stood up and jumped out the window.

Client acceptance/ continuance (Chapter 3)

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Major Phases of an Audit

Final PDF to printer

530 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 530 10/14/15 01:51 PM

Auditing Cash

The line item “cash” reported in the financial statements represents currency on hand and cash on deposit in bank accounts, including certificates of deposit, time deposits, and savings accounts. Frequently, certain “cash equivalents” are combined with cash for presentation in the financial statements. FASB ASC Topic 230, “Statement of Cash Flows,” defines cash equivalents as short-term, highly liquid investments that are readily convertible to cash and so near their maturity that there is little risk of change in their value. Examples of such financial instruments include Treasury bills and money market funds.

Because virtually all accounting transactions pass through the cash account as part of their “cradle-to-grave” cycle, cash is affected in one way or another by all of the entity’s busi- ness processes. Figure 16–1 shows the effect each major business process has on the cash account. Although the main source of cash receipts is the revenue process, other sources of cash include the sale of property, plant, and equipment and the proceeds from issuing long- term debt or capital stock. The main sources of disbursements from cash are the purchasing and human resource management processes. Generally, large payments initiated in the pur- chasing process are for acquisitions of inventory and property, plant, and equipment. Pay- ments on long-term debt and repurchase of stock are other types of cash disbursements.

Because of the close relationship of cash to the revenue and purchasing processes, issues relating to the inherent and control risks for cash were discussed in Chapters 10 and 11, respectively. Specifically regarding control risk, Table 10–7 summarized the assertions, pos- sible misstatements, control activities, and tests of controls for cash receipt transactions. A similar summary was provided for cash disbursement transactions in Table 11–7. Therefore, we will not repeat the discussion of inherent or control risk for cash receipt and disbursement transactions in this chapter. However, the auditor’s assessment of inherent risk and control risk for transactions processed through the revenue and purchasing processes strongly affects the nature and extent of testing for the ending cash balance.

Stop and Think: Considering the inherent and control risk assessments for cash receipts and disbursements, what characteristics of cash increase inherent risk and how would this impact the substantive procedures? What effect does the control risk assess- ment have on substantive testing for cash?

LO 16-1

The Effects of Major Accounting Transactions/Business Processes on CashF I G U R E 1 6 – 1

Revenue

Sale of property, plant, and equipment

Issuance of long-term

debt or capital stock

Cash

Inventory

Property, plant, and equipment

Sources of Cash Disbursements of Cash

Purchases

Payroll

Long-term debt and

stockholders’ equity

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 531

mes32502_ch16_528-560.indd 531 10/14/15 01:51 PM

If the control risk assessment is below the maximum for both cash receipts and dis- bursements, the auditor can reduce the extent of substantive evidence gathered for the cash balances.

Types of Bank Accounts

Cash management is an important function in all organizations. In order to optimize its cash flow, an entity implements procedures for accelerating the collection of cash receipts and delaying the payment of cash disbursements, to the extent delay is appropriate. Such proce- dures allow the entity to earn interest on excess cash or to reduce the cost of cash borrowings.

Management must also be concerned with the control and safekeeping of cash. The use of different types of bank accounts aids in controlling the entity’s cash. The following types of bank accounts are typically used:

∙ General cash account. ∙ Imprest cash accounts. ∙ Branch accounts.

It is important to understand each of the different types of bank accounts used. While the audit approach to each type of account is similar, the extent of testing varies from one account to the next. Each type of bank account is briefly discussed.

General Cash Account The general cash account is the main cash account for most entities. The major source of cash receipts for this account is the revenue process, and the major sources of cash disbursements are the purchasing and human resource management processes. This cash account may also be used for receipts and disbursements from other bank accounts maintained by the entity. For many small entities, this is the only cash account maintained.

Imprest Cash Accounts An imprest bank account contains a stipulated amount of money to be used for a specific pur- pose. For example, separate imprest accounts are frequently used for disbursing payroll and dividend checks. In the case of payroll, a separate bank account is established for disbursing payroll. Prior to the disbursement of payroll to employees through check or direct deposit, funds sufficient to cover payroll are transferred from the general cash account to the payroll imprest account. The payroll is then drawn on this imprest account, which reduces the imprest account balance back to a specified minimum amount required to keep the account open and active with the bank. Thus, the payroll account serves as a clearing account for payroll pay- ments and facilitates the disbursement of cash while also helping to maintain adequate control over cash.

Use of imprest accounts also minimizes the time required to reconcile the general cash account.

Branch Accounts Companies that operate branches in multiple locations may maintain separate accounts at local banks. This allows each branch to pay local expenses and to maintain a banking relation- ship in the local community. Branch cash accounts can be operated in a number of ways. In some cases, the branch accounts are nothing more than imprest accounts for branch payments in which a minimum balance is maintained. The branch submits periodic cash reports to head- quarters, and the branch account receives a check or transfer from the general cash account. In other cases, the branch account functions as a general cash account by recording both cash receipts and cash disbursements.

LO 16-2

Final PDF to printer

532 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 532 10/14/15 01:51 PM

For proper control, the branch should be required to submit periodic cash reports to head- quarters, and the entity’s management should carefully monitor the branch cash requests and account balances.

Practice I N S I G H T

Management ordinarily uses a “sweep account” cash management strategy to transfer, on a nightly basis, any surplus cash in noninterest bearing commercial checking accounts to savings or money market accounts in order to earn higher returns on bank accounts.

Control Risk Assessment—Cash

The reliability of the entity’s controls over cash receipts and cash disbursements affects the nature and extent of the auditor’s tests of details. The preceding chapters discussed a number of important controls for both cash receipts and disbursements. For example, incoming checks are to be restrictively endorsed (stamped “For deposit only” to the company’s bank account), and daily cash receipts from customers are to be reconciled with postings to the accounts receivable subsidiary ledger. The effective operation of these controls provides strong evi- dence that the completeness assertion is being met. Similarly, outgoing checks are to be signed only by authorized signers and only after all documents included in the voucher packet have been independently approved. The effective operation of this control activity provides the auditor with evidence on the authorization assertion.

A major control that directly affects the audit of cash is the completion of a monthly bank reconciliation by entity personnel who are independent of the handling and recording of cash receipts and cash disbursements. Such bank reconciliations ensure that the entity’s books reflect the same balance as the bank’s after reconciling items have been considered. Control can be improved further if an independent party such as the internal auditor reviews the bank reconciliation.

If the entity has good bank reconciliation procedures that are promptly performed, the auditor may choose to test the entity’s reconciliation procedures as part of testing controls and thereby reduce the audit work on the ending cash balance.

Substantive Procedures—Cash

Substantive Analytical Procedures—Cash Because of its residual nature, cash does not have a predictable relationship with other finan- cial statement accounts. As a result, the auditor’s use of substantive analytical procedures for auditing cash is typically limited to comparisons with prior years’ cash balances and to bud- geted amounts. This limited applicability of substantive analytical procedures is normally off- set by (1) extensive tests of controls and/or substantive tests of transactions for cash receipts and cash disbursements or (2) extensive tests of the entity’s bank reconciliations.

Substantive Tests of Details of Transactions and Balances—Cash Table 16–1 contains examples of substantive tests of transactions for both cash receipts and cash disbursements. By testing both cash receipts and disbursements, the auditor obtains important evidence about the relevant assertions for the cash account. On most audits, the sub- stantive tests of transactions for cash receipts and cash disbursements are conducted together with the tests of controls for the revenue and purchasing processes, respectively.

Balance-Related Assertions Table 16–2 summarizes the assertions and tests of details of account balances for cash accounts. The rights and obligations assertion is not included in Table 16–2 because it is seldom important to the audit of the cash balance. The major audit

LO 16-3, 16-4

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 533

mes32502_ch16_528-560.indd 533 10/14/15 01:51 PM

procedures for each cash account involve tests of the bank reconciliation. The approach to auditing a bank reconciliation is basically the same regardless of the type of bank account being examined. However, the type and extent of the audit work are more detailed for the gen- eral cash account because it normally represents a material amount and because of the large amount of activity in the account.

Auditing the General Cash Account Table 16–2 shows that the main source of evidence for the existence, completeness, and val- uation assertions is the audit work completed on the bank reconciliation. To audit a cash account, the auditor should obtain the following documents:

∙ A copy of the bank reconciliation. ∙ A standard form to confirm account balance information with financial institutions

(referred to as a standard bank confirmation). ∙ A cutoff bank statement.

LO 16-5

Examples of Tests of Transactions for Cash Receipts and Disbursements

Example Substantive Tests of Transactions*

Assertions about Classes of Transactions Cash Receipts Cash Disbursements

Occurrence Vouch a sample of entries in the cash receipts journal to remittance advices, daily deposit slips, and bank statement

Vouch a sample of entries from the cash disbursements journal to canceled checks, voucher packet, and bank statement

Completeness Trace a sample of remittance advices to cash receipts journal and, if necessary, to deposit slips

Trace a sample of canceled checks to the cash disbursements journal

Authorization For a sample of days, examine the signature on the deposit slip and the check endorsements for proper authorization

Examine a sample of canceled checks for authorized signature and proper endorsement

Accuracy For a sample of daily deposits, foot the remittance advices and entries on the deposit slip and agree to the cash receipts journal and bank statement

For a sample of voucher packets, agree amounts in purchase order, receiving report, invoice, canceled check, and disbursement journal

For a sample of weeks, foot the cash receipts journal and agree posting to the general ledger

For a sample of weeks, foot the cash disbursements journal and agree posting to the general ledger

Cutoff Compare the dates for recording a sample of cash receipts transactions in the cash receipts journal with the dates the cash was deposited in the bank (note any significant delays)

Compare the dates for a sample of checks with the dates the checks cleared the bank (note any significant delays)

Observe cash on hand for the last day of the year, and trace deposits to cash receipts journal and cutoff bank statement

Record the last check issued on the last day of the year, and trace to cash disbursements journal

Classification Examine a sample of remittance advices for proper account classification

Examine a sample of canceled checks for proper account classification

*These substantive tests of transactions are commonly conducted as dual-purpose tests (i.e., in conjunction with tests of controls).

T A B L E 1 6 – 1

Examples of Tests of Details of Balances for Cash

Assertions about Account Balances at Period End Example Tests of Details Account Balances

Existence Confirm bank account balance with financial institution Completeness, Valuation, and Allocation

Test bank reconciliation for each account: • Foot the reconciliation and the outstanding check listing. • Trace balances per book to the general ledger. • Obtain standard bank confirmation and trace balance per

bank to the bank reconciliation. • Obtain cutoff bank statement. • Trace deposits in transit, outstanding checks, and other

reconciling items to cutoff bank statement. If control risk is high or if fraud is suspected: • Perform extended bank reconciliation procedures. • Perform a proof of cash. • Test for kiting (kiting is defined later in the chapter).

T A B L E 1 6 – 2

Final PDF to printer

534 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 534 10/14/15 01:51 PM

Bank Reconciliation Working Paper Exhibit 16–1 provides an example of a bank rec- onciliation working paper for EarthWear’s general cash account. Note that the difference between the cash balance showed in Exhibit 16–1 and the balance in cash on the financial statements is represented by cash equivalents (Treasury bills and commercial paper). On most audits, the auditor obtains a copy of the bank reconciliation prepared by the entity’s person- nel. The working paper reconciles the balance per the bank with the balance per the books. The major reconciling items are deposits in transit, outstanding checks, bank service charges, and a check returned because the customer did not have sufficient cash (i.e., an NSF check) in its account to cover payment of the check.

Standard Bank Confirmation Form The auditor generally confirms account balance information with every bank or financial institution that maintains an account for the entity. The American Institute of Certified Public Accountants, American Bankers Association, and Bank Administration Institute have agreed on a standard format for confirming such infor- mation. Exhibit 16–2 contains a completed copy of the confirmation form, which is titled “Standard Form to Confirm Account Balance Information with Financial Institutions.” This form is also used to obtain information about any loans the entity may have with the bank.

Bank confirmations provide third-party written evidence on bank account bal- ances and other relevant information such as loans, lines of credit, security arrangements

Example of a Bank Reconciliation Working PaperE X H I B I T 1 6 – 1

C10 DLJ

1/15/16

Balance per bank: C11 $1,854,890C

Add: Deposits in transit: 12/30/15 $156,940 ✓ 497,815 12/31/15 340,875 ✓ Deduct: Outstanding checks: #1243 $ 121,843 ϕ #1244 232,784 ϕ #1247 30,431 ϕ #1250 64,407 ϕ #1251 123,250 ϕ (572,715)

Balance per books, unadjusted 1,779,990

Adjustments to books: Bank service charge for returned check $ 250 ✓ Check included in 12/30/15 deposit, returned for insufficient funds (NSF) 7,400 ✓ (7,650)

Balance per books, adjusted $1,772,340L

F = Footed. C = Traced balance to bank confirmation. L = Agreed to cash lead schedule and general ledger. ✓ = Traced amount to cutoff bank statement. ϕ = Examined canceled check for proper payee, amount, and endorsement.

Note: The controller has signed for the return of the cutoff bank statement.

EARTHWEAR CLOTHIERS Bank Reconciliation

12/31/15 General Cash Account

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 535

mes32502_ch16_528-560.indd 535 10/14/15 01:51 PM

(e.g., account restrictions or guarantees), or complex relationships (e.g., derivative or com- modity transactions). While alternative sources could be used to verify bank balances (e.g., bank statement or bank website), such procedures would not be effective at identifying the “other information.” Note that, while it does request that bank personnel indicate any other deposits, loans, arrangements or transactions that come to their attention, the standard con- firmation form does not require bank personnel to conduct a comprehensive, detailed search of the bank’s records beyond the account information requested on the confirmation. As a result, this confirmation request cannot be relied upon to identify all information about an entity’s bank deposits or loans. If the auditor believes that additional information is needed

Example of a Completed Standard Bank Confirmation FormE X H I B I T 1 6 – 2

STANDARD FORM TO CONFIRM ACCOUNT BALANCE INFORMATION WITH FINANCIAL INSTITUTIONS

EarthWear Clothiers

Financial Institution's Name and Address

CUSTOMER NAME

We have provided to our accountants the following information as of

the close of business on ___________________________, 20___, regarding our deposit and loan balances. Please confirm the accuracy of the information, noting any exceptions to the information provided. If the balances have been left blank, please complete this form by furnishing the balance in the appropriate space below.° Although we do not request or expect you to conduct a comprehensive, detailed search of your records, if during the process of completing this con- firmation additional information about other deposit and loan accounts we may have with you comes to your attention, please include such information below. Please use the enclosed envelope to return the form directly to our accountants.

[ ]

First National Bank P.O. Box 1947 Boise, Idaho 79443

December 31, 15

1. At the close of business on the date listed above, our records indicated the following deposit balance(s): ACCOUNT NAME ACCOUNT NO. INTEREST RATE

INTEREST RATE

BALANCE°

General Account Payroll Account

04-78925 01-04354

None None

$ 1,854,890.00 to C10 $ 5,000.00 to C20

C11 DLJ 1/14/16

2. We were directly liable to the financial institution for loans at the close of business on the date listed above as follows:

ACCOUNT NO./ DESCRIPTION DATE DUE

DATE THROUGH WHICH INTEREST IS PAID

DESCRIPTION OF COLLATERAL

(Customer's Authorized Signature)

(Title)

(Financial Institution Authorized Signature)

The information presented above by the customer is in agreement with our records. Although we have not conducted a comprehensive, detailed search of our records, no other deposit or loan accounts have come to our attention except as noted below.

EXCEPTIONS AND/OR COMMENTS

Please return this form directly to our accountants: Willis & Adams P.O. Box 4080 Boise, Idaho 79443-4080

°Ordinarily, balances are intentionally left blank if they are not available at the time the form is prepared.

Approved 1990 by American Bankers Association, American Institute of Certified Public Accountants, and Bank Administration Institute. Additional forms available from AICPA — Order Department, P.O. Box 1003, NY, NY 10106-1003.

(Date)

(Date) Branch Manager

Final PDF to printer

536 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 536 10/14/15 01:51 PM

about an entity’s arrangements with a financial institution, a separate confirmation letter signed by the entity should be sent to the official at the financial institution responsible for the entity’s accounts. Details regarding lines of credit and compensating balances are examples of information that might be confirmed in this manner. This issue is discussed later in this chapter.

Bank confirmation requests should be sent and received under the auditor’s control. The notorious and massive Parmalat fraud (see Exhibit 16–3) perpetrated through a fictitious $4.9 billion bank confirmation highlights the importance of auditors properly controlling the confirmation process and applying a healthy dose of professional skepticism when evaluating audit evidence, even for large and seemingly reputable clients.

Rather than mailing standard bank confirmations, when auditing larger entities audi- tors often work with a third-party provider of electronic confirmation services. These pro- viders have direct and secure relationships with the banks and for a fee auditors are able to obtain the bank confirmation information they need. These confirmation services address many of the problems with paper-based bank confirmations, which include inefficiency in preparing, mailing, and remailing the request and more importantly the risk of fraud. Exhibit 16–4 outlines how electronic confirmations uncovered a fraud that had been going on for over 20 years.

Cutoff Bank Statement A major step in auditing a bank reconciliation is verifying the propriety of the reconciling items such as deposits in transit and outstanding checks. The auditor obtains a cutoff bank statement to test the reconciling items included in the bank rec- onciliation. A cutoff bank statement normally covers the 7- to 10-day period after the date on which the bank account is reconciled. Any reconciling item should have cleared the entity’s bank account during the 7- to 10-day period. The auditor obtains this cutoff bank statement by having the entity request that the bank send the statement, including canceled or electronic check images, directly to the auditor.

Parmalat’s $4.9 Billion Fictitious Bank Confirmation

After taking over his father’s food distribution business, Calisto Tanzi founded a small milk pasteurization company near Parma, Italy. Later named Parmalat Finanziaria S.p.A., the company gained notoriety by acquiring a Swedish pasteurization technology called ultra-high temperature (UHT). This process created the long-life milk product for which the company is best known.

Parmalat expanded its operations through acquisitions and, by the end of the 1990s, was the fourth largest food company in Europe, employing over 36,000 people in 30 countries; however, company expansion through acquisitions meant that Parmalat assumed a heavy debt burden.

Although Parmalat had a strong credit rating entering the 2000s, the business community began to question Parmalat’s decision not to pay down acquisition debt with the large amount of cash it had on hand. Suspicions increased when Parmalat was unable to make a £108 million bond payment. Parmalat officials claimed that the delay was caused by a temporary liquidity problem.

Shortly thereafter, Calisto Tanzi resigned as chairman and CEO. Following his resignation, allega- tions arose that Parmalat had forged a Bank of America confirmation for $4.9 billion and sent it to the company’s auditors to corroborate the existence of cash. However, the cash did not exist. The forged confirmation was fuzzy and of poor quality because it is alleged that Parmalat officials ran the fake con- firmation through the fax machine several times as part of its efforts to hide the fact that the document was a forgery.

Before the end of 2003, Parmalat had filed for bankruptcy and investigations began uncovering what appeared to be a large and intricate accounting fraud, which in the end was hidden by the company’s false cash deposits. Investors, creditors, and legal authorities immediately questioned the work per- formed by the auditors.

The Parmalat case is a high-profile and painful example of a failure in the audit of cash and how impor- tant it is to correctly verify cash balances. The Parmalat case demonstrates the importance of auditing standards regarding evidence and proper auditing procedures. The SEC’s Accounting and Auditing Enforce- ment Release No. 1936, charging Parmalat with fraud, is available on the SEC’s website, www.sec.gov.

E X H I B I T 1 6 – 3

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 537

mes32502_ch16_528-560.indd 537 10/14/15 01:51 PM

Tests of the Bank Reconciliation The auditor typically uses the following audit proce- dures to test the bank reconciliation:

1. Verify the mathematical accuracy of the bank reconciliation working paper and agree the balance per the books to the general ledger. In Exhibit 16–1, the working paper has been footed and the balance per the books as shown on the reconciliation has been agreed to the general ledger.

2. Agree the bank balance on the bank reconciliation with the balance shown on the standard bank confirmation. The bank confirmation shown in Exhibit 16–2 has been prepared so that it corresponds to the bank reconciliation in Exhibit 16–1. The $1,854,890 shown on the bank reconciliation has been agreed to the $1,854,890 balance shown on the bank confirmation in Exhibit 16–2.

3. Trace the deposits in transit on the bank reconciliation to the cutoff bank statement. Any deposit in transit shown on the bank reconciliation should be listed as a deposit shortly after the end of the period. The tick mark next to the deposits in transit shown in Exhibit 16–1 indicates that the deposits were traced by the auditor to the cutoff bank statement.

4. Compare the outstanding checks on the bank reconciliation working paper with the canceled (or substitute) checks contained in the cutoff bank statement for proper payee, amount, and endorsement. The auditor should also ensure that no checks dated prior to December 31 are included with the cutoff bank statement that are not included as outstanding checks on the bank reconciliation. The tick mark next to the outstanding checks shown in Exhibit 16–1 indicates that the checks were traced by the auditor to the cutoff bank statement and that the canceled (or substitute) checks were examined for propriety.

5. Agree any charges included on the bank statement to the bank reconciliation. In some cases, these charges may result in an adjustment to the entity’s books. For example,

Practice I N S I G H T

Newly hired auditors are often assigned to audit cash accounts because cash is typically consid- ered a lower-risk audit area. However, similar to the fraud at Parmalat (see Exhibit 16–3), a mas- sive accounting fraud involving fictitious cash deposits at Satyam Computer Systems, New Delhi, India, was concealed because the auditors did not properly control the bank confirmation process. For noncompliance with PCAOB auditing standards, the Indian affiliate to PricewaterhouseCoopers International Limited was sanctioned and fined $1.5 million by the PCAOB and $6.0 million by the SEC (see Chapter 20 for additional discussion on the Satyam case).

Electronic Bank Confirmation Uncovers $215 Million Fraud

Within 24 hours of a regulatory mandate to use an electronic confirmation service, PFGBest, a commodity brokerage unit of Peregrine Financial Group, Inc., was exposed as a multi-year $215 million fraud. Brian Fox, founder of Confirmation.com, said, “PFGBest is a sadly common example of how easily bank and account information can be falsified to evade detection of accounting frauds. This is a textbook case of how easy it is to use false mailing addresses and fax machines to conceal massive theft and fraud.” The CEO of PFGBest, Russell Wasendorf, admitted to committing fraud and embezzling the funds. He created false bank statements and maintained a post office box that he used to receive the auditor’s standard bank confirmation, which he then returned with forged official bank signatures. To conceal the fraud, Wasendorf insisted that all bank mailings and correspondence come directly to him unopened, and only he had access to the actual account information online. When the fraud was revealed, Wasendorf unsuc- cessfully attempted suicide and PFGBest filed for bankruptcy.

Sources: S. A. Solieri, “The End of a 20-Year-Old Fraud,” Accounting Today (October 1, 2012); and Press release, “Comfirmation.com Uncovers $200 Million Peregrine Financial Group Fraud,” Confirmation.com (July 23, 2012).

E X H I B I T 1 6 – 4

Final PDF to printer

538 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 538 10/14/15 01:51 PM

the bank service charges of $250 and the NSF check for $7,400 received from a customer shown in Exhibit 16–1 require adjustment of the entity’s records.

6. Agree the adjusted book balance to the cash account lead schedule. The adjusted book balance would be part of the amount included in the financial statements for cash.

Fraud-Related Audit Procedures If the entity does not have adequate controls over cash or the auditor suspects that some type of fraud or defalcation involving cash has occurred, it may be necessary to extend the normal cash audit procedures. Although many types of fraud, such as forgery or collusion, are dif- ficult to detect, auditing standards indicate that the auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud.

Three audit procedures that auditors typically use to detect fraudulent activities in the cash accounts are

∙ Extended bank reconciliation procedures. ∙ Proof of cash. ∙ Tests for kiting.

Extended Bank Reconciliation Procedures In some instances, an unscrupulous client might use the year-end bank reconciliation to cover cash defalcations. This is usually accom- plished by manipulating the reconciling items in the bank reconciliation. For example, sup- pose an entity employee stole $5,000 from the entity. The entity’s cash balance at the bank would then be $5,000 less than reported on the entity’s books. The employee could hide the $5,000 shortage in the bank reconciliation by including a fictitious deposit in transit. Thus, the typical approach to searching for possible fraud is to extend the bank reconciliation pro- cedures to examine the disposition of the reconciling items included on the prior months’ reconciliations and the reconciling items included in the current bank reconciliation.

For example, assume that the auditor suspected that some type of fraud had been com- mitted. The auditor would examine the November and December bank reconciliations by ensuring that all reconciling items had been properly handled. For deposits in transit on the November bank reconciliation, the auditor would trace the deposits to the November cash receipts journal to verify that they were recorded. The deposits would also be traced to the December bank statement to verify that they were deposited in the bank. Checks listed as outstanding on the November bank reconciliation would be traced to the November cash dis- bursements journal, and the canceled or substitute checks returned with the December bank statement would be examined for propriety. Other reconciling items such as bank charges, NSF checks, and collections of notes by the bank similarly would be traced to the accounting records for proper treatment. The auditor would examine the reconciling items included on the December bank reconciliation in a similar fashion to ensure that such items were not being used to cover a cash defalcation. Further investigation would be required for any reconciling items not properly accounted for. The entity’s management should be informed if the auditor detects any fraudulent transactions.

Proof of Cash A proof of cash is used to reconcile the cash receipts and disbursements recorded on the entity’s books with the cash deposited into and disbursed from the entity’s bank account for a specific time period. Exhibit 16–5 presents an example of a proof of cash for Calabro Wireless Services for one month, although on some audits a proof of cash is per- formed for the entire period under audit. Because the proof contains four columns, a proof of cash is commonly referred to as a four-column proof of cash. The four columns include

∙ A bank reconciliation for the beginning of the period. ∙ A reconciliation of the cash deposited in the bank with the cash receipts recorded in

the cash receipts journal.

LO 16-6

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 539

mes32502_ch16_528-560.indd 539 10/14/15 01:51 PM

∙ A reconciliation of the cash disbursed through the bank account with the cash disbursements recorded in the cash disbursements journal.

∙ A bank reconciliation for the end of the period.

The primary purposes of the proof of cash are (1) to ensure that all cash receipts recorded in the entity’s cash receipts journal were deposited in the entity’s bank account, (2) to ensure that all cash disbursements recorded in the entity’s cash disbursements journal have cleared the entity’s bank account, and (3) to ensure that no bank transactions have been omitted from the entity’s accounting records. The reader should note that a proof of cash will not detect a theft of cash when the cash was stolen before it was recorded in the entity’s books. If the auditor suspects that cash was stolen without being recorded in the entity’s books, the audit procedures discussed under the completeness assertion for cash receipt transactions in Chapter 10 should be performed.

Example of a Proof of CashE X H I B I T 1 6 – 5

C15 DLJ

1/15/16

December

11/30/15 Receipts Disbursements 12/31/15

Balance per bank $513,324 $457,822ϕ $453,387ϕ $517,759F Deposits in transit: 11/30/15 114,240 (114,240) 12/31/15 116,437 116,437 Outstanding checks: 11/30/15 (117,385) (117,385) 12/31/15 115,312 (115,312) Bank charges 125 (125)ε NSF checks (5,250) (5,250)ε

Balance per books $510,179 $454,769Y $451,439µ $513,509FL

F F F F

F = Footed and crossfooted. L = Agreed to general ledger. ϕ = Traced to December bank statement. Y = Agreed to December cash receipts journal. µ = Agreed to December cash disbursements journal. ε = Traced to the January 14, 2016, bank cutoff statement.

CALABRO WIRELESS SERVICES Proof of Cash—General Cash

12/31/15

Practice I N S I G H T

Skimming is the removal of cash from an organization prior to its entry in an accounting system. Lapping is one of the most common forms of concealing a skimming scheme. As discussed in Chapter 10, lapping occurs when the perpetrator covers the cash shortage by applying cash from one customer’s account against another customer’s account. The perpetrator then eliminates the shortage in the accounting records by recording credit memos or write-offs. Thus, to detect lap- ping, auditors would review the journal entries involving write-offs and credit memos as well as any irregular entries to the cash accounts.

Tests for Kiting When cash has been stolen by an employee, sometimes the employee will attempt to cover the cash shortage by following a practice known as kiting. This involves an employee covering the cash shortage by transferring money from one bank account to another and recording the transactions improperly on the entity’s books. The employee does this by

Final PDF to printer

540 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 540 10/14/15 01:51 PM

preparing a check on one account before year-end but not recording it as a cash disbursement in the account until the next period (paper checks are still commonly used, particularly by small businesses). The check is deposited and recorded as a cash receipt in a second account before year-end. The employee makes this deposit close enough to year-end that the check will not clear the first bank account before the end of the year. While electronic wire transfers are recorded more rapidly than paper transactions, there is often still a one-day delay, which makes kiting possible even without the use of paper checks.

One approach that auditors commonly use to test for kiting is the preparation of an inter- bank transfer schedule such as the one shown in Exhibit 16–6. This exhibit provides six exam- ples of the types of cash transfers an auditor might encounter. For example, transfer 2 is an example of a proper cash transfer. A check was drawn on the disbursing bank account and recorded as a cash disbursement on December 30. It was recorded as a cash receipt in the receiving bank account on December 30 and deposited in that account on December 31. The check cleared the disbursing account on January 2. The auditor would examine this transfer by tracing the check to the December cash disbursements and cash receipts journals and to the December 31 bank reconciliation. Because the check cleared the bank on January 2, it should be listed as an outstanding check on the December 31 bank reconciliation for the disbursing bank account.

Stop and Think: Referring to Exhibit 16–6, which transfers appear to be proper? Do you see any that represent an example of kiting?

You will notice that transfers 1, 3, and 6 are proper cash transfers and transfer 4 repre- sents an example of kiting. A check was written on the disbursing bank account before year- end, but the disbursement was not recorded in the disbursements journal until after year-end (January 2). The check was deposited in the receiving bank account and recorded as a cash receipt before year-end. Thus, the cash shortage in the receiving bank account is covered by a cash deposit from the disbursing bank account, and the net effect is that cash is overstated by $10,000. As noted in Exhibit 16–6, transfer 5 is also improper in that a deposit was made

Example of an Interbank Transfer ScheduleE X H I B I T 1 6 – 6

Disbursing Bank Account Receiving Bank Account

Transfer Number* Amount

Recorded in Client’s Books

Paid by Bank

Recorded in Client’s Books

Received by Bank

1 $15,000 12/28 12/30 12/28 12/29 2 7,500 12/30 1/2 12/30 12/31 3 8,400 12/31 1/2 12/31 1/2 4 10,000 1/2 1/2 12/30 12/31 5 3,000 1/3 1/3 1/3 12/30 6 17,300 1/2 1/4 1/2 1/2

* Explanation for each transfer in determining proper cash cutoff at 12/31: 1. The transfer was made on December 28 and recorded on the books as both a receipt and a disbursement on the same date. The check written was

deposited on December 28 in the receiving bank account and credited on the bank statement the next day. The check cleared the disbursing bank account on December 30. All dates are in the same accounting period, so there are no questions as to the propriety of the cutoff.

2. This transfer is proper. However, the transfer check should appear as an outstanding check on the reconciliation of the disbursing bank account. 3. Transfer 3 is also proper. In this example, the transfer should appear as a deposit in transit on the reconciliation of the receiving bank account and as an

outstanding check on the reconciliation of the disbursing bank account. 4. This transfer represents kiting because the receipt was recorded on the books in the period prior to that in which the corresponding disbursement was

recorded. Cash is overstated by $10,000. 5. Transfer 5 is also improper. In this case a deposit was made in the receiving bank in one period without the receipt being made in the books until the

subsequent period. Unless this matter is explained on the reconciliation for the receiving bank, the transfer was apparently made to temporarily cover a shortage in that account. While the shortage will become apparent in the accounts as soon as the transfer is recorded in the following period, it will be covered by an unrecorded deposit on the balance sheet date.

6. This transfer is proper.

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 541

mes32502_ch16_528-560.indd 541 10/14/15 01:51 PM

in the receiving bank in one period without the receipt being made in the books until the subsequent period. The matter should be included and explained on the reconciliation for the receiving bank.

Practice I N S I G H T

According to a recent report produced by the Association of Certified Fraud Examiners (www.acfe.com), fraudulent cash disbursements can be divided into five distinct subcategories:

• Billing schemes, where an individual causes the organization to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases.

• Payroll schemes, where an employee causes the organization to issue a payment by making false claims for compensation.

• Expense reimbursement scheme, where an employee makes a claim for reimbursement of ficti- tious or inflated business expenses.

• Check tampering, where the perpetrator converts an organization’s funds by forging or altering a check on one of the organization’s bank accounts or steals a check the organization has legiti- mately issued to another payee.

• Register disbursement schemes, where an employee makes false entries on a cash register to conceal the fraudulent removal of currency.

In some instances an interbank transfer schedule is used even though control activities are adequate and no fraud is suspected. When an entity maintains many cash accounts, cash transfers may be inadvertently mishandled. The use of an interbank transfer schedule provides the auditor with evidence on the proper cutoff for cash transactions.

Auditing a Payroll or Branch Imprest Account The audit of any imprest cash account such as payroll or a branch account follows the same basic audit steps discussed under the audit of the general cash account. The auditor obtains a bank reconciliation, along with a standard bank confirmation and a cutoff bank statement. However, the audit testing is less extensive for two reasons. First, the imprest balance in the account is generally not material. For example, an imprest payroll or branch account may contain a minimum balance, of say $100, required by the bank to keep the account open and active except for the short time after a payroll deposit and before the related payroll disburse- ments have cleared. Second, the types of disbursements from the account are homogeneous. The checks are for similar types of transactions and for relatively small amounts. For example, there are often limits on the size of an individual payroll check.

Auditing a Petty Cash Fund Most entities maintain a petty cash fund for paying certain types of expenses or transactions. Although the balance in the fund is not material (hence the word “petty”), there is a potential for defalcation because an entity’s employee may be able to process numerous fraudulent transactions through the fund over the course of a year. External auditors seldom perform sub- stantive procedures on the petty cash fund, except when fraud is suspected. Internal auditors (see Chapter 21) often do document and perform testing of the controls over the petty cash fund. For smaller entities without an internal audit function, the external auditors may also perform limited testing of controls over petty cash.

Common controls over petty cash involve the use of prenumbered petty cash vouchers for withdrawing cash from the fund, and a limit should be placed on the size of reimbursements made from petty cash. Periodically, the petty cash fund is reimbursed from the general cash account. Accounts payable clerks should review the vouchers for propriety before replenish- ing the petty cash fund. Finally, someone independent of the cash function should conduct surprise counts of the petty cash fund.

Final PDF to printer

542 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 542 10/14/15 01:51 PM

Disclosure Issues for Cash The auditor must consider a number of important financial statement disclosures when audit- ing cash. Some of the more common disclosure issues are shown in Table 16–3. The audi- tor’s review of the minutes of board of directors’ meetings, line-of-credit arrangements, loan agreements, and similar documents is the primary source of the information for the financial statement disclosures. In addition, the auditor typically confirms items such as compensating balances required under a bank line of credit.

Exhibit 16–7 illustrates a letter for confirmation of compensating balances, while Exhibit 16–8 presents an example of footnote disclosures for compensating balances.

Examples of Disclosure Items for Cash

Accounting policy for defining cash and cash equivalents Any restrictions on cash such as a sinking fund requirement for funds allocated by the entity’s board of directors for

special purposes Contractual obligations to maintain compensating balances Cash balances restricted by foreign exchange controls Letters of Credit

T A B L E 1 6 – 3

Illustrative Letter for Confirmation of Compensating Balances

CALABRO WIRELESS SERVICES December 31, 2015

Mr. John L. Gren First National Bank Tampa, FL 34201

Dear Mr. Gren:

In connection with an audit of the financial statements of Calabro Wireless Services as of December 31, 2015, and for the year then ended, we have advised our independent auditors that as of the close of business on December 31, 2015, there were compensating balance arrangements as described in our agreement dated June 30, 2011. Withdrawal by Calabro Wireless Services of the compensating balance was not legally restricted as of December 31, 2015. The terms of the compensating balance arrangements at December 31, 2015, were:

The company has been expected to maintain a compensating balance, as determined from your bank’s ledger records without adjust- ment for estimated average uncollected funds, of 15% of its outstanding loans plus 10% of its unused line of credit.

The company was in compliance with, and there have been no changes in, the compensating balance arrangements during the year ended December 31, 2015, and subsequently through the date of this letter.

During the year ended December 31, 2015, and subsequently through the date of this letter, no compensating balances were main- tained by the company at your bank on behalf of an affiliate, director, officer, or any other third party, and no third party maintained com- pensating balances at the bank on behalf of the company.

Please confirm whether the information about compensating balances presented above is correct by signing below and returning this letter directly to our independent auditors, Abbott & Johnson, LLP. P.O. Box 669, Tampa, FL 32691.

Sincerely,

Calabro Wireless Services

BY: Jan Rodriguez Jan Rodriguez, Controller

Dear Abbott & Johnson, LLP:

The above information regarding the compensating balance arrangement with this bank agrees with the records of this bank.

BY: Jan Rodriguez Date: 1/14/16 Jan Rodriguez, Controller

E X H I B I T 1 6 – 7

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 543

mes32502_ch16_528-560.indd 543 10/14/15 01:51 PM

Entities frequently invest in securities of other entities. Such investments might include equity securities such as common and preferred stock, debt securities such as notes and bonds, and hybrid securities such as convertible bonds and stocks. The accounting for such instruments is affected by factors such as the percentage of the other entity owned, the degree of influence exercised over the entity, the classification of the investment as a current or noncurrent asset, fair-value considerations, and a myriad of other factors. For example, FASB ASC Topic 320, “Investments—Debt and Equity Securities,” provides detailed guidance on how to account for investments in certain debt and equity securities. The Advanced Module at the end of this chapter discusses auditing fair value measurements.

On a general level, the auditor’s consideration of investments is no different than for any other financial statement account. That is, the auditor must be assured that the amounts shown on the balance sheet for the various types of investments are not materially misstated. This includes the proper recognition of interest income, dividends, and changes in value that must be included in the financial statements.

The inherent risks associated with investments vary with the amount of activity, the com- plexity, and valuation considerations. For example, an investment in stock of a publicly traded company is relatively easy to account for and audit. However, more complex financial instru- ments, such as derivatives and asset-backed securities, have become increasingly common holdings in investment portfolios. These complex financial instruments require substantial subjective judgments by management in the value of inputs used to determine fair values as of the reporting dates. It is not uncommon for the reasonable range of estimation uncertainty to be very large.1 Due to the judgment and complexity associated with these types of financial instruments, the auditor is likely to assess the inherent risk as high.

For an entity that has a large investment portfolio, the auditor is likely to follow a reliance strategy in which internal control is formally evaluated and tests of controls are performed in order to set control risk below the maximum. However, for the vast majority of entities that do not require an audit of internal control over financial reporting, it is more efficient for the auditor to follow a substantive strategy and perform a detailed audit of the investment securi- ties at year-end.

LO 16-7

1Academic research has demonstrated that the range of irreducible uncertainty can be many times larger than overall materiality. See B. Christensen, S. Glover, and D. Wood, “Extreme Estimation Uncertainty in Fair Value and Other Estimates: The Implications for Audit Assurance,” Auditing: A Journal of Practice & Theory, 2012, Vol. 31, No. 1.

Auditing Investments

Control Risk Assessment—Investments

The discussion of investments that follows focuses on the general types of control activities that should be present to minimize the likelihood of a material misstatement. Even when a substantive strategy is followed, the auditor must reasonably understand control over invest- ments in order to anticipate the types of misstatements that may occur and plan the substantive

LO 16-8

Sample Disclosure of Compensating Balances

Lines of Credit:

On December 31, 2011, the company established a line of credit with a bank that provides for unsecured borrowings of $7,000,000 at the bank’s prime rate (7% at December 31, 2015). At December 31, 2014 and 2015, $200,000 and $800,000, respectively, had been borrowed under this arrangement. Under the credit arrangement, the company is expected to maintain compensating balances equal to 5 percent of the borrowings in excess of $500,000. This requirement is generally met through normal operating cash balances, which are not restricted as to withdrawal.

E X H I B I T 1 6 – 8

Final PDF to printer

544 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 544 10/14/15 01:51 PM

procedures. The main assertions that concern the auditor are occurrence, authorization, com- pleteness, accuracy, and classification. Proper segregation of duties is important in ensuring the propriety of investments and will be discussed briefly.

Assertions and Related Control Activities Following are some of the more common controls that should be present for each of the important assertions for investments.

Occurrence and Authorization Controls must ensure that the purchase or sale of any investment is properly initiated by authorized individuals. First, the entity should have ade- quate documents to verify that a particular purchase or sale of a security was properly initi- ated and approved. The presence of adequate documentation allows the auditor to determine the validity of the transaction. Second, the commitment of resources to investment activities should be approved by the board of directors or by an executive who has been delegated this authority. An entity engaging in recurring investment activities should have an entity-wide general investment policy as well as specific procedures and control activities around indi- vidual investment transactions. The board of directors should establish general policies to guide the entity’s investment activities, while the specific procedures for the purchase and sale of securities may be delegated to an individual executive, an investment committee, or outside investment advisers. If the entity has proper controls for initiating and authorizing securities transactions, it is generally easy for the auditor to verify security transactions at the end of the period.

Completeness The entity should maintain adequate controls to ensure that all securities transactions are recorded, and the auditor should evaluate the design and operating effective- ness of the entity’s controls. One control for handling the detailed securities transactions is maintenance of a securities ledger that records all securities owned by the entity. The entity should reconcile the subsidiary ledger to the general ledger control account regularly. Person- nel responsible for investment activities should periodically review the securities owned to ensure that all dividends and interest have been received and recorded in the entity’s records.

Accuracy and Classification Some important accuracy and classification issues are related to investment securities. As mentioned previously, ASC Topic 320 addresses account- ing and reporting for investments in equity securities that have readily determinable fair val- ues and for all investments in debt securities. The standard requires that those investments be classified in three categories and accounted for as follows:

∙ Debt securities that the entity has the positive intent and ability to hold to maturity are classified as held-to-maturity securities and reported at amortized cost.

∙ Debt and equity securities that are bought and held principally for the purpose of selling them in the near term are classified as trading securities and reported at fair value, with unrealized gains and losses included in earnings.

∙ Debt or equity securities not classified as either held-to-maturity or trading securities are classified as available-for-sale securities and are reported at fair value, with unrealized gains and losses excluded from earnings and reported in other comprehensive income until realized.

Practice I N S I G H T

Scholars examining public company financial statements have found evidence suggesting that com- panies realize gains and losses on available-for-sale securities to smooth earnings. A company can also manipulate financial statements by intentionally misclassifying securities or transferring securi- ties to a different class of investment. For example, a company might transfer a security from held-to- maturity to trading, which would trigger the recognition of a gain or a loss.

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 545

mes32502_ch16_528-560.indd 545 10/14/15 01:51 PM

The entity’s controls should ensure that securities are properly classified and that appro- priate prices are used to accurately value investments for financial statement purposes.

One final issue related to the control risk for investments is that the entity should have adequate custodial procedures to safeguard against theft. When securities are held by the entity, they should be stored in a safe or safe-deposit box. Procedures should provide for peri- odic inspections by an individual independent of both the custodial and accounting respon- sibilities for securities. If an independent custodian such as a broker maintains securities, the entity needs to establish procedures for authorizing the transfer of securities. For example, one approach would require dual authorization by appropriate management personnel.

Segregation of Duties Table 16–4 contains some key segregation of duties for investments and examples of possible errors or fraud that can result from conflicts in duties. However, only entities that engage in a significant number of investment activities are likely to have adequate segregation of duties for all investment activities. When some of the duties noted in Table 16–4 are not segregated, the entity should have other compensating controls such as a regular review by a person in a higher level of management of the performance of the duty not segregated.

LO 16-9

Key Segregation of Duties for Investments and Possible Errors or Fraud

Segregation of Duties Possible Errors or Fraud Resulting from Conflicts of Duties

The initiation function should be segregated from the final approval function.

If one individual is responsible for both the initiating and approving of securities transactions, fictitious transactions can be made or securities can be stolen.

The valuation-monitoring function should be segregated from the acquisition function.

If one individual is responsible for both acquiring securities and monitoring their valuation, securities values can be improperly recorded or not reported to management.

Responsibility for maintaining the securities ledger should be separate from that of making entries in the general ledger.

If one individual is responsible for both the securities ledger and the general ledger entries, that individual can conceal any defalcation that would normally be detected by reconciliation of subsidiary records with general ledger control accounts.

Responsibility for custody of the securities should be separate from that of accounting for the securities.

If one individual has access both to securities and to the supporting accounting records, a theft of the securities can be concealed.

T A B L E 1 6 – 4

Substantive Procedures—Investments

As discussed earlier, it is generally more efficient to follow a substantive strategy for auditing investments. When the control risk is set at the maximum, the auditor conducts extensive sub- stantive procedures to reach the planned level of detection risk. Additionally, because of the nature of the audit work due to relatively few transactions and/or the availability of third party investment records, tests of details of transactions are seldom used as a source of evidence.

Substantive Analytical Procedures—Investments Substantive analytical procedures such as the following can be used to evaluate the overall reasonableness of investments and related income statement accounts:

∙ Comparison of the balances in the current year’s investment accounts with prior years’ balances after consideration of the effects of current-year operating and financing activities on cash and investments.

∙ Comparison of current-year interest and dividend income with the reported income for prior years and with the expected return on investments.

∙ Recompute current-year interest income using the face amount of securities held, interest rate, and time period held.

LO 16-10

Final PDF to printer

546 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 546 10/14/15 01:51 PM

Tests of Details—Investments Auditing standards provide guidance concerning substantive auditing procedures the auditor can perform when gathering evidence related to assertions for investments. Table 16–5 sum- marizes the audit procedures performed on the investment account for balance and presenta- tion and disclosure assertions. The discussion of the investment account audit procedures focuses on the more important assertions. The procedures shown for the other assertions should be familiar to you.

Existence Auditing standards state that the auditor should perform one or more of the fol- lowing audit procedures when gathering evidence for existence:

∙ Physical examination. ∙ Confirmation with the issuer. ∙ Confirmation with the custodian. ∙ Confirmation of unsettled transactions with the broker-dealer. ∙ Confirmation with the counterparty. ∙ Reading executed partnership or similar agreements.

If the entity maintains custody of the securities, the auditor normally examines the securi- ties. During the physical count, the auditor should note the name, class and description, serial number, maturity date, registration in the name of the entity, interest rates or dividend pay- ment dates, and other relevant information about the various securities. The auditor should insist that a representative of the entity be present during the physical inspection of securities in order to acknowledge that all securities inspected are returned. If the securities are held in a safe-deposit box and the auditor is unable to inspect and count the securities on the balance sheet date, the auditor should consider having the bank seal the safe-deposit box until the auditor can count the securities at a later date. When the securities are held by an issuer or a custodian such as a broker or investment adviser, the auditor gathers sufficient, appropriate evidence for the existence assertion by confirming the existence of the securities. The informa- tion contained in the confirmation needs to be reconciled with the entity’s investment records.

Examples of Tests of Account Balances and Disclosures—Investments

Assertions about Account Balances at Period End Example Tests of Details of Account Balances

Existence Inspect securities if maintained by client or obtain confirmation from independent custodian. Rights and obligations Examine brokers’ advices for a sample of securities purchased during the year. Completeness Search for purchases of securities by examining transactions for a few days after year-end.

Confirm securities held by independent custodian. Review and test securities information to determine if all interest and dividend income has been recorded.

Valuation and allocation Review brokers’ invoices for cost basis of securities purchased. Determine basis for valuing investments by tracing values to published quotations for marketable securities. Determine whether there has been any permanent impairment in the value of the cost basis of an

individual security. Examine sales of securities to ensure proper recognition of realized gains or losses. Obtain a listing of investments by category (held-to-maturity, trading, and available-for-sale); foot listing and

agree totals to securities register and general ledger.

Assertions about Presentation and Disclosure Example Tests of Details of Disclosures

Occurrence and rights and obligations Determine whether any securities have been pledged as collateral by (1) asking management and (2) reviewing board of directors’ minutes, loan agreements, and other documents.

Completeness Determine that all disclosures required by ASC Topic 320 have been made for investments (both debt and equity securities).

Complete financial reporting checklist to ensure all financial statement disclosures related to investments are made.

Classification and understandability Review and inquire of management of proper classification of investments. Read footnotes to ensure that required disclosures are understandable.

Accuracy and valuation Read footnotes and other information to ensure that the information is accurate and properly presented at the appropriate amounts.

T A B L E 1 6 – 5

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 547

mes32502_ch16_528-560.indd 547 10/14/15 01:51 PM

Valuation and Allocation When securities are initially purchased, they are recorded at their acquisition cost. The auditor can verify the purchase price of a security by examining a broker’s invoice or similar document. Debt securities that are to be held to maturity should be valued at their amortized cost. The auditor should have verified the purchase price of the debt at the time of purchase, and the effective interest rate should be used to recognize the interest income, which the auditor can recompute. The fair value of most equity securities is available from securities exchanges registered with the Securities and Exchange Commission or on the over-the-counter market. The auditor can verify these values by tracing them to sources such as brokers, The Wall Street Journal, or other reliable financial publications.

Some investments do not have fair values that can be readily obtained from market data and thus require substantial judgment on the part of management. Auditing of fair value mea- surement is covered in the Advanced Module at the end of this chapter.

The auditor must also determine if there has been any other than temporary changes to the fair value of the investment security. The following factors are indicators that the value decline of the investment may be other than temporary.

∙ Fair value is significantly below cost. ∙ The decline in fair value is attributable to specific adverse conditions affecting a

particular investment. ∙ The decline in fair value is attributable to specific conditions, such as conditions in an

industry or in a geographic area. ∙ Management does not possess both the intent and the ability to hold the investment

long enough to allow for any anticipated recovery in fair value. ∙ The decline in fair value has existed for an extended period. ∙ A debt security has been downgraded by a rating agency. ∙ The financial condition of the issuer has deteriorated. ∙ Dividends have been reduced or eliminated, or scheduled interest payments on debt

securities have not been made.

If the investment value is determined to be other than temporarily impaired, the secu- rity should be written down and a new carrying amount established. Last, the auditor should examine the sale of any security to ensure that proper values were used to record the sale and any realized gain or loss.

Disclosure Assertions Two issues are important when the auditor examines the proper classification of investments. First, marketable securities need to be properly classified as held-to-maturity, trading, or available-for-sale because both the balance sheet and income statement are affected by misclassification. Second, the financial statement classification requires that all trading securities be reported as current assets. Held-to-maturity securities and individual available-for-sale securities should be classified as current or noncurrent assets based on whether management expects to convert them to cash within the next 12 months. If the security is expected to be converted to cash within 12 months, it should be classified as a current asset. The auditor should ask management about its plans to sell securities.

Auditing standards also guide auditors in evaluating both management’s intent with regard to an investment and the entity’s ability to hold a debt security to maturity. In evaluat- ing management’s intent, the auditor should consider whether investment activities corrobo- rate or conflict with management’s stated intent. The auditor should examine evidence such as written and approved records of investment strategies, records of investment activities, instructions to portfolio managers, and minutes of meetings of the board of directors or the investment committee. In evaluating an entity’s ability to hold a debt security to maturity, the auditor should consider factors such as the entity’s financial position, working capital needs, operating results, debt agreements, guarantees, and other relevant contractual obliga- tions, as well as laws and regulations. The auditor should also consider operating and cash flow projections or forecasts when considering the entity’s ability to hold the debt security to maturity.

Final PDF to printer

548 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 548 10/14/15 01:51 PM

ASC Topic 320 requires specific disclosures for securities. For example, the aggregate fair value and gross unrealized holding gains or losses on securities should be presented for available-for-sale or held-to-maturity securities.

Most of the information necessary for such disclosures is developed as the other asser- tions are being tested. In addition, the amount of any securities pledged as collateral should be disclosed. To collect such information, the auditor might inquire of management, review the board of directors’ minutes, and examine loan agreements and other relevant documents.

Advanced Module: Auditing Fair Value Measurements FASB ASC Topic 820 establishes a framework for measuring fair value in accordance with GAAP. It defines fair value as the price that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants at the measurement date. Because orderly transactions between market participants may or may not be observable at the measurement date, FASB ASC Topic 820 provides a hierarchy with three levels that distinguish the types of inputs used to value different types of assets and liabilities at their appropriate fair values:

∙ Level 1: Valuations are based on quoted prices in active markets for identical assets or liabilities. Sometimes called “marking to market,” valuations in this category typically apply to assets such as publicly traded stocks, options, bonds, and mutual funds.

∙ Level 2: Valuations are based on directly or indirectly observable market data for similar or comparable assets or liabilities. Sometimes called “marking to matrix,” Level 2 inputs include quoted prices for similar assets or liabilities in active markets or inputs other than quoted prices that are observable for the asset or liability (interest rates, standard deviation, default rates, etc.). Examples of assets in this category include infrequently traded bonds and some mortgage and asset-based securities.

∙ Level 3: Valuations are based on management’s best judgment and involve management’s assumptions about how the market would price an asset or liability where the inputs are unobservable because there is little or no active market for the asset or liability being valued. Sometimes called “marking to model,” valuation in this category may include assets such as long-term options, real estate, and private- equity investments.

An individual fair value measurement, such as an employee stock option, may contain inputs from one or all of the three levels, but the measurement in its entirety is categorized based on the lowest level of its significant inputs. For example, the Black-Scholes option- pricing model requires the exercise price, stock price, length of time until option expires, stock price volatility, dividend yield, and risk-free rate as inputs. Some of these inputs, such as stock price, may be quoted in active markets and would be Level 1 inputs. However, other inputs, such as stock price volatility, are not likely Level 1 inputs as the volatility requires an estimate based on historical data over a period of time, which may or may not be expected to be representative of the future. Therefore, stock price volatility would likely be categorized as either a Level 2 or Level 3 input, depending on the availability of similar or comparable vola- tility data and estimates. Thus, the employee stock options as a whole would be categorized as either a Level 2 or Level 3 fair value measurement, consistent with the lowest level of input in categorizing the asset.

Stop and Think: How would the different fair value levels affect planned audit procedures? How would an audit plan for an entity whose financial instruments are mostly Level 1 be different from that for an entity whose financial instruments are mostly Level 2 or Level 3?

LO 16-11

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 549

mes32502_ch16_528-560.indd 549 10/14/15 01:51 PM

As preparers and auditors consider the implications of using the different fair value levels to value assets and liabilities, moving from Level 1’s objective market-driven inputs to Level 2 or 3 inputs means objective measures are replaced with increasingly subjective inputs, some based on management’s assumptions. Complicated financial instruments, such as credit default swaps, asset-backed securities, and collateralized debt obligations, among others, often are not traded on active markets, making accurate valuation of such instruments diffi- cult. The valuation of assets and liabilities, and the related income statement effect of reduc- tions in fair value, can have material implications for amounts reported in the financial statements.2 As a result, gathering sufficient, appropriate evidence to support the entity’s fair value measurements and related disclosures is an increasingly important—and risky—area of many audits.

As an example of how fair value measurements can materially impact an audit, let’s return to our example of the Black-Scholes option-pricing model. Assume the following information concerning the audit of a successful entity in the computer and technology sector:

∙ Income before tax: $700 million. ∙ Overall materiality at 5 percent of net income before taxes: $35 million. ∙ Tolerable misstatement applied to stock compensation expense: $26.25 million. ∙ The company has 7 million options outstanding at the end of the year.

ASC Topic 718 requires that the expense for employee stock options be reported at fair value. One way to estimate the fair value of the expense is to use the Black-Scholes option- pricing model. Continuing our example, the following values have been determined for the model’s inputs:

∙ Stock price at valuation date: $130. ∙ Exercise price: $140. ∙ Dividend yield: 0.00 percent. ∙ Time until expiration: 10 years. ∙ Risk-free rate: 3.8 percent. ∙ Volatility of stock price: between 36 and 40 percent.

If management decides to calculate stock compensation expense based on the lower stock-price volatility, the model provides an expense equal to $471.1 million. However, if management were to use the higher range of volatility, the model provides an expense equal to $502.9 million. The difference between the two estimates is $31.8 million, which is greater than the tolerable misstatement applied to the account and almost as large as overall material- ity for the entire engagement. This example demonstrates the significant impact that small changes in assumptions in fair value–measurement models can have on the financial state- ments. It also highlights the difficulty preparers and auditors are in when evaluating the fair- ness of the reported amount of option expense.

In this module, we briefly cover four important areas in the auditing of fair value mea- surements from the more complete guidance provided AU-C 540, Auditing Accounting Esti- mates, Including Fair Value Accounting Estimates and Related Disclosures.

∙ Obtaining an understanding of how management makes fair value measurements. ∙ Considering whether specialized skills or knowledge are required. ∙ Testing the entity’s fair value measurements. ∙ Evaluating the reasonableness of the fair value measurements.

2For example, the reasonable range of estimation uncertainty associated with some estimates can be larger than overall materiality. See B. Christensen, S. Glover, and D. Wood, “Extreme Estimation Uncertainty in Fair Value and Other Estimates: The Implications for Audit Assurance,” Auditing: A Journal of Practice & Theory, 2012, Vol. 31, No. 1.

Final PDF to printer

550 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 550 10/14/15 01:51 PM

Understanding How Management Makes Fair Value Measurements In order to plan the nature, timing, and extent of audit procedures associated with auditing fair value measurements, the auditor gains an understanding of the entity’s process for deter- mining fair value measurements and disclosures and of the relevant controls by considering factors such as

∙ The types of accounts or transactions requiring fair value measurements. ∙ The nature of the assumptions, including which of the assumptions are likely to be

significant assumptions. ∙ How management considered the nature of the asset or liability being valued,

including how and why they selected a particular valuation method or model. ∙ Whether the entity operates in a particular industry where specific models are

commonly used for fair value measurement. ∙ The extent to which the entity’s process relies on a service organization to provide

fair value measurements. ∙ The nature and extent of documentation, if any, supporting management’s assumptions. ∙ The controls related to the review and approval of accounting estimates (including

the assumptions or inputs used in their development) by appropriate levels of management and, where appropriate, those charged with governance.

∙ The controls over how management determines the completeness, relevance, and accuracy of the data used to develop accounting estimates.

As the risk and complexity of the fair value measurements increase, so also does the extent of the audit procedures.

Considering Whether Specialized Skills or Knowledge Is Required Auditors must have a good understanding of the accounting and auditing frameworks associ- ated with fair value measurements, but it is not realistic to expect all auditors to be experts in the area of valuation. A valuation specialist is often engaged to help obtain audit evidence when the valuation model used by management is complex, the markets for the asset or liabil- ity are not currently active, or a high degree of estimation uncertainty exists. We discussed the use of specialists in Chapter 3, and auditing standards address the use of specialists in AU-C 620, Using the Work of an Auditor’s Specialist.

Testing the Entity’s Fair Value Measurements Based on the understanding of management’s processes and the risk assessment, auditors plan the nature, timing, and extent of the testing. Substantive tests of fair value measure- ments for Level 1 assets or liabilities, such as publicly traded stocks and bonds, is relatively straightforward, as market pricing can be easily verified by the auditor by, for example, corroborating closing stock prices with prices published in The Wall Street Journal. Sub- stantive audit procedures for Level 2 or Level 3 valuations, such as complicated derivatives, may include

∙ Testing whether the assumptions appropriately reflect observable market assumptions. ∙ Testing management’s assumptions for bias. ∙ Performing sensitivity analyses to determine the effects of changes in the assumptions

on a fair value estimate. ∙ Testing whether management’s rationale for the method selected is reasonable. ∙ Testing that the underlying data used in the valuation model are accurate, complete,

and relevant. ∙ Developing an independent point estimate or range for corroborative purposes. ∙ Reviewing subsequent events and transactions.

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 551

mes32502_ch16_528-560.indd 551 10/14/15 01:51 PM

In testing the models used by management, it is important for auditors to understand the inherent weaknesses of valuation models. As opposed to active markets, valuation models do not take qualitative factors into account when creating a fair value.

Qualitative factors include an assessment of how active the market is and whether current exit prices should be used to value a security an entity intends to hold. Models are tools used to capture and evaluate complex and uncertain inputs to derive estimated fair values, but they have limitations. Uncertainty arises for a variety of reasons, including the length of forecast and the subjectivity and complexity associated with the factors in the model. Given the inher- ent uncertainty in the inputs, valuation models rarely provide the “correct” or exact value and should be viewed as providing a range of reasonable values, all of which should be considered in light of other industry and market information.

Stop and Think: What do you think are some qualitative factors that would impact the valuation of an asset-backed security (such as a bundle of home mortgages discussed in Exhibit 15–1)?

Further, auditors must test management’s assumptions for bias, which can be difficult to detect at the account level. Such bias may be identified only by considering management’s accounting estimates in aggregate or the accuracy of past estimates over a number of account- ing periods. Although some degree of management bias is inherent in subjective decisions, in making such judgments there may be no intention by management to mislead the users of financial statements. However, where the intent to mislead is present, management bias can be considered fraudulent in nature.

Evidence obtained from audit procedures performed for other purposes also may provide evidence relevant to the measurement and disclosure of fair values. For example, inspection procedures to verify existence of an asset measured at fair value also may provide relevant evidence about its valuation, such as the physical condition of the asset.

Evaluating the Reasonableness of the Fair Value Measurements After obtaining sufficient appropriate evidence through substantive tests, the auditor then eval- uates whether management’s measurements and disclosures are in accordance with GAAP.

As capital markets continue to increase the complexity of financial instruments, it will be increasingly important for auditors to be proficient in understanding how fair value estimates are created and the impact they have on the overall audit plan.

Practice I N S I G H T

During the recent PCAOB inspections of two of the Big 4 firms, the PCAOB inspection team identified deficiencies having to do with auditing fair value estimates. For example, one auditor failed to evalu- ate the reasonableness of some of the assumptions used to support the estimated fair values of cer- tain illiquid securities. Another auditor failed to obtain an understanding of the methodologies used to develop the fair value measurement for securities that were not actively traded (www.pcaob.org).

KEY TERMS

Final PDF to printer

552 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 552 10/14/15 01:51 PM

Cash equivalents. Short-term, highly liquid investments that are readily convertible to cash or so near their maturity that there is little risk of change in their value (e.g., money market funds, Treasury bills). Confirmation. The process of obtaining and evaluating direct communication from a third party in response to a request for information about a particular item affecting financial state- ment assertions. Fair value. The price that would be received to sell an asset or paid to transfer a liability in an orderly transaction between market participants at the measurement date. Imprest account. A bank account containing a stipulated amount of money used for lim- ited purposes (e.g., imprest accounts are frequently used for disbursing payroll and divi- dend checks). Proof of cash. A technique used to reconcile the cash receipts and disbursements recorded on the entity’s books with the cash deposited into and disbursed from the entity’s bank account for a specific time period. Reliance strategy. The auditor’s decision to rely on the entity’s controls, test those controls, and reduce the direct tests of the financial statement accounts. Substantive tests of transactions. Tests to detect errors or fraud in individual transactions. Tests of controls. Audit procedures performed to test the operating effectiveness of con- trols in preventing, or detecting and correcting, material misstatements at the relevant assertion level. Tests of details of account balances and disclosures. Substantive tests that concentrate on the details of items contained in the account balance and disclosure.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 16-1 16-1 How does an entity’s controls over cash receipts and disbursements affect the nature and extent of the auditor’s substantive tests of cash balances?

LO 16-2 16-2 Briefly describe each type of bank account. How does an imprest account help to improve control over cash?

LO 16-3 16-3 Why are analytical procedures of limited use in the audit of the cash balance? LO 16-4, 16-5 16-4 Explain why the standard bank confirmation form does not identify all information

about an entity’s bank accounts or loans. LO 16-4, 16-5 16-5 Why does an auditor obtain a cutoff bank statement when auditing a bank account?

What information is examined on the canceled or substitute checks returned with the cutoff bank statement?

LO 16-6 16-6 List three fraud-related audit procedures for cash. LO 16-6 16-7 What is one approach used by auditors to test for kiting? LO 16-8, 16-9 16-8 What are the main transaction-related assertions for investments? Identify the key

segregation of investment-related duties and possible errors or fraud that can occur if this segregation is not present.

LO 16-10 16-9 Briefly describe the classification and valuation issues related to investments in debt and equity securities.

LO 16-10 16-10 What two presentation classification issues are important for the audit of investments?

LO 16-11 16-11 How does the fair value evidence the auditor is likely to gather differ between Level 1 and Level 3 assets?

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 553

mes32502_ch16_528-560.indd 553 10/14/15 01:51 PM

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

Questions 16-12 and 16-13 relate to the following bank transfer schedule.

MILES COMPANY Bank Transfer Schedule

December 31

Check Number

Bank Account Date

Disbursed per Date

Deposited per

From To Amount Books Bank Books Bank

2020 First National Suburban $32,000 12/31 1/5♦ 12/31 1/3▲ 2021 First National Capital 21,000 12/31 1/4♦ 12/31 1/3▲ 3217 Second State Suburban 6,700 1/3 1/5 1/3 1/6 0659 Midtown Suburban 5,500 12/30 1/5♦ 12/30 1/3▲

LO 16-4, 16-6 16-12 The tick mark ♦ most likely indicates that the amount was traced to the a. December cash disbursements journal. b. Outstanding check list of the applicable bank reconciliation. c. January cash disbursements journal. d. Year-end bank confirmations.

LO 16-4, 16-6 16-13 The tick mark ▲ most likely indicates that the amount was traced to the a. Deposit in transit of the applicable bank reconciliation. b. December cash receipts journal. c. January cash receipts journal. d. Year-end bank confirmations.

LO 16-5 16-14 An auditor ordinarily sends a standard confirmation request to all banks with which the entity has done business during the year under audit, regardless of the year-end balance. One purpose of this procedure is to

a. Provide the data necessary to prepare a proof of cash. b. Request that a cutoff bank statement and related checks be sent to the auditor. c. Detect kiting activities that may otherwise not be discovered. d. Seek information about loans from the banks.

LO 16-5 16-15 The primary evidence regarding year-end bank balances is documented in the a. Standard bank confirmations. b. Outstanding check listing. c. Interbank transfer schedule. d. Bank deposit lead schedule.

LO 16-5 16-16 On receiving the cutoff bank statement, the auditor should vouch a. Deposits in transit on the year-end bank reconciliation to deposits in the cash

receipts journal. b. Checks dated before year-end listed as outstanding on the year-end bank recon-

ciliation to the cutoff statement. c. Deposits listed on the cutoff statement to deposits in the cash receipts journal. d. Checks dated after year-end to outstanding checks listed on the year-end bank

reconciliation and to the cutoff statement.

Final PDF to printer

554 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 554 10/14/15 01:51 PM

LO 16-6 16-17 Which of the following cash transfers results in a misstatement of cash at December 31?

Bank Transfer Schedule

Disbursing Bank Account Receiving Bank Account

Transfer Recorded in

Client’s Books Paid by Bank

Recorded in Client’s Books

Received by Bank

a. 12/31 1/4 12/31 12/31 b. 1/4 1/5 12/31 1/4 c. 12/31 1/5 12/31 1/4 d. 1/4 1/11 1/4 1/4

LO 16-8, 16-9 16-18 Which of the following controls would most effectively ensure that the proper cus- tody of assets in the investing process is maintained?

a. Direct access to securities in the safe-deposit box is limited to one corporate officer. b. Personnel who post investment transactions to the general ledger are not permit-

ted to update the investment subsidiary ledger. c. Purchase and sale of investments are executed on the specific authorization of the

board of directors. d. The recorded balances in the investment subsidiary ledger are periodically com-

pared with the contents of the safe-deposit box by independent personnel.

LO 16-10 16-19 An auditor testing long-term investments would ordinarily use substantive analytical procedures to ascertain the reasonableness of the

a. Existence of unrealized gains or losses in the portfolio. b. Completeness of recorded investment income. c. Classification between current and noncurrent portfolios. d. Valuation of marketable equity securities.

LO 16-10 16-20 To establish the existence and rights of a long-term investment in the common stock of a publicly traded company, an auditor ordinarily performs a security count or

a. Relies on the entity’s internal controls if the auditor has reasonable assurance that the control activities are being applied as prescribed.

b. Confirms the number of shares owned that are held by an independent custodian. c. Determines the market price per share at the balance sheet date from published

quotations. d. Confirms the number of shares owned with the issuing company.

LO 16-10 16-21 Which of the following is likely to be the most effective audit procedure for verifying dividends earned on investments in publicly traded equity securities?

a. Trace deposits of dividend checks to the cash receipts book. b. Reconcile recorded earnings with the dividend earnings reported in the invest-

ment broker statement. c. Compare the amounts received with prior-year dividends received. d. Recompute selected extensions and footings of dividend schedules and compare

totals to the general ledger.

LO 16-10 16-22 An auditor would most likely verify the interest earned on bond investments by a. Vouching the receipt and deposit of interest checks. b. Confirming the bond interest rate with the issuer of the bonds. c. Recomputing the interest earned on the basis of face amount, interest rate, and

period held. d. Testing the controls over cash receipts.

LO 16-11 16-23 The audit firm’s valuation specialist would likely be brought in to assist in the audit of fair value measurements at an entity when the following is present:

a. The entity is a new audit client. b. Significant uncertainty exists in key inputs to the entity’s valuation models. c. The entity has a financial instrument with a Level 2 input. d. The entity owns a large and diverse portfolio of publicly traded stock.

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 555

mes32502_ch16_528-560.indd 555 10/14/15 01:51 PM

PROBLEMS All applicable problems are available with Connect.

LO 16-7, 16-8, 16-9 16-24 Cassandra Corporation, a manufacturing company, periodically invests large sums in investment (debt and equity) securities. The investment policy is established by the investment committee of the board of directors, and the treasurer is responsible for carrying out the investment committee’s directives. All securities are stored in a bank safe-deposit vault.

The independent auditor’s internal control questionnaire with respect to Cassan- dra’s investments in debt and equity securities contains the following three questions:

∙ Is investment policy established by the investment committee of the board of directors?

∙ Is the treasurer solely responsible for carrying out the investment committee’s directives?

∙ Are all securities stored in a bank safe-deposit vault?

Required: In addition to these three questions, what questions should the auditor’s internal con- trol questionnaire include with respect to the company’s investments in debt and equity securities?

(AICPA, adapted) LO 16-4, 16-6 16-25 Sevcik Company’s auditor received, directly from the banks, confirmations and cutoff

statements with related checks and deposit tickets for Sevcik’s three general-purpose bank accounts. The auditor determined that the controls over cash are satisfactory and can be relied upon. The proper cutoff of external cash receipts and disbursements was established. No bank accounts were opened or closed during the year.

Required: Prepare the audit program of substantive procedures to verify Sevcik’s bank bal- ances. Ignore any other cash accounts.

LO 16-5 16-26 The following client-prepared bank reconciliation is being examined by Zachary Kallick, CPA, during the examination of the financial statements of Simmons Company.

SIMMONS COMPANY Bank Reconciliation

1st National Bank of U.S. Bank Account September 30, 2015

Procedure(s)

a. Select 2 procedures Balance per bank $28,375

b. Select 5 procedures Deposits in transit: 9/29/15 $4,500 9/30/15 1,525 6,025

$34,400

c. Select 5 procedures Outstanding checks: 988 8/31/15 2,200 1281 9/26/15 675 1285 9/28/15 850 1289 9/29/15 2,500 1292 9/30/15 7,225 (13,450)

$20,950

d. Select 1 procedure Error:

Check 1282, written on 9/26/15 for $270, was erroneously charged by bank as $720; bank was notified on 10/3/15. 450

e. Select 1 procedure Balance per books $21,400

Final PDF to printer

556 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 556 10/14/15 01:51 PM

Required: Items (a) through (e) represent items an auditor would ordinarily find on an entity- prepared bank reconciliation. The following list of audit procedures shows substan- tive auditing procedures. For each item, select one or more procedures, as indicated, that the auditor most likely would perform to gather evidence in support of that item. (The procedures on the list may be selected once, more than once, or not at all.)

Assume that ∙ The entity prepared the bank reconciliation on 10/3/2015. ∙ The bank reconciliation is mathematically accurate. ∙ The auditor received a cutoff bank statement dated 10/7/2015 directly from the

bank on 10/12/2015. ∙ The 9/30/2015 deposit in transit; outstanding checks 1281, 1285, 1289, and 1292;

and the correction of the error regarding check 1282 appear on the cutoff bank statement.

∙ The auditor set control risk concerning the financial statement assertions related to cash at the maximum.

Audit Procedure: 1. Trace to cash receipts journal. 2. Trace to cash disbursements journal. 3. Compare to 9/30/2015 general ledger. 4. Directly confirm with bank. 5. Ascertain reason for unusual delay. 6. Inspect supporting documents for reconciling item not appearing on cutoff

statement. 7. Vouch items on bank reconciliation to cutoff statement. 8. Vouch items on the cutoff statement to bank reconciliation. (AICPA, adapted)

LO 16-7, 16-8, 16-10 16-27 The schedule on the following page was prepared by the controller of World Man- ufacturing, Inc., for use by the independent auditors during their examination of World’s year-end financial statements. All procedures performed by the audit assis- tant were noted in the “Legend” section; the schedule was properly initialed, dated, and indexed and then submitted to a senior member of the audit staff for review. Internal control was reviewed and is considered to be satisfactory.

Required: a. What information that is essential to the audit of debt and equity securities is

missing from this schedule? b. What essential audit procedures were not noted as having been performed by the

audit assistant? (AICPA, adapted)

LO 16-10 16-28 Phung, CPA, has been engaged to audit the financial statements of Vernon Distribu- tors, Inc., a continuing audit client, for the year ended September 30. After obtaining an understanding of Vernon’s internal control system, Phung set control risk at the maximum level for all financial statement assertions concerning investments. Phung determined that Vernon is unable to exercise significant influence over any investee and none are related parties. Phung obtained from Vernon detailed analyses of its investments in domestic securities showing

∙ The classification among held-to-maturity, trading, and available-for- sale securities. ∙ A description of each security, including the interest rate and maturity date of

bonds and the par value and dividend rate of stocks. ∙ A notation of the location of each security, either in the treasurer’s safe or held by

an independent custodian.

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 557

mes32502_ch16_528-560.indd 557 10/14/15 01:51 PM

W O

R LD

M A

N U

FA C

T U

R IN

G , I

N C

. M

a rk

e ta

b le

S e

cu ri

ti e

s Ye

a r

E n

d e

d D

e ce

m b

e r

3 1,

2 0

D iv

id e

n d

s &

In te

re st

D es

cr ip

tio n

S ec

ur ity

Se ria

l N

Fa ce

lu e

B on

ds G

en er

Le dg

er 1

Pu rc

ha se

20 15

So ld

15 C

os t

G en

er al

dg er

/3 1

12 /3

1 M

ar ke

t Pa

y D

at e(

s) Am

Re c.

Ac cr

ua ls

/3 1

C or

p Bo

nd s

% Yr

. D

A 6

16 21

-7 10

,0 00

9 ,4

00 a

9, 40

0 9,

10 0

1/ 15

00 b,

d 7/

15 30

0b ,d

27 5

D 4

12 73

-0 30

,0 00

2 7,

50 0a

27 ,5

00 26

,2 20

12 /1

1, 20

0b ,d

10 0

G 9

17 16

-4 5,

00 0

4 ,0

00 a

4, 00

0 5,

08 0

8/ 1

45 0b

,d 18

8 R

5 14

08 -2

70 ,0

00 6

6, 00

0a 57

,0 00

b, c

66 ,0

00 S

10 19

07 -4

10 0,

00 0

10 0,

00 0c

,e 10

0, 00

0 10

1, 25

0 7/

5, 00

0b ,d

5, 00

10 6,

90 0a

10 0,

00 0

57 ,0

00 66

,0 00

14 0,

90 0

14 1,

65 0

7, 25

0 5,

56 3

a, f

f f

f f,g

f f

St oc

ks P

1, 00

0 sh

s. 1,

04 4

7 ,5

00 a

7, 50

0 7,

60 0

3/ 1

75 0b

,d C

om m

on 6/

1 75

0b ,d

9/ 1

75 0b

,d 12

/1 75

0b ,d

25 0

U 5

0 sh

s. 8,

53 0

9 ,7

00 a

9, 70

0 9,

80 0

2/ 1

80 0b

,d C

om m

on 8/

1 80

0b ,d

66 7

17 ,2

00 17

,2 00

17 ,4

00 4,

60 0

91 7

a, f

f,g f

f f

Le ge

nd s

an d

co m

m en

ts re

la tiv

e to

a bo

ve s

ch ed

ul e:

a =

B eg

in ni

ng b

al an

ce s

ag re

ed to

2 01

4 w

or ki

ng p

ap er

b =

T ra

ce d

to c

as h

re ce

ip ts

. c

= B

oa rd

o f d

ire ct

or s’

m in

ut es

e xa

m in

ed —

pu rc

ha se

s an

d sa

le s

ap pr

ov ed

. d

= A

gr ee

d to

1 09

e =

C on

fir m

ed b

y tr

ac in

g to

b ro

ke r’s

a dv

ic e.

= T

ot al

s fo

ot ed

. g

= A

gr ee

d to

g en

er al

le dg

er .

Final PDF to printer

558 Part 5 Auditing Business Processes

mes32502_ch16_528-560.indd 558 10/14/15 01:51 PM

∙ The number of shares of stock or face value of bonds held at the beginning and end of the year.

∙ The beginning and ending balances at cost and at market, and the unamortized premium or discount on bonds.

∙ Additions to and sales from the portfolios for the year, including date, number of shares, face value of bonds, cost, proceeds, and realized gain or loss.

∙ Valuation allowances at the beginning and end of the year and changes therein. ∙ Accrued investment income for each investment at the beginning and end of the

year, and income earned and collected during the year. Phung then prepared the following partial audit program of substantive audit

procedures: 1. Foot and crossfoot the analyses. 2. Trace the September 30 balances to the general ledger and financial statements. 3. Trace the beginning balances to the prior year’s working papers. 4. Obtain positive confirmation of the investments held by any independent custo-

dian as of the balance sheet date. 5. Determine that income from investments has been properly recorded as accrued

or collected by reference to published sources, by computation, and by tracing to recorded amounts.

6. For investments in nonpublic entities, compare carrying value to information in the most recently available audited financial statements.

7. Determine that all transfers among held-to-maturity, trading, and available-for- sale securities have been properly authorized and recorded.

8. Determine that any other-than-temporary decline in the price of an investment has been properly recorded.

Required: a. For procedures 4-8, identify the primary financial statement assertion relative to

investments that would be addressed by each procedure. b. Describe three additional substantive auditing procedures Phung should consider

in auditing Vernon’s investments. (AICPA, adapted)

LO 16-10 16-29 To support financial statement assertions, an auditor develops specific audit proce- dures to satisfy or accomplish each assertion.

Required: Items (a) through (c) represent assertions for investments. Select the most appropri- ate procedure from the following list and enter the number in the appropriate place on the grid. (An audit procedure may be selected once or not at all.)

Audit Procedure: 1. Vouch opening balances in the subsidiary ledgers to the prior year’s audit working

papers. 2. Determine that employees who are authorized to sell investments do not have

access to cash. 3. Examine supporting documents for a sample of investment transactions to verify

that prenumbered documents are used. 4. Determine that any impairments in the price of investments have been properly

recorded. 5. Verify that transfers from the current to the noncurrent investment portfolio have

been properly recorded. 6. Obtain positive confirmations as of the balance sheet date of investments held by

independent custodians. 7. Trace investment transactions to minutes of board of directors’ meetings to deter-

mine that transactions were properly authorized.

Final PDF to printer

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments 559

mes32502_ch16_528-560.indd 559 10/14/15 01:51 PM

Specific Assertion Audit Procedure

a. Verify that investments are properly described and classified in the financial statements (presentation and disclosure-classification).

b. Verify that recorded investments represent investments actually owned at the balance sheet date (rights and obligations).

c. Verify that investments are properly valued at the lower of cost or market at the balance sheet date (valuation and allocation).

(AICPA, adapted)

LO 16-11 16-30 Spencer, CPA, has been engaged to audit the fair value measurements of Christensen & Son, a high-tech company in the Midwest. During the audit, Spencer must obtain evidence that management of Christensen & Son has appropriately valued the fol- lowing two accounts:

1. Available-for-Sale Stock Portfolio, containing investments in Fortune 100 com- pany stocks.

2. Stock compensation expense related to stock options granted to Christensen’s employees as valued by the Black-Scholes option-pricing model. Christensen’s stock is largely held by the owners and neither the company’s stock nor the related stock options are actively traded.

Required: For each account, complete the following:

a. Identify the fair value inputs to the value of each account. b. Identify the valuation levels for each of the identified inputs as well as the account

as a whole (i.e., Level 1, Level 2, or Level 3). c. Create a summary audit plan, by account, for how Spencer can obtain assurance

regarding the fair value of each of the inputs.

INTERNET ASSIGNMENT

LO 16-7, 16-10 16-31 Both Intel (www.intel.com) and Microsoft (www.microsoft.com) have large amounts of investment securities. Visit their home pages, and review their financial statements for information on how they account for investment securities and the amounts of those securities. Describe your findings in a short memo.

HANDS-ON CASE

EarthWear Online

Audit of Cash Willis and Adams’ staff partially completed the audit program for the audit of cash for EarthWear’s primary general cash account. Your task is to complete the remaining audit program procedures by evaluating documents such as bank confirmations and cutoff bank statements. You will document your work utilizing the appropriate tick marks as outlined in the work papers. You will also identify the assertions tested by each procedure and describe any errors you detected or potential errors that would be detected by performing the procedure.

Visit Connect’s additional student resources to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch16_528-560.indd 560 10/14/15 01:51 PM

Final PDF to printer

561

mes32502_ch17_561-595.indd 561 10/14/15 04:01 PM

PART SIX

Completing the Audit and Reporting Responsibilities

CHAPTER 17 Completing the Audit Engagement

CHAPTER 18 Reports on Audited Financial Statements

Final PDF to printer

mes32502_ch17_561-595.indd 562 10/14/15 06:42 PM

CHAPTER

17 17-1 Be able to explain the audit issues related to contingent

liabilities. 17-2 Know the audit procedures used to identify contingent

liabilities. 17-3 Understand the audit issues related to a legal letter. 17-4 Be able to explain why the auditor must be concerned

with entity commitments. 17-5 Know the types of subsequent events. 17-6 Understand the effect of subsequent events on the dating

of the audit report. 17-7 Know the audit procedures used to identify subsequent

events.

17-8 Know the audit steps included in the auditor’s final evaluation of audit evidence.

17-9 Be able to explain how auditors identify and assess going concern problems.

17-10 Understand the auditor’s communication with management and those charged with governance and the matters that should be addressed.

17-11 Know the auditor’s responsibilities when relevant facts that existed at the date of the auditor’s report are discovered after the audit report has been issued.

FASB ASC Topic 275, Risks and Uncertainties FASB ASC Topic 450, Contingencies FASB ASC Topic 815, Derivatives and Hedging FASB ASC Topic 855, Subsequent Events FASB Accounting Standards Update 2014-2015, Disclosures of Uncertainties about an Entity’s Ability to Continue as a Going Concern AU-C 220, Quality Control for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 501, Audit Evidence—Specific Considerations for Selected Items AU-C 505, External Confirmations AU-C 520, Analytical Procedures AU-C 540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures AU-C 560, Subsequent Events and Subsequently Discovered Facts AU-C 570, The Auditor’s Consideration of an Entity’s Ability to Continue as a Going Concern AU-C 580, Written Representations AU-C 700, Forming an Opinion and Reporting on Financial Statements

COSO, Internal Control—Integrated Framework (New York: AICPA, 2013) PCAOB Auditing Standard No. 3, Audit Documentation (AU-C 230) PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PCAOB Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit (AU-C 320) PCAOB Auditing Standard No. 12, Identifying and Assessing Risks of Material Misstatement (AU-C 315) PCAOB Auditing Standard No. 13, The Auditor’s Responses to the Risks of Material Misstatement (AU-C 330) PCAOB Auditing Standard No. 14, Evaluating Audit Results (AU-C 450) PCAOB Auditing Standard No. 15, Audit Evidence (AU-C 500) PCAOB Auditing Standard No. 16, Communications with Audit Committees (AU-C 260) PCAOB Auditing Standard No. 18, Related Parties (AU-C 550)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

563

mes32502_ch17_561-595.indd 563 10/14/15 04:01 PM

Completing the Audit Engagement

O nce the financial statement accounts and related controls in each of the various business processes have been audited, the auditor sum- marizes and evaluates the evidence. Before determining the appropri-

ate audit report, the auditor evaluates the results of audit tests and considers a number of possible additional issues that could impact the entity’s internal control over financial reporting and its financial statements. This chapter dis- cusses the following areas in which the auditor has responsibilities in complet- ing the audit:

• Review for contingent liabilities

• Review for commitments

• Review for subsequent events

• Final evaluation of audit evidence

• Communications with the audit committee and management

• Subsequent discovery of relevant facts existing at the date of the auditor’s report

Client acceptance/ continuance (Chapter 3)

Major Phases of an Audit

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report (Chapters 1 and 18)

Final PDF to printer

564 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 564 10/14/15 04:01 PM

A contingent liability is an existing condition or set of circumstances involving uncertainty about a possible loss that will ultimately be resolved when some future event occurs or fails to occur. For example, if an oil refining company experiences an explosion and some of its workers are hurt or killed, lawsuits will likely result. Until the lawsuits are settled or resolved in court, there is uncertainty about the amount of the loss the company will face. When the uncertainty about the loss exists as of the balance sheet date, the company must decide how to account for the contingent liability in its financial statements. FASB ASC Topic 450, “Contingencies,” states that when a contingent liability exists, the likelihood that the future event will result in a loss is to be assessed using three categories:

1. Probable: The future event is likely to occur. 2. Reasonably possible: The chance of the future event occurring is more than remote

but less than likely. 3. Remote: The chance of the future event occurring is slight.

As you have learned in your financial accounting courses, if the event is probable and the amount of the loss can be reasonably estimated, the loss associated with the contingency is accrued by a charge to income. When the outcome of the event is judged to be reason- ably possible or the amount cannot be estimated, a disclosure of the contingency is made in the footnotes to the financial statements. Exhibit 17–1 presents an example of such dis- closure taken from a recent annual report. In general, loss contingencies that are judged to be remote are neither accrued in the financial statements nor disclosed in the footnotes. In reading Exhibit 17–1, consider the judgment involved on the part of management and the auditor in making and assessing the reasonableness of this type of disclosure. This is just one example of how both accounting and auditing involve a great deal of subjectivity and require the application of sound professional judgment.

Examples of contingent liabilities include the following:

∙ pending or threatened litigation. ∙ actual or possible claims and assessments. ∙ income tax disputes. ∙ product warranties or defects. ∙ guarantees of obligations to others. ∙ agreements to repurchase receivables that have been sold.

LO 17-1

Example of Footnote Disclosure for a Contingency

On October 31, 2014, a class action complaint was filed by a stockholder against the company and cer- tain of its officers and directors in the United States District Court (“the court”). Shortly thereafter, other stockholders filed similar class action complaints. On February 1, 2015, a consolidated amended class action complaint against the company and certain of its officers and directors was filed in the court. In their consolidated complaint, the plaintiffs seek to represent a class consisting generally of persons who purchased or otherwise acquired the company’s common stock in the period from March 5, 2014, through August 14, 2014. These actions claim damages related to alleged material misstatements and omissions of fact and manipulative and deceptive acts in violation of federal securities laws and common-law fraud. In December 2015, a motion filed by the plaintiffs to certify a class of purchasers of the company’s common stock was approved with limited exceptions, and a class period for certain claims was established from March 5, 2014, to August 14, 2014. Also in December 2015, in response to a motion by the company and individual defendants, claims of common-law fraud, deceit, negligence, misrepresentation, and certain of the violations of the federal securities laws against certain of the individual defendants were dismissed. At this time, it is not possible to predict the outcome of the pending lawsuit or the potential financial impact on the company of an adverse decision.

E X H I B I T 1 7 – 1

Review for Contingent Liabilities

Final PDF to printer

Chapter 17 Completing the Audit Engagement 565

mes32502_ch17_561-595.indd 565 10/14/15 04:01 PM

Audit Procedures for Identifying Contingent Liabilities Examples of procedures that can help the auditor identify contingent liabilities include

1. Reading the minutes of meetings of the board of directors, committees of the board, and stockholders.

2. Reviewing contracts, loan agreements, leases, and correspondence from government agencies.

3. Reviewing tax returns, IRS reports, and schedules supporting the entity’s income tax liability.

4. Confirming or otherwise documenting guarantees and letters of credit obtained from financial institutions or other lending agencies.

5. Inspecting other documents for possible guarantees or other similar arrangements.

For example, the auditor usually reads the minutes of the board of directors’ meetings for identification of major events and approval of significant transactions. Normally, the board of directors would discuss any material uncertainty that might exist for the entity, and such discussions should be noted in the minutes. Similarly, the auditor examines the entity’s cal- culations for its income tax expense and accrued tax liability. The audit procedures for these accounts include determining if the IRS has audited the entity’s prior year’s tax returns. If so, the auditor should examine the IRS agents’ report for any additional taxes assessed and deter- mine whether the entity will contest the additional assessment.

In addition, near the completion of the engagement the auditor takes specific additional steps to identify contingent liabilities. Such procedures include

1. Inquiry of and discussion with management regarding the entity’s policies and procedures for identifying, evaluating, and accounting for contingent liabilities. Management has the responsibility for establishing policies and procedures to identify, evaluate, and account for contingencies. Large entities may implement such policies and procedures as part of their risk assessment process. Smaller private entities, however, sometimes rely on legal counsel or other parties to help them identify and account for contingencies.

2. Examining documents in the entity’s records such as correspondence and invoices from attorneys for pending or threatened lawsuits. Even though the amount of the legal expense account may be immaterial, the auditor normally examines the transactions in the account (see Chapter 15). One purpose of this examination is to identify actual or potential litigation against the entity. The account analysis can also be used to develop a list of attorneys who have been consulted by the entity.

3. Obtaining a legal letter that describes and evaluates any litigation, claims, or assessments. Legal letters are discussed in the next section.

4. Obtaining a written representation from management that all litigation, asserted and unasserted claims, and assessments have been disclosed in accordance with FASB ASC Topic 450. This information is obtained in a representation letter furnished by the entity. Management representation letters are discussed later in this chapter.

Legal Letters A letter of audit inquiry (often referred to as a legal letter) sent to the entity’s attorneys is the primary means of corroborating information provided by management to the auditor about litigation, claims, and assessments. Auditors typically analyze legal expense for the entire period and then ask management to send a letter to in-house attorneys (often referred to as general counsel) and to external attorneys who have been consulted by management. Audi- tors should be particularly vigilant with responses from the entity’s general counsel and from attorneys specializing in patent law or securities laws. General counsel will likely be aware

LO 17-2

LO 17-3

Final PDF to printer

566 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 566 10/22/15 11:01 AM

of any major litigation involving the entity, and patent infringement and securities laws are major sources of litigation. Table 17–1 provides examples of types of litigation that the audi- tor may encounter. Chapter 20 covers issues relating to auditor liability and litigation in detail. Management should request that the attorneys provide information about a number of items, including the following:

∙ A list of any pending or threatened litigation or any probable but as yet unasserted claims to which the attorney has devoted substantial attention or for which an unfavorable outcome is reasonably possible

∙ A request that the attorney describe and evaluate each pending or threatened litigation; this should include the progress of the case, the action the entity plans to take, the likelihood of an unfavorable outcome, and the amount or range of the potential loss

∙ A request that the attorney identify any pending or threatened litigation or claims not included in management’s list or a statement that the list is complete

∙ A request that the attorney comment on unasserted claims where his or her views differ from management’s evaluation

∙ A request that the attorney indicate if his or her response is limited in any way and the reasons for such limitations

Exhibit 17–2 presents an example of a legal letter relating to EarthWear. Attorneys are gener- ally willing to provide evidence on actual or pending litigation. However, they are often reluc- tant to provide information on situations in which the injured party or potential claimant has not yet notified the entity of a claim. For example, suppose there is a cave-in at one of a coal mining entity’s mines and a number of miners are killed. Suppose further that a subsequent investigation shows that the entity had failed to install proper safety equipment. Although the families of the employees may not yet have initiated or threatened litigation at the end of the entity’s fiscal period, an unasserted claim likely exists at the financial statement date. In this case, the entity’s attorneys may be reluctant to provide the auditor with information about the unasserted claims because the attorneys may be concerned that disclosing the unasserted claim in the financial statements may actually encourage a lawsuit or make it more difficult for the entity to defend itself. This type of situation is generally resolved by having the attor- neys corroborate management’s understanding of their professional responsibility involving unasserted claims and assessments. Refer to the third paragraph in the legal letter shown in Exhibit 17–2 for the manner in which the entity requests the attorneys to communicate to the auditor. In general, disclosing an unasserted claim is not required unless it is probable that the claim will be asserted and there is a reasonable possibility that the outcome will prove to be unfavorable.

Attorneys may be unable to respond to the outcome of a matter because the factors in the case do not allow them to reasonably estimate the likelihood of the outcome or to estimate the possible loss. However, refusal by an entity’s attorney to furnish information in a legal letter is a limitation on the scope of the audit that is potentially sufficient to preclude an unqualified opinion.

Examples of Types of Litigation

• Breach of contract • Patent infringement • Product liability • Violations of government laws and regulation, including the following: Securities laws Antidiscrimination statutes based on race, sex, age, and other characteristics Antitrust laws Income tax regulations Environmental protection laws Foreign Corrupt Practices Act Racketeer Influenced and Corrupt Organizations Act (RICO)

T A B L E 1 7 – 1

Final PDF to printer

Chapter 17 Completing the Audit Engagement 567

mes32502_ch17_561-595.indd 567 10/14/15 04:01 PM

Companies often enter long-term commitments to purchase raw materials or to sell products at a fixed price. For example, an airline might commit to purchasing its jet fuel from a sup- plier at a predetermined price over a given future time period. The main purpose of entering into such a purchase or sales contract is to obtain a favorable or predictable pricing arrange- ment or to secure the availability of raw materials.

Stop and Think: Why might an auditor be concerned with commitments made by an entity?

Accounting standards on derivatives and hedging require such commitments to be dis- closed in a footnote to the financial statements with an adjustment to Other Comprehensive

LO 17-4

Example of a Legal Letter

EARTHWEAR CLOTHIERS

January 15, 2016

Leon, Leon & Dalton 958 S.W. 77th Avenue Boise, Idaho 79443

Dear Legal Counsel:

In connection with an audit of our financial statements for the year ended December 31, 2015, please fur- nish our auditors, Willis & Adams, P.O. Box 4080, Boise, Idaho 79443-4080, with the information requested below concerning contingencies involving matters with respect to which you have devoted substantial attention on behalf of the company in the form of legal consultation or representation. For the purposes of your response to this letter, we believe that as to each contingency an amount in excess of $25,000 would be material, and in the aggregate, $150,000. However, determination of materiality with respect to the overall financial statements cannot be made until our auditors complete their examination. Your response should include matters that existed at December 31, 2015, and during the period from that date to the date of completion of their examination, which is anticipated to be on or about February 15, 2016.

Regarding pending or threatened litigations, claims, and assessments, please include in your response (1) the nature of each matter; (2) the progress of each matter to date; (3) how the company is responding or intends to respond (for example, to contest the case vigorously or seek an out-of-court settlement); (4) an evaluation of the likelihood of an unfavorable outcome; and (5) an estimate, if one can be made, of the amount or range of potential loss. Please furnish to our auditors such explanation, if any, that you consider necessary to supplement the foregoing information, including an explanation of the matters as to which your views may differ from those we have stated.

We understand that in the course of performing legal services for us with respect to a matter rec- ognized to involve an unasserted possible claim or assessment that may call for financial statement disclosure, if you have formed a professional conclusion that we should disclose or consider disclosure concerning such possible claim or assessment, as a matter of professional responsibility to us, you will so advise us and will consult with us concerning the question of such disclosure and the applicable require- ments of FASB Accounting Standards Codification Topic 450, “Contingencies.” Please specifically confirm to our auditors that our understanding is correct.

Please specifically identify the nature of and reasons for any limitation in your response.

Sincerely,

Calvin J. Rogers Chief Executive Officer EarthWear Clothiers

E X H I B I T 1 7 – 2

Commitments

Final PDF to printer

568 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 568 10/14/15 04:01 PM

Income (OCI) for any gains or losses. For example, suppose a client produces woolen cloth for use in women’s suits and that the company has a December 31 year-end. Suppose fur- ther that the client enters a noncancelable contract on September 30, 2015, to purchase 1 million pounds of wool at $1.00 per pound with delivery on March 31, 2016. At year-end (December 31, 2015), the auditor compares the current market price of wool with the contract price. If the current price of wool is $1.00, only a footnote disclosure is required. However, if the price of wool is less than $1.00, a decrease would also be recognized at December 31, 2015. For example, if the current market price of wool is $.75 per pound, the client would recognize a $250,000 decrease in OCI (1,000,000 pounds × $.25 per pound) at year-end. Likewise, if the price was $1.15 per pound, the client would again disclose the agreement and recognize an increase of $150,000 in OCI (1,000,000 pounds × .15).

Long-term commitments are usually identified through inquiry of entity personnel dur- ing the audit of the revenue and purchasing processes and through review of the minutes of board meetings. In fact, the audit procedures relating to commitments are often very similar to those we discussed above for contingent liabilities. The auditor should ensure that appropriate disclosures and accruals are made in the financial statements.

Sometimes events or transactions that occur after the balance sheet date but before the issu- ance of the financial statements materially affect the financial statements. These events or transactions are referred to as subsequent events and require recognition or disclosure in the financial statements. Management is required to disclose the date through which the entity has considered subsequent events (ASC 855). Auditors are responsible for evaluating the enti- ty’s handling of subsequent events in the financial statements.

Two types of subsequent events require consideration by management and evaluation by the auditor:

1. Type I (Recognized Events): Events that provide additional evidence about conditions that existed at the date of the balance sheet and that affect the amounts or estimates involved in the financial statement preparation process. Type I events require adjustment of the numbers in the financial statements.

2. Type II (Unrecognized Events): Events that provide evidence about conditions that did not exist at the date of the balance sheet but that arose subsequent to that date. Type II events usually require disclosure in the notes to the financial statements. In some instances where the effect of the Type II event or transaction is very significant, pro forma financial statements may be required in order to prevent the financial statements from being misleading.

The following are examples of Type I events or conditions:

∙ An uncollectible account receivable resulting from deterioration in a customer’s financial condition prior to year end, about which the holder of the receivable is unaware. The customer declares bankruptcy after the balance sheet date but prior to the issuance of the financial statements.

∙ The settlement of a lawsuit after the balance sheet date but prior to issuance of the financial statements for an amount different from the amount recorded in the year-end financial statements as a contingent liability.

Note that in both of these examples, additional evidence that shed light on estimates pre- viously made in the financial statements became available after the balance sheet date but before the financial statements were issued. In other words, the “events” that occurred in both examples shed additional light on conditions that already existed as of the balance sheet date.

LO 17-5

Review of Subsequent Events for Audit of Financial Statements

Final PDF to printer

Chapter 17 Completing the Audit Engagement 569

mes32502_ch17_561-595.indd 569 10/14/15 04:01 PM

Subsequent events such as these that affect the realization of assets or the settlement of esti- mated liabilities normally require adjustment of the financial statements.

Examples of Type II events that result in disclosure include the following:

∙ Loss of the entity’s manufacturing facility or assets resulting from a casualty such as a fire or flood that occurred after the balance sheet date but prior to issuance of the financial statements

∙ Purchase or disposal of a business by the entity after the balance sheet date but prior to issuance of the financial statements

∙ A capital stock or bond issuance by the entity after the balance sheet date but prior to issuance of the financial statements

∙ Losses on receivables caused by conditions such as a business failure arising subsequent to the balance sheet date

Stop and Think: You’ll recall that EarthWear has a December 31 year-end. Suppose the IRS notified EarthWear on January 5, 2016, that the company had made an error in its 2014 tax return, submitted on April 15, 2015, and as a result had underpaid its 2014 income taxes. If EarthWear settles the claim on February 27, 2016 (before issuing its 2015 financial statements), should the payment be classified as a Type I (Recognized) or Type II (Unrecognized) event? Now suppose that on February 20, 2016, EarthWear learned that a large wholesale customer, from whom EarthWear had a material receiv- able, had filed for bankruptcy. The customer’s business had been destroyed by an earth- quake on January 5, 2016, and was uninsured. Would the bankruptcy constitute a Type I or Type II event? Once you’ve articulated your answers, read on.

The IRS payment would be classified as a Type I event because it provides evidence about the underpayment of prior-year taxes, a condition that clearly existed prior to the bal- ance sheet date. This subsequent event would lead to an adjustment of the numbers in the financial statements. On the other hand, the bankruptcy would be a considered a Type II event because it resulted from the earthquake, which occurred on January 6, and thus was not a con- dition that existed as of the balance sheet date. The loss of the receivable would be disclosed in the notes but would not require an adjustment to the 2015 financial statements.

Figure 17–1 presents a diagram of the subsequent-events period for EarthWear. The period from the date of the financial statements (December 31, 2015) to the date of the audi- tor’s report (February 15, 2016) is sometimes referred to as the formal subsequent-events period. During this time frame, the auditor actively conducts audit procedures related to the

The Subsequent-Events Period for EarthWear ClothiersF I G U R E 1 7 – 1

Financial statement

date

12/31/15

Audit report date

2/15/16

Issue financial

statements

3/5/16

Subsequent-events period

Dual dating issue

Subsequent discovery of facts existing at the date of the

auditor’s report

Final PDF to printer

570 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 570 10/14/15 04:01 PM

current-year audit. The period from the date of the auditor’s report to the issuance of the financial statements (March 5, 2016) is also part of the subsequent-events period, but the auditor is not responsible for making any inquiries or conducting any audit procedures after the date of the audit report. However, subsequent events may come to the auditor’s atten- tion during this period. If the subsequent event is Type I, the financial statements should be adjusted. Depending on the event and its circumstances, additional disclosure may need to be made in the footnotes. When the subsequent event is Type II, a footnote describing the event should be included with the financial statements.

Figure 17–1 also refers to the possibility that the auditor will discover additional facts after the issuance of the financial statements to the public (i.e., after March 5, 2016). We dis- cuss this postissuance time period later in the chapter after covering the other steps the audi- tor takes to complete the audit. First, however, we need to address the typically brief time period between the date of the auditor’s report and the issuance of the financial statements (between February 15, 2016, and March 5, 2016, in this example), because this time period gives rise to a potential “dual dating” of the auditor’s report.

Dual Dating The date of the auditor’s report is significant because it relates to certain auditor responsibili- ties. Auditing standards indicate that the auditor’s report should be dated no earlier than the date on which the auditor has obtained sufficient appropriate audit evidence on which to base an opinion on the financial statements. To meet this criterion, by the date of the audit report all significant audit documentation must have been reviewed and approved, all of the financial statements, including related notes, must have been prepared; and management must have explicitly taken responsibility for the financial statements.

When a subsequent event is recorded or disclosed in the financial statements after the date on which the auditor has obtained sufficient appropriate audit evidence but before the issuance of the financial statements, the auditor must consider what date to put on the audi- tor’s report. For example, suppose that prior to issuance of the financial statements EarthWear notifies Willis & Adams that on March 1, 2016, the company had entered an agreement to purchase another catalog retailer. Such an event is not indicative of conditions that existed at the balance sheet date and therefore would require only disclosure in the footnotes to the December 31, 2015, financial statements, but the question arises as to what date the auditor should put on the audit report. Two methods are available for dating the audit report in such a situation: Willis & Adams may (1) “dual date” the report, using wording such as “February 15, 2016, except for Note 10, which is as of March 1, 2016” or (2) use the date of the sub- sequent event (March 1). Dual dating limits the auditor’s responsibility for events occurring subsequent to the date on which the auditor has obtained sufficient appropriate audit evidence to only the specific subsequent event referred to in the footnote. If the audit report uses the March 1, 2016. subsequent event date rather than dual dating the report, the auditor’s respon- sibility for identifying any material subsequent events extends to that later date.

Stop and Think: For this example, how do you think most auditors would choose to date the audit report and why?

In this instance, due to the desire to not extend their responsibility for other events that might have occurred between February 15 and March 1 besides the one noted, Willis & Adams would most likely dual date the report.1

LO 17-6

1Until 2009, the date on which the auditors completed fieldwork usually coincided with the auditor’s report date. However, this reporting convention has changed in practice in response to Statement of Financial Accounting Stan- dards (SFAS) No. 165 (issued in 2009 and now codified as ASC Topic 855). SFAS No. 165 requires companies to perform their own evaluation of subsequent events through the date on which the financial statements are filed with the SEC. In response to this change in GAAP, auditors now usually delay the dating of the auditor’s report to coincide with the filing of the financial statements with the SEC. Thus, dual-dating has become quite rare in practice.

Final PDF to printer

Chapter 17 Completing the Audit Engagement 571

mes32502_ch17_561-595.indd 571 10/14/15 04:01 PM

Audit Procedures for Subsequent Events As you learned in previous chapters, some audit procedures are conducted before year-end (these are called “interim procedures”), while others are conducted after the balance sheet date but prior to the issuance of the financial statements. Some of these latter audit pro- cedures, such as testing proper sales and purchases cutoff, are applied to transactions that occurred after the balance sheet date. Such audit procedures may detect subsequent events. In addition, the auditor conducts audit procedures specifically to detect any subsequent events that might have occurred during the period between the balance sheet date and the date of the audit report. Examples of these audit procedures include the following: ∙ Asking management about the following matters: (a) whether there were or are any

substantial contingent liabilities or commitments existing at the balance sheet date or at the date of inquiry; (b) whether there have been any significant changes in capital stock, long-term debt, or working capital; (c) the current status of any items in the financial statements that were accounted for based on preliminary or inconclusive data; and (d) whether any unusual adjustments have been made during the subsequent- events period

∙ Reading any interim financial statements that are available for the period after year- end (e.g., monthly financial statements for January 2016) and comparing them to the prior-period statements; any unusual fluctuations are investigated

∙ Examining the books of original entry (such as sales journal, purchases journal, cash receipts and cash disbursements journals, and general ledger) for the subsequent- events period and investigating any unusual transactions or information that shed additional light on conditions existing at the balance sheet date or that give rise to conditions subsequent to the balance sheet date

∙ Reading the available minutes of meetings of stockholders, directors, or other committees for the subsequent-events period

∙ Asking legal counsel about any developments relating to litigation, claims, or assessments against the company

LO 17-7

Review of Subsequent Events for the Audit of Internal Control over Financial Reporting

In addition to reporting subsequent events that have implications for the financial statement account balances, auditors of public companies are responsible for reporting any changes in inter- nal control that might adversely affect financial reporting between the end of the reporting period and the date of the auditor’s report (AS5). The auditor’s treatment of subsequent events relating to internal control is similar to the Type I and Type II treatments discussed above. In other words, the treatment depends on whether the change in control reveals information about a material weakness that existed as of the end of the reporting period or whether the event creates or reveals information about a new condition that did not exist as of the end of the reporting period.

If the event reveals information about a material weakness that existed as of the end of the reporting period, the auditor should issue an adverse opinion on the effectiveness of internal control over financial reporting (see Chapter 7). If the auditor is unable to determine the effect of the subsequent event on the effectiveness of the company’s internal control, the auditor should disclaim any opinion with respect to the entity’s ICFR. If the event creates or reveals adverse information about an internal control condition that did not exist as of the end of the reporting period and the information has a material effect, the auditor includes an explanatory paragraph that describes the event and its effects.

Auditors of public companies are required to inquire of management whether there were any changes in internal control between the end of the reporting period and the date of the auditor’s report that might adversely affect financial reporting, and should obtain written rep- resentations regarding any such changes. The public company auditor should also inquire about and examine, for this subsequent period, the following (AS5):

Final PDF to printer

572 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 572 10/14/15 04:01 PM

∙ Relevant internal audit reports (or similar functions, such as loan review in a financial institution) issued during the subsequent period

∙ Independent auditor reports (if other than the primary auditor’s) of significant deficiencies or material weaknesses

∙ Regulatory agency reports on the company’s internal control over financial reporting, if any

∙ Information about the effectiveness of the company’s internal control over financial reporting obtained through other engagements

Practice I N S I G H T

Each year the PCAOB reviews the documentation for several audit engagements conducted during the prior year. The Board recently concluded that in several engagements it has reviewed, auditors appeared to take an unjustifiably uniform approach to their testing across processes, accounts, and assertions. Such an approach can result in auditors expending more effort than necessary in lower- risk areas and not enough effort in higher-risk areas.

Final Steps and Evidence Evaluation

In addition to the search for unrecorded contingent liabilities and the review for subsequent events, the auditor conducts a number of audit steps before deciding on the appropriate audit report for the entity. These include the following: ∙ Performance of final analytical procedures ∙ Obtaining a management representation letter ∙ Review of working papers ∙ Final evaluation of audit results ∙ Evaluation of financial statement presentation and disclosure ∙ Obtaining an independent review of the engagement ∙ Evaluation of the entity’s ability to continue as a going concern

Final Analytical Procedures Auditing standards require that the auditor perform analytical procedures both in planning and at the final review stage of the audit. The objective of conducting analytical procedures near the end of the engagement is to help the auditor assess the conclusions reached on the financial statement components and evaluate the overall financial statement presentation. These final analytical procedures may include recalculating some of the ratios discussed in an Advanced Module in Chapter 5 that were used in planning the audit to evaluate how these ratios may have been affected by audit adjustments. They may also involve the use of addi- tional ratios or trends that help the auditor evaluate the adequacy of the evidence gathered in response to unexpected fluctuations in the account balances identified during the planning of the audit. These final analytical procedures may indicate that more evidence is needed for certain account balances.

The auditor performs final analytical procedures to consider the overall reasonableness of the financial statement amounts. In other words, final analytical procedures provide a sort of final, overall “smell test” by the auditor. In doing this analysis, the auditor reexamines the entity’s business risks (refer to Chapter 4). For example, the auditor considers the critical issues and significant industry business risks and whether such risks might impact the finan- cial statements. The auditor also assesses the structure and profitability of the industry and how the entity fits within the industry in terms of its profitability and solvency. In other words, the auditor considers whether the financial statement amounts make sense given the auditor’s knowledge of the entity’s business risks. Much of this same kind of analysis is completed dur- ing the planning phase, but final analytical procedures allow the auditor to reevaluate these big picture issues after auditor-proposed adjustments to the financial statements have been made.

LO 17-8

Final PDF to printer

Chapter 17 Completing the Audit Engagement 573

mes32502_ch17_561-595.indd 573 10/14/15 04:01 PM

Representation Letter During the course of a financial statement audit or an integrated audit, management makes a number of representations in response to auditor inquiries. Auditing standards require that the auditor obtain a representation letter from management. The purpose of this letter is to docu- ment, in writing, significant oral representations made to the auditor by management. The representation letter also reduces the possibility of misunderstanding between management and the auditor.

For example, during the audit, the auditor may inquire about related parties and conduct specific audit procedures to identify related-party transactions. Even if the results of these audit procedures indicate that such transactions have been properly disclosed, the auditor obtains written representations indicating that management is not aware of any undisclosed related-party transactions. In other instances, evidence simply may not be available to corrob- orate management’s representations. For example, suppose management indicates an intent to refinance a short-term obligation in the next period and reclassifies it as a long-term liabil- ity in the current financial statements. The auditor would obtain written representation from management to confirm that the obligations will be refinanced in the next period. The auditor may also seek written confirmation of such financing arrangements from the entity’s lender.

Exhibit 17–3 presents an example of a representation letter. Note the types of important information management is asked to represent to the auditor. Note also that the representation letter is addressed to the auditor and is typically signed by the chief executive officer (CEO) and the chief financial officer (CFO). It generally bears the same date as the auditor’s report. Management’s refusal to provide a representation letter would result in a scope limitation that is sufficient to preclude an unqualified opinion and, in fact, is ordinarily sufficient to cause an auditor to disclaim an opinion or withdraw from the engagement. For public companies, some of these management representations are required to be made public. The Sarbanes-Oxley Act of 2002, Section 302, “Corporate Responsibility for Financial Reports,” requires the CEO and CFO of publicly traded companies to certify the appropriateness of their financial statements and related disclosures and to certify that they fairly present, in all material respects, the oper- ations and financial condition of the company. These certifications required under Section 302 are included with each quarterly and annual filing of financial statements with the SEC.

Practice I N S I G H T

The management representation letter, although it is written as a letter addressed to the auditor and signed by management, is typically drafted by the auditor and is then presented to management for appropriate signatures. Auditors often refer to a letter of representations as a “rep letter.”

Practice I N S I G H T

Auditors must be careful not to leave “loose ends” in the working papers. Consider the third general auditing standard, relating to due professional care: will a regulator or a jury believe that the auditor exercised due care if a question is left unanswered or an audit step undocumented? There’s a com- mon saying in audit practice: “If you didn’t document it, you didn’t do it.”

Working Paper Review All audit work should be reviewed by an audit team member who is senior to the person preparing the working papers. Thus, the senior-in-charge should conduct a detailed review of the working papers prepared by staff auditors and follow up on any unresolved problems or issues. In turn, the manager should review all working papers. The engagement partner normally reviews working papers related to critical audit areas as well as working papers prepared by the manager. In reviewing the working papers, the reviewers evaluate whether the work was performed and documented, the objectives of the procedures were achieved, and the results of the work support the conclusions reached. Ultimately, the engagement partner is responsible to ensure that the body of evidence gathered fully justifies and supports the auditor’s opinion.

Final PDF to printer

574 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 574 10/14/15 04:01 PM

Example of a Representation Letter

EARTHWEAR CLOTHIERS February 15, 2016

Willis & Adams P.O. Box 4080 Boise, Idaho 79443-4080

Dear Willis & Adams, CPAs:

We are providing this letter in connection with your audits of our assertion about the effectiveness of internal control over financial reporting at December 31, 2015, and of the consolidated financial statements of EarthWear Clothiers as of December 31, 2015 and 2014, for the years then ended. These audits were conducted for the purpose of expressing opinions on the effectiveness of EarthWear Cloth- iers’ internal control over financial reporting, and whether our consolidated financial statements present fairly, in all material respects, the financial position, results of operations, and cash flows of EarthWear Clothiers in conformity with accounting principles accepted in the United States of America. We confirm that we are responsible for the fair presentation in the consolidated financial statements of financial position, results of operations, and cash flows in conformity with generally accepted accounting principles, for establishing and maintaining effective internal control over financial reporting, and for performing an assessment of the effectiveness of internal control over financial reporting.

Certain representations in this letter are described as being limited to matters that are material. Items are considered material, regard- less of size, if they involve an omission or misstatement of accounting information that, in the light of surrounding circumstances, makes it probable that the judgment of a reasonable person relying on the information would have been changed or influenced by the omission or misstatement.

We confirm, to the best of our knowledge and belief, as of February 15, 2016, the following representations made to you during your audits:

1. The consolidated financial statements referred to above are fairly presented in conformity with accounting principles generally accepted in the United States of America, and include all disclosures necessary for such fair presentation and disclosures other- wise required to be included therein by laws and regulations to which the Company is subject.

2. We have made available to you all a. Financial records and related data. b. Minutes of the meetings of stockholders, directors, and committees of directors, or summaries of actions of recent meetings for

which minutes have not yet been prepared. 3. There have been no communications from regulatory agencies concerning noncompliance with or deficiencies in financial report-

ing practices. 4. There are no material transactions, agreements, or accounts that have not been properly recorded in the accounting records

underlying the financial statements. 5. The effects of the uncorrected financial statements misstatements summarized in the accompanying schedule are immaterial, both

individually and in the aggregate, to the financial statements taken as a whole. 6. Receivables recorded in the financial statements represent valid claims against debtors for sales or other charges arising on or

before the balance sheet date and have been appropriately reduced to their estimated net realizable value. Receivables classified as current do not include any material amounts which are collectible after one year.

7. Inventories recorded in the consolidated financial statements are stated at the lower of cost or market, cost being determined on the basis of LIFO, and due provision was made to reduce all slow-moving, obsolete, or unusable inventories to their estimated use- ful values. Inventory quantities at the balance sheet dates were determined from physical counts taken by competent employees at various times during the year. Liabilities for amounts unpaid are recorded for all items included in inventories at balance sheet dates and all quantities billed to customers at those dates are excluded from the inventory balances.

8. All liabilities of the Company of which we are aware are included in the financial statements at the balance sheet date. There are no other liabilities or gain or loss contingencies that are required to be accrued or disclosed by FASB ASC Topic 450, Contingencies, and no unasserted claims or assessments of which our legal counsel has advised us are probable of assertion and required to be disclosed in accordance with that Statement.

9. We acknowledge our responsibility for establishing and maintaining comprehensive systems of internal control that provide reasonable assurance as to the consistency, integrity, and reliability of the preparation and presentation of financial state- ments; the safeguarding of assets; the effectiveness and efficiency of operations; and compliance with applicable laws and regulations.

10. We monitor the systems of internal control and maintain an independent internal auditing program that assesses the effective- ness of internal control. We did not rely on the Willis & Adams’s procedures performed during the audits of internal control over financial reporting or the financial statements as part of the basis for our assessment of the effectiveness of internal control over financial reporting.

E X H I B I T 1 7 – 3

Final PDF to printer

Chapter 17 Completing the Audit Engagement 575

mes32502_ch17_561-595.indd 575 10/14/15 04:01 PM

Example of a Representation Letter (continued)

11. We assessed the Company’s internal control over financial reporting for financial presentations in conformity with accounting prin- ciples generally accepted in the United States of America. This assessment was based on criteria for effective internal control over financial reporting established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (the COSO Report). Based on this assessment, we believe that the Company maintained effective inter- nal control over financial reporting for financial presentations in conformity with accounting principles generally accepted in the United States of America as of December 31, 2015.

12. There are no significant deficiencies, including material weaknesses, in the design or operation of internal controls that could adversely affect the Company’s ability to record, process, summarize, and report financial data.

13. We acknowledge our responsibility for the design and implementation of programs and controls to prevent and detect fraud. 14. We have no knowledge of any fraud or suspected fraud affecting the entity involving

a. Management. b. Employees who have significant roles in internal control. c. Others that could have a material effect on the consolidated financial statements.

15. We have no knowledge of any allegations of fraud or suspected fraud affecting the entity received in communications from employees, former employees, analysts, regulators, short sellers, or others.

16. There have been no violations or possible violations of laws or regulations whose effects should be considered for disclosure in the consolidated financial statements or as a basis for recording a loss contingency.

17. The Company has no plans or intentions that may materially affect the carrying value or classification of assets and liabilities. 18. There have not been any changes, subsequent to the date being reported on, in internal control over financial reporting or other

factors that might significantly affect internal control over financial reporting, including corrective actions with regard to significant deficiencies and material weaknesses.

19. All control deficiencies communicated to the audit committee during previous engagements have been resolved. 20. The following, if material, have been properly recorded or disclosed in the consolidated financial statements:

a. Related-party transactions, including sales, purchases, loans, transfers, leasing arrangements, and guarantees, and amounts receivable from or payable to related parties.

b. Guarantees, whether written or oral, under which the company is contingently liable. c. Significant estimates and material concentrations known to management that are required to be disclosed in accordance with

the FASB ASC Topic 275, Risks and Uncertainties. (Significant estimates are estimates at the balance sheet date that could change materially within the next year. Concentrations refer to volumes of business, revenues, available sources of supply, or markets or geographic areas for which events could occur that would significantly disrupt normal finances within the next year.)

21. The Company has satisfactory title to all owned assets, and there are no liens or encumbrances on such assets, nor has any asset been pledged as collateral, except as disclosed in the consolidated financial statements.

22. The Company has complied with all aspects of contractual agreements that would have a material effect on the financial state- ments in the event of noncompliance.

23. The unaudited interim financial information has been prepared and presented in conformity with accounting principles generally accepted in the United States of America applicable to interim financial information and with Item 302(a) of Regulation S-K. The unau- dited quarterly financial information for the year ended December 31, 2015, also has been prepared on a basis consistent with the corresponding interim periods in the year ended December 31, 2014, and, to the degree appropriate, with the consolidated financial statements for the years ended December 31, 2015, and December 31, 2014. The unaudited interim financial information for the three months ended December 31, 2015, and December 31, 2014, does not include any material amount of year-end adjustments that have not been disclosed or any material amounts that should have been included in earlier interim periods of the respective fiscal years.

24. Arrangements with financial institutions involving compensating balances or other arrangements involving restrictions on cash bal- ances, line of credit, or similar arrangements have been properly disclosed.

25. We have fully disclosed to you all sales terms, including all rights of return of price adjustments and all warranty provisions. 26. The company has appropriately reconciled its books and records underlying the consolidated financial statements to their related

supporting information. All related reconciling items considered to be material were identified and included on the reconciliations and were appropriately adjusted in the consolidated financial statements. There were no material unreconciled differences or material general ledger suspense account items. All intracompany and intercompany accounts have been eliminated or appropri- ately measured and considered for disclosure in the consolidated financial statements.

To the best of our knowledge and belief, no events have occurred subsequent to the balance sheet date and through the date of this letter that would require adjustment to or disclosure in the aforementioned financial statements or that would significantly alter the fairness of the representations we have made herein.

Calvin J. Rogers Chief Executive Officer

James C. Watts Chief Financial Officer

E X H I B I T 1 7 – 3

Final PDF to printer

576 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 576 10/14/15 04:01 PM

Final Evaluation of Audit Results In conjunction with the review of the working papers, the auditor must evaluate the results of the audit tests. In Chapter 7 we discussed evaluating the results of the audit of internal control over financial reporting, including taking into account whether misstatements identi- fied in the financial statement audit might affect the auditor’s conclusions about the entity’s internal control.

The final evaluation of evidence from the financial statement audit is concerned primar- ily with two issues: (1) the sufficiency of the audit evidence and (2) the effects of detected misstatements in the financial statements.

In terms of the first issue, evaluating the audit evidence, the auditor determines whether there is sufficient evidence to support each relevant assertion. This evaluation considers evidence obtained to support the assessment of the risk of material misstatement, as well as the evidence gathered to reach the planned level of detection risk (i.e., the auditor’s sub- stantive procedures). If this evaluation indicates that the evidence, taken as a whole, is not sufficient to meet the planned level of audit risk, the auditor may need to gather additional evidence. For example, if the final analytical procedures indicate that inventory may still contain material misstatements, the auditor should gather additional audit evidence on the inventory account balance.

In terms of the second issue, any misstatements detected during the audit process must be considered in terms of the materiality of their effects on the financial statements. This involves performing the third step in applying materiality (refer to Chapter 3). In particular, the auditor must estimate the total likely misstatements in each financial statement component and compare the amount arrived at to the amount of materiality allocated to that component. The auditor should also consider sampling risk, the possibility of undetected misstatements, and the effects of unadjusted misstatements on aggregated components of the financial state- ments such as assets, liabilities, equity, revenues, and expenses.

In evaluating whether a misstatement is material, the auditor should also consider both quantitative and qualitative aspects of the account and transactions involved. Although mate- riality may be planned and implemented using a quantitative approach, qualitative aspects of small misstatements may also materially affect the users of financial statements.

Stop and Think: Consider for a moment the impact of a very small misstatement on earnings per share, let’s say two cents per share. In what situations might this two cent misstatement be material?

A two-cent misstatement in earnings per share might be material under a variety of cir- cumstances. For example, it might be material if those two cents meant the company was able to just meet analysts’ earnings expectations, or if they made it so that the company could report a one cent per share profit instead of a one cent per share loss. A very small misstate- ment might also be considered material if it resulted from management fraud or if it allowed management to claim a larger bonus, among other factors. Table 17–2 presents some of the factors that auditors should consider in determining whether a misstatement that is quantita- tively immaterial might be considered material from a qualitative perspective.

Exhibit 17–4 shows a working paper that was first introduced in Chapter 3. As indicated there, none of the errors detected is material in terms of tolerable misstatement ($900,000). Additionally, the overall effect of the misstatements is not material in terms of aggregated components of the financial statements. Even though the misstatements shown in Exhibit 17–4 are not material either quantitatively or qualitatively, it is common practice for the auditor to communicate any such adjustments to the entity to correct the books. It is normally expected that known misstatements will be corrected. However, the auditor would not necessarily require all proposed adjustments to be booked. For example, suppose the auditor identifies a misstatement in an account receivable for a particular customer in confirming a sample of accounts receivable. She or he will likely calculate an estimated or projected error in the

Final PDF to printer

Chapter 17 Completing the Audit Engagement 577

mes32502_ch17_561-595.indd 577 10/14/15 04:01 PM

Some Factors That May Lead to a Conclusion That a Quantitatively Immaterial Misstatement is Material from a Qualitative Perspective*

1. The potential effect of the misstatement on trends, especially trends in profitability. 2. A misstatement that changes a loss into income or vice versa. 3. The potential effect of the misstatement on the company’s compliance with loan covenants, other contractual agreements, and regulatory provisions. 4. A misstatement that has the effect of increasing management’s compensation, for example, by satisfying the requirements for the award of bonuses

or other forms of incentive compensation. 5. The sensitivity of the circumstances surrounding the misstatement, for example, the implications of misstatements involving fraud and possible illegal

acts, violations of contractual provisions, and conflicts of interest. 6. The effects of misclassifications, for example, misclassification between operating and non-operating income or recurring and non-recurring

income items. 7. The significance of the misstatement or disclosures relative to known user needs for example: a. The significance of earnings and earnings per share to public company investors. b. The magnifying effects of a misstatement on the calculation of purchase price in a transfer of interests (buy/sell agreement). c. The effect of misstatements of earnings when contrasted with expectations. 8. The definitive character of the misstatement, for example, the precision of an error that is objectively determinable as contrasted with a misstatement

that unavoidably involves a degree of subjectivity through estimation, allocation, or uncertainty. 9. The motivation of management with respect to the misstatement, for example, (i) an indication of a possible pattern of bias by management when

developing and accumulating accounting estimates or (ii) a misstatement precipitated by management’s continued unwillingness to correct weak- nesses in the financial reporting process.

10. The cost of making the correction. If management has developed a system to calculate an amount that represents an immaterial misstatement, not correcting such a difference may reflect a possible bias or motivation on the part of management.

*Source: PCAOB, AS14, Appendix B.

T A B L E 1 7 – 2

Example Working Paper for Evaluating Detected Misstatements

EARTHWEAR CLOTHIERS Schedule of Proposed Adjusting Entries

12/31/15

Workpaper Ref. Proposed Adjusting Entry Assets Liabilities Equity Revenues Expenses

N10 Payroll expense 75,000 Bonuses 140,000 Accrued liabilities 215,000 To accrue payroll through 12/31 and recognize bonuses.

312,500

F20 Cost of sales Inventory (312,500) To adjust ending inventory based on sample results.

F20 Inventory 227,450 Accounts payable 227,450 To record inventory in transit at 12/31.

R15 Accounts receivable 79,850 Sales 79,850 To record sales cutoff errors at 12/31. Total (5,200) 442,450 79,850 527,500

Tolerable Misstatement = $900,000 (50 percent of planning materiality) Conclusion: Based on the above analysis, the account balances for EarthWear Clothiers are fairly stated in accordance with GAAP.

E X H I B I T 1 7 – 4

Final PDF to printer

578 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 578 10/14/15 04:01 PM

population of accounts receivable based on the sample results (see Chapter 9). The auditor will normally expect the entity to correct the specific customer account found to be in error but may not require the entity to book the full amount of the projected error in receivables if the amount is immaterial. If the likely misstatement for a particular account is greater than the tolerable misstatement, the account will require adjustment at least to the point at which the likely error remaining is less than tolerable misstatement.

In evaluating misstatements relating to accounting estimates, the auditor should be very careful in considering the risk of material misstatement in accounts that are subject to estimation. Examples of such estimates include inventory obsolescence, loan loss reserves, uncollectible receivables, and warranty obligations. Seldom can accounting estimates be con- sidered accurate with certainty. If, based on the best audit evidence, the auditor believes the estimated amount included in the financial statements is unreasonable, the difference between that estimate and the closest reasonable estimate should be treated as a misstatement. The closest reasonable estimate may be a range of acceptable amounts or a precisely determined point estimate, if that is a better estimate than any other amount (AS14 ¶13). For example, suppose that the auditor concludes based on the evidence that the allowance for doubtful accounts should be between $210,000 and $270,000. If management’s recorded estimate falls within this range (say $250,000), the auditor will likely conclude that the recorded amount is reasonable and no difference would be aggregated. If the recorded estimate falls outside this range (say $190,000), the difference between the recorded amount and the amount at the clos- est end of the auditor’s range ($20,000) would be aggregated as a likely misstatement. The auditor compares this aggregate misstatement to the overall materiality.

The process of determining whether misstatements are material can become somewhat more complicated when misstatements that occurred in prior years were left uncorrected because they were deemed immaterial. SEC Staff Accounting Bulletin No. 108, Consider- ing the Effects of Prior Year Misstatements When Quantifying Misstatements in Current Year Financial Statements (SAB 108) stipulates that a registrant should evaluate a current year misstatement using both of two different methods—the “iron curtain” approach and the “roll- over” approach. The iron curtain method quantifies the misstatement based on the amount required to correct the misstatement in the balance sheet at the period end, regardless of the misstatement’s year of origination. Thus, under the iron curtain approach, if a misstatement accumulates to a material amount over two or more periods, the entire accumulated misstate- ment must be corrected. The rollover method, on the other hand, quantifies the misstatement based only on the amount of the error that originates in the current year income statement. Thus, the rollover approach ignores the effects of uncorrected misstatements that originated in prior years that have accumulated on the balance sheet. In other words, the rollover method ignores the “carryover effects” of uncorrected prior year misstatements. If a misstatement is considered material to the financial statements under either the iron curtain or the rollover approach, the registrant’s financial statements would need to be adjusted so that any remain- ing misstatement would be considered immaterial under either approach.

Practice I N S I G H T

Qualitative factors can be more important than dollar amount in determining whether a misstatement is material. Auditors are particularly sensitive to misstatements that are intentional regardless of their size. If the auditor learns of an intentional misstatement introduced by management, even when the misstatement is relatively small, he or she may be required to (1) reevaluate the degree of audit risk involved in the audit engagement; (2) determine whether to revise the nature, timing, and extent of audit procedures; and (3) consider whether to resign from the engagement.

Evaluating Financial Statement Presentation and Disclosure The entity normally drafts the financial statements, including footnotes. The auditor reviews the financial statements to ensure compliance with GAAP, proper presentation of accounts, and inclusion of all necessary disclosures. Most public accounting firms use some type of financial statement disclosure checklist to assist the auditor in ensuring that all required

Final PDF to printer

Chapter 17 Completing the Audit Engagement 579

mes32502_ch17_561-595.indd 579 10/14/15 04:01 PM

footnotes have been properly included. In addition, the auditor ensures that numbers and repre- sentations made in financial statement disclosures are fairly presented in all material respects.

Independent Engagement Quality Review Most firms have a policy requiring an engagement quality review for publicly traded compa- nies and for privately held companies whose financial statements are expected to be widely distributed.2 The engagement quality reviewer is a partner who is not associated with the details of the engagement and is expected to provide an independent, objective review. The engagement quality control reviewer performs an objective evaluation of the significant judg- ments made by the engagement team and the conclusions reached in formulating the auditor’s report. She or he discusses significant findings or issues with the engagement partner and reads the financial statements and the proposed auditor’s report. The engagement quality reviewer reviews selected audit documentation relating to the significant judgments the engagement team made and the related conclusions it reached, and evaluates the conclusions reached in formulating the auditor’s report. Finally, she or he considers whether the proposed auditor’s report is appropriate.

Archiving and Retention As discussed in Chapter 5, the events leading up to the Sarbanes-Oxley Act of 2002 focused a spotlight on the practice of archiving and retaining audit files. The PCAOB’s “Audit Doc- umentation” (AS3), requires that firms archive their public company audit files (working papers and other documentation) for retention within 45 days following the time the auditor grants permission to use the auditor’s report in connection with the issuance of the company’s financial statements. The PCAOB’s requires that audit documentation be retained for seven years from the date of completion of the engagement, as indicated by the date of the auditor’s report, unless a longer period of time is required by law (e.g., pending or threatened lawsuit, investigation, or subpoena). Some states (e.g., New York and California) have adopted similar (or in some cases even more stringent) archiving and retention policies for all audits, includ- ing audits of nonpublic companies.

All documents that “form the basis of the audit or review” must be retained. The PCAOB requires that any document created, sent, or received, including documents that are incon- sistent with a final conclusion, be included in the audit files for all significant matters. This includes any correspondence between engagement teams and national technical accounting or auditing experts in a public accounting firm’s national office. Also, when significant changes are made to the planned audit approach at any point during the audit, the final documentation should indicate the original plan, modifications to the plan, and the rationale for the change. Such document retention is intended to facilitate any subsequent investigations, proceedings, and litigation.

Going Concern Considerations The auditor has a responsibility to evaluate whether there is substantial doubt about an enti- ty’s ability to continue as a going concern for a reasonable period of time. “Going concern” in this context means that the “concern” (i.e., entity) is likely to keep “going” (i.e., it is likely to be able to keep doing business). In other words, it is a good thing when a company is con- sidered to be a “going concern.” The issue here is whether the auditor has “substantial doubt” about the company’s ability to continue as such for a reasonable period of time. While this assessment is made during the planning of the engagement, the auditor must consider this issue again near the end of the engagement.

2K. Epps and W. F. Messier, Jr., “Engagement Quality Reviews: A Comparison of Audit Firm Practices,” Auditing: A Journal of Practice & Theory, November 2007, pp. 167–181.

LO 17-9

Final PDF to printer

580 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 580 10/14/15 04:01 PM

Until recently, accounting standards did not require an entity to evaluate its own ability to continue in existence as a going concern. This set of circumstances represented a depar- ture from the standard role of auditors, which is to evaluate and report on management’s assertions. However, the FASB recently rectified this situation by issuing Accounting Stan- dards Update 2014–15, Disclosure of Uncertainties about an Entity’s Ability to Continue as a Going Concern. With this new accounting standard, an entity’s management must first evaluate the entity’s ability to continue in existence as a going concern, and auditors then make an independent assessment in order to evaluate the adequacy of management’s going concern disclosures.

The new FASB standard requires an entity to evaluate its ability to meet its obligations for a “look-forward” period of one year from the financial statement issuance date. In some cases, management initially may conclude it is probable the entity will be unable to meet its obligations within the look-forward period but develops plans to mitigate that risk. In such situations, management can consider its plans as being sufficient to overcome a substantial doubt conclusion only if it is probable the plans can be effectively implemented.

If management determines that it is probable that the entity will be unable to meet its obligations within the look-forward period, management is required to make disclosures. If management determines that its plans successfully reduce the doubt to less than probable, management discloses the principal conditions or events that gave rise to the doubt, its evalu- ation of the significance of those conditions or events, and an analysis of how its plans will successfully reduce the doubt to be less than probable. If management determines that the initial substantial doubt has not been sufficiently reduced by its plans, management must disclose the same information listed above and in addition must disclose in the footnotes that there is substantial doubt about its ability to continue as a going concern within one year from the financial statement issuance date.

The FASB’s going concern guidance for management is quite consistent with existing auditing standards that guide auditors’ going concern evaluations, except that the FASB stan- dard begins the one-year look-forward period at the financial statement issuance date while the auditing literature refers to a one-year look-forward period from the balance sheet date. It is likely that auditing standards will be revised to eliminate this inconsistency before the FASB standard’s effective date of December 15, 2016. For example, the PCAOB is already evaluating potential revisions to its going concern auditing standard and will continue to mon- itor the activities of the FASB and other standard setters.

Steps in the Auditor’s Going Concern Evaluation The auditor follows three overall steps in making the going concern evaluation:

1. Consider whether the results of audit procedures performed during the planning, performance, and completion of the audit indicate whether there is substantial doubt about the entity’s ability to continue as a going concern for a reasonable period of time (one year).

2. If there is substantial doubt, obtain information about management’s plans to mitigate the going concern problem and assess the likelihood that such plans can be successfully implemented.

3. Conclude, in light of management’s plans, whether there is substantial doubt about the ability of the entity to continue as a going concern; if substantial doubt exists, consider the adequacy of the disclosures about the entity’s ability to continue and include an explanatory paragraph in the audit report.

Let’s discuss each of these steps in turn. Identifying and Assessing Going Concern Problems. Standard audit procedures are

normally sufficient to identify conditions and events that indicate going concern problems. Examples of audit procedures that are likely to identify these kinds of conditions and events include risk assessment and analytical procedures, review of subsequent events, tests for com- pliance with debt agreements, reading the minutes of board of directors’ meetings, inquiry of

Final PDF to printer

Chapter 17 Completing the Audit Engagement 581

mes32502_ch17_561-595.indd 581 10/14/15 04:01 PM

legal counsel, and confirmations with lenders or investors regarding financial arrangements. Auditing standards identify four major categories of such conditions or events: negative finan- cial trends, other financial difficulties, internal problems, and external matters.

Negative financial trends consist of poor results from operations and adverse financial ratios. Analytical procedures performed as part of the auditor’s risk assessment procedures during the planning phase of the audit are often particularly helpful in identifying negative financial trends. Table 17–3 lists a number of important financial conditions and ratios that prior audit research has shown to be good indicators of financial distress that can lead to a going concern report. If the entity being evaluated meets a number of these financial condi- tions and has adverse ratios, the auditor may conclude that there is substantial doubt about the entity’s ability to continue as a going concern.

Conditions or events that may occur in the other three categories are shown in Table 17–4. Other financial difficulties are particularly important for the going concern assessment. For example, if an entity has violated certain debt covenants or is in default on its debt, the debt holders may call for immediate payment. In such circumstances, the entity may be unable to meet its cash requirements and may have to seek bankruptcy protection or liquidation. Simi- larly, internal matters such as work stoppages may have severe consequences on the entity. Finally, external matters may cause an entity to be unable to continue as a going concern. For example, macroeconomic downturns or the loss of even one or two major customers have been known to cause companies to face severe financial difficulties.

Financial Conditions and Ratios That Indicate Financial Distress

Financial Conditions Recurring operating losses Current-year deficit Accumulated deficits Negative net worth Negative working capital Negative cash flow Negative income from operations Inability to meet interest payments Ratios Net worth/total liabilities Working capital from operations/total liabilities Current assets/current liabilities Total long-term liabilities/total assets Total liabilities/total assets Net income before taxes/net sales

T A B L E 1 7 – 3

Other Conditions and Events Indicating a Problem with the Going Concern Assumption

Other Financial Difficulties Default on loans Dividends in arrears Restructuring of debt Denial of trade credit by suppliers No additional sources of financing Internal Matters Work stoppages Uneconomic long-term commitments Dependence on the success of one particular project External Matters Legal proceedings Loss of a major customer or supplier Loss of a key franchise, license, or patent

T A B L E 1 7 – 4

Final PDF to printer

582 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 582 10/14/15 04:01 PM

Consideration of Management’s Plans. Once conditions have been identified that indicate substantial doubt about the ability of the entity to continue, the auditor considers manage- ment’s plans for dealing with the adverse effects of the conditions or events. Potential man- agement responses include the following:

∙ Plans to dispose of assets ∙ Plans to borrow money or restructure debt ∙ Plans to reduce or delay expenditures ∙ Plans to increase ownership equity

For example, management may attempt to sell assets to pay off debt or dispose of operations that are losing money. Management may negotiate with creditors in order to restructure debt or seek additional financing. Frequently, management will develop plans to reduce wages or cut back the workforce. When evaluating management’s plans, the audi- tor should obtain evidence about the elements of the plans and their likelihood of success. This requires examining the assumptions used by management in developing such plans. If the auditor concludes that there is substantial doubt about the entity’s ability to continue as a going concern even after considering management’s plans, the auditor will normally issue a modified audit report describing the going concern issue similar to the one shown in Chapter 18.

Deciding whether to issue an opinion with a going concern paragraph is a complex pro- cess and can involve significant difficulty and even conflict with the entity’s management. As you might imagine, management can be overconfident about the entity’s prospects and sometimes will not agree with the auditor about whether a going concern opinion should be issued. The decision is a particularly difficult one because it involves making subjective judgments and estimates about future events. Further, a going concern opinion can be a “self- fulfilling prophecy” in that it can interfere with a company’s ability to obtain capital through additional issuances of equity or debt, or even to acquire needed inventory or supplies except on a “COD” (cash on delivery) basis. The decision to issue a going concern opinion is one that heavily involves the engagement senior manager and partner, often in consultation with the accounting firm’s head office.

Now that an accounting standard is in place requiring management to first evaluate the likelihood of the entity continuing in existence as a going concern and disclose its conclusions in the financial statements, the auditor can use the results of her or his independent evaluation to assess the adequacy of management’s assessment and related disclosures.

Communications with Those Charged with Governance and Management

Auditing standards require that the auditor communicate certain matters related to the conduct of the audit to those individuals responsible for oversight of the entity’s strategic direction and its financial reporting process, sometimes referred to as “those charged with governance.” For publicly traded companies, “those charged with governance” would typically refer to the board of directors, and the audit committee in particular. The intent of this communication is to encourage a healthy, two-way dialogue about financial reporting matters and to ensure that those charged with governance receive adequate information on significant audit-related issues. The objectives of communication with the audit committee are to (1) communicate the auditor’s responsibilities and establish an understanding of the terms of the audit engagement with the audit committee; (2) obtain information from the audit committee that is relevant to the audit; (3) communicate an overview of the overall audit strategy and timing; and (4) pro- vide timely observations arising from the audit that are significant to the financial reporting process. As shown in Table 17–5, there are several important topics organized into three cate- gories that the auditor should discuss with the audit committee or other responsible body. The

LO 17-10

Final PDF to printer

Chapter 17 Completing the Audit Engagement 583

mes32502_ch17_561-595.indd 583 10/14/15 04:01 PM

three categories are appointment and retention of the auditor, obtaining information relevant to the audit and communicating the audit strategy, and communicating the results of the audit.

All audit committee communications required by auditing standards should be made in a timely manner and prior to the issuance of the auditor’s report. Communication regarding significant findings from the audit should be in writing when the auditor deems oral com- munication to be inadequate. Other parts of the communication may be oral or in writing but should be documented.

Communications Regarding the Audit of Internal Control over Financial Reporting The auditor also has a number of communication responsibilities with respect to the audit of internal control over financial reporting (AS5). The auditor must communicate in writing to management and the audit committee all significant deficiencies and material weaknesses identified during the audit. The written communication should be made prior to the issuance of the auditor’s report on internal control over financial reporting. If a significant deficiency or material weakness exists because the oversight of external financial reporting and internal control over financial reporting by the company’s audit committee is ineffective, the auditor must communicate that specific significant deficiency or material weakness in writing to the board of directors. The auditor also must communicate to management, in writing, all control deficiencies identified (including deficiencies in internal control that are of a lesser magni- tude than significant deficiencies—see Chapter 7 for additional details regarding communica- tion about matters relating to internal control).3

3Auditing Standards also require the auditor to communicate fraud or illegal acts to the appropriate level of manage- ment, or the audit committee if senior management is involved.

Examples of Communication with Those Charged with Governance

Appointment and Retention of the Auditor • Discuss any significant issues that were discussed with management in connection with the initial appointment or retention of the auditor, including any

significant discussions about applying accounting principles and auditing standards. • Establish an understanding of the terms of the audit engagement with the audit committee, which includes communicating the objective of the audit,

the responsibilities of the auditor, and the responsibilities of management in an engagement letter.

Obtaining Information Relevant to the Audit and Communicating the Audit Strategy • Inquire if the audit committee is aware of matters that may be relevant to the audit, including, but not limited to, violations or possible violations of laws

or regulations. • Provide an overview of the overall audit strategy, including the timing of the audit and a discussion of the significant risks identified by the auditor during

its risk assessment procedures, and communicate the nature and extent of specialized skill or knowledge needed to perform the planned audit procedures or evaluate the audit results related to significant risks, the extent to which the auditor plans to use the work of the company’s internal audit function, and the basis for the auditor’s determination that it can serve as principal auditor, if significant parts of the audit are to be performed by other auditors.

• Discuss how the auditor proposes to address the significant risks of material misstatement, whether due to fraud or error.

Communicating Results of the Audit • Share the auditor’s views about qualitative aspects of the entity’s significant and critical accounting practices, including accounting policies, estimates,

and financial statement disclosures, and communicate the auditor’s conclusions about the quality of accounting policies and practices. • Discuss critical estimates and significant unusual transactions, and considerations relating to assessment of going concern. • Disclose disagreements with management, if any. • Provide a summary of uncorrected misstatements unless deemed by the auditor to be clearly trivial in nature, and corrected misstatements that were

brought to management’s attention by the auditor, including whether detected misstatements (whether or not material) may indicate a particular bias in the preparation of the financial statements.

• Summarize representations the auditor is requesting from management. • Discuss management’s consultations with other accountants, as well as matters for which the auditor consulted outside the engagement team. • Communicate other findings or issues arising from the audit that are, in the auditor’s professional judgment, significant and relevant to those charged

with governance.

(This list is not exhaustive; see PCAOB AS No. 16.)

T A B L E 1 7 – 5

Final PDF to printer

584 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 584 10/14/15 04:01 PM

Management Letter In addition to the communications discussed above, the auditor normally prepares a manage- ment letter. Be sure not to confuse the management letter with the management representation letter discussed previously in this chapter. The auditor uses the management letter to make recommendations to the entity based on observations during the audit; the letter may include suggested improvements in various areas, such as organizational structure and efficiency issues.

Earlier in this chapter we discussed procedures conducted as part of the audit to identify rel- evant events occurring after the date of the financial statements but before the statements and the accompanying audit report are issued. Although an auditor has no obligation to conduct any audit procedures after the financial statements and accompanying audit report have been issued, facts may come to the auditor’s attention after issuance that might have affected the report, had he or she known about them. In Figure 17–1, this would include events occurring after March 5, 2016. The most common situation is where the auditor becomes aware that pre- viously issued financial statements contain material misstatements due to either unintentional or intentional actions by management. For example, the auditor may learn that a material amount of inventory was not included in the financial statements because of a computer error. Alternatively, the auditor may learn that management fraudulently inflated inventory quanti- ties and prices in an effort to increase reported profits. A number of such situations have arisen in recent years (e.g., see Exhibit 17–5). Keep in mind that here we are discussing events occurring after the issuance of the financial statements and that would have changed the state- ments or the auditor’s opinion, had the facts been known prior to issuance. Events that have no bearing on the prior period’s financial statements will appropriately be recognized in the period in which they occur.

When facts are encountered that may affect the auditor’s previously issued report, the auditor should consult with his or her attorney because legal implications may be involved and actions taken by the auditor may involve confidential entity–auditor communications. The auditor should determine whether the facts are reliable and whether they existed at the date of the audit report. The auditor should also discuss the matter with an appropriate level of management and, when appropriate, those charged with governance. Finally, the auditor should determine whether the financial statements need revision and, if so, inquire how man- agement intends to address the matter.

LO 17-11

Subsequent Discovery of Facts Existing at the Date of the Auditor’s Report

New Century Announces Financial Statements Should Not Be Relied Upon, Goes Bankrupt

New Century Financial Corporation was, at one point, the second largest originator of subprime loans in the United States. New Century’s loan originations had risen from $14 billion in 2002 to about $60 billion in 2006. However, on February 7, 2007, New Century began to crumble as it restated its interim earnings for the first three quarters of 2006. A combination of allegedly shady accounting, insufficient loan loss reserves, and the collapse of the subprime mortgage market eventually led New Century to declare bank- ruptcy in 2007. In April 2007, KPMG, New Century’s auditor, terminated its relationship with New Century. In May, New Century announced that the December 2005 financial statements should no longer be relied upon. Litigation against KPMG by New Century’s bankruptcy trustee was settled in August 2010 for nearly $45 million.

Sources: P. Brickley and A. Efrati, “KPMG Aided New Century Missteps, Report Says,” The Wall Street Journal, March 27, 2008, p. A-12; D. Kardos, “KPMG Is Sued over New Century,” The Wall Street Journal, April 2, 2009, p. C-3; New Century Chapter 11 Bankruptcy Report, Case No. 07-10416 (KJC), “Final Report of Michael J. Missal, Bankruptcy Court Examiner,” United States Bankruptcy Court for the District of Delaware, February 20, 2008.

E X H I B I T 1 7 – 5

Final PDF to printer

Chapter 17 Completing the Audit Engagement 585

mes32502_ch17_561-595.indd 585 10/14/15 04:01 PM

If the auditor determines that the previously issued financial statements are in error and the audit report is affected, he or she should request that the entity issue an immediate revision to the financial statements. The reasons for the revisions should be described in the footnotes to the revised financial statements. If the effect on the financial statements cannot immedi- ately be determined, the entity should notify persons known to be relying on the financial statements and the accompanying auditor’s report. If the stock is publicly traded or subject to regulatory jurisdiction, the entity should contact the SEC, stock exchanges, and other regula- tory agencies as appropriate.

If the entity refuses to cooperate and make the necessary disclosures, the auditor should notify the board of directors and take the following steps, if possible:

1. Notify the entity that the auditor’s report must no longer be associated with the financial statements.

2. Notify any regulatory agencies having jurisdiction over the entity that the auditor’s report can no longer be relied upon.

3. Notify each person known to the auditor to be relying on the financial statements. (Notifying a regulatory agency such as the SEC is often the only practical way of providing appropriate disclosure.)

The practical outcome of these procedures is that the auditor has withdrawn his or her report on the previously issued financial statements. In notifying the entity, regulatory agen- cies, and other persons relying on the auditor’s report, the auditor should disclose the effect the information would have had on the auditor’s report, had the information been known to the auditor prior to issuance of the report.

KEY TERMS

Analytical procedures. Evaluations of financial information made by an analysis of plausible relationships among both financial and nonfinancial data. Contingent liability. An existing condition, situation, or set of circumstances involving uncertainty as to possible loss to an entity that will ultimately be resolved when some future event occurs or fails to occur. Closest reasonable estimate. A range of acceptable amounts or a precisely determined point estimate for an estimate (e.g., uncollectible receivables), if that is a better estimate than any other amount. Dual dating. The auditor’s report is dual dated when a subsequent event occurs after the date on which the auditor has obtained sufficient appropriate audit evidence but before the finan- cial statements are issued. Engagement quality review. A review by a quality review partner of the financial statements and audit report to ensure the audit was properly conducted and an appropriate report issued. Legal letter. An audit inquiry sent to the entity’s attorneys in order to obtain or corroborate information about litigation, claims, and assessments. Management letter. A letter from the auditor to management making recommendations to the entity based on observations during the audit; the letter may include topics relating to organizational structure and efficiency issues. Representation letter. A letter that corroborates oral representations made to the auditor by management or by other auditors and documents the continued appropriateness of such representations. Subsequent event. An event or transaction that occurs after the balance sheet date but prior to the issuance of the financial statements and the auditor’s reports that may materially affect the financial statements. Working papers. The auditor’s record of the work performed and the conclusions reached on the audit.

Final PDF to printer

586 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 586 10/14/15 04:01 PM

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 17-1 17-1 Define what is meant by contingent liability. What three categories are used to clas- sify a contingent liability? Give four distinct examples of contingent liabilities.

LO 17-3 17-2 What information does the auditor ask the attorney to provide on pending or threat- ened litigation?

LO 17-4 17-3 Provide two examples of commitments. Under what conditions do such commit- ments result in a decrease in Other Comprehensive Income?

LO 17-5 17-4 What are the types of subsequent events relevant to financial statement audits? Give one example of each type of subsequent event that might materially affect the finan- cial statements.

LO 17-5, 17-6 17-5 Under what circumstances would the auditor dual date an audit report? LO 17-8 17-6 Are analytical procedures required as part of the final overall review of the financial

statements? What is the purpose of such analytical procedures? LO 17-8 17-7 Why does the auditor obtain a representation letter from management? LO 17-8 17-8 Describe the purposes of an independent engagement quality review by a quality

review partner. LO 17-9 17-9 List the three overall steps in the auditor’s going concern evaluation process. LO 17-9 17-10 What four major categories of events or conditions may indicate going concern prob-

lems? Give two examples for each category. LO 17-10 17-11 What items should be included in the auditor’s communication with those charged

with governance (i.e., the audit committee or similar group)? LO 17-11 17-12 What types of events would generally require restatement of the issued financial

statements? What procedures should the auditor follow when the entity refuses to cooperate and make the necessary disclosures?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 17-1, 17-2 17-13 An auditor would be most likely to identify a contingent liability by obtaining a(n) a. Accounts payable confirmation. b. Bank confirmation of the entity’s cash balance. c. Letter from the entity’s general legal counsel. d. List of subsequent cash receipts.

LO 17-3 17-14 An auditor should request that an audited entity send a letter of inquiry to those attor- neys who have been consulted concerning litigation, claims, or assessments. The primary reason for this request is to provide

a. The opinion of a specialist as to whether loss contingencies are possible, prob- able, or remote.

b. A description of litigation, claims, and assessments that have a reasonable pos- sibility of unfavorable outcome.

c. An objective appraisal of management’s policies and procedures adopted for identifying and evaluating legal matters.

d. Corroboration of the information furnished by management concerning litigation, claims, and assessments.

LO 17-6 17-15 An auditor issued an audit report that was dual dated for a subsequent event occur- ring after the date on which the auditor has obtained sufficient appropriate audit

Final PDF to printer

Chapter 17 Completing the Audit Engagement 587

mes32502_ch17_561-595.indd 587 10/14/15 04:01 PM

evidence but before issuance of the financial statements. The auditor’s responsibility for events occurring subsequent to the date on which the auditor has obtained suf- ficient appropriate audit evidence was

a. Limited to the specific event referenced. b. Extended to include all events occurring since the date on which the auditor has

obtained sufficient appropriate audit evidence. c. Extended to subsequent events occurring through the date of issuance of the

report. d. Limited to events occurring up to the date of the last subsequent event referenced.

LO 17-7 17-16 Which of the following procedures would an auditor most likely perform to obtain evidence about the occurrence of any changes in internal control that might affect financial reporting between the end of the reporting period and the date of the audi- tor’s report?

a. Review a fire insurance settlement during the subsequent period. b. Examine relevant internal audit reports issued during the subsequent period. c. Inquire of the entity’s legal counsel concerning litigation, claims, and assess-

ments arising after year-end. d. Confirm bank accounts established after year-end.

LO 17-8 17-17 Final analytical procedures are generally intended to a. Provide the auditor with a final, overall evaluation of the relationships among

financial statement balances. b. Test transactions to corroborate management’s financial statement assertions. c. Gather evidence concerning account balances that have not yet been investigated. d. Retest control activities that appeared to be ineffective during the assessment of

control risk.

LO 17-9 17-18 Which of the following audit procedures is most likely to assist an auditor in iden- tifying conditions and events that may indicate substantial doubt about an entity’s ability to continue as a going concern?

a. Review compliance with the terms of debt agreements. b. Review management’s plans to dispose of assets. c. Evaluate management’s plans to borrow money or restructure debt. d. Consider management’s plans to reduce or delay expenditures.

LO 17-10 17-19 Auditing standards primarily encourage which of the following conversations between the auditor and another party about financial reporting?

a. A conversation with those charged with governance to discuss matters pertaining to financial reporting.

b. A conversation with only management to discuss matters pertaining to financial reporting.

c. A conversation with the head of the entity’s internal audit department and those charged with governance to discuss matters pertaining to financial reporting.

d. A conversation in which those charged with governance report on management’s views on matters pertaining to financial reporting.

LO 17-10 17-20 Which of the following matters should an auditor communicate to those charged with governance?

Significant Audit Adjustments

Management’s Consultations with Other Accountants

a. Yes Yes b. Yes No c. No Yes d. No No

Final PDF to printer

588 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 588 10/14/15 04:01 PM

LO 17-11 17-21 Which of the following events occurring after the issuance of a set of financial state- ments and the accompanying auditor’s report would be most likely to cause the audi- tor to make further inquiries about the financial statements?

a. A technological development in the industry that could affect the entity’s future ability to continue as a going concern.

b. The entity’s sale of a subsidiary that accounts for 30 percent of the entity’s con- solidated sales.

c. The discovery of information regarding a contingency that existed before the financial statements were issued.

d. The final resolution of a lawsuit explained in a separate paragraph of the auditor’s report.

PROBLEMS All applicable problems are available with Connect.

LO 17-1, 17-2, 17-3 17-22 During an audit engagement, Harper, CPA, has satisfactorily completed an examina- tion of accounts payable and other liabilities and now plans to determine whether there are any loss contingencies arising from litigation, claims, or assessments.

Required: What audit procedures should Harper follow with respect to the existence of loss contingencies arising from litigation, claims, and assessments? Do not discuss reporting requirements.

(AICPA, adapted)

LO 17-3 17-23 Cole & Cole, CPAs, are auditing the financial statements of Consolidated Industries Company for the year ended December 31, 2015. On April 2, 2016, an inquiry let- ter to J. J. Young, Consolidated’s outside attorney, was drafted to corroborate the information furnished to Cole by management concerning pending and threatened litigation, claims, and assessments, as well as unasserted claims and assessments. On May 6, 2016, C. R. Cao, Consolidated’s chief financial officer, gave Cole a draft of the inquiry letter below for Cole’s review before mailing it to Young.

May 6, 2016

J. J. Young, Attorney at Law 123 Main Street Anytown, USA

Dear J. J. Young:

In connection with an audit of our financial statements at December 31, 2015, and for the year then ended, management of the company has prepared, and furnished to our auditors, Cole & Cole, CPAs, 456 Broadway, Anytown, USA, a description and evaluation of cer- tain contingencies, including those set forth below involving matters with respect to which you have been engaged and to which you have devoted substantive attention on behalf of the company in the form of legal consultation or representation. Your response should include matters that existed at December 31, 2015. Because of the confidentiality of all these matters, your response may be limited.

In November 2015, an action was brought against the company by an outside salesman alleging breach of contract for sales commissions and pleading a second cause of action for an accounting with respect to claims for fees and commissions. The salesman’s action claims damages of $300,000, but the company believes it has meritorious defenses to the claims. The possible exposure of the company to a successful judgment on behalf of the plaintiff is slight.

In July 2015, an action was brought against the company by Industrial Manufacturing Company (“Industrial”) alleging patent infringement and seeking damages of $20 million. The action in U.S. District Court resulted in a decision on October 16, 2015, holding that

Final PDF to printer

Chapter 17 Completing the Audit Engagement 589

mes32502_ch17_561-595.indd 589 10/14/15 04:01 PM

the company had infringed seven Industrial patents and awarding damages of $14 million. The company vigorously denies these allegations and has filed an appeal with the U.S. Court of Appeals for the Federal Circuit. The appeal process is expected to take approximately two years, but there is some chance that Industrial may ultimately prevail.

Please furnish to our auditors such explanation, if any, that you consider necessary to supplement the foregoing information, including an explanation of those matters as to which your views may differ from those stated and an identification of the omission of any pending or threatened litigation, claims, and assessments or a statement that the list of such matters is complete. Your response may be quoted or referred to in the financial statements without further correspondence with you.

You also consulted on various other matters considered pending or threatened litiga- tion. However, you may not comment on these matters because publicizing them may alert potential plaintiffs to the strengths of their cases. In addition, various other matters prob- able of assertion that have some chance of an unfavorable outcome, as of December 31, 2015, are unasserted claims and assessments.

C. R. Cao Chief Financial Officer

Required: Describe the omissions, ambiguities, and inappropriate statements and terminology in Cao’s letter.

(AICPA, adapted)

LO 17-5, 17-7 17-24 Namiki, CPA, is auditing the financial statements of Taylor Corporation for the year ended December 31, 2015. Namiki plans to complete the fieldwork and sign the auditor’s report about March 10, 2016. Namiki is concerned about events and transactions occurring after December 31, 2015, that may affect the 2015 financial statements.

Required: a. What general types of subsequent events require Namiki’s consideration and

evaluation? b. What auditing procedures should Namiki consider performing to gather evidence

concerning subsequent events?

(AICPA, adapted)

LO 17-5, 17-6, 17-7 17-25 For each of the following items, assume that Josh Feldstein, CPA, is expressing an opinion on Scornick Company’s financial statements for the year ended December 31, 2015; that he completed fieldwork on January 21, 2016; and that he now is preparing his opinion to accompany the financial statements. In each item a subsequent event is described. This event was disclosed to the CPA either in connection with his review of subsequent events or after the date on which the auditor has obtained sufficient appropriate audit evidence. Describe the financial statement effects, if any, of each of the following subsequent events. Each of the five items is independent of the other four and is to be considered separately.

1. A large account receivable from Agronowitz Company (material to financial statement presentation) was considered fully collectible at December 31, 2015. Agronowitz suffered a plant explosion on January 25, 2016. Because Agronowitz was uninsured, it is unlikely that the account will be paid.

2. The tax court ruled in favor of the company on January 25, 2016. Litigation involved deductions claimed on the 2012 and 2013 tax returns. In accrued taxes payable, Scornick had provided for the full amount of the potential disallowances. The Internal Revenue Service will not appeal the tax court’s ruling.

3. Scornick’s Manufacturing Division, whose assets constituted 45 percent of Scornick’s total assets at December 31, 2015, was sold on February 1, 2016. The new owner assumed the bonded indebtedness associated with this property.

Final PDF to printer

590 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 590 10/14/15 04:01 PM

4. On January 15, 2016, R. E. Fogler, a major investment adviser, issued a negative report on Scornick’s long-term prospects. The market price of Scornick’s com- mon stock subsequently declined by 40 percent.

5. At its January 5, 2016, meeting, Scornick’s board of directors voted to increase substantially the advertising budget for the coming year and authorized a change in advertising agencies.

LO 17-8 17-26 Arenas, an assistant accountant with the firm of Gonzales & Ramirez, CPAs, is audit- ing the financial statements of Tech Consolidated Industries, Inc. The firm’s audit program calls for the preparation of a written management representation letter.

Required: a. In an audit of financial statements, in what circumstances is the auditor required

to obtain a management representation letter? What are the purposes of obtaining the letter?

b. To whom should the representation letter be addressed, and when should it be dated? Who should sign the letter, and what would be the effect of his or her refusal to sign the letter?

c. In what respects may an auditor’s other responsibilities be relieved by obtaining a management representation letter?

(AICPA, adapted)

LO 17-8 17-27 During the examination of the annual financial statements of Amis Manufacturing, Inc., a nonpublic company, the company’s president, R. Heinrich, and Luddy, the auditor, reviewed the matters that were to be included in a written representation letter. Upon receipt of the following entity representation letter, Luddy contacted Heinrich to state that it was incomplete.

To: E. K. Luddy, CPA In connection with your examination of the balance sheet of Amis Manufacturing, Inc., as of December 31, 2015, and the related statements of income, retained earnings, and cash flows for the year then ended, for the purpose of expressing an opinion as to whether the financial statements present fairly the financial position, results of operations, and cash flows of Amis Manufacturing, Inc., in conformity with generally accepted account- ing principles, we confirm, to the best of our knowledge and belief, the following repre- sentations made to you during your examination. There were no

∙ Plans or intentions that may materially affect the carrying value or classification of assets and liabilities.

∙ Communications from regulatory agencies concerning noncompliance with, or defi- ciencies in, financial reporting practices.

∙ Agreements to repurchase assets previously sold. ∙ Violations or possible violations of laws or regulations whose effects should be con-

sidered for disclosure in the financial statements or as a basis for recording a loss contingency.

∙ Unasserted claims or assessments that our lawyer has advised are probable of assertion and must be disclosed in accordance with FASB ASC Topic 450, “Contingencies.”

∙ Capital stock repurchase options or agreements or capital stock reserved for options, warrants, conversions, or other requirements.

∙ Compensating balance or other arrangements involving restrictions on cash balances.

R. Heinrich, President Amis Manufacturing, Inc. March 14, 2016

Required: Identify the other matters that Heinrich’s representation letter should specifically

confirm.

(AICPA, adapted)

Final PDF to printer

Chapter 17 Completing the Audit Engagement 591

mes32502_ch17_561-595.indd 591 10/14/15 04:01 PM

LO 17-2, 17-3, 17-7, 17-28 Items 1 through 16 represent a series of unrelated statements, questions, excerpts, and 17-8, 17-10 comments taken from various parts of an auditor’s working paper file. Below items

1 through 16 is a list of the likely sources of the statements, questions, excerpts, and comments. Select, as the best answer for each item, the most likely source. Select only one source for each item. A source may be selected once, more than once, or not at all.

1. During our audit we discovered evidence of the company’s failure to safeguard inventory from loss, damage, and misappropriation.

2. The company considers the decline in value of equity securities classified as available-for-sale to be temporary.

3. There have been no communications from regulatory agencies concerning non- compliance with or deficiencies in financial reporting practices.

4. It is our opinion that the possible liability to the company in this proceeding is nominal in amount.

5. As discussed in Note 4 to the financial statements, the company experienced a net loss for the year ended July 31, 2015, and is currently in default under substan- tially all of its debt agreements. In addition, on September 25, 2015, the company filed a prenegotiated voluntary petition for relief under Chapter 11 of the U.S. Bankruptcy Code. These matters raise substantial doubt about the company’s abil- ity to continue as a going concern.

6. During the year under audit, we were advised that management consulted with Gonzales & Ramirez, CPAs. The purpose of this consultation was to obtain another CPA firm’s opinion concerning the company’s recognition of certain rev- enue that we believe should be deferred to future periods. Gonzales & Ramirez’s opinion was consistent with our opinion, so management did not recognize the revenue in the current year.

7. The company believes that all material expenditures that have been deferred to future periods will be recoverable.

8. Our use of professional judgment and the assessment of audit risk and materiality for the purpose of our audit mean that matters may have existed that would have been assessed differently by you. We make no representation as to the sufficiency or appropriateness of the information in our working papers for your purposes.

9. Indicate in the space provided below whether this information agrees with your records. If there are exceptions, please provide any information that will assist the auditor in reconciling the difference.

10. Blank checks are maintained in an unlocked cabinet along with the check-signing machine. Blank checks and the check-signing machine should be locked in sepa- rate locations to prevent the embezzlement of funds.

11. The company has insufficient expertise and controls over the selection and appli- cation of accounting policies that are in conformity with GAAP.

12. The timetable set by management to complete our audit was unreasonable con- sidering the failure of the company’s personnel to complete schedules on a timely basis and delays in providing necessary information.

13. Several employees have disabled the antivirus detection software on their PCs because the software slows the processing of data and occasionally rings false alarms. The company should obtain antivirus software that runs continuously at all system entry points and that cannot be disabled by unauthorized personnel.

14. In connection with an audit of our financial statements, please furnish to our audi- tors a description and evaluation of any pending or probable litigation against our company of which you are aware.

15. The company has no plans or intentions that may materially affect the carrying value or classification of assets and liabilities.

16. In planning the sampling application, was appropriate consideration given to the relationship of the sample to the assertion and to planning materiality?

Final PDF to printer

592 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 592 10/14/15 04:01 PM

List of Sources: A. Practitioner’s report on management’s assertion about an entity’s compliance

with specified requirements. B. Auditor’s communications on significant deficiencies and material weakness. C. Audit inquiry letter to legal counsel. D. Lawyer’s response to audit inquiry letter. E. Audit committee’s communication to the auditor. F. Auditor’s communication to those charged with governance (other than with

respect to significant deficiencies and material weakness). G. Report on the application of accounting principles. H. Auditor’s engagement letter. I. Letter for underwriters. J. Accounts receivable confirmation request. K. Request for bank cutoff statement. L. Explanatory paragraph of an auditor’s report on financial statements. M. Partner’s engagement review notes. N. Management representation letter. O. Successor auditor’s communication with predecessor auditor. P. Predecessor auditor’s communication with successor auditor.

DISCUSSION CASES

LO 17-1, LO 17-2, 17-29 In February 2016, Ceramic Crucibles of America was notified by the state of 17-3 Colorado that the state was investigating the company’s Durango facility to deter-

mine if there were any violations of federal or state environmental laws. In formulat- ing your opinion on Ceramic Crucibles’ 2015 financial statements, you determine that, based primarily on management’s representations, the investigation did not pose a serious threat to the company’s financial well-being.

The company subsequently retained a local law firm to represent it in dealing with the state commission. At the end of 2015, you concluded that the action did not represent a severe threat. However, it is now 2016 and you have just received the attorney’s letter, which you find a little unsettling. It states:

On January 31, 2016, the U.S. Environmental Protection Agency (EPA) listed the Durango site in Durango, Colorado, on the National Priorities List under the Compre- hensive Environmental Response, Compensation, and Liability Act (Superfund). The site includes property adjoining the western boundary of Ceramic Crucibles’ plant in Durango and includes parts of Ceramic Crucibles’ property. The EPA has listed Ceramic Crucibles as one of the three “potentially responsible parties” (“PRPs”) that may be liable for the costs of investigating and cleaning up the site. The EPA has autho- rized $400,000 for a “Remedial Investigation and Feasibility Study” of the site, but that study will not begin until sometime later in 2016. Thus, we do not deem it possible or appropriate at this time to evaluate this matter with regard to potential liability or cost to the company.

You immediately set up a meeting with Dave Buff, Ceramic Crucibles’ vice presi- dent; Ron Bonner, the company’s attorney; and Margaret Osmond, an attorney who specializes in EPA-related issues. At the meeting you ascertain that

∙ Ceramic Crucibles bought the Durango facility from TW Industries in 2005. ∙ TW Industries had operated the facility as a manufacturer of ceramic tiles, and it

had used lead extensively in incorporating color into the tile. ∙ The site has been placed on the National Priorities List (“the List”) apparently

because each state must have at least one site on the List. All sites on the List are rated on a composite score that reflects the relative extent of pollution. The Durango site has a rating of 8.3 compared to a rating of no less than 25 for the other sites on the List.

Final PDF to printer

Chapter 17 Completing the Audit Engagement 593

mes32502_ch17_561-595.indd 593 10/14/15 04:01 PM

∙ The most severe lead pollution (based on toxicity) is in an area located on the other side of a levee behind Ceramic Crucibles’ facilities. Although the area close to the building contains traces of lead pollution, the toxicity in this area is about 50 parts per million (ppm), compared to 19,000 ppm beyond the levee.

∙ Although Ceramic Crucibles used lead in coloring its crucibles until about 2007, the lead was locked into a ceramic glaze that met FDA requirements for appli- ances used in the preparation of food. Apparently, the acids used in determining the leaching properties of lead for EPA tests are stronger than that used by the FDA. Since 2007, Ceramic Crucibles has used lead-free mud in its crucibles.

∙ Affidavits taken from present and former employees of Ceramic Crucibles indi- cate that no wastewater has been discharged though the levee since Ceramic Cru- cibles acquired the property in 2005.

∙ The other PRPs and TW Industries are viable companies that should be in a posi- tion to meet their responsibilities resulting from any possible EPA action.

Materiality for purposes of evaluating a potential loss is $10 million to $13 mil- lion. This is based on the assumption that the loss would be deductible for income tax purposes. In that case, the loss would represent a reduction in stockholders’ equity of 4.5 percent to 7.0 percent. Your best guess is that the company’s exposure does not exceed that amount. Further, based on the financial strength of the company and its available lines of credit, you believe such an assessment would not result in financial distress to the company.

The creation of the Environmental Protection Agency (EPA) and that of the Com- prehensive Environmental Response, Compensation, and Liability Act is a result of the increasing concern of Americans about pollution. An amendment to the act permits the EPA to perform the cleanup. The EPA has a national priorities list of several thousand sites thought to be severely damaged. The average cost of con- ducting remedial investigation and feasibility studies ranges from $750,000 to over $1 million, and such studies may take as long as three years. Cleanup costs can often exceed $10 million to $12 million. It is said that the current estimates of $100 billion to clean up nonfederal hazardous waste sites may be conservative.

The law requires the EPA to identify toxic waste sites and request records from PRPs. The PRPs are responsible for the cost of cleanup, but if they lack the funds, the EPA uses its funds for the cleanup. The EPA has spent $3.3 billion from its trust fund and collected only $65 million from polluters since the passage of the legislation.

Required: a. How would this type of contingency be classified in the accounting literature, and

how should it be accounted for? b. Would the amount be material to the financial statements? c. What additional evidence would you gather, and what kinds of representations

should you require from the entity? d. Should the investigation affect your opinion on those financial statements?

LO 17-8 17-30 Medical Products, Inc. (MPI) was created in 2013 and entered the optical equipment industry. Its made-to-order optical equipment requires large investments in research and development. To fund these needs, MPI made a public stock offering, which was completed in 2014. Although the offering was moderately successful, MPI’s ambitious management is convinced that it must report a good profit this year (2015) to maintain the current market price of the stock. MPI’s president recently stressed this point when he told his controller, Pam Adams, “If we don’t make $1.25 million pretax this year, our stock will tank.”

Adams was pleased that even after adjustments for accrued vacation pay, 2015 pretax profit was $1.35 million. However, MPI’s auditors, Hammer & Bammer (HB), proposed an additional adjustment for inventory valuation that would reduce this profit to $900,000. HB’s proposed adjustment had been discussed during the 2014 audit.

Final PDF to printer

594 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch17_561-595.indd 594 10/14/15 04:01 PM

An additional issue discussed in 2014 was MPI’s failure to accrue executive vacation pay. At that time HB did not insist on the adjustment because the amount ($20,000) was not material to the 2014 results and because MPI agreed to begin accruing vacation pay in future years. The cumulative accrued executive vacation pay amounts to $300,000 and has been accrued at the end of 2015.

The inventory issue arose in 2013 when MPI purchased $450,000 of specialized computer components to be used with its optical scanners for a special order. The order was subsequently canceled, and HB proposed to write down this inventory in 2014. MPI explained, however, that the components could easily be sold without a loss during 2015, and no adjustment was made. However, the equipment was not sold by the end of 2015, and prospects for future sales were considered nonexistent. HB proposed a write-off of the entire $450,000 in 2015.

The audit partner, Johanna Schmidt, insisted that Adams make the inventory adjustment. Adams tried to convince her that there were other alternatives, but Schmidt was adamant. Adams knew the inventory was worthless, but she reminded Schmidt of the importance of this year’s reported income. Adams continued her argument, “You can’t make us take both the write-down and the vacation accrual in one year; it doesn’t fairly present our performance this year. If you insist on making us take that write-down, I’m taking back the accrual. Actually, that’s a good idea because the executives are such workaholics, they don’t take their vaca- tions anyway.”

As Adams calmed down, she said, “Johanna, let’s be reasonable; we want to con- tinue our good working relationship with your firm into the future. But we won’t have a future unless we put off this accrual for another year.”

Required: a. Should the auditor insist that the inventory adjustment be made despite the impact

on MPI’s pre-tax profits? b. Irrespective of your decision regarding the inventory adjustment, what is your

reaction to Adams’ suggestion to release the vacation accrual? Should the auditor insist on keeping the accrual of the executives’ vacation pay?

c. Consider the conflict between Adams and Schmidt. Assuming that Schmidt believes the inventory adjustment and vacation pay accrual must be made and that she does not want to lose the audit fee from the MPI audit. What should she do?

LO 17-8 17-31 Wyly Waste Management. Wyly Waste Management (“WWM”) is an SEC reg- istrant and your firm is its auditor. Overall materiality for the audit is $100,000. Shortly after the end of the year, WWM’s CFO is meeting with your audit partner to review the preliminary results of the audit. The engagement partner presents a copy of the draft unadjusted error summary to the CFO, which contains only one error. During the year, WWM did not capitalize individual expenditures of less than $10,000, which is in accordance with its company policy. In the past, WWM’s capital expenditures have been relatively constant each period and the expensing of the items has not caused any material errors. In the prior two years, the expensed items totaled $7,500 and $5,000, respectively. However, in the current year, WWM undertook significant development of a new waste disposal plant. As a result, WWM incurred eight capital expenditures of less than $10,000 each that were not capital- ized. These purchases totaled $75,000.

Required: a. Should your partner require WWM to record an adjustment for the expensed

items in the current year? b. Suppose the facts were changed and the expensed items for the prior two years

totaled $22,500 and $15,000, respectively. Should your partner require WWM to record an adjustment for the expensed items in the current year?

Final PDF to printer

Chapter 17 Completing the Audit Engagement 595

mes32502_ch17_561-595.indd 595 10/14/15 04:01 PM

c. Given the facts as presented in (b), above, how much of an adjustment should the auditor require before being willing to issue an unqualified audit opinion?

INTERNET ASSIGNMENTS

LO 17-1 17-32 A number of companies have pending lawsuits or other contingent liabilities reported in their financial statements.

Required: a. Search the EDGAR database found at

http://www.sec.gov/edgar/searchedgar/companysearch.html to find a company’s 10-K that reports a contingent liability. Write a paragraph summarizing one of the liabilities found in the financial statements. Did the company disclose the liability in the footnotes only, or did it recognize the liability in the financial statements?

b. What procedures might the auditors use to search for the contingent liabilities listed in part (a)?

LO 17-5 17-33 Over the past 10 years it has become quite common for an accounting firm to with- draw its opinion on a set of previously issued financial statements. Search the Inter- net to find a recent example of a company that has had to restate its financials and whose public accounting firm has withdrawn its opinion. Write a brief description of the reason for which the entity’s financial statements were restated, and write down the wording that the accounting firm used to indicate that its audit opinion was withdrawn.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch18_596-626.indd 596 10/22/15 10:21 AM

CHAPTER

18 18-1 Understand the various components of the standard

unqualified financial statement audit report. 18-2 Know the situations that result in the addition of

explanatory language to the standard unqualified audit report.

18-3 Be able to explain the conditions that lead to a departure from the standard unqualified/unmodified audit report.

18-4 Know the types of financial statement audit reports other than unqualified/unmodified.

18-5 Be able to explain the effect of materiality on the auditor’s choice of audit reports.

18-6 Understand the situations that may require different types of reports on comparative financial statements.

18-7 Know the auditor’s responsibility for other information in documents containing audited financial statements.

18-8 Understand the auditor’s reporting responsibility when financial statements are prepared on a basis other than GAAP.

18-9 Understand the auditor’s responsibility when reporting on specified elements, accounts, or items of a financial statement.

18-10 Understand the auditor’s reporting responsibility for compliance with contractual agreements or regulatory requirements related to financial statements.

18-11 Understand the changes to the auditor reporting model coming soon.

FASB ASC Topic 250, Accounting Changes and Error Corrections FASB ASC Topic 450, Contingencies AU-C 570, Going Concern AU-C 600, Special Considerations—Audits of Group Financial Statements (Including the Work of Component Auditors) AU-C 700, Forming an Opinion and Reporting on Financial Statements AU-C 705, Modifications to the Opinion in the Independent Auditor’s Report AU-C 706, Emphasis-of-Matter Paragraphs and Other-Matter Paragraphs in the Independent Auditor’s Report AU-C 708, Consistency of Financial Statements

AU-C 800, Special Considerations—Audits of Financial Statements Prepared in Accordance with Special Purpose Frameworks AU-C 806, Reporting on Compliance with Aspects of Contractual Agreements or Regulatory Requirements in Connection with Audited Financial Statements PCAOB Auditing Standard No. 1, References in Auditors’ Reports to the Standards of the Public Company Accounting Oversight Board PCAOB Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

597

mes32502_ch18_596-626.indd 597 10/22/15 10:21 AM

Reports on Audited Financial Statements

T his chapter discusses the auditor’s report for audits of financial state- ments. The audit report is the most important “deliverable” on an audit engagement. Whenever an auditor is associated with an entity’s financial

statements, the auditor must issue a report that contains an opinion regarding the financial statements taken as a whole or the reasons why an opinion can- not be issued. An auditor is associated with financial statements when he or she has consented to the use of his or her firm’s name in a document such as an annual report.

The purpose of the fourth standard of reporting is to enable shareholders, bondholders, bankers, and other third parties who rely on the financial state- ments to understand the degree of responsibility taken by the auditor. To assist in accomplishing this goal, the auditing profession has adopted standardized wording for audit reports. As a result, you will notice that most audit reports look very much alike. This approach helps prevent misunderstandings in the message being communicated by the auditor to the users of the financial state- ments. At the same time, some argue that the “boilerplate” nature of the audit report prevents the auditor from conveying subjective information that could be useful to users of the financial statements.

In addition to reporting on financial statements, auditors must also perform and report on an audit of internal control over financial reporting for public company entities. Chapter 7 discusses the nature of the audit of internal con- trol over financial reporting and presents the auditor’s reporting requirements specific to the audit of internal control.

Client acceptance/ continuance (Chapter 3)

Major Phases of an Audit

Audit business processes and related accounts

(e.g., revenue generation) (Chapters 10–16)

Preliminary engagement activities

(Chapter 3)

Plan the audit (Chapters 3, 4, and 5)

Consider and audit internal control

(Chapters 6 and 7)

Complete the audit (Chapter 17)

Evaluate results and issue audit report

(Chapters 1 and 18)

Final PDF to printer

598 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 598 10/22/15 10:21 AM

Chapter 1 briefly introduced the standard unqualified financial statement audit report. Such a report is issued when the audit has been performed in accordance with applicable auditing standards, the auditor has gathered sufficient evidence, and the auditor believes that the finan- cial statements conform to GAAP in all material respects. In this first section of the chapter, we’ll help you understand the auditor’s standard unqualified report, after which we will explain and illustrate how the auditor’s report changes when one (or all) of the above require- ments for issuing a standard unqualified report are not met. However, you should know that big changes are in the works for auditor reporting! We will briefly discuss the main elements of the coming changes later in the chapter.

The Standard Unqualified Audit Report for Public Companies Exhibit 18–1 shows the auditor’s standard unqualified audit report for a public company. This report contains eight elements: (1) the report title, (2) the addressee, (3) the introductory paragraph, (4) the scope paragraph, (5) the opinion paragraph, (6) an explanatory paragraph referring to the audit of internal control over financial reporting, (7) the name of the auditor, and (8) the audit report date. The EarthWear report shown here refers to the audit of internal control and to the PCAOB’s auditing standards because EarthWear is a publicly traded entity and is subject to public company auditing and reporting requirements. The report presented in Exhibit 18–1 is a separate report on the financial statement audit, but as noted, in addition to giving the auditor’s opinion on EarthWear’s financial statements, the report refers to the

LO 18-1

Reporting on the Financial Statement Audit: The Standard Unqualified/Unmodified Audit Report

The Auditor’s Standard Unqualified Report for a Public Company (PCAOB Standards)—Comparative Financial Statements (with explanatory paragraph referring to audit of ICFR)

Title: REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM

Addressee: To the Stockholders of EarthWear Clothiers:

Scope paragraph: We conducted our audits in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audits provide a reasonable basis for our opinion.

Explanatory paragraph referring to the audit of internal control:

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the effectiveness of EarthWear Clothiers’ internal control over financial reporting as of December 31, 2015, based on criteria established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), and our report dated February 15, 2016, expressed an unqualified opinion that EarthWear Clothiers maintained, in all material respects, effective internal control over financial reporting.

Name of auditor: Willis & Adams Boise, Idaho

Date of report: February 15, 2016

E X H I B I T 1 8 – 1

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 599

mes32502_ch18_596-626.indd 599 10/22/15 10:21 AM

auditor’s opinion relating to the audit of internal control over financial reporting. Instead of separate reports, the auditor’s opinions on the financial statements and on the effectiveness of internal control may be presented together, in a combined report format. However, when the two opinions are presented separately, as in Exhibit 18–1, the reports must have the same date and each must include an explanatory paragraph referring to the opinion expressed in the other report. Chapter 7 addresses reporting on the audit of internal control.

The Standard Unmodified Audit Report for All Entities Other Than Public Companies The ASB’s clarity standards require a different format and some differences in content for audit reports relating to non-public companies. While the content of the ASB and PCAOB reports is essentially the same, their organization and terminology differ somewhat. Exhibit 18–2 pres- ents the ASB “unmodified” report. The term “unmodified” in the ASB report is the equivalent of the term “unqualified” in the PCAOB report—they both refer to a “clean” opinion. We will use these two terms interchangeably throughout the rest of the chapter.

Stop and Think: Take a moment to scan the ASB report and compare it to the PCAOB report shown in Exhibit 18–1.

The Auditor’s Standard Unmodified Report for a Non-Public Company (ASB Standards)—Comparative Financial Statements

Title: INDEPENDENT AUDITOR’S REPORT

Addressee: To the Shareholders of Ekins Cycling:

Introductory paragraph: Report on the Financial Statements We have audited the accompanying consolidated financial statements of Ekins Cycling, which comprise the consolidated balance sheets as of December 31, 2015 and 2014, and the related consolidated statements of income, changes in stockholders’ equity and cash flows for the years then ended, and the related notes to the financial statements.

Management’s responsibility paragraph:

Management’s Responsibility for the Financial Statements Management is responsible for the preparation and fair presentation of these consolidated financial statements in accordance with accounting principles generally accepted in the United States of America; this includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of consolidated financial statements that are free from material misstatement, whether due to fraud or error.

Auditor’s responsibility paragraph:

Auditor’s Responsibility Our responsibility is to express an opinion on these consolidated financial statements based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the consolidated financial statements are free from material misstatement.

Scope paragraph: An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the consolidated financial statements. The procedures selected depend on the auditor’s judgment, including the assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s preparation and fair presentation of the consolidated financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity’s internal control. Accordingly, we express no such opinion. An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Opinion paragraph: Opinion In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of Ekins Cycling as of December 31, 2015 and 2014, and the results of its operations and its cash flows for the years then ended in accordance with accounting principles generally accepted in the United States of America.

Name: Willis & Adams Boise, Idaho

Date: February 15, 2016

E X H I B I T 1 8 – 2

Final PDF to printer

600 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 600 10/22/15 10:21 AM

As you can see, one of the most noticeable differences is the use of headings for each section of the ASB report. Two of these sections clearly delineate management’s and the audi- tor’s responsibilities. You will note that the content of these paragraphs is nearly identical to the introductory and scope paragraphs of the standard unqualified PCAOB report, with the exception that the ASB report adds a phrase emphasizing management’s responsibility for the design, implementation, and maintenance of internal control relevant to financial statement preparation and reporting.

You will also note that the ASB report indicates that the audit was conducted “in accor- dance with generally accepted auditing standards” and is titled “Independent Auditor’s Report.” By comparison, the public company audit report is titled “Report of Independent Registered Public Accounting Firm” and indicates that the audit was conducted “in accor- dance with the standards of the Public Company Accounting Oversight Board (United States).” Also, as noted earlier, the PCAOB report addresses the audit of internal control over financial reporting, which is required for public companies. By contrast, the ASB report indicates that while internal control was considered for the purpose of planning the financial statement audit, no opinion is expressed on the effectiveness of internal control over financial report- ing. Private companies can opt to have their audits performed in accordance with PCAOB standards, in which case their audit reports must conform to PCAOB standards. Except where otherwise noted, we use the ASB’s report in illustrations throughout the rest of this chapter. Fortunately, most of the variations from the standard unqualified/unmodified report that are covered in this chapter are very similar for public company and non-public company audits. However, we highlight notable differences between PCAOB and ASB reporting standards where appropriate.

The standard unqualified/unmodified audit report, which we just illustrated and dis- cussed, is fairly straightforward. Most of the rest of this chapter is devoted to explaining various circumstances that require modification of the standard report. We begin with circum- stances requiring the addition of explanatory language to the standard report either through changes in the wording of the existing paragraphs of the report or through the insertion of an additional paragraph. We then discuss conditions requiring audit reports other than the standard report, including qualified and adverse opinions and the disclaimer of opinion. We conclude the chapter by discussing various other “special reporting” issues.

Explanatory Language Added to the Standard Unqualified/Unmodified Financial Statement Audit Report

Sometimes circumstances arise that require the auditor to add explanatory language to the standard unqualified report. This is accomplished either by adding explanatory language to the existing paragraphs of the report (referred to as “modified wording”) or by inserting an additional explanatory paragraph, depending on the circumstances.

Modified Wording for Opinion Based in Part on the Report of Another Auditor Explanatory language is added to the auditor’s responsibility and opinion paragraphs of the report when an auditor’s opinion is based in part on the report of another auditor. On some audit engagements, parts of the audit may be completed by a separate, unaffiliated public accounting firm. For example, in reporting on consolidated financial statements, one of the entity’s subsidiaries might be located in a foreign country where the auditor of the parent company does not have a strong presence and thus may request that another firm audit these subsidiaries. In such cases, the auditor for the parent company must be satisfied that he or she is the “principal auditor.” This is normally determined by the portion of the consolidated financial statements audited by the parent-company auditor in relation to the portion of the consolidated financial statements audited by the other independent auditors.

LO 18-2

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 601

mes32502_ch18_596-626.indd 601 10/23/15 07:29 AM

The principal auditor at this point must decide whether or not to refer to the other auditors in the report. The principal auditor first assesses the professional reputation and independence of the other auditors. If the principal auditor is satisfied as to the professional reputation and independence of the other auditors and the quality of their audit work, an opinion may be expressed without referring to the work of the other auditors in the audit report. In so doing, the principal auditor accepts full responsibility for the work done and conclusions drawn by the other auditors.

However, in most situations where the subsidiary represents a material amount in the consolidated financial statements, the principal auditor refers to the other auditors. In refer- encing the other auditors, the principal auditor is sharing responsibility for the audit report with the other auditors.

The portion of the consolidated financial statements audited by the other auditors is dis- closed in the report. Exhibit 18–3 shows excerpts of a report in which the principal auditor has referred to the other auditors (only the affected parts of the report are shown and the modified wording is shown in italics so you can easily see what the differences are). Generally, even though the other auditors are referenced in the report, the name of the other firm is not stated in the audit report. You’ll note in Exhibit 18–3 that the auditor’s responsibilities and opinion paragraphs contain additional explanatory wording, but no additional explanatory paragraph is necessary. When this situation arises in an audit conducted under PCAOB standards, the introductory and opinion paragraphs are modified in a similar fashion.

If the other auditor’s report is not a standard unqualified audit report, the principal audi- tor needs to determine the nature of the departure and its significance in relation to the overall financial statements. If the departure is not material to the financial statements of the overall entity, the principal auditor need not refer to the departure in his or her report. If the principal auditor assesses that the departure is material to the overall financial statements, it may be necessary to refer to the issue giving rise to the other auditor’s qualified opinion and how the departure affects the overall audit opinion.

Opinion Based in Part on the Report of Another Auditor

[Standard title, addressee, introductory, and management’s responsibility paragraphs wording.]

Auditor’s Responsibility Our responsibility is to express an opinion on these financial statements based on our audits. We did not audit the financial statements of Furillo Company, a wholly owned subsidiary, whose statements reflect total assets of $25,450,000 and $23,750,000 as of December 31, 2015 and 2014, respectively, and total revenues of $42,781,000 and $40,553,000 for the years then ended. Those statements were audited by other auditors whose report has been furnished to us, and our opinion, insofar as it relates to the amounts included for Furillo Company, is based solely on the report of the other auditors. [Standard scope paragraph.]

Opinion In our opinion, based on our audits and the report of the other auditors, the consolidated financial state- ments referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 2015 and 2014, and the results of its operations and its cash flows for the years then ended, in conformity with U.S. generally accepted accounting principles.

[Name of auditor and date of report]

E X H I B I T 1 8 – 3

Circumstances Requiring Explanatory Language in an Additional Paragraph There are four situations that require the auditor to add an explanatory paragraph to a standard unqualified report on an entity’s financial statements. They are as follows: 1. Reference to the report on the audit of internal control for public companies. 2. Substantial doubt about an entity’s ability to continue as a going concern.

Final PDF to printer

602 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 602 10/22/15 10:21 AM

3. Lack of consistency in the application of accounting principles due to accounting changes.

4. The need for additional emphasis.

These four situations all lead to the addition of an explanatory paragraph following the opinion paragraph.1 Note that no modification to the wording of the introductory, scope, or opinion paragraphs is necessary. The audit reports that are issued in these situations are con- sidered unqualified opinions despite the addition of an explanatory paragraph. We’ve already discussed the need for the financial statement audit report for a public company to include a paragraph referring to the audit of ICFR when the report on the audit of ICFR is presented separately from the financial statement audit report. We’ll discuss each of the other three situ- ations in turn, but first we’ll discuss some differences in terminology between PCAOB and ASB standards relating to these additional paragraphs.

While the PCAOB standards refer to all such paragraphs simply as “explanatory para- graphs,” the ASB’s standards, which apply to audits of all entities except for public com- panies, refer to explanatory paragraphs as either “emphasis-of-matter” or “other-matter” paragraphs. An emphasis-of-matter paragraph refers to a matter that has been appropriately presented or disclosed in the financial statements. An emphasis-of-matter paragraph is used when the auditor has substantial doubt about an entity’s ability to continue as a going concern, when there is a lack of consistency in the financial statements, or when the auditor wishes to emphasize a particular matter, if such items have been appropriately disclosed in the financial statements. An emphasis-of-matter paragraph would also be used under ASB standards when the financial statements have been prepared in accordance with a special purpose framework other that GAAP. An other-matter paragraph refers to a matter other than those presented or disclosed in the financial statements but that, in the auditor’s judgment, is relevant to users’ understanding of the audit, the auditor’s responsibilities, or the auditor’s report. For exam- ple, an other-matter paragraph is used when the auditor’s opinion on prior period financial statements differs from the opinion the auditor previously expressed (for example, a previ- ously qualified opinion on prior period financial statements has been changed to unqualified because the financial statements have been restated) or when the distribution of the auditor’s report is to be restricted to particular users. Like the explanatory paragraph in a report for a public company, emphasis-of-matter or other-matter paragraphs are placed after the opinion paragraph, but under the section heading “Emphasis of Matter” or “Other Matter.” While the term explanatory paragraph has a slightly more general meaning than the term emphasis-of- matter paragraph, we use these terms interchangeably throughout the text for simplicity.

Going Concern A basic assumption that underlies financial reporting is that an entity will continue as a going concern (i.e., that it will stay in business). As discussed in Chapter 17, auditing standards state that the auditor has a responsibility to independently evaluate whether there is substantial doubt about the entity’s ability to continue as a going concern for a reason- able period of time, not to exceed one year beyond the date of the financial statements being audited. The auditor uses this independent assessment to ensure that management’s going concern assessment has been adequately conducted and disclosed.

When the auditor concludes that there is substantial doubt about an entity’s ability to continue as a going concern, the auditor should consider the possible effects on the financial statements and the related disclosures. If management has adequately disclosed the entity’s financial problems, the audit report typically will express an unqualified opinion but will include an emphasis-of-matter paragraph to emphasize the auditor’s doubt about the enti- ty’s ability to continue as a going concern (see Exhibit 18–4). In rare cases of extreme and

1Until 2009, another condition existed that could result in the addition of explanatory language to an unqualified auditor’s report. In certain circumstances, if the auditor agreed with the entity that following GAAP would mislead financial statement users, the auditor could issue an unqualified opinion on financial statements that were not in accordance with GAAP and add an explanatory paragraph to describe the situation. The exception was very rarely invoked and was essentially eliminated with the FASB’s adoption of the Accounting Standards Codification in September 2009.

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 603

mes32502_ch18_596-626.indd 603 10/22/15 10:21 AM

immediate financial distress (e.g., impending bankruptcy), the auditor may disclaim an opin- ion on the entity. If the entity’s disclosures with respect to its ability to continue as a going concern are inadequate, a departure from GAAP exists, resulting in a qualified or an adverse opinion (discussed later in this chapter).

Stop and Think: Suppose that the conditions that raised substantial doubt about the entity’s ability to continue as a going concern in the prior period, and thus resulted in the prior period auditor report to include an emphasis-of-matter paragraph, were recti- fied in the current period. How do you think the current period’s auditor report on the comparative financial statements would be affected?

If an entity received a going concern report in the prior period and the substantial doubt regarding going concern is removed in the current period, the emphasis-of-matter paragraph included with the prior year’s audit report is not included with the auditor’s report covering the comparative financial statements.

Lack of Consistency A fundamental principle of accounting is that financial statements should be consistent and comparable across periods. Accordingly, the auditor’s standard unqualified audit report implies that the comparability of the financial statements is not mate- rially affected by inconsistent use of accounting principles. When such an implication is not valid, under some circumstances the auditor must add an explanatory paragraph to the report. FASB ASC Topic 250, “Accounting Changes and Error Corrections,” governs the accounting for changes in accounting principles. From the auditor’s perspective, accounting changes can be categorized into (1) changes that affect both comparability and consistency in the applica- tion of accounting principles and (2) changes that affect comparability but that do involve inconsistency in the application of accounting principles.

Changes Affecting Comparability and Consistency If an entity makes a change in an accounting principle or in the method of its application that materially affects the comparabil- ity and the consistency of the financial statements, the auditor must decide whether she or he concurs with the change. If the auditor concurs, she or he will issue an unqualified opinion but would add a discussion of the change in an explanatory or emphasis-of-matter paragraph to highlight the lack of consistency. Auditing standards (AU-C 708) refer to the following accounting changes as affecting both comparability and consistency and requiring an explana- tory or emphasis-of-matter paragraph:

1. Change in accounting principle. An example is a change from straight-line depreciation to an accelerated method for depreciating equipment.

2. Change in reporting entity. An example is the consolidation of a major subsidiary’s financial statements with the parent company’s financial statements in the previous year and accounting for the subsidiary on a cost or equity basis in the current year.

Unqualified/Unmodified Financial Statement Audit Report with an Emphasis-of-Matter Paragraph for Going-Concern Problems

[Standard introductory, management’s responsibility, auditor’s responsibility, scope, and opinion paragraphs]

Emphasis of Matter The accompanying financial statements have been prepared assuming that the Company will continue as a going concern. As discussed in Note 6 to the financial statements, the Company has suffered recurring losses from operations and has a net capital deficiency that raises substantial doubt about its ability to con- tinue as a going concern. Management’s plans in regard to these matters are also described in Note 6. The financial statements do not include any adjustments that might result from the outcome of this uncertainty.

E X H I B I T 1 8 – 4

Final PDF to printer

604 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 604 10/22/15 10:21 AM

While the vast majority of audit opinions issued to entities are unqualified/unmodified, the auditor has the option to issue opinions that depart from the unqualified report when circum- stances indicate a need. Three such types of audit reports are available to the auditor. We’ll first discuss the conditions that indicate a need for audit reports that depart from the unquali- fied report, and then we’ll explain the nature of these reports.

3. Correction of a misstatement in previously issued financial statements. This includes two situations: first, a change in the use of an accounting principle in prior years (for example, replacement cost for inventory) to an acceptable accounting principle (such as FIFO) in the current year and, second, adjustments to correct a material misstatement in previously issued financial statements.

An explanatory or emphasis-of-matter paragraph highlighting an accounting change that results in a lack of consistency would contain wording such as the following: “As discussed in Note 7 to the financial statements, the Company changed its method of computing deprecia- tion on fixed assets from the straight-line to the double-declining balance method in 2015.” Note that adding an explanatory or emphasis-of-matter paragraph does not eliminate the audi- tor’s responsibility to evaluate the adequacy of the required financial statement disclosures relating to accounting changes and corrections of errors.

Some changes in accounting principles might have no material effect in the current year but are expected to have a material effect in future years. In such circumstances, the change in principles should be included in the footnotes to the financial statements, but the auditor’s report does not need to include an explanatory paragraph in the current year.

Changes Affecting Comparability but Not Consistency Other changes may affect compara- bility but not consistency in the use of accounting principles. These include:

1. Change in accounting estimate. A change in an accounting estimate, such as reducing the expected service life of a garbage truck from 7 to 5 years, can affect the comparability of financial statements with no change in accounting principles.

2. Change in classification and reclassification. A change in classification but not in accounting principle occurs when a balance is classified differently from one period to the next, such as when an item that was included in operating expenses last year is included in administrative expenses in the current year.

Changes that affect comparability but not consistency in the application of accounting principles are normally disclosed in the notes to the financial statements. Such changes do not require an explanatory/emphasis-of-matter paragraph in the auditor’s report.

Additional Emphasis Under certain circumstances an auditor may want to emphasize a specific matter regarding the financial statements even though he or she intends to express an unqualified or unmodified opinion. Such information is presented in an explanatory/ emphasis-of-matter paragraph. Two examples of situations that might cause the auditor to add explanatory language in an emphasis-of-matter paragraph are significant related-party transactions that are appropriately disclosed by the entity and important events occurring after the balance sheet date.

Practice I N S I G H T

FASB ASC Topic 250 requires “retrospective application” for accounting changes and corrections of errors. Retrospective application is the application of a different accounting principle to one or more previously issued financial statements, or to the statement of financial position at the beginning of the current period as if that principle had always been used.

Departures from an Unqualified/Unmodified Financial Statement Audit Report

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 605

mes32502_ch18_596-626.indd 605 10/22/15 10:21 AM

Practice I N S I G H T

Keep in mind that an unqualified opinion on the financial statement audit does not necessarily mean that the opinion on the audit of internal control over financial reporting will be unqualified. In fact, an auditor can issue an adverse opinion on the audit of internal control, and still issue an unqualified opinion on the financial statement audit if the audit evidence supports the conclusion that the financial statements are fairly presented. This often occurs because misstatements existing in the financial statements at year-end can be corrected prior to issuance, allowing for a “clean” financial statement audit opinion. However, a material weakness in internal control that exists at year-end necessitates an adverse opinion on the entity’s internal control.

Types of Financial Statement Audit Reports Other Than Unqualified/Unmodified The three types of reports available to the auditor other than unqualified are2

1. Qualified. The auditor qualifies his or her opinion when either a scope limitation or a specific departure from GAAP exists, but overall the financial statements present fairly in conformity with GAAP. If the auditor decides to qualify a report for a scope limitation, the report describes why the limitation arose and indicates that the financial statements present fairly except for the possible effects of the limitation. If the auditor qualifies a report for a GAAP departure, the report describes the nature and impact of the faulty accounting and indicates that the financial statements present fairly except for the effects of the departure. Note that a qualified report always uses the words “except for.”

2. Disclaimer. The auditor disclaims an opinion on the financial statements either because there is insufficient appropriate evidence to form an opinion on the overall financial statements or because there is a lack of independence. In a disclaimer the auditor explains the reasons for withholding an opinion and explicitly indicates that no opinion is expressed.

3. Adverse. The auditor issues an adverse opinion when the financial statements do not present fairly due to a GAAP departure that materially affects the financial statements overall. In an adverse report the auditor explains the nature and size of the misstatement and states the opinion that the financial statements do not present fairly in accordance with GAAP.

LO 18-4

2Note that PCAOB and ASB terms are the same for the following list of reports other than unqualified/unmodified.

Conditions for Departure To this point we have been discussing the unqualified audit report, with or without additional modified wording or explanatory paragraphs. Let’s now take a look at the circumstances in which an audit report might depart from an unqualified opinion. An auditor may be unable to express such an opinion in three situations:

1. Scope limitation. A scope limitation results from an inability to collect sufficient appropriate evidence, such as when management or some set of circumstances prevents the auditor from conducting an audit procedure that the auditor considers necessary.

2. Departure from GAAP. A departure from GAAP exists when the financial statements are prepared or presented in a manner that conflicts with GAAP, whether due to error or fraud.

3. Lack of independence of the auditor. A lack of independence arises when the auditor and the entity have any financial, business, or personal relationship prohibited by professional standards. The auditor must comply with the second general standard and Section 1.200 of the Code of Professional Conduct in order to issue an unqualified opinion.

LO 18-3

Final PDF to printer

606 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 606 10/22/15 10:21 AM

The choice of audit report depends on both the nature and the materiality of the condition giving rise to the departure from the unqualified report. Figure 18–1 presents an overview of the auditor’s reporting options, including the type of report to be issued under various condi- tions, together with the effect of materiality. We believe you will find Figure 18–1 to be very helpful to your understanding of auditor reporting—study it carefully!

The Effect of Materiality on Financial Statement Reporting The concept of materiality plays a major role in the auditor’s choice of audit reports. If the auditor judges a departure from GAAP to be immaterial, a standard unqualified audit report can be issued. As the materiality of the condition increases, the auditor must judge the effect of the item on the financial statements overall. Auditing standards (AU-C 705) use the term pervasive to describe the potential effect of a scope limitation or departure from GAAP on the auditor’s report. Pervasive effects on the financial statements are those that

∙ are not confined to specific elements, accounts, or items of the financial statements; ∙ if so confined, represent or could represent a substantial proportion of the financial

statements; or ∙ with regard to disclosures, are fundamental to users’ understanding of the financial

statements (¶ 6).

LO 18-5

Immaterial

Materiality Type of Audit Report

Unqualified/ unmodified

Qualified for GAAP departure

Qualified for scope limitation

Disclaimer*

*An auditor will also issue a disclaimer for a lack of independence and, in some rare and extreme cases, for substantial doubt about the entity's ability to continue as a going concern.

Adverse

Scope limitation: • Client-imposed • Condition-imposed

• Other auditors • Going concern • Lack of consistency • Additional emphasis • Refer to audit of ICFR

Not GAAP

Unqualified with modified wording or explanatory/

emphasis-of-matter/ other-matter paragraph

Material but not

pervasive

Pervasively material

An Overview of Financial Statement Audit ReportingF I G U R E 1 8 – 1

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 607

mes32502_ch18_596-626.indd 607 10/22/15 10:21 AM

As you can clearly see, applying this guidance requires a great deal of professional judg- ment by the auditor, and these issues can be topics of intense and sometimes even contentious discussion between management and the auditor.

Stop and Think: Using Figure 18–1, think through the logical process of how an audi- tor would decide on the appropriate report to give when there is a scope limitation?

When the auditor is faced with a scope limitation, the assessment of the omitted procedure(s) should include the nature and magnitude of the potential effects of the financial statement area that the auditor was unable to examine and its significance to the overall finan- cial statements. If the potential effects relate to many items in the financial statements or if the effect of the item is so significant that the auditor considers the financial statements taken as a whole to be unreliable, the auditor will likely issue a disclaimer rather than a qualified report. For example, suppose an auditor is unable to perform certain audit procedures consid- ered necessary in determining the fairness of an entity’s inventory balance, which represents approximately 10 percent of total assets. In such a situation, the auditor would probably con- sider the item material but not pervasive, and thus would most likely issue a qualified opin- ion. However, if inventory represented a larger percentage of total assets (e.g., 30 percent), the effect likely would be considered material and pervasive and would lead the auditor to disclaim an opinion on the financial statements. Where to draw the line is a matter of profes- sional judgment on the part of the auditor.

Judgments concerning the effects of a departure from GAAP are handled similarly. If the departure from GAAP is judged to be immaterial, the auditor issues an unqualified opinion. If the auditor considers the departure from GAAP to be material but not pervasive, the audi- tor will issue a qualified opinion. If the departure is seen by the auditor as material and perva- sive, the auditor will issue an adverse opinion. For example, suppose that an entity accounts for leased assets as operating leases despite the fact that proper accounting requires that the leases be capitalized. If an entity has only one small piece of equipment that is accounted for inappropriately, the auditor will probably issue an unqualified opinion because the item is not material. However, if the entity has many significant leased assets that are accounted for as operating leases instead of capitalized leases, the auditor will normally issue either a qualified or adverse opinion, depending on the magnitude of the problem and its effect on the reliability of the financial statements overall.

In some cases, an issue can be considered material even if the magnitude does not reach conventional materiality levels in terms of magnitude. For example, if the auditor discovers that management has intentionally introduced an otherwise immaterial error into the financial statements in order to meet analysts’ earnings forecasts, auditing standards indicate that the auditor is to consider this departure to be material in view of its nature, even if it does not rise to conventional levels of materiality in quantitative terms.

Although materiality is important in considering scope limitations and departures from GAAP, note that materiality is not a factor in considering an auditor’s independence. When according to the Code of Professional Conduct or other rules an auditor is not independent, the auditor must disclaim an opinion regardless of the significance of the condition that resulted in the lack of independence!

Discussion of Conditions Requiring Other Types of Financial Statement Audit Reports

Scope Limitation A scope limitation results from an inability to obtain sufficient appropriate evidence about some component of the financial statements. This occurs because the auditor is unable to apply all the audit procedures considered necessary either because of restrictions on the scope

Final PDF to printer

608 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 608 10/22/15 10:21 AM

of the audit imposed by the client or by the circumstances of the engagement. Auditors should be particularly cautious when a client restricts the scope of the engagement, because in such a situation the client may be trying to prevent the auditor from discovering material misstate- ments. Auditing standards suggest that when restrictions imposed by the client significantly limit the scope of the engagement, the auditor should consider disclaiming an opinion on the financial statements. However, some scope limitations arise due to reasons beyond the control of the client, such as a fire that destroys accounting records. If the auditor can overcome such a scope limitation by acquiring sufficient, appropriate evidence about the area in question through alternative procedures, a standard unqualified/unmodified audit report can be issued.

A number of these types of situations can occur on audit engagements. For example, circumstances may prevent the auditor from observing the period-end physical inventory count. This could be the case if the auditor is not engaged to conduct the audit until after the end of the period. If such deficiencies in audit evidence cannot be overcome by employing other auditing procedures, the auditor will have to issue a qualified opinion or a disclaimer, depending on the materiality of the inventory account. Exhibit 18–5 shows an example of a disclaimer of opinion due to a scope limitation.

Another example occurs when a client requests that the auditor not confirm accounts receivable because of concerns over customer relations. If the auditor is satisfied that the cli- ent’s reasons for not confirming are legitimate and is unable to apply alternative audit proce- dures to determine fairness of the receivables, he or she would qualify the opinion or disclaim an opinion depending on the materiality of accounts receivable in the context of the financial statements. Exhibit 18–6 presents an example of a qualified report for a scope limitation.

Note that in both examples the paragraph that explains the scope limitation is presented before the opinion or disclaimer paragraph. As illustrated in Figure 18–1, the reporting options for a scope limitation are to qualify the opinion or to disclaim an opinion, depending on the materiality of the limitation.

Practice I N S I G H T

The SEC does not accept filings of public company registrants that include qualified or adverse audit opinions resulting from a departure from GAAP or qualified or disclaimers of opinions resulting from a management-imposed scope limitation. Thus, management must make whatever adjustments are necessary to receive a clean audit opinion before filing audited financial statements with the SEC.

Disclaimer of Financial Statement Audit Opinion—Scope Limitation

[Standard wording for introductory and management’s responsibility paragraphs.]

Auditor’s Responsibility Our responsibility is to express an opinion on these financial statements based on conducting the audit in accordance with auditing stan- dards generally accepted in the United States of America. Because of the matters described in the Basis for Disclaimer of Opinion para- graph, however, we were not able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion.

[Scope paragraph of standard report is omitted]

Basis for Disclaimer of Opinion The Company’s investment in XYZ Company, a joint venture, is carried at $25,000,000 on the Company’s balance sheet, which repre- sents over 90 percent of the Company’s net assets as of December 31, 2015. We were not allowed access to the management and the auditors of XYZ Company. As a result, we were unable to determine whether any adjustments were necessary relating to the Company’s proportional share of XYZ Company’s assets that it controls jointly, its proportional share of XYZ Company’s liabilities for which it is jointly responsible, its proportional share of XYZ Company’s income and expenses for the year, and the elements making up the statements of changes in stockholders’ equity and cash flows.

Disclaimer of Opinion Because of the significance of the matter described in the Basis for Disclaimer of Opinion paragraph, we have not been able to obtain sufficient appropriate audit evidence to provide a basis for an audit opinion. Accordingly, we do not express an opinion on these finan- cial statements.

E X H I B I T 1 8 – 5

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 609

mes32502_ch18_596-626.indd 609 10/22/15 10:21 AM

Statements Not in Conformity with GAAP If the financial statements are materially affected by a departure from GAAP, the auditor should express a qualified or adverse opinion, depending on the pervasiveness of the misstate- ment. Examples of these types of departures include the use of an accounting principle that is not acceptable, inadequate disclosure, or an unjustified change in accounting principle.

When the financial statements include the use of an accounting principle that is not acceptable, the auditor should issue a qualified or adverse opinion, depending on materiality. When the auditor expresses a qualified opinion, a separate paragraph is added to the report before the opinion paragraph. The paragraph discloses the effects of the departure on the financial statements. Note that whenever a qualified opinion is issued, the opinion paragraph will include the words “except for.” Exhibit 18–7 is an example of a report that is qualified because of the use of an accounting principle that is not in accordance with GAAP.

If the departure’s effect is so pervasive that the financial statements taken as a whole do not fairly present the entity’s financial position, results of operations, and cash flows in accor- dance with GAAP, the auditor should issue an adverse opinion. When an adverse opinion is issued, the auditor should add a paragraph just before the opinion paragraph discussing the reasons for the adverse opinion and the effects of the departure on the financial statements. The opinion paragraph is modified to state that the financial statements do not present fairly in conformity with GAAP. Exhibit 18–8 is an example of an adverse report.

Qualified Financial Statement Audit Report—Scope Limitation

[Standard wording for the introductory, management’s responsibility, auditor’s responsibility, and scope paragraphs, except that the fol- lowing italicized words are added to the scope paragraph: “Except as discussed in the following paragraph, we conducted our audits in accordance with auditing standards generally accepted in the United States of America.”]

Basis for Qualified Opinion We were unable to obtain audited financial statements supporting the Company’s investment in a foreign affiliate stated at $12,500,000 and $11,700,000 at December 31, 2015 and 2014, respectively, or its equity in earnings of that affiliate of $1,200,000 and $1,050,000, which is included in net income for the years then ended as described in Note 10 to the financial statements; nor were we able to satisfy ourselves as to the carrying value of the investment in the foreign affiliate or the equity in its earnings by other auditing procedures.

Qualified Opinion In our opinion, except for the effects of such adjustments, if any, as might have been determined to be necessary had we been able to examine evidence regarding the foreign affiliate and earnings, the financial statements referred to . . . [same wording as for the remainder of the standard opinion paragraph].

E X H I B I T 1 8 – 6

Qualified Financial Statement Audit Report—Not in Conformity with Generally Accepted Accounting Principles

[Standard wording for the introductory, management’s responsibility, auditor’s responsibility, and scope paragraphs]

Basis for Qualified Opinion The Company has excluded, from property and debt in the accompanying balance sheets, certain lease obligations that, in our opin- ion, should be capitalized in order to conform with generally accepted accounting principles. If these lease obligations were capitalized, property would be increased by $7,500,000 and $7,200,000, long-term debt by $6,900,000 and $6,600,000, and retained earnings by $1,420,000 and $1,290,000 as of December 31, 2015 and 2014, respectively. Additionally, net income would be increased by $250,000 and $220,000 and earnings per share would be increased by $.25 and $.22, respectively, for the years then ended.

Qualified Opinion In our opinion, except for the effects of not capitalizing certain lease obligations as discussed in the preceding paragraph, the financial statements referred to above present fairly, in all material respects, the financial position of the company as of December 31, 2015 and 2014, and the results of its operations and its cash flows for the years then ended in accordance with accounting principles generally accepted in the United States of America.

E X H I B I T 1 8 – 7

Final PDF to printer

610 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 610 10/22/15 10:21 AM

As illustrated in Figure 18–1, a disclaimer of opinion is not an option when there is a known departure from GAAP. In such a case, the auditor’s opinion will either be qualified or adverse, depending on the level of materiality of the GAAP departure.

Practice I N S I G H T

An explanatory or emphasis-of-matter/other-matter paragraph used to call attention to a specific matter that does not affect the audit opinion follows the opinion paragraph, while a paragraph that discusses the basis for a qualified or adverse opinion is placed before the opinion paragraph.

Adverse Financial Statement Audit Opinion—Not in Conformity with Gener- ally Accepted Accounting Principles

[Standard wording for the introductory, management’s responsibility, auditor’s responsibility, and scope paragraphs]

Basis for Adverse Opinion As discussed in Note 6 to the financial statements, the Company carries its property, plant, and equipment accounts at appraisal values and determines depreciation on the basis of such values. Generally accepted accounting principles require that property, plant, and equipment be stated at an amount not in excess of cost, reduced by depreciation based on such amount. Because of the departures from gener- ally accepted accounting principles identified above, as of December 31, 2015 and 2014, respectively, inventories have been increased $1,500,000 and $1,340,000 by inclusion in manufacturing overhead of depreciation in excess of that based on cost; property, plant, and equipment, less accumulated depreciation, is carried at $13,475,000 and $12,950,000 in excess of an amount based on the cost to the Company. For the years ended December 31, 2015 and 2014, cost of goods sold has been increased $4,200,000 and $3,600,000, respec- tively, because of the effects of the depreciation accounting referred to above, resulting in a decrease in net income of $2,520,000 and $2,160,000, respectively.

Adverse Opinion In our opinion, because of the effects of the matters discussed in the preceding paragraph, the financial statements referred to above do not present fairly, in conformity with accounting principles generally accepted in the United States of America, the financial position of Morton Company as of December 31, 2015 and 2014, or the results of its operation or its cash flows for the years then ended.

E X H I B I T 1 8 – 8

If an entity fails to disclose information in the financial statements or footnotes as required by GAAP (e.g., significant related-party transactions), the auditor should issue a qualified or adverse report, depending on the materiality of the omission. The auditor should provide the omitted information in the report, if practicable, unless the auditor is specifically not required by auditing standards to do so. For example, one situation in which the auditor would modify the opinion but would not have to provide the missing information is where the client has declined to include a statement of cash flows. Auditing standards do not require that the audi- tor prepare a statement of cash flows when one has been omitted by the client.

As a practical matter, qualified and adverse reports are quite rare because most clients are willing to make the financial statement adjustments needed in order to obtain a clean opinion. This is especially true for public companies, because the SEC does not accept qualified or adverse opinions in filings from registrants. Thus, the option to issue such opinions provides great leverage to the auditor.

Auditor Not Independent Much of the value that users of financial statements place on the auditor’s report is based on the assumption of an unbiased relationship between the auditor and the entity (see Chapter 19). It is extremely unlikely that an auditor would knowingly agree to audit an entity’s financial statements where independence between the two parties did not exist. However, it is possible, for example, that an auditor could enter an engagement believing that all members of the audit team were independent of the entity only to find later that a member of the audit team had a prohibited financial interest in the entity. When the audit firm’s independence is jeopardized in this manner, the audit report consists only of two sentences such as these: “We are not independent with respect to Jordan Company, Inc. Accordingly, we do not express an

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 611

mes32502_ch18_596-626.indd 611 10/22/15 10:21 AM

opinion on the accompanying balance sheet as of December 31, 2015, and the related state- ments of income, retained earnings, and cash flows for the year then ended.”

In other words, if it is found that the auditor is not independent, a disclaimer of opinion must be issued. In the disclaimer, the auditor should not state the reasons for the lack of inde- pendence or describe any audit procedures performed. This requirement is intended to prevent the auditor from attempting to minimize or explain away the circumstances.

Special Reporting Issues

In addition to the types of audit reports just discussed, auditors often encounter a number of special reporting issues that affect the financial statement audit report. Three topics are cov- ered in the remainder of this section of the chapter:

∙ Reports on comparative financial statements. ∙ Other information in documents containing audited financial statements. ∙ Special reports.

Reports on Comparative Financial Statements

When an entity presents financial statements for the current period together with those for one or more prior periods, the auditor’s report refers to the prior-period financial statements presented on a comparative basis. Exhibit 18–1 shows an unqualified standard audit report on EarthWear’s comparative financial statements covering the balance sheets for two years and statements of income, stockholders’ equity, and cash flows for three years. Normally, the date of the auditor’s report on the comparative statements is the date of the most recently completed audit.

During the current-year audit, the auditor should be alert for events that may affect prior- period financial statements. We’ll discuss three relatively common situations involving com- parative financial statements.

Different Reports on Comparative Financial Statements A number of situations may cause the auditor to express different reports on comparative financial statements. One example is when the auditor previously expressed a standard unmodified opinion on prior years’ financial statements but qualifies the current-year opinion.

Stop and Think: Suppose that an entity inappropriately decides not to capitalize cer- tain lease obligations in the current year. In prior years, the entity did not have capital- ized lease obligations, so the financial statements for those years conformed to GAAP. How would the auditor’s report be affected by this decision?

In this situation the auditor would issue a report similar to a qualified report for a depar- ture from GAAP but would clarify that the departure only affects the current year’s financial statements. For example, the opinion paragraph could read “In our opinion, except for the effects on the 2015 financial statements of not capitalizing certain lease obligations as dis- cussed in the preceding paragraph, the financial statements referred to . . . [same wording as for the remainder of the standard opinion paragraph].”

Another situation occurs when the report on the current year is unmodified but prior- period financial statements were qualified or were disclaimed. Exhibit 18–9 presents an example of a report issued when an auditor was hired after the observation of the physical inventory in the prior year, which resulted in a disclaimer of opinion on results of operations

LO 18-6

Final PDF to printer

612 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 612 10/22/15 10:21 AM

and cash flows for the next period (note: this is because ending inventory for one year enters into the determination of results of operations and cash flows of the following year). At the end of the prior year and in the current year, the auditor was able to conduct the audit without any scope limitation and thus issues an unmodified opinion on the prior year’s balance sheet and on all of the current year’s financial statements.

A Change in Report on the Prior-Period Financial Statements During the course of the current year’s audit, the auditor may encounter circumstances or events that require updating the report issued on the prior-period financial statements. For example, the auditor may have issued a qualified or adverse opinion in the prior year because the entity had not followed GAAP. If the entity conforms to GAAP in the current year and appropriately restates the prior-period results, the auditor should express an unmodified opin- ion on the restated prior-period financial statements if they are presented along with the cur- rent period statements as comparatives. Exhibit 18–10 is an example of such a report. Note that the other-matter paragraph comes after the opinion paragraph and contains the date of the previous report, the type of opinion previously issued, the reasons for the previous report being issued, and mention of the fact that the current report differs from the previously issued

Comparative Report When the Prior Year Was Disclaimed for a Scope Limitation and the Current Year Received an Unmodified Opinion

[Standard wording for the introductory, management’s responsibility, and auditor’s responsibility paragraphs]

Except as explained in the following paragraph, we conducted our audits in accordance with . . . [same wording as for the remainder of the standard scope paragraph].

Basis for Disclaimer of Opinion on 2014 Operations and Cash Flows We did not observe the taking of the physical inventory as of December 31, 2013, since that date was prior to our appointment as auditors for the Company, and we were unable to satisfy ourselves regarding inventory quantities by means of other auditing procedures. Inven- tory amounts as of December 31, 2013, enter into the determination of net income and cash flows for the year ended December 31, 2014.

Disclaimer of Opinion on 2014 Operations and Cash Flows Because of the matter discussed in the preceding paragraph, the scope of our work was not sufficient to enable us to express, and we do not express, an opinion on the results of operations and cash flows for the year ended December 31, 2014.

Opinion In our opinion, the balance sheets of RUUD Rubber Company as of December 31, 2015 and 2014, and the related statements of income, retained earnings, and cash flows for the year ended December 31, 2015, present fairly, in all material respects, the financial position of RUUD Rubber Company as of December 31, 2015 and 2014, and the results of its operations and its cash flows for the year ended December 31, 2015 in accordance with accounting principles generally accepted in the United States of America.

E X H I B I T 1 8 – 9

Change in the Report on the Prior-Period Financial Statements

[Standard wording for the introductory, management’s responsibility, auditor’s responsibility, scope, and opinion paragraphs]

Other Matter In our report dated March 1, 2015, we expressed an opinion that the 2014 financial statements did not fairly present financial position, results of operations, and cash flows in conformity with accounting principles generally accepted in the United States of America because of two departures from such principles: (1) the Company carried its property, plant, and equipment at appraisal values and provided for depreciation on the basis of such values; and (2) the Company did not provide for deferred income taxes with respect to differences between income for financial reporting purposes and taxable income. As described in Note 8, the Company has changed its method of accounting for these items and restated its 2014 financial statements to conform with accounting principles generally accepted in the United States of America. Accordingly, our present opinion on the 2014 financial statements, as presented herein for comparative pur- poses, is different from that expressed in our previous report.

E X H I B I T 1 8 – 1 0

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 613

mes32502_ch18_596-626.indd 613 10/22/15 10:21 AM

report. In this example, after the entity conformed to GAAP in accounting for property, plant, and equipment and for deferred taxes and restated the prior-period financial statements, the auditor issued an unmodified report for both the current and prior years.

Report by a Predecessor Auditor When an entity has changed auditors, the predecessor auditor can reissue, at the request of the entity, his or her report on the financial statements of prior periods when those prior state- ments are presented for comparative purposes. In such a situation, the predecessor auditor must determine if the previously issued reports are still appropriate, given the current circum- stances. The predecessor auditor should do the following before reissuing the report:

1. Read the financial statements of the current period. 2. Compare the prior-period financial statements on which the predecessor previously

reported with the current-year financial statements on which the successor will report. 3. Obtain a letter of representations from the current-year, successor auditor.

The letter of representations from the successor auditor should indicate whether the suc- cessor auditor discovered any material items that might affect, or require disclosure in, the financial statements reported on by the predecessor auditor. If the predecessor auditor is satis- fied that the financial statements previously reported on should not be revised, he or she reis- sues the audit report using the date of the previous report.

In the event that the predecessor auditor becomes aware of circumstances or events that may affect the previously issued financial statements, he or she should make inquiries and perform any procedures considered necessary. For example, the successor auditor may dis- cover errors indicating that the prior year’s financial statements were materially misstated. If the prior-period financial statements are restated, the predecessor auditor should revise the report as necessary and dual date the reissued report.

If the prior-period financial statements have been audited but the predecessor auditor’s report will not be included, the successor auditor indicates in the report’s introductory para- graph that the financial statements for the prior period were audited by other auditors and mentions the date and the type of report issued by the predecessor auditor. If the predeces- sor’s report was not standard (i.e., unqualified), the successor auditor should describe the nature of and reasons for the departure from the standard report as laid out in the predeces- sor’s report.

Other Information in Documents Containing Audited Financial Statements

An entity may publish documents, such as annual reports and registration statements, that contain other information in addition to the audited financial statements and the audit report. Auditing standards provide guidance for the auditor’s consideration of other information con- tained in (1) annual reports of entities and (2) other documents to which the auditor devotes attention at the entity’s request.

The auditor is required to read the other information and consider whether such informa- tion is consistent with the information contained in the audited financial statements. However, the auditor has no obligation to perform any audit procedures to corroborate the other infor- mation contained in the report and has no responsibility for information that is not financial in nature. For example, the audited financial statements may show a 10 percent increase in sales and a 5 percent increase in net income. If the president’s letter that is included in the annual report stated that sales were up 15 percent and net income increased by 12 percent, a material inconsistency would exist. The auditor would then have to determine whether the financial statements or the president’s letter required revision. If the financial statements were correct,

LO 18-7

Final PDF to printer

614 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 614 10/22/15 10:21 AM

the auditor would request that the president change the other information. If the president refused to change the other information that is inconsistent with the financial statements, the auditor should include an explanatory or other-matter paragraph in the audit report, withhold the report, or withdraw from the engagement depending on the severity of the circumstances.

Special Reports Relating to Financial Statements

Auditing standards require the auditor to report on whether the financial statements conform to GAAP. Auditors, however, are sometimes engaged to report on financial statements that are not prepared on the basis of GAAP. Auditors also may be engaged to report on specific parts of the financial statements or on an entity’s compliance with contractual agreements or regulatory requirements relating to audited financial statements. Special reports are more common for private entities than for public companies. Auditing standards provide the auditor with specific guidance for such engagements and cover the auditor’s reporting responsibilities for the following situations:

∙ Financial statements prepared on a basis of accounting other than GAAP (e.g., the cash basis of accounting).

∙ Specified elements, accounts, or items of a financial statement. ∙ Compliance with aspects of contractual agreements or regulatory requirements

related to audited financial statements.

Financial Statements Prepared According to a Special Purpose Framework One type of special report is employed when an entity has prepared its financial statements on a basis other than GAAP, or in other words, a “special purpose framework.” Auditing stan- dards define special purpose financial statements as those prepared under the following bases:

∙ Regulatory basis. The basis used to comply with the requirements or financial reporting provisions of a governmental regulatory agency. An example would be when an insurance company reports in compliance with the rules of a state insurance commission.

∙ Tax basis. The basis the entity uses to file its income tax return. Real estate partnerships frequently use this basis for reporting to partners.

∙ Cash (or modified cash) basis. The entity reports on revenues when received and expenses when paid. The cash basis may be modified to record depreciation or to accrue income taxes.

∙ Contractual basis. The basis the entity uses to comply with an agreement between the entity and one or more third parties other than the auditor.

The introductory paragraph identifies the financial statements on which a report is being issued. It is important that these financial statements be titled so that they are not confused with financial statements prepared on a GAAP basis. For example, if the financial statements are prepared on a tax basis, the report uses the terms statement of assets, liabilities, and capital–income tax basis instead of balance sheet, and statement of revenues and expenses– income tax basis instead of statement of income or operations.

The management’s responsibility, auditor’s responsibility, and scope paragraphs are basi- cally identical to those included in the standard unmodified audit report. The opinion para- graph is a positive statement about the fairness of presentation in conformity with the special purpose framework being used, similar to the opinion paragraph in the standard unmodified report. The report also includes an emphasis-of-matter paragraph after the opinion paragraph that describes the special purpose framework being used.

LO 18-8

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 615

mes32502_ch18_596-626.indd 615 10/22/15 10:21 AM

If the financial statements are prepared on a regulatory basis, a paragraph such as the fol- lowing is added to restrict the distribution of the report to those parties within the entity and those involved in filing with the regulatory agency:

Our report is intended solely for the information and use of Great Atlantic Insurance Company and for filing with the Excelsior State Insurance Agency and is not intended to be and should not be used by anyone other than these specified parties.

Specified Elements, Accounts, or Items of a Financial Statement In some situations an auditor may be engaged to report on only specific parts of the financial statements. Examples include a report on rentals, royalties, or profit participation, or on the provision for income taxes. The basis of accounting for the elements, accounts, or items may be GAAP or a special purpose framework.

An engagement to express an opinion on one or more specified elements, accounts, or items of a financial statement may be performed as a separate engagement or as part of an audit of financial statements. The only exception is when the auditor is engaged to report on the entity’s net income or stockholders’ equity. In this case, the auditor must audit the entire set of financial statements.

Generally, the procedures applied in an audit of an element, account, or item are more extensive than if the same information were considered as part of an audit of the overall finan- cial statements. Thus, materiality needs to be set in relation to the individual element, account, or item and the auditor should consider how the item relates to other parts of the financial statements. For example, if the auditor is engaged to audit the entity’s accounts receivable, other accounts such as sales and allowance for bad debts should also be considered.

Suppose an auditor is engaged to issue a special report on gross sales for an entity whose building lease payment is contingent on the total amount of sales for the period, such as might be the case with a department store that rents space in a shopping mall. The audit report’s introductory paragraph states that only this specific account was audited. Similar to the stan- dard unmodified audit report, the management’s responsibility and auditor’s responsibility paragraphs state management’s and the auditor’s responsibilities with respect to that specific account. The scope paragraph differs from the scope paragraph in the standard report only in that it references the specific account being audited rather than the financial statements. The opinion paragraph expresses the auditor’s opinion on the specified account. Finally, in the case when the specified element, account, or item is audited in compliance with the provi- sions of a contract or agreement, the auditor includes a paragraph limiting distribution of the report to the parties who are part of the contract.

Rather than auditing specified elements, accounts, or items, an auditor may be engaged to perform only a set of agreed-upon procedures, as specified by the entity hiring the audi- tor. Chapter 21 provides more information on agreed-upon procedures engagements and the associated report.

Compliance Reports Related to Audited Financial Statements An auditor may be asked to report on an entity’s compliance with certain contractual agree- ments or regulatory requirements that are related to audited financial statements. For exam- ple, loan agreements may include covenants such as restrictions on dividends or maintenance of certain levels for selected financial ratios (for example, maintaining a current ratio of 2 to 1). Exhibit 18–11 is an example of a special report related to compliance with contractual provisions. Note that the auditor provides negative assurance as to the entity’s compliance with the provisions of the loan agreement. Negative assurance consists of a statement that in applying the specified procedures nothing came to the auditor’s attention that indicated that the provisions of the loan agreement had not been complied with. Note that in express- ing negative assurance the auditor does not express an affirmative opinion about the client’s compliance with the loan provisions. In other words, the auditor does not use the words “In our opinion. . . .”

LO 18-9

LO 18-10

Final PDF to printer

616 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 616 10/22/15 10:21 AM

A Demand for More Information and Insight from Auditors The auditor’s report is the key deliverable that communicates the results of the audit process. This chapter offers a fairly in-depth introduction to the current audit reporting model in the United States for public companies and non-public entities. But your understanding would be incomplete if we didn’t clue you in on the fact that big changes are coming to the audit reporting model!

At the beginning of this chapter we told you that some stakeholders in the financial reporting process have argued that the “boilerplate” nature of the current audit reporting model precludes the auditor from conveying subjective information and insights that could be useful to users of the financial statements. While financial statement users have signaled that they value the current auditor’s report, many have called for the auditor’s report to be more informative and relevant. Some have even argued that the current pass/fail model of audit reporting should give way to a more subjective, nuanced audit opinion, indicating gradations in entities’ financial reporting quality and reliability.

Although the coming changes will retain the binary, pass/fail reporting model, the IAASB has adopted new standards that will increase the amount of subjective information conveyed by the auditor to financial statement users. These standards are effective for audits of financial statements relating to periods ending after December 15, 2016. The PCAOB and the ASB have active projects on their standard-setting agendas that will bring similar changes to audits of U.S. public and non-public entities

An Overview of Reporting Changes Coming to IAASB Standards For purposes of alerting you to the coming changes, for two reasons we offer an overview of the IAASB stan- dards that have already been adopted for use in countries that follow international auditing standards. First, PCAOB and ASB standards have not been finalized as of the writing of this edition, and second, at this point it appears that the substance of the U.S. audit reporting stan- dards currently under development likely will be very similar to those adopted by the IAASB.

Key Enhancements in the New IAASB Reporting Standards The new IAASB reporting standards require two key enhancements in the audit reports for “listed” (i.e., public) entities, which are available for voluntary adoption by non-listed entities:

1. A new section in the report to communicate key audit matters (KAM—currently referred to as critical audit matters, or CAM in proposed PCAOB standards). KAM are those matters that, in the auditor’s judgment, were of most significance in the audit of the current-period financial statements. The process for identifying KAM to include in the audit report begins with auditor communications with those charged with governance (usually the audit committee in the United States). From the

LO 18-11

Report on Compliance with Contractual Provisions Given in a Separate Report

We have audited, in accordance with auditing standards generally accepted in the United States of America, the balance sheet of Lynch Lumber Company as of December 31, 2015, and the related state- ment of income, retained earnings, and cash flows for the year then ended, and have issued our report thereon dated February 16, 2016.

In connection with our audit, nothing came to our attention that caused us to believe that the Company failed to comply with the terms, covenants, provisions, or conditions of sections 6.1 to 6.14, inclusive, of the indenture dated July 21, 2014, with First State Bank insofar as they relate to accounting matters. However, our audit was not directed primarily toward obtaining knowledge of such noncompliance.

This report is intended solely for the information and use of the board of directors and management of Lynch Lumber Company and First State Bank and is not intended to be and should not be used by anyone other than these specified parties.

E X H I B I T 1 8 – 1 1

Big Changes Coming to Audit Reporting

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 617

mes32502_ch18_596-626.indd 617 10/22/15 10:21 AM

matters communicated with those charged with governance, the auditor selects those matters that required significant auditor attention during the course of the audit. In identifying matters that require significant auditor attention, the auditor explicitly considers the following:

∙ Areas of higher assessed risks of material misstatement ∙ Significant auditor judgments relating to areas in the financial statements that

involved significant management judgment ∙ The effect on the audit of significant events or transactions that occurred during

the year Finally, from the matters that required significant auditor attention, the auditor

uses judgment to select those matters that were of the most significance in the audit of the financial statements of the current period. These matters are considered key audit matters. In reporting KAM in the audit report, the auditor explains why each matter was considered to be of significance, describes how each matter was addressed in the audit, and refers readers to the financial statement disclosures relevant to each matter.

2. Disclosure of the name of the engagement partner in the audit report. This item is a more controversial issue in the United States, where auditor litigation is more prevalent. The PCAOB is exploring ways to implement a similar requirement but is meeting considerable resistance from both auditors and audited entities. Thus, it remains to be seen if this requirement will be included in U.S. standards, and if so, what form it will take.

In addition to these two major changes in audit reporting requirements for listed entities (i.e., public companies), the new IAASB reporting standards will require four key audit report enhancements for all audits:

∙ The Opinion section of the report will be presented first, followed by a Basis for Opinion section, explaining the rationale for the opinion.

∙ Auditor reporting on going concern will be enhanced, with the audit report including a description of the respective responsibilities of management and the auditor, and a separate section or paragraph titled “Material Uncertainty Related to Going Concern” when a material uncertainty exists and is adequately disclosed.

∙ The audit report will include a statement that the auditor is independent and that the auditor has fulfilled all relevant ethical responsibilities as defined by the principles and rules of professional conduct under which the auditor operates (see Chapter 19 to learn about the Code of Professional Conduct applicable to auditors in the United States).

∙ The audit report will include an enhanced description of the responsibilities of the auditor and the key features of an audit.

Anticipated Benefits of the New IAASB Reporting Standards The IAASB believes that the new auditor’s report will be more transparent and will provide more information and insight to stakeholders in the financial reporting process. In addition, the board hopes that the report’s new emphasis on key audit matters will enhance communica- tion between auditors and investors and between auditors and those charged with governance and thus improve the quality of financial reporting. Finally, a requirement for the auditor to report on key (or critical) audit matters could sharpen auditors’ sense of professional skepti- cism in dealing with these matters during the audit.

The current model for the auditor’s report has been in place for several decades with very little change but as you can see, significant changes are coming. We believe these changes, if planned and implemented carefully, will enhance the value of the audit report. We also believe these changes are likely just the beginning of what will prove to be a long and interest- ing process of experimentation and change for the auditor’s report—stay tuned!

Final PDF to printer

618 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 618 10/22/15 10:21 AM

KEY TERMS

Adverse opinion. The auditor’s opinion that the financial statements do not present fairly in accordance with generally accepted accounting principles (or other basis of accounting) due to a pervasively material misstatement. Disclaimer of opinion. The auditor’s indication that no opinion is expressed on the financial statements. The auditor will disclaim an opinion if a pervasive scope limitation arises or if it is determined that the auditor lacks independence. Explanatory paragraph. A paragraph that is used under certain circumstances to provide additional explanation to users of the financial statements. Explanatory paragraphs do not affect the auditor’s unqualified/unmodified opinion. Under GAAS, an explanatory paragraph that refers to a matter appropriately presented or disclosed in the financial statements is known as an emphasis-of-matter paragraph, while a paragraph that refers to matters other than those presented or disclosed in the financial statements is known as an other-matter paragraph. Generally accepted auditing standards. Standards against which the quality of the auditor’s performance is measured. Materiality. The maximum amount by which the auditor believes the financial statements could be misstated and still not affect the decisions of users. Qualified opinion. The auditor’s opinion that the financial statements present fairly, in all material respects, in accordance with generally accepted accounting principles (or other basis of accounting), except for a material misstatement that does not, however, pervasively affect users’ ability to rely on the financial statements. Can also be issued for a scope limitation that is of limited significance. Reasonable assurance. A term that implies some risk that a material misstatement could be present in the financial statements without the auditor detecting it, even when the auditor has exercised due care. Representation letter. A letter that corroborates oral representations made to the auditor by management or by other auditors and documents the continued appropriateness of such representations. Scope limitation. A lack of evidence that may preclude the auditor from issuing a clean opin- ion, usually resulting from an inability to conduct an audit procedure considered necessary. Special purpose financial statements. Financial statements prepared under cash basis, tax basis, regulatory basis, or contractual basis (formerly referred to as “other comprehensive basis of accounting”). Unqualified/Unmodified opinion. The auditor’s opinion that the financial statements pres- ent fairly, in all material respects, the client’s financial position, results of operations, and cash flows in accordance with generally accepted accounting principles (or other basis of accounting)—i.e., a “clean” opinion.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

INTRO 18-1 Describe what is meant when it is said that an auditor is “associated with” a set of financial statements.

LO 18-2 18-2 Distinguish between accounting changes that affect consistency and changes that do not. To what does the word consistency refer? How is it possible for an accounting change to affect comparability but not consistency?

LO 18-3, 18-5 18-3 Give examples of a client-imposed and a condition-imposed scope limitation. Why is a client-imposed limitation generally considered more serious?

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 619

mes32502_ch18_596-626.indd 619 10/22/15 10:21 AM

LO 18-5 18-4 How does the materiality of a departure from GAAP affect the auditor’s choice of financial statement audit reports?

LO 18-6 18-5 In 2014, your firm issued an unmodified report on Tosi Corporation, a private com- pany. During 2015, Tosi entered its first lease transaction, which you have deter- mined is material but not pervasive, and meets the criteria for a capitalized lease. Tosi Corporation’s management chooses to treat the transaction as an operating lease. What types of reports would you issue on the corporation’s comparative finan- cial statements for 2014 and 2015?

LO 18-7 18-6 What are the auditor’s responsibilities for other information included in an entity’s annual report?

LO 18-7 18-7 If the auditor determines that other information contained with the audited financial statements is incorrect and the client refuses to correct the other information, what actions can the auditor take?

LO 18-8, 18-9, 18-10 18-8 List three examples of “special reports.” LO 18-8 18-9 List four bases for special purpose financial statements. Why is it important that the

audit report clearly identify the basis of accounting used in the preparation of the financial statements?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 18-1, 18-2 18-10 In which of the following situations would an auditor ordinarily issue an unqualified/ unmodified financial statement audit opinion with no explanatory (or emphasis-of- matter/other-matter) paragraph?

a. The auditor wishes to emphasize that the entity had significant related-party transactions.

b. The auditor decides to refer to the report of another auditor as a basis, in part, for the auditor’s opinion.

c. The entity issues financial statements that present financial position and results of operations but omits the statement of cash flows.

d. The auditor has substantial doubt about the entity’s ability to continue as a going concern, but the circumstances are fully disclosed in the financial statements.

LO 18-1, 18-2 18-11 A public entity changed from the straight-line method to the declining balance method of depreciation for all newly acquired assets. This change has no material effect on the current year’s financial statements but is reasonably certain to have a substantial effect in later years. The client’s financial statements contain no material misstatements and the auditor concurs with this change. If the change is disclosed in the notes to the financial statements, the auditor should issue a report with a(n)

a. “Except for,” qualified opinion. b. Explanatory paragraph. c. Unqualified opinion. d. Consistency modification.

LO 18-1, 18-2 18-12 An auditor includes a separate paragraph in an otherwise unmodified financial state- ment audit report to emphasize that the entity being reported upon had significant transactions with related parties. The inclusion of this separate paragraph

a. Is appropriate and would not negate the unmodified opinion. b. Is considered an “except for” qualification of the opinion. c. Violates generally accepted auditing standards if this information is already dis-

closed in footnotes to the financial statements. d. Necessitates a revision of the opinion paragraph to include the phrase “with the

foregoing explanation.”

Final PDF to printer

620 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 620 10/22/15 10:21 AM

LO 18-2 18-13 Eagle Company, a public company, had a computer failure and lost part of its finan- cial data. As a result, the auditor was unable to obtain sufficient audit evidence relat- ing to Eagle’s inventory account. Assuming the inventory account is at least material, the auditor would most likely choose either

a. A qualified opinion or a disclaimer of opinion. b. A qualified opinion or an adverse opinion. c. An unqualified opinion with no explanatory paragraph or an unqualified opinion

with an explanatory paragraph. d. A qualified opinion with no explanatory paragraph or a qualified opinion with an

explanatory paragraph.

LO 18-3, 18-4 18-14 Tech Company has disclosed an uncertainty due to pending litigation. The audi- tor’s decision to issue a qualified opinion on Tech’s financial statements would most likely result from

a. A lack of sufficient evidence. b. An inability to estimate the amount of loss. c. The entity’s lack of experience with such litigation. d. A lack of insurance coverage for possible losses from such litigation.

LO 18-3, 18-4, 18-5 18-15 In which of the following circumstances would an auditor usually choose between issuing a qualified opinion or a disclaimer of opinion on a client’s financial statements?

a. Departure from generally accepted accounting principles. b. Inadequate disclosure of accounting policies. c. Inability of the auditor to obtain sufficient competent evidence. d. Unreasonable justification for a change in accounting principle.

LO 18-3, 18-4, 18-5 18-16 King, CPA, was engaged to audit the financial statements of Chang Company, a private company, after its fiscal year had ended. King neither observed the inventory count nor confirmed the receivables by direct communication with debtors but was satisfied that both were fairly stated after applying appropriate alternative proce- dures. King’s financial statement audit report most likely contained a(n)

a. Qualified opinion. b. Disclaimer of opinion. c. Unmodified opinion. d. Unmodified opinion with an emphasis-of-matter paragraph.

LO 18-6 18-17 Comparative financial statements for a public company include the prior year’s state- ments, which were audited by a predecessor auditor. The predecessor’s report is not presented along with the comparative financial statements. If the predecessor’s report was unqualified, the successor should

a. Express an opinion on the current year’s statements alone and make no reference to the prior year’s statements.

b. Indicate in the auditor’s report that the predecessor auditor expressed an unquali- fied opinion.

c. Obtain a letter of representations from the predecessor concerning any matters that might affect the successor’s opinion.

d. Request that the predecessor auditor reissue the prior year’s report.

LO 18-6 18-18 When reporting on comparative financial statements for a private company, which of the following circumstances should ordinarily cause the auditor to change the previ- ously issued opinion on the prior year’s financial statements?

a. The prior year’s financial statements are restated following the purchase of another company in the current year.

b. A departure from generally accepted accounting principles caused an adverse opinion on the prior year’s financial statements, and those statements have been properly restated.

c. A change in accounting principle causes the auditor to make a consistency modi- fication in the current year’s audit report.

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 621

mes32502_ch18_596-626.indd 621 10/22/15 10:21 AM

d. A scope limitation caused a qualified opinion on the prior year’s financial state- ments, but the current year’s opinion is properly unmodified.

LO 18-7 18-19 Which of the following best describes the auditor’s responsibility for “other informa- tion” included in the annual report to stockholders that contains financial statements and the auditor’s report?

a. The auditor has no obligation to read the “other information.” b. The auditor has no obligation to corroborate the “other information” but should

read the “other information” to determine whether it is materially inconsistent with the financial statements.

c. The auditor should extend the examination to the extent necessary to verify the “other information.”

d. The auditor must modify the auditor’s report to state that the other information “is unaudited” or “is not covered by the auditor’s report.”

LO 18-8 18-20 When reporting on financial statements prepared on the basis of accounting used for income tax purposes, the auditor should include in the report a paragraph that

a. Emphasizes that the financial statements have not been examined in accordance with generally accepted auditing standards.

b. Refers to the authoritative pronouncements that explain the income tax basis of accounting being used.

c. States that the income tax basis of accounting is a basis of accounting other than generally accepted accounting principles.

d. Justifies the use of the income tax basis of accounting.

LO 18-9 18-21 When an auditor is asked to express an opinion on an entity’s rent and royalty rev- enues, he or she may

a. Not accept the engagement because to do so would be tantamount to agreeing to issue a piecemeal opinion.

b. Not accept the engagement unless also engaged to audit the full financial state- ments of the entity.

c. Accept the engagement, provided the auditor’s opinion is expressed in a special report.

d. Accept the engagement, provided distribution of the auditor’s report is limited to the entity’s management.

PROBLEMS All applicable problems are available with Connect.

LO 18-1, 18-2, 18-3, 18-22 For each of the following independent situations, indicate the type of financial 18-4, 18-8 statement audit report that you would issue and briefly explain your reasoning.

Assume that all companies mentioned are private companies and that each item is at least material.

a. Barefield Corporation, a wholly owned subsidiary of Sandy, Inc., is audited by another CPA firm. As the auditor of Sandy, Inc., you have assured yourself of the other CPA firm’s independence and professional reputation. However, you are unwilling to take complete responsibility for its audit work.

b. The management of Bonner Corporation has decided to exclude the statement of cash flows from its financial statements because it believes that its bankers do not find the statement to be very useful.

c. You are auditing Diverse Carbon, a manufacturer of nerve gas for the military, for the year ended September 30. On September 1, one of its manufacturing plants caught fire, releasing nerve gas into the surrounding area. Two thousand people were killed and numerous others paralyzed. The company’s legal counsel indicates that the company is liable and that the amount of the liability can be

Final PDF to printer

622 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 622 10/22/15 10:21 AM

reasonably estimated, but the company refuses to disclose this information in the financial statements.

d. During your audit of Cuccia Coal Company, the controller, Tracy Tricks, refuses to allow you to confirm accounts receivable because she is concerned about com- plaints from her customers. You are unable to satisfy yourself about accounts receivable by other audit procedures and you are concerned about Tracy’s true motives.

e. On January 31, Asare Toy Manufacturing hired your firm to audit the company’s financial statements for the prior year. You were unable to observe the client’s inventory on December 31. However, you were able to satisfy yourself about the inventory balance using other auditing procedures.

f. Gelato Bros., Inc., leases its manufacturing facility from a partnership controlled by the chief executive officer and major shareholder of Gelato. Your review of the lease indicates that the rental terms are in excess of rental terms for similar build- ings in the area. The company refuses to disclose this related-party transaction in the footnotes.

g. Johnstone Manufacturing Company has used the double-declining balance method to depreciate its machinery. During the current year, management switched to the straight-line method because it felt that it better represented the utilization of the assets. You concur with its decision. All information is adequately disclosed in the financial statements.

LO 18-1, 18-2, 18-3, 18-23 For each of the following independent situations, indicate the reason for and the type 18-4, 18-8 of financial statement audit report that you would issue. Assume that all companies

mentioned are private companies and that each item is at least material. a. Thibodeau Mines, Inc., uses LIFO for valuing inventories held in the United

States and FIFO for inventories produced and held in its foreign operations. b. Walker Computers is suing your client, Super Software, for royalties over patent

infringement. Super Software’s outside legal counsel assures you that Walker’s case is completely without merit.

c. In previous years, your client, Merc International, has consolidated its Panama- nian subsidiary. Because of restrictions on repatriation of earnings placed on all foreign-owned corporations in Panama, Merc International has decided to account for the subsidiary on the equity basis in the current year. You concur with the change.

d. In prior years, Worcester Wool Mills has used current market prices to value its inventory of raw wool. During the current year, Worcester changed to FIFO for valuing raw wool.

e. Upon review of the recent history of the lives of its specialized automobiles, Gas Leak Technology justifiably changed the service lives for depreciation purposes on its autos from five years to three years. This change resulted in a material amount of additional depreciation expense.

f. During the audit of Brannon Bakery Equipment, you found that a material amount of inventory had been excluded from the company’s financial statements. After discussing this problem with management, you become convinced that it was an unintentional oversight. Management appropriately corrected the error prior to your finalization of field work.

g. Jay Rich, CPA, holds 10 percent of the stock in Rothenburg Construction Com- pany. The board of directors of Rothenburg asks Rich to conduct its audit. Rich completes the audit and determines that the financial statements present fairly in accordance with generally accepted accounting principles.

h. Ramamoorthi Savings and Loan’s financial condition has been deteriorating for the last five years. Most of its problems result from loans made to real estate devel- opers in Saint Johns County. Your review of the loan portfolio indicates that there should be a major increase in the loan-loss reserve. Based on your calculations,

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 623

mes32502_ch18_596-626.indd 623 10/22/15 10:21 AM

the proposed writedown of the loans will put Ramamoorthi into violation of the state’s capital requirements. The client refuses to make the adjustment or to dis- close the possible going concern issue in the notes to the financial statements.

LO 18-2 18-24 The CPA firm of May & Marty has audited the consolidated financial statements of BGI Corporation, a private company. May & Marty examined the parent company and all subsidiaries except for BGI-Western Corporation, which was audited by the CPA firm of Dey & Dee. BGI-Western constituted approximately 10 percent of the consolidated assets and 6 percent of the consolidated revenue.

Dey & Dee issued an unmodified opinion on the financial statements of BGI- Western. May & Marty will be issuing an unmodified opinion on the consolidated financial statements of BGI.

Required: 1. What procedures should May & Marty consider performing with respect to Dey

& Dee’s examination of BGI-Western’s financial statements regardless of whether reference is to be made to the other auditors?

2. Describe the various circumstances under which May & Marty could take respon- sibility for the work of Dey & Dee and make no reference to Dey & Dee’s exami- nation of BGI-Western in its own report on the consolidated financial statements of BGI.

(AICPA, adapted)

LO 18-2, 18-3, 18-25 Devon, Inc., a private company, engaged Rao to examine its financial statements for 18-4, 18-6 the year ended December 31, 2015. The financial statements of Devon, Inc., for the

year ended December 31, 2014, were examined by Jones, whose March 30, 2015, auditor’s report expressed an unqualified opinion. The report of Jones is not pre- sented with the 2015–2014 comparative financial statements.

Rao’s working papers contain the following information that is not reflected in footnotes to the 2015 financial statements as prepared by Devon, Inc.:

∙ One member of Devon’s board of directors, who was appointed in 2015, was for- merly a partner in Jones’ accounting firm. Jones’ firm provided financial consult- ing services to Devon during 2013 and 2012, for which Devon paid approximately $1,600 and $9,000, respectively.

∙ Devon refused to capitalize certain lease obligations for equipment acquired in 2015. Capitalization of the leases in conformity with generally accepted account- ing principles would have increased assets and liabilities by $312,000 and $387,000, respectively; decreased retained earnings as of December 31, 2015, by $75,000; and decreased net income and earnings per share by $75,000 and $.75, respectively, for the year then ended. Rao has concluded that the leases should have been capitalized.

∙ During the year, Devon changed its method of valuing inventory from the first-in, first-out method to the last-in, first-out method. This change was made because management believes LIFO more clearly reflects net income by providing a closer matching of current costs and current revenues. The change had the effect of reduc- ing inventory at December 31, 2015, by $65,000 and net income and earnings per share by $38,000 and $.38, respectively, for the year then ended. The effect of the change on prior years was immaterial; accordingly, the change had no cumulative effect. Rao supports the company’s position, agreeing that it is justified.

After completing the fieldwork on February 28, 2016, Rao concludes that the expres- sion of an adverse opinion is not warranted.

Required: Prepare the body of Rao’s report, addressed to the board of directors, dated

February 28, 2016, to accompany the 2015–2014 comparative financial statements.

Final PDF to printer

624 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 624 10/22/15 10:21 AM

Rao has conducted an audit of Devon’s internal controls over financial reporting based on the 2013 COSO framework. No material weaknesses were identified.

LO 18-8 18-26 On March 12, 2016, Kristen & Valentine, CPAs, completed the audit of the financial statements of Modern Museum, Inc., for the year ended December 31, 2015. Mod- ern is a privately held company. Modern Museum presents comparative financial statements on a modified cash basis. Assets, liabilities, fund balances, support, rev- enues, and expenses are recognized when cash is received or disbursed, except that Modern includes a provision for depreciation of buildings and equipment. Kristen & Valentine believes that Modern’s three financial statements, prepared in accordance with a basis of accounting other than generally accepted accounting principles, are adequate for Modern’s needs and wishes to issue a special report on the financial statements. Kristen & Valentine has gathered sufficient competent evidence to be satisfied that the financial statements are fairly presented according to the modi- fied cash basis. Kristen & Valentine audited Modern’s 2014 financial statements and issued an auditor’s special report expressing an unmodified opinion.

Required: Draft the audit report to accompany Modern’s comparative financial statements.

(AICPA, adapted)

LO 18-1, 18-3, 18-27 For the year ended December 31, 2014, Friday & Co., CPAs (“Friday”), audited the 18-4, 18-6 financial statements of Kim Company and expressed an unqualified opinion on the

balance sheet only. Friday did not observe the taking of the physical inventory as of December 31, 2013, because that date was prior to its appointment as auditor. Friday was unable to satisfy itself regarding inventory by means of other auditing procedures, so it did not express an opinion on the other basic financial statements that year.

For the year ended December 31, 2015, Friday expressed an unqualified opinion on all the basic financial statements and satisfied itself as to the consistent applica- tion of generally accepted accounting principles. The fieldwork was completed on March 12, 2016; the partner-in-charge reviewed the working papers and signed the auditor’s report on March 19, 2016. The report on the comparative financial state- ments for 2015 and 2014 was delivered to Kim on March 21, 2016.

Required: Prepare Friday’s audit report that was submitted to Kim’s board of directors on the

2015 and 2014 comparative financial statements. Kim is a public company. Friday has conducted an audit of Kim’s internal controls over financial reporting based on the COSO framework. No material weaknesses were identified.

LO 18-1, 18-8 18-28 The following auditor’s report was drafted by a staff accountant of Nathan and Mat- thew, CPAs, at the completion of the audit of the comparative financial statements of Monterey Partnership for the years ended December 31, 2015 and 2014. Mon- terey is a privately held company that prepares its financial statements on the income tax basis of accounting. The report was submitted to the engagement partner, who reviewed matters thoroughly and properly concluded that an unmodified opinion should be expressed. The draft of the report prepared by an inexperienced staff audi- tor is as follows:

Auditor’s Report We have audited the accompanying financial statements of Monterey Partnership,

which comprise the statements of assets, liabilities, and capital–income tax basis as of December 31, 2015, and the related statements of revenue and expenses–income tax basis and of changes in partners’ capital accounts–income tax basis for the year then ended, and the related notes to the financial statements.

Final PDF to printer

Chapter 18 Reports on Audited Financial Statements 625

mes32502_ch18_596-626.indd 625 10/22/15 10:21 AM

Auditor’s Responsibility We conducted our audit in accordance with standards established by the AICPA.

Those standards require that we plan and perform the audit to obtain reasonable assur- ance about whether the financial statements are free from material misstatement.

An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the financial statements. The procedures selected depend on the auditor’s judgment, including the assessment of the risks of material mis- statement of the financial statements, whether due to fraud or error. An audit also includes evaluating the appropriateness of accounting policies used as well as evalu- ating the overall presentation of the financial statements.

We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Opinion In our opinion, the financial statements referred to above present fairly, in all

material respects, the assets, liabilities, and capital of Monterey Partnership as of December 31, 2015, and its revenue and expenses and changes in partners’ capital accounts for the year then ended in conformity with generally accepted accounting principles applied on a consistent basis.

Basis of Accounting We draw attention to Note 2 of the financial statements, which describes the basis

of accounting. The financial statements are prepared on the basis of accounting the Partnership uses for income tax purposes. Accordingly, these financial statements are not designed for those who do not have access to the Partnership’s tax returns. Our opinion is not modified with respect to this matter.

Nathan and Matthew, CPAs April 3, 2016

Required: Identify the errors and omissions in the auditor’s report as drafted by the staff audi-

tor. Group the errors and omissions by paragraph, where applicable. Do not redraft the report.

(AICPA, adapted)

DISCUSSION CASE

LO 18-2 18-29 You are auditing the financial statements for your new client, Paper Packaging Cor- poration, a manufacturer of paper containers, for the year ended March 31, 2016. Paper Packaging’s previous auditors had issued a going concern opinion on the March 31, 2015, financial statements for the following reasons:

∙ Paper Packaging had defaulted on $10 million of unregistered debentures sold to three insurance companies, which were due in 2015, and the default constituted a possible violation of other debt agreements.

∙ The interest and principal payments due on the remainder of a 10-year credit agreement, which began in 2011, would exceed the cash flows generated from operations in recent years.

∙ The company had disposed of certain operating units. The proceeds from the sale were subject to possible adjustment through arbitration proceedings, the outcome of which was uncertain at year-end.

∙ Various lawsuits were pending against the company. ∙ The company was in the midst of tax proceedings as a result of an examination of

the company’s federal income tax returns for a period of 12 years.

Final PDF to printer

626 Part 6 Completing the Audit and Reporting Responsibilities

mes32502_ch18_596-626.indd 626 10/22/15 10:21 AM

Required (for this question, you may wish to reference extant auditing standards):

a. What should you consider in deciding whether to discuss a going concern uncer- tainty in your report?

b. How much influence should the report on the March 31, 2015, financial state- ments have on your decision?

c. Should your report for the year ended March 31, 2016, include a discussion of a going concern uncertainty? Briefly explain why or why not.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

You find that the status of the above matters is as follows at year-end, March 31, 2016:

∙ The company is still in default on $4.6 million of the debentures due in 2015 but is trying to negotiate a settlement with remaining bondholders. A large number of bondholders have settled their claims at significantly less than par.

∙ The company has renegotiated the 2011 credit agreement, which provides for a two-year moratorium on principal payments and interest at 8 percent. It also limits net losses ($2.25 million for 2016) and requires a certain level of defined cumulative quarterly operating income to be maintained.

∙ The arbitration proceedings were resolved in 2016. ∙ The legal actions were settled in 2014. ∙ Most of the tax issues have been resolved, and, according to the company’s out-

side legal counsel, those remaining will result in a net cash inflow to the company. At year-end, Paper Packaging had a cash balance of $5.5 million and expects to gen-

erate a net cash flow of $3.2 million in the upcoming fiscal year. The following information about Paper Packaging’s plans for its operations for the

fiscal year ending in 2017 may also be useful in arriving at a decision.

Fiscal Year 2017 Budget

Fiscal Year 2016 Actual

Fiscal Year 2016 Budget

Net revenues $66.2 $60.9 $79.8 Gross margin 34.7 33.6 45.6 Operating expenses 27.9 34.7 31.4 Interest—net 5.1 6.0 5.7 Other income (expenses)—net (.8) 2.1 — Earnings before income taxes and extraordinary items 1.5 (5.1) (.2) Cash flows: Receipts 69.9 79.7 Disbursements 66.7 96.9 Excess/deficit 3.2 (22.8)

Final PDF to printer

mes32502_ch19_627-671.indd 627 10/22/15 11:42 AM

627

PART SEVEN

Professional Responsibilities

CHAPTER 19 Professional Conduct, Independence, and Quality Control

CHAPTER 20 Legal Liability

Final PDF to printer

mes32502_ch19_627-671.indd 628 10/22/15 11:42 AM

CHAPTER

19 19-1 Know the definitions and general importance of ethics

and professionalism. 19-2 Be able to explain three basic theories of ethical behavior

and understand how to deal with ethical challenges through an example situation.

19-3 Know how professional ethics standards for auditors have developed over time and the entities involved.

19-4 Understand the framework for the newly reorganized AICPA Code of Professional Conduct, including principles, rules, and interpretations.

19-5 Acquire a working knowledge of the rules of conduct that apply to independence, integrity, and objectivity.

19-6 Know the basic differences between the SEC’s independence rules for public company auditors and AICPA standards for audits of nonpublic entities.

19-7 Know the rules of conduct that apply to general standards and accounting principles, responsibilities to clients, and other responsibilities and practices.

19-8 Be able to explain the definition and elements of a system of quality control and how the AICPA’s peer review program relates to quality control.

19-9 Be familiar with the PCAOB inspection program for accounting firms that audit public companies.

AICPA, Code of Professional Conduct AU-C 220, Quality Control for an Engagement Conducted in Accordance with Generally Accepted Auditing Standards ISB 3, Employment with Audit Clients PCAOB Auditing Standard No. 1, References in Auditors’ Reports to the Standards of the Public Company Accounting Oversight Board PCAOB Rules on Auditor Ethics, Independence, and Tax Services, Rules No. 3520, 3521, 3522, 3523, 3524, and 3526

PCAOB Auditing Standard No. 10, Supervision of the Audit Engagement PR 100, Standards for Performing and Reporting on Quality Reviews Securities and Exchange Commission Rule 2-01, Revision of the Commission’s Auditor Independence Requirements Statement on Quality Control Standards (SQCS) No. 8, “A Firm’s System of Quality Control”

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

629

mes32502_ch19_627-671.indd 629 10/22/15 11:42 AM

Professional Conduct, Independence, and Quality Control

A fter 29 years of working his way up within the firm, Scott London had risen to serve as KPMG’s senior partner for the firm’s Pacific Southwest audit practice. While he served as the managing partner for Herbalife

and Skechers, London began passing inside information from the companies to his friend, Bryan Shaw, who used the tips to trade stocks. This transfer of information represented a serious violation not only of KPMG’s policies but also of professional ethics rules and insider trading laws. After authorities con- fronted him about his activities, London notified KPMG of his actions in April 2013, resulting in his immediate termination.

Between 2010 and 2012, London discussed insider information with Shaw, who bought shares and options in anticipation of increased stock prices. In turn, Shaw paid London $50,000 cash and provided him with expensive jew- elry, meals, and tickets to entertainment events, as well as other benefits. Although London’s personal gain from sharing inside information amounted to only about $70,000 (a small amount relative to his annual $900,000 salary), he facilitated the reaping of $1.27 million in illegal profits by Shaw. When asked if he could give an explanation for his actions, London responded, “To be honest, I can’t. I knew the rules and followed them for 26 years. I take full responsibility for what I did, but I am at a loss to say exactly why I allowed myself to break my moral and ethical code.”1

The insider trading began to come to light when Shaw’s abnormal trad- ing behavior caught the attention of authorities. When confronted, he fully confessed and agreed to record incriminating conversations with London in exchange for leniency. After the sentencing, KPMG issued a statement saying that “it was appropriate that Scott London was held accountable today for the consequences of his illegal and unethical actions.” In the end, London lost his job, paid over $100,000 in civil penalties, and in April 2014 was sentenced to 14 months in federal prison. In June of that same year, Shaw was sentenced to 5 months in prison and paid back nearly $2 million in illegally gained profits and fines.

The judge in the London/Shaw case wrote: “As a partner at KPMG, London owed a fiduciary duty of trust and confidence to KPMG. As a fiduciary, he was obligated to keep his firm’s client information confidential and not to misappro- priate it for his own financial or personal benefit.” Similarly, a federal court judge presiding over a 2004 case involving independence violations by EY emphasized the importance of auditor independence:2

Auditors have been characterized as “gatekeepers” to the public securities markets that are crucial for capital formation. The independent public accountant performing this special function owes ultimate allegiance to the corporation’s creditors and stockholders, as well as

1As told in an interview with Forbes’ contributor Walter Pavlo—see http://www.forbes.com/sites/ walterpavlo/2014/06/16/fmr-kpmg-partner-scott-london-shares-cautionary-tale-before-prison/ 2See Central District of California Court Proceedings: Case # CV13-02558.

Final PDF to printer

630 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 630 10/22/15 02:59 PM

to the investing public. This “public watchdog” function demands that the accountant maintain total inde- pendence from the client at all times and requires complete fidelity to the public trust.3

In this chapter, we discuss the importance of ethical and professional conduct by audi- tors. We begin by defining ethics and professionalism and by offering a general frame- work within which ethical issues can be evaluated. We then provide an overview of the nature of the principles, rules, and regulations governing public accountants’ conduct, fol- lowed by a discussion of the specific rules and regulations that accountants, and auditors in particular, must follow. We highlight independence rules, which arguably constitute the most complicated and controversial aspect of auditor professionalism. Finally, we discuss how public accounting firms are monitored and inspected to help ensure quality audits and compliance with professional standards, regulations, and codes of conduct. Note that the AICPA recently reorganized the Code of Professional Conduct; this chapter reflects that reorganization.

3See Initial Decision Release No. 249, Administrative Proceeding, File No. 3-10933, United States of America before the Securities and Exchange Commission in the Matter of Ernst & Young LLP, www.sec.gov/litigation/aljdec/id249bpm.htm

Ethics and Professional Conduct

Ethics and Professionalism Defined Ethical conduct is the bedrock of modern civilization—it underpins the successful function- ing of nearly every aspect of society, from daily family life to law, medicine, business, and government. Ethics refers to a system or code of conduct based on moral duties and obliga- tions that indicate how an individual should interact with others in society. A sense for ethics guides individuals to value more than their own self-interest and to recognize and respect the interests of others. Our society would fall into chaos if people were devoid of ethics and moral sentiments. Imagine what it would be like if everyone completely ignored rules of the road, moral standards, obligations, and the rights and interests of others! Life in such a society would be, as the philosopher Hobbes said, “solitary, poor, nasty, brutish, and short.”

Ethical conduct is also the bedrock of modern professionalism. Professionalism, broadly defined, refers to the conduct, aims, or qualities that characterize a profession or professional person.4 All professions establish rules or codes of conduct that define ethical behavior for members of the profession. These rules are established so that (1) users of the professional services know what to expect when they purchase such services, (2) members of the profes- sion know what behavior is acceptable, and (3) the profession can use the rules to monitor the actions of its members and apply discipline where appropriate. Consider the medical profes- sion. When you see a doctor for a potentially serious medical condition, you as a user of this professional service have a valid and vital interest in expecting competent and honest behavior that is free from conflicts of interest. You expect, for example, that the doctor will prescribe the best medication for your condition, rather than one for which the doctor receives a kick- back. To better meet these expectations, the medical profession requires particular training and certifications, and it has a code of professional conduct, one of the earliest forms of which is the Hippocratic oath, written in about 400 BC. An essential distinguishing mark of a profes- sion is that it recognizes the responsibility of its members to place the interests of the public above their own when the two are in conflict.

Recall that in Chapter 1 we discussed the desired characteristics of a house inspector and concluded that competence, objectivity, and integrity are critical. We also discussed the role that auditors, as “information inspectors,” play in reducing information risk through

LO 19-1

4S. M. Mintz, Ethical Obligations and Decision Making in Accounting: Text and Cases, 2nd ed. (New York: McGraw-Hill/Irwin, 2011).

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 631

mes32502_ch19_627-671.indd 631 10/22/15 11:42 AM

independent verification of management assertions. To be a credible source of objective, independent assurance, the professional must have a solid reputation for competence and for unquestioned character and integrity. The concepts of ethical behavior and professional con- duct are clearly central to the success of the accounting profession. In fact, those who enter the accounting profession and engage in unethical conduct will inevitably harm themselves, others, and the profession. The most important concept you will read in this chapter is that of personal responsibility and integrity. As an accountant, auditor, manager, or businessperson, you will face numerous difficult ethical issues, and you will experience temptations and pres- sures to act in ways that are not aligned with ethical principles or the public interest. Never forget that your most valuable assets as a professional and as a person are unquestioned integ- rity and a solid reputation. We encourage you to continually evaluate your choices and behav- ior and commit to a high level of integrity and ethical behavior as a student, professional, and member of society.

Given the importance of ethical behavior, reputation, and professionalism, the accounting profession has developed a Code of Professional Conduct that guides the conduct of account- ing professionals. The profession’s Code of Professional Conduct (which was recently revised and codified), together with related rules, interpretations, and regulations, is discussed later in this chapter, after we discuss a general framework for considering ethical issues.

Theories of Ethical Behavior When individuals are confronted with situations that have moral and ethical implications, they do not always agree on the issues at hand, which individuals or groups will be affected, or what solutions or courses of action are available or appropriate for dealing with the situa- tion. Such differences may be caused by differences in the individuals’ concepts of fairness and different opinions about the right action to take in a particular situation. Some ethical choices are difficult simply due to the temptation or pressure to pursue one’s self-interest, which can cloud judgment regarding what is right or wrong. Other choices are complicated by the sheer difficulty of sorting out the issues and deciphering what might be appropriate or inappropriate actions to take.

S. M. Mintz has suggested that there are three overlapping methods or theories of ethical behavior that can guide the analysis of ethical issues in accounting.5 These theories are (1) utili- tarianism, (2) a rights-based approach, and (3) a justice-based approach. No single approach is necessarily better than another. In fact, the theories overlap with one another, and elements of each theory may be appropriate for resolving ethical dilemmas in different circumstances.

Utilitarian theory recognizes that decision making involves trade-offs between the ben- efits and burdens of alternative actions, and it focuses on the consequences of a particular action on the individuals affected. The theory proposes that the interests of all parties affected, not just one’s self-interest, should be considered. From this perspective, an action conforms to the principle of utility only if that action will produce more pleasure or happiness (or prevent more pain or unhappiness) for the greatest number of people than any other possible action. The value of an action is determined solely by the consequences of the action on the welfare of individuals. This is why utilitarianism is sometimes also described as a “consequentialist” theory. One form of utilitarianism holds that rules have a central position in moral judgment due to the adverse consequences that would likely arise if everyone chose to break them. This approach has significance for auditors, who are expected to follow the Code of Professional Conduct in carrying out their responsibilities. One disadvantage in applying the utilitarian theory to ethical dilemmas is that it is often difficult to measure the potential costs and ben- efits of the actions to be taken. It may also be difficult to balance the interests of all parties involved when those interests conflict with one another.

The rights-based approach assumes that individuals have certain rights and other indi- viduals have a duty to respect those rights. Thus, a decision maker who follows a theory of

LO 19-2

5See S. M. Mintz, Ethical Obligations and Decision Making in Accounting: Text and Cases, 2nd ed. (New York: McGraw-Hill/Irwin, 2011), for a more detailed discussion of each of these models.

Final PDF to printer

632 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 632 10/22/15 11:42 AM

rights should undertake an action only if it does not violate the rights of any individual. An obvious disadvantage of the theory of rights is that it may be difficult or impossible to satisfy all rights of all affected parties, especially when those rights conflict. The theory of rights is important to auditors because of their public-interest responsibility. As the judge’s ruling in this chapter’s preface indicates, in conflicting situations, the right of the public to have objec- tive and clear information from the auditor takes precedence over any right the auditor might have to enter into relationships with the audited entity that might cloud the auditor’s judg- ment. According to the concept known as the “moral point of view,” auditors must be willing to see issues through others’ eyes and put the interests of other stakeholders, such as investors and creditors, ahead of their own self-interests and those of the CPA firm. For example, if a difference of opinion with top management exists over an accounting or reporting issue, the auditor should emphasize the interests of the investors and creditors in deciding what action to take, even if it means displeasing management and even losing the audit engagement.

The justice-based approach is concerned with issues such as equity, fairness, and impar- tiality. The theory of justice involves two basic principles.6 The first principle posits that each person has a right to have the maximum degree of personal freedom that is still compatible with the liberty of others. The second principle asserts that social and economic actions should be to everyone’s advantage and the benefits available to all. For example, someone in a position to accumulate wealth has a moral obligation to make sure that others are not treated unfairly as a result of his or her gains. Decisions made within this theory should fairly and equitably distribute resources among those individuals or groups affected. There may be dif- ficulty in trying to apply this theory in practice because the rights of one or more individuals or groups may be affected when a better distribution of benefits is provided to others. Under this approach, the auditor considers what would be the most just decision in terms of alloca- tion of resources among interested parties.

While none of these theories by itself can provide a perfect ethical framework, note that each emphasizes the need to consider more than one’s self-interest, and each can be useful in helping an auditor to solve dilemmas by providing an ethical perspective.

Example—an Ethical Challenge

6Theory of Justice (The Belknap Press of Harvard University Press, 1971).

Sun City Savings and Loan Company

Pina, Johnson & Associates has recently been awarded the audit of Sun City Savings and Loan Company for the year just ended. Sun City Savings and Loan is now the largest client of the firm, and the fees from this engagement represent a significant portion of the firm’s revenues. Upon accepting the Sun City engagement, the firm incurred additional costs by hiring several new employees and a new manager from a larger firm. In bidding on the engagement, Sam Johnson knew that the first-year fees would be just enough to cover the actual cost of the first year’s audit, but he hoped that future audit fee increases might lead to a long-term, profitable engagement. Based on his discussions with the predecessor auditors, Johnson knew that there were possible problems with Sun City’s loans because of the collateral used for security. Johnson was also concerned that there might be problems with loan-loss reserves due to the effects of the economic slowdown on the tourist industry in Sun City over the last two years. However, Johnson felt that these problems were manageable.

During the current year, the amount included in the loan-loss reserves account was $675,000, approx- imately the same as the figure for the prior year. The state’s banking regulations require that an amount equal to 1.5 percent of the loans outstanding be included as a reserve against losses. The $675,000 was slightly above the statutory requirement. However, the audit staff identified two large loans, aggregating to $15 million, that appeared not to be collectible in full. The working papers disclosed that each loan had originated during the current year and that both had been in default for four months. Additionally, the collateral used to secure the loans was worth considerably less than the amount of the loans and was not in accordance with Sun City’s loan policy procedures. Based on this information, the staff estimated that

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 633

mes32502_ch19_627-671.indd 633 10/22/15 11:42 AM

Stop and Think: What ethical and professional concerns should Johnson consider in deciding on a course of action? How would Johnson’s views differ if the dilemma were viewed with a utilitarian perspective as compared to a rights-based or a justice- based approach?

In situations such as this one, an auditor is well advised to think about the ethical issues carefully and from several different perspectives. According to the utilitarian perspective, Johnson should consider the consequences of his actions on all affected parties and whether any rules exist that might require a particular action. He should think not only about the consequences of breaking any applicable rule in the current situation but also what the conse- quences would be if everyone else also broke the rule. Costs and benefits need to be assessed in terms of the public, Sun City’s stockholders, Cabot’s reputation, and the situation of the public accounting firm.

Using a rights-based approach, Johnson should consider the rights of the involved par- ties. If he does so, he will realize that the stockholders’ right to fair and accurate information for decision-making purposes would clearly be violated if he did not require an increase in the loan-loss reserves. If Cabot has entered into inappropriate loans at the expense of the stockholders, they will not have received accurate information about Sun City’s profitability, liquidity, and so on. Cabot, of course, has no defensible right to misappropriate funds or to report account balances incorrectly.

Finally, from a justice-based perspective, Johnson should think about whether his deci- sion might yield advantages for some at the expense of others, focusing on the protection of those who may otherwise be at a disadvantage. Johnson should avoid favoring the interests of any individual or group and should not select an action that will confer unfair advantages on some (e.g., the management of the S&L) at the expense of others (e.g., the public). Integ- rity and objectivity require that Johnson not place his self-interest or that of the entity ahead of the public interest. Instead, he must focus on Sun City’s shareholders as members of the investing public.

If he does not allow his self-interest to cloud his judgment, Johnson will require the entity to book the $6 million adjustment for the delinquent loans, regardless of the consequences to himself or to his firm. But, realistically, Johnson’s professionalism is likely to be tested in this situation. While he realizes that the loan-loss reserves probably should be increased, he is also likely to be concerned about the possibility of losing this valuable engagement and the sig- nificant investment in new personnel that the firm has made. After all, he could easily ratio- nalize that there is a good chance the economy will turn around and the loans will be repaid, as promised by Cabot. While it seems fairly clear what action should be taken, the question becomes—as it so often does—does the auditor have the courage to do the right thing?

Auditors frequently face ethical pressures, and the issues are often not quite as clear-cut as in the above example. It is important that auditors develop sound moral character and act with courage and integrity so that they can respond appropriately in such situations. Mintz

about 40 percent of the $15 million, or $6 million, will not be collected. The staff has also determined that these loans are to entities owned by Patricia Cabot, Sun City’s CEO, and some of her business associates.

When Johnson met with Cabot to discuss the two delinquent loans, Cabot assured Johnson that the loans would be paid in full. She told Johnson that the loans had been properly made and that as soon as the economy picked up, payments would be made on the loans. She indicated that no additional reserves were needed and that if Johnson requires such adjustments, his firm might be replaced.

Johnson is concerned that if the loan-loss reserves are increased, Sun City Savings & Loan’s owners and investors might be hurt financially. Further, if Johnson requires the adjustment, Pina, Johnson & Asso- ciates may lose Sun City as a client, his own career goals may be damaged, and the firm may have to lay off professional and staff employees. Johnson believes there could be serious consequences to several different parties whatever decision he makes.

Final PDF to printer

634 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 634 10/22/15 11:42 AM

points out that auditors who possess certain “virtues” or traits of character are more capable of adhering to a moral point of view.7 Examples of such virtues include honesty, integrity, impartiality, faithfulness, and trustworthiness. These characteristics are embodied in the pro- fession’s Principles of Professional Conduct, discussed later in the chapter, and are vital to the continued health of the profession.8

7S. M. Mintz, “Virtue, Ethics, and Accounting Education,” Issues in Accounting Education (Fall 1995), pp. 24–31. 8J. E. Copeland, Jr., “Ethics as an Imperative,” Accounting Horizons (March 2005), pp. 35–43.

Practice I N S I G H T

In the final analysis, individual morality is the basis for effectively dealing with ethical challenges. Moral virtues, such as honesty and fairness, are essential characteristics for members of the account- ing profession. Accountants who do not possess these foundational characteristics are likely to do great harm to themselves, the profession, and others.

An Overview of Ethics and Professionalism in Public Accounting

A Tale of Two Companies A couple of true stories about two business organizations will help illustrate the importance of ethics and professionalism in accounting and auditing. The first Kmart store opened in Garden City, Michigan, in March 1962. Kmart Corp. filed for Chapter 11 bankruptcy protec- tion in January 2002, representing the largest retail bankruptcy ever in the United States up to that time. In May 2002, Kmart announced that it was restating its earnings for the first three quarters of the preceding fiscal year to reflect an additional $554 million in losses for a 2001 loss of $2.4 billion. In January 2003, Kmart fired the last of 25 executives who had pocketed a total of $28 million in loans that were forgiven before the company filed for bankruptcy. A month later, two former Kmart vice presidents, Enio Montini, Jr., and Joseph Hofmeister, were indicted for alleged crimes involving Kmart’s accounting. In May 2003, Kmart emerged from bankruptcy and continued to operate independently for several years. The company now operates more than 1,000 stores as a wholly owned subsidiary of Sears Holding Company.

Arthur Andersen, originally founded in 1913 as Andersen, Delaney & Co., grew to become one of the five largest and most respected accounting firms in the world by the late 1990s, with about 85,000 employees. In fall 2001, it became clear that issues were arising in connection with the firm’s audits of Enron Corp., and Andersen’s Houston office undertook a massive shredding operation to destroy Enron-related documents in October and November 2001. The U.S. Justice Department indicted the firm in March 2002 on obstruction of justice charges related to the shredding. Despite the fact that the Enron scandal was primarily cen- tered in Texas, Andersen began to unravel quickly across the country, losing over 400 of its publicly traded entities from all over the country by June 2002. The firm was convicted on a single count of obstruction of justice in June 2002, and the firm ceased to audit publicly held companies shortly thereafter. Ironically, the obstruction of justice charge was overturned by the U.S. Supreme Court in 2005, but this was a hollow victory for Andersen, as all of the firm’s clients and audit staff had fled by that time to other firms and in all practical respects Andersen ceased to exist.

Stop and Think: Why was financially feeble Kmart able to continue its operations despite questionable accounting practices and federal indictments, while Arthur Andersen was not able to survive even though it was financially strong?

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 635

mes32502_ch19_627-671.indd 635 10/22/15 11:42 AM

Kmart had physical assets and traded in physical goods, while Andersen’s primary asset was its reputation for competence, professionalism, and integrity. That reputation was dam- aged prior to the Enron scandal by a string of questionable practices and audit failures (involv- ing Sunbeam, Waste Management, the Baptist Foundation of Arizona, and others) and was finished off by the Enron scandal and the firm’s subsequent indictment. The sudden death of one of the largest and formerly most respected public accounting firms was a serious wake-up call for the profession, and the collapse underscored the vital importance of ethical conduct and professionalism on the part of auditors.

Standards for Auditor Professionalism This section provides an overview of the principles, rules, and regulations governing ethics and professionalism in public accounting. The topic is complicated by the fact that these rules and regulations were established over time by different professional and regulatory bodies and in some cases by legislation. Early in the history of the public accounting profession in the United States, nongovernmental associations took charge of setting standards and establishing codes of conduct for practicing accountants. In particular, the AICPA (and its predecessor, the American Association of Public Accountants) established auditing standards and a Code of Professional Conduct, mapping out the primary areas in which ethical conduct is expected of public accountants. The AICPA, being a private, nongovernmental association, has the authority only to require its members to comply with the Code as a condition of continued membership. However, state and federal courts have consistently held that all practicing CPAs, whether in public or private practice and whether or not a member of the AICPA, must follow professional ethical standards as laid out in the Code of Professional Conduct. Further, most state boards of accountancy have adopted the Code, thus integrating it into state-level regulation of the practice of accountancy.

LO 19-3

Practice I N S I G H T

It is important to understand that the U.S. capital markets system is based on public confidence. Pub- lic accountants play a central role in the public’s ability to place confidence in companies’ financial reports, and thus greatly influence how efficiently and effectively our capital markets work. Integrity and independence in fact and in appearance are cornerstones of the auditor’s social responsibility and are critical to public confidence and to the proper functioning of our economic system.

The SEC has legal authority to oversee the public accounting profession. Through much of its history, the SEC has allowed private-sector entities such as the Financial Accounting Standards Board and the Auditing Standards Board (or ASB, a standing senior technical com- mittee within the AICPA) to set accounting and auditing standards, respectively. However, the SEC exercises considerable influence in the standard-setting process and has established stan- dards of its own from time to time, some of which differ from those established by private- sector bodies.

The PCAOB, upon taking authority for establishing auditing standards for public com- pany audits, adopted in 2003 (on an interim basis) the professional standards established by the AICPA, including the AICPA’s Code of Professional Conduct. However, the PCAOB and the SEC have additional, more stringent standards of professional conduct, mostly in the key area of auditor independence, which must be followed by auditors of public companies. Because the AICPA Code of Professional Conduct provides the broadest map of the areas in which professionalism is expected from auditors, the newly revised Code serves as the orga- nizing framework for the discussion of auditor ethical and professional responsibilities in this chapter. However, we also highlight the more stringent independence requirements the SEC and PCAOB impose on public company auditors.

Figure 19–1 summarizes the auditor’s responsibilities with respect to auditing standards and standards of professional conduct for the audits of private and public companies. As the figure illustrates, in auditing a privately held entity a CPA must follow the auditing standards established by the ASB, as well as the independence and other standards of professional

Final PDF to printer

636 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 636 10/22/15 11:42 AM

conduct established by the Code of Professional Conduct. In addition, the three standards and the three interpretations issued by the Independence Standards Board (ISB) during its short existence from 1997 to 2001 generally must be followed.9

In auditing a publicly held company, a CPA must follow the auditing standards of the PCAOB, the Code of Professional Conduct, and also the more stringent independence require- ments established by the SEC, ISB, and PCAOB.

9The committee within the AICPA that is charged with setting, deleting, or modifying rules and interpretations and delivering ethics rulings in response to specific questions is known as the Professional Ethics Executive Com- mittee (PEEC).

Relevant Professional Standards for Audits of Private versus Public Companies

F I G U R E 1 9 – 1

Private company audit

Auditing Standards ASB (AICPA)—GAAS

Standards of Professional Conduct AICPA—Code of Professional Conduct ISB—apply unless AICPA expressly disagrees

Auditing Standards PCAOB—currently similar to ASB standards, with notable exceptions

Standards of Professional Conduct PCAOB—Code of Professional Conduct (adopted from AICPA) SEC—more stringent independence rules for public company audits ISB—a cooperative e�ort between the AICPA and SEC; now defunct but standards apply

Public company audit

CPA (auditor)

The Newly Revised AICPA Code of Professional Conduct: A Comprehensive Framework for Auditors

The newly reorganized AICPA Code of Professional Conduct is organized into a preface that is applicable to all CPAs, and three “Parts.” Part 1 applies to CPAs in public practice; in other words, CPAs who provide assurance and conduct financial statement audits and issue reports stemming from those services on which the public will rely. This includes auditors practicing

LO 19-4

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 637

mes32502_ch19_627-671.indd 637 10/22/15 11:42 AM

in public accounting firms and government auditors who issue audit and other assurance reports on government entities. Part 1 requires the CPA to be independent of the entities on which she or he is providing assurance. Part 2 applies to CPAs who are working in business but who are not working as auditors that issue assurance reports on which the public will rely. Part 2 of the Code does not require independence but does require integrity and objectivity on the part of CPAs working in any business capacity. For example, if a CPA works for a com- pany as a controller or CFO but not as an auditor, Part 2 of the Code of Professional Conduct applies but Part 1 does not. If a CPA works both as an auditor and in another business capac- ity, both Part 1 and Part 2 apply to her or his conduct. Part 3 of the Code applies to CPAs who are neither functioning as an auditor nor in business. Even in such cases the profession expects that CPAs will behave in certain ways; for example, that the CPA will not engage in any act that would be discreditable to the profession. Note, therefore, that if your instructor is a CPA, the profession expects certain behavior of him or her even in the capacity of an accounting or auditing instructor!

The Preface of the Code of Professional Conduct, which applies to all CPAs, defines ideal Principles of Professional Conduct that are expected of all CPAs. The separate “Parts” of the Code then set out specific, mandatory Rules of Conduct describing minimum levels of conduct a CPA must maintain, depending on whether the CPA is in public practice (Part 1), working in some business capacity (Part 2), or other capacity (Part 3).

The Principles of Professional Conduct provide the framework for the Rules of Conduct within each part of the Code (Parts 1–3). Additional guidance for applying the Rules of Con- duct is provided by Interpretations of Rules of Conduct by the AICPA Professional Ethics Executive Committee (PEEC). (The prior version of the Code also included “rulings” on indi- vidual questions submitted to the PEEC, listed in question and answer format. These rulings have been redrafted and codified as Interpretations of Rules of Conduct in the newly revised Code of Professional Conduct.)

The Interpretations of Rules of Conduct are promulgated by the AICPA’s PEEC to pro- vide guidelines as to the scope and application of the Rules of Conduct. Unlike the Rules of Conduct, interpretations are not specifically enforceable, but an auditor who departs from them has the burden of justifying such departures.

The guidance provided by the Code of Professional Conduct starts at a conceptual level with the principles and progressively moves to general rules and then to detailed interpreta- tions. Figure 19–2 illustrates how the principles, rules, and interpretations of the Code of Professional Conduct fit in the context of the Code.

Code of Professional ConductF I G U R E 1 9 – 2

Principles of Professional Conduct

Not enforceable

General

Specific

Specifically enforceable

Not specifically enforceable, but departures must be justified

Rules of Conduct

Interpretations of Rules of Conduct

Ideal attitudes and behaviors

Minimally acceptable standards

Detailed interpretations and answers to questions regarding rules of conduct

Final PDF to printer

638 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 638 10/22/15 11:42 AM

Principles of Professional Conduct The framework for the Code of Professional Conduct is provided by six fundamental ethical principles in the Preface to the Code. The preamble to the Principles of Professional Conduct states the following:

They [the principles] guide members in the performance of their professional responsibilities and express the basic tenets of ethical and professional conduct. The principles call for an unswerv- ing commitment to honorable behavior, even at the sacrifice of personal advantage. (Code Section 0.300.010.02)

Table 19–1 presents the definition of each of the six principles. Please take a moment to read these vital precepts—they represent the ideals of the profession you are preparing to enter!

Stop and Think: Why do you think the profession has adopted these high ideals for accountants and auditors?

The first two principles address a CPA’s responsibilities to exercise professional and moral judgment in a manner that serves the public interest. These principles reinforce the conviction that a CPA’s role in society is to serve the public.

As indicated by the third and fourth principles, the public relies on a CPA’s integrity, objectivity, and independence in providing high-quality services. Integrity requires that a CPA be honest and candid and honor both the form and the spirit of ethical standards. Thus, a CPA should make judgments that are consistent with the theories of rights and justice. When faced with an ethical challenge, the CPA should ask, “What actions would an individual with integrity take, given these facts and circumstances?” Objectivity and inde- pendence are hallmarks of the public accounting profession. The principle of objectivity requires the CPA to be impartial and free of conflicts of interest. Independence requires that the CPA avoid relationships that would impair his or her objectivity. When a CPA provides auditing- or attestation-related services, independence in both fact and appearance must be maintained.

The fifth principle, due care, requires that the CPA perform his or her professional responsibilities with competence and diligence. While the performance of professional ser- vices must take into account the interests of the entity, the public’s interest must be con- sidered more important when the two interests conflict. The last principle requires that the CPA determine that the services to be rendered are consistent with acceptable professional behavior for CPAs. This principle also requires that the CPA’s firm maintain internal quality control activities to ensure that services are delivered competently and that no conflict of interest exists.

LO 19-4

Principles of Professional Conduct

Responsibilities: In carrying out their responsibilities as professionals, members should exercise sensitive professional and moral judgments in all their activities.

The public interest: Members should accept the obligation to act in a way that will serve the public interest, honor the public trust, and demonstrate a commitment to professionalism.

Integrity: To maintain and broaden public confidence, members should perform all professional responsibilities with the highest sense of integrity.

Objectivity and independence: A member should maintain objectivity and be free of conflicts of interest in discharg- ing professional responsibilities. A member in public practice should be independent in fact and appearance when providing auditing and other attestation services.

Due care: A member should observe the profession’s technical and ethical standards, strive continually to improve competence and the quality of services, and discharge professional responsibility to the best of the member’s ability.

Scope and nature of services: A member in public practice should observe the Principles of the Code of Professional Conduct in determining the scope and nature of services to be provided.

(See AICPA Code of Professional Conduct, Sections 0.300.020-0.300.070)

T A B L E 1 9 – 1

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 639

mes32502_ch19_627-671.indd 639 10/22/15 11:42 AM

Rules of Conduct The bylaws of the AICPA specifically require that members adhere to the Rules of Conduct of the Code of Professional Conduct. The PCAOB also requires auditors of public companies to adhere to the Rules of Conduct. Table 19–2 provides an overview of the existing Rules of Conduct. Take a few minutes to read through these rules. As you can see, the Rules of Con- duct cover much of the same ground as the Principles of Professional Conduct but are some- what more specific. The rules are grouped and numbered differently, depending on which Part of the Code applies to the CPA. Because this book is primarily about financial statement auditing, this chapter focuses on Part 1 of the Code. Part 1 has the most stringent requirements of the three Parts because it applies to CPAs who provide assurance to the broader public, which in turn relies on the work of those CPAs in making financial and investing decisions.

Much of the original text of the rules in Part 1 of the Code of Professional Conduct is included in Table 19–2. The “nitty-gritty” details in implementing the rules are found in the interpretations of each rule. For example, while the rule relating to independence is comprised of only one brief sentence, the in-force interpretations of the Independence Rule comprise many pages of detail relating to financial or business interests that are, or are not, considered

Overview of Part 1 AICPA Rules of Conduct

Code Section Rule Title Text of the Rule*

1.100.001 Integrity and objectivity In the performance of any professional service, a member shall maintain objectivity and integrity, shall be free of conflicts of interest, and shall not knowingly misrepresent facts or subordinate his or her judgment to others.

1.200.001 Independence A member in public practice shall be independent in the performance of professional services as required by standards promulgated by bodies designated by Council.

1.300.001 General standards A member shall comply with the following standards and with any interpretations thereof by bodies designated by Council: A. Professional competence. B. Due professional care. C. Planning and supervision. D. Sufficient relevant data.

1.310.001 Compliance with standards

A member who performs auditing, review, compilation, management consulting, tax, or other professional ser- vices shall comply with standards promulgated by bodies designated by Council.

1.320.001 Accounting principles A member shall not (1) express an opinion . . . that the financial statements or other financial data of any entity are presented in conformity with generally accepted accounting principles or (2) state that he or she is not aware of any material modifications that should be made . . . in order for them to be in conformity with generally accepted accounting principles, if such statements or data contain any departure from an accounting principle . . . that has a material effect. . . .

1.400.001 Acts discreditable A member shall not commit an act discreditable to the profession. 1.510.001 Contingent fees A member in public practice shall not (1) perform for a contingent fee any professional services for . . . a client

for whom the member or the members firm performs, an audit or review of a financial statement . . . or (2) prepare an original or amended tax return or claim for a tax refund for a contingent fee for any client.

1.520.001 Commissions and referral fees

A member in public practice shall not for a commission recommend or refer to a client any product or service, or for a commission recommend or refer any product or service to be supplied by a client, or receive a commission, when the member or the member’s firm also performs for that client an audit or review of a financial statement. . . .

Any member who accepts a referral fee for recommending or referring any service of a CPA to any person or entity or who pays a referral fee to obtain a client shall disclose such acceptance or payment to the client.

1.600.001 Advertising and other forms of solicitation

A member in public practice shall not seek to obtain clients by advertising or other forms of solicitation in a manner that is false, misleading, or deceptive. Solicitation by the use of coercion, overreaching, or harassing conduct is prohibited.

1.700.001 Confidential client information

A member in public practice shall not disclose any confidential client information without the specific consent of the client . . .

Members . . . shall not use to their own advantage or disclose any members confidential client information that comes to their attention. . .

1.800.001 Form of organization and name

A member may practice public accounting only in a form of organization permitted by law or regulation whose characteristics conform to resolutions of Council.

A member shall not practice public accounting under a firm name that is misleading. Names of one or more past owners may be included in the firm name of a successor organization.

A firm may not designate itself as “Members of the American Institute of Certified Public Accountants” unless all of its CPA owners are members of the Institute.

*Some of the longer rules have been excerpted or abridged. Refer to the full set of rules and interpretations at www.aicpa.org.

T A B L E 1 9 – 2

Final PDF to printer

640 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 640 10/22/15 11:42 AM

to compromise independence. Interpretations of the other rules tend to be significantly shorter and less involved than those relating to independence. This is because independence has become the most complex and controversial area of auditor ethics and professionalism—not only has the AICPA established multiple pages of rules and interpretations regarding indepen- dence, but the SEC and the now defunct ISB also weighed in heavily on the independence issue.10 Differences between AICPA independence standards and the SEC independence regu- lations, which apply only to the audits of public companies, are discussed in the context of the AICPA Code of Professional Conduct, which we’ll now explore in more depth.

10The ISB was created in 1997 as a joint effort of the AICPA and the SEC to address important issues relating to audits of public companies. The board was housed within the SEC Practice Section of the AICPA. In 2000 the SEC issued its own comprehensive rules on auditor independence for the audits of public companies, and the ISB was dis- banded in July 2001, when the SEC concluded that “the board’s mission had been substantially fulfilled.” During its brief tenure, the ISB issued three standards and three interpretations. Although the ISB is now defunct, its standards are recognized by the SEC and the AICPA, and they currently remain in effect for public company audits. However, the most important aspects of the ISB’s standards have been incorporated into the SEC’s independence rules and the Code of Professional Conduct and are therefore not discussed separately in this chapter.

Integrity, Objectivity, and Independence

Integrity and Objectivity—Framework, Rule, and Interpretations The first section in Part 1 of the AICPA Code of Professional Conduct, Section 1.100, con- tains the Code’s Integrity and Objectivity Rule. This is no accident—integrity and objectivity are the bedrock of the profession of public accountancy. They are essential to the value that CPAs can provide as providers of assurance and as auditors of financial statements that are used by the general public in making financial and investment decisions.

Integrity and Objectivity Rule (1.100.001): In the performance of any professional service, a member shall maintain objectivity and integrity, shall be free of conflicts of interest, and shall not knowingly misrepresent facts or subordinate his or her judgment to others.

The Integrity and Objectivity Rule expands slightly on the principle from which it was developed and requires that a member maintain integrity and objectivity. Before we address specific interpretations of this rule, it is important to note that the Code of Professional Con- duct recognizes that there may be situations where the CPA’s integrity and objectivity are threatened in ways that are not specifically addressed in the Code. When no interpretation exists to address a particular relationship or circumstance, the CPA should evaluate whether that relationship or circumstance would lead a reasonable and informed third party to conclude that there is a threat to the member’s compliance with the rules that is not at an acceptable level. In such cases the CPA would apply the Code’s “Integrity and Objectivity Framework,” identifying threats to integrity and objectivity, evaluating the significance of those threats, and then applying appropriate safeguards to bring the threat to an acceptable level. Obviously, the professional must apply considerable professional judgment in such situations.

Threats to a CPA’s integrity and objectivity can take several forms, with many falling into one or more of the following seven categories: adverse interest threats, where the CPA’s interest runs contrary to those of the client; self-interest threats, where a CPA may be forced to choose between actions that further her or his own interests and actions that serve the investing public’s interests; advocacy threats, where a CPA might feel inclined to advocate for the client’s preferred outcomes; familiarity threats, where a CPA might have such a close, long-standing relationship with a client that it becomes difficult to maintain objectivity; man- agement participation threats, where a CPA who becomes involved in management decisions is unable to be completely objective; self-review threats, where a CPA is in a position that involves evaluating his or her own judgments; and finally, undue influence threats, when a CPA’s integrity or objectivity is pressured due to another involved party’s aggressiveness or dominant personality. (See Code of Conduct 1.210.010.)

Safeguards to identified threats to a CPA’s integrity and objectivity will be highly dependent on the specific circumstances but should be adequate to bring the threat to the

LO 19-5

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 641

mes32502_ch19_627-671.indd 641 10/22/15 11:42 AM

professional’s integrity and objectivity to an acceptable level, based on professional judg- ment. Examples of safeguards might include additional training, involvement of an other- wise uninvolved third party, and the availability of hotlines and direct consultation on ethical and other matters.

As you can see, the Code of Professional Conduct places the responsibility for ethical behavior squarely on the professional, regardless of whether there are specific interpretations in place to address the myriad situations that might arise to challenge or threaten the CPA’s integrity or objectivity. That said, there are a number of important interpretations of this rule. For example, Interpretation 1.110 states that a conflict of interest may occur if a CPA per- forms a professional service for an entity or employer and the CPA or the CPA’s firm has a relationship with another person, entity, product, or service that could be viewed as impair- ing the CPA’s objectivity. For example, a CPA might be hired to provide recommendations to an entity on which commercially available software package the entity should select for managing inventory. A conflict of interest would exist if the CPA had a substantial business or financial interest in one of the potential software providers. Interpretation 1.130 indicates that a member who knowingly makes, permits or directs another to make, materially false and misleading entries in an entity’s financial statements or records violates the Integrity and Objectivity Rule.

Two other interpretations relate mainly to members employed in industry but have a bear- ing on the work of auditors. Interpretation 2.130.010 states that, in dealing with his or her employer’s external accountants, a member must be candid and not knowingly misrepresent facts or knowingly fail to disclose material facts. Interpretation 2.130.020 indicates that, if a CPA working in industry (e.g., as an accountant in a company) has a disagreement or dispute with his or her supervisor relating to the preparation of financial statements or the recording of transactions, the member must take steps to ensure that the situation does not result in a subordination of judgment. If the member concludes that the financial statements or records could be materially misstated, he or she should communicate those concerns to a higher level of management within the organization. If appropriate action is not taken, the member should consider whether to continue the relationship with the employer. The member should also consider whether any responsibility exists to communicate the problem to third parties, such as regulatory agencies or the employer’s external accountants.

You might be interested to know that educational services are considered by the Code to be professional services and therefore are subject to the Integrity and Objectivity Rule (Inter- pretation 2.160.010). Thus, a CPA who is an accounting instructor must maintain objectivity and integrity when performing such services according to the Code. A complete coverage of the Code of Professional Conduct in this chapter isn’t practical, so be aware that there are other important interpretations in the Code relating to Integrity and Objectivity that we don’t discuss here, such as those relating to “Offering or Accepting Gifts or Entertainment,” and “Use of a Third-Party Service Provider.”

Independence The second section in Part 1 of the Code, Section 1.200, relates to the independence of assur- ance providers. Independence, both in fact and in appearance, is very important to the assur- ance that CPAs provide: if the auditor is not perceived to be independent of the audited entity, it is unlikely that a user of financial statements will place much reliance on the CPA’s work. In addition to the Code of Professional Conduct, SEC and PCAOB rules and standards relat- ing to auditor independence are discussed in this section to the extent that they add to the AICPA’s requirements. While we cover minimum guidelines required by the profession, it is important to note that firms often require their employees to comply with rules and guidelines that are even stricter than those imposed on them by outside bodies.

The Code’s Independence Rule is a very general statement concerning auditor indepen- dence and relates only to attestation-related services, including audits.

Independence Rule (1.200.001): A member in public practice shall be independent in the per- formance of professional services as required by standards promulgated by bodies designated by Council.

Final PDF to printer

642 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 642 10/22/15 11:42 AM

AICPA professional standards require a public accounting firm, including the firm’s partners and professional employees, to be independent in accordance with the Code’s Inde- pendence Rule whenever the firm performs an attest service for an entity. Attest services include the following: ∙ Financial statement audits ∙ Financial statement reviews (see Chapter 21) ∙ Other attest services as defined in the Statements on Standards for Attestation

Engagements (SSAEs) Performing a compilation of an entity’s financial statements (see Chapter 21) does not

require independence, but an accountant or a firm that lacks independence must explicitly indicate this fact in the compilation report. Likewise, independence is not required to perform other nonattest services (e.g., tax preparation, financial planning, or consulting services) if those services are the only services provided to a particular entity.

Because of the difficulties that sometimes arise in defining independent relationships in providing attest services, numerous interpretations of the Independence Rule have been issued. However, as with the Integrity and Objectivity Rule, the Code of Professional Conduct offers a conceptual framework for evaluating and safeguarding against threats to independence that might not be specifically addressed by the Code’s independence interpretations. The frame- work is very similar to that introduced earlier in the chapter in conjunction with Integrity and Objectivity—threats to the appearance of independence are identified, the significance of the threats is evaluated, and safeguards are implemented to bring the threats to an acceptable level, as defined by the likely judgment of a reasonable, informed third party. The Code specifies that for certain threats, either no safeguards can eliminate or reduce the threat to an accept- able level, or a member must apply specific safeguards to eliminate or reduce an independence threat to an acceptable level. The same seven categories of threats are used in the Independence Framework as in the Integrity and Objectivity Framework—adverse interest, advocacy, famil- iarity, management participation, self-interest, self-review, and undue influence. Under this conceptual framework approach, a CPA is required to identify and assess the extent to which a threat to independence exists. If such a threat does exist, the CPA considers whether the threat might reasonably be considered to compromise the member’s professional judgment. If so, the CPA evaluates whether the threat can be effectively mitigated or eliminated using various safe- guards. Depending on the evaluation, the CPA implements safeguards to eliminate or reduce the threats to an acceptable level or concludes that independence is impaired. However, keep in mind that the risk-based conceptual framework for considering independence threats cannot be used to justify departures from specific independence interpretations!

Table 19–3 presents several of the most important interpretations of the Independence Rule. In reading these interpretations, it is important to consider the definition of a “covered member,” or in other words, those who are bound by the independence requirements. The AICPA uses an engagement team approach to determine independence (see Code Section 0.400.012). Under this approach, a covered member includes the following: ∙ An individual on the attest engagement team ∙ An individual in a position to influence the attest engagement ∙ A partner, partner equivalent, or manager who provides more than 10 hours of

nonattest services to the attest client within any fiscal year. Designation as a covered member ends on the later of (i) the date that the firm signs the report on the financial statements for the fiscal year during which those services were provided or (ii) the date he or she no longer expects to provide 10 or more hours of nonattest services to the attest client on a recurring basis

∙ A partner or partner equivalent in the office in which the lead attest engagement partner or partner equivalent primarily practices in connection with the attest engagement

∙ The firm, including the firm’s employee benefits plans ∙ An entity whose operating, financial, or accounting policies can be controlled by any

of the individuals or entities described above or by two or more such individuals or entities if they act together

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 643

mes32502_ch19_627-671.indd 643 10/22/15 11:42 AM

Some Key Interpretations of Independence Rule (Code Section 1.200)*

1.230—Unpaid Fees: Threats to the covered member’s compliance with the “Independence Rule” [1.200.001] would not be at an acceptable level and could not be reduced to an acceptable level by the application of safeguards if a covered member has unpaid fees from an attest client for any previously rendered professional service provided more than one year prior to the date of the current-year report. Accordingly, independence would be impaired. Unpaid fees include fees that are unbilled or a note receivable arising from such fees.

1.240—Financial Interests: Direct Financial Interests: If a covered member had or was committed to acquire any direct financial interest in an attest client during the period of the

professional engagement, the self-interest threat to the covered member’s compliance with the “Independence Rule” would not be at an acceptable level and could not be reduced to an acceptable level by the application of safeguards. Accordingly, independence would be impaired.

Material Indirect Financial Interests: If a covered member had or was committed to acquire any material indirect financial interest in an attest client during the period of the professional engagement, the self-interest threat to the covered member’s compliance with the “Independence Rule” would not be at an acceptable level and could not be reduced to an acceptable level by the application of safeguards. Accordingly, independence would be impaired.

Ownership Interests: If a partner or professional employee of the firm, his or her immediate family, or any group of such persons acting together owned more than 5 percent of an attest client’s outstanding equity securities or other ownership interests during the period of the professional engage- ment, the self-interest threat to compliance with the “Independence Rule” would not be at an acceptable level and could not be reduced to an acceptable level by the application of safeguards. Accordingly, independence would be impaired.

1.250—Participation in Employee Benefit Plans: When a covered member participates in an employee benefit plan that is an attest client or is sponsored by an attest client, during the period of the profes- sional engagement or during the period covered by the financial statements, the self-interest threat to compliance with the “Independence Rule” would not be at an acceptable level. Independence with respect to the employee benefit plan and the sponsor would be impaired except in . . . specific situations.

1.260—Loans, Leases, and Guarantees: If a covered member has a loan to or from an attest client, any officer or director of the attest client, or any individual owning 10 percent or more of the attest client’s outstanding equity securities or other ownership interests, a self-interest threat to the covered member’s compliance with the “Indepen- dence Rule” may exist. Threats would not be at an acceptable level and independence would be impaired if the loan exists during the period of the profes- sional engagement, except as provided for in the “Loans and Leases With Lending Institutions” interpretation [1.260.020] of the “Independence Rule.”

1.270—Immediate Family and Close Relative Relationships With Attest Clients: Immediate Family Relationships: A covered member’s immediate family is subject to the “Independence Rule” and its interpretations. However, the

following exceptions address some of the situations in which independence will not be considered impaired: • An individual in a covered member’s immediate family may be employed by an attest client in a position other than a key position. • In certain situations, an immediate family member of a covered member may participate in a benefit plan that is an attest client or that is sponsored by

an attest client, subject to certain restrictive conditions detailed in the independence interpretations. • In certain situations, an immediate family member may hold a direct or material indirect financial interest in an attest client through participation in a

benefit plan, subject to certain restrictive conditions detailed in the interpretations. • In certain situations, an immediate family member of a covered member may participate in a share-based compensation arrangement that results in his

or her holding a beneficial financial interest in an attest client, subject to certain restrictive conditions detailed in the interpretation. • In certain situations, as a result of his or her permitted employment at an attest client, an immediate family member of a covered member may partici-

pate in a nonqualified deferred compensation plan sponsored by the attest client, subject to certain restrictive conditions detailed in the interpretation. When materiality of a financial interestis identified as a factor affecting independence in these interpretations and rulings, the immediate family mem-

ber and the covered member’s interests should be combined. Close Relative Relationships: Independence would be considered to be impaired if an individual participating on the attest engagement team or an

individual in a position to influence the attest engagement or any partner in the office in which the lead attest engagement partner primarily practices in connection with the attest engagement has a close relative who had a. A key position with the client, or b. A financial interest in the client that (i) Was material to the close relative and of which the individual or partner has knowledge; or (ii) Enabled the close relative to exercise significant influence over the client.

1.275—Current Employment or Association With an Attest Client: If a partner or professional employee of the member’s firm is simultaneously employed or associated with an attest client as a director, an officer, an

employee, a promoter, an underwriter, a voting trustee, a trustee for any pension or profit-sharing trust of the attest client, or in any capacity equivalent to that of a member of management of an attest client during the period covered by the financial statements or the period of the professional engagement . . . familiarity, management participation, advocacy, or self-review threats to the member’s compliance with the “Independence Rule” would not be at an accept- able level and could notbe reduced to an acceptable level by the application of safeguards. Accordingly, independence would beimpaired.

1.277—Former Employment or Association With an Attest Client: When a member becomes a partner or professional employee of a firm that provides attest services to an entity where the member was formerly employed or otherwise associated, familiarity, self-interest, self-review, or management participation threats to the member’s compliance with the “Inde- pendence Rule” may exist. A firm’s independence would be impaired if a covered member who was formerly (a) employed by a client or (b) associated with a client as a(n) officer,director, promoter, underwriter, voting trustee, or trustee for a pension or profit-sharing trust of the client either 1. Participates on the attest engagement team or is an individual in a position to influence the attest engagement for the client when the attest engage-

mentcovers any period that includes his or her former employment or association with that client, or 2. Fails to disassociate himself or herself from the client prior to becoming a covered member. Disassociation from the client includes the following (with certain exceptions and conditions): a. Ceasing to participate in all employee health and welfare plans sponsored by the client. . . b. Ceasing to participate in all other employee benefit plans. . . c. Disposing of any direct or material indirect financial interests in the client. d. Collecting or repaying any loans to or from the client, except for loans specifically permitted or grandfathered under the interpretations detailed in 1.260. e. Assessing other relationships with the client to determine if such relationships create threats to independence that would require the application of

safeguards to reduce the threats to an acceptable level.

*The selection of interpretations of the Independence Rule shown here is not complete and has been excerpted, summarized, and abridged. Refer to the full set of rules and interpretations in the Code of Professional Conduct at www.aicpa.org.

T A B L E 1 9 – 3

Final PDF to printer

644 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 644 10/22/15 11:42 AM

Note that the independence rules apply to more than just the partner on the attest engage- ment. Every individual on the engagement team and others who may be in a position to influ- ence the engagement must be independent with respect to the attest entity. Other partners or managers of the CPA firm who are not on the attest engagement team must also generally be independent of the entity if they provide nonattest services to that entity (such as tax or consulting services), or even if a partner simply works in the same office as the attest engage- ment’s lead partner. Under the engagement team approach, a staff member of the CPA firm does not need to be independent of the attest entity unless he or she performs work directly for the entity or becomes a partner in the same office where the attest engagement’s lead partner works.

The CPA firm itself must also be independent with respect to the entity; for example, the CPA firm’s benefit plan cannot invest in the firm’s attest entities. Note that with few excep- tions, the Code’s independence requirements extend to the CPA’s immediate family members (spouse, spousal equivalent, or dependents) and, in a few cases, to the CPA’s close relatives (nondependent children, siblings, parents, etc.). The applicability of the independence require- ments to family members and relatives is discussed later in this section.

While CPA firms are required to comply with the Independence Rule and its interpreta- tions, most major CPA firms have their own firm-specific independence rules that are typi- cally more stringent than the AICPA’s standards. In addition, firms are required by AICPA and PCAOB standards to establish and maintain a system of quality control, a significant aspect of which is to ensure the firms’ compliance with independence standards. Quality control requirements, the AICPA’s peer review program, and the PCAOB’s auditor inspection program are discussed later in this chapter.

Note that interpretations of the Independence Rule can generally be classified along two dimensions—financial relationships and business relationships—and explicitly considers the effects of family relationships on independence. A number of other interpretations of the Independence Rule provide further explanations on such relationships.

Practice I N S I G H T

During the audit of a public company, a senior auditor at one of the Big 4 accounting firms purchased $5,000 of the company’s stock. The auditor was sanctioned by the PCAOB, fired by the firm, and banned from association with a registered public accounting firm for one year (PCAOB Release 105-2007-003).

Financial Relationships Interpretations found in Code Section 1.240 prohibit members from any financial relationship with an audited entity that may impair or give the appearance of impairing independence. This includes any direct or material indirect financial interest in the entity. Note that the materiality of the interest is only considered if the interest is indirect. While materiality comes into play for indirect financial interests, any direct financial interest impairs independence even if it is so small as to be considered immaterial.

Code Section 0.400 and Interpretation 1.240.010 define financial interests, direct finan- cial interests, and indirect financial interests and provides guidance to members in determin- ing whether financial interests should be considered direct or indirect financial interests. A financial interest is an ownership interest in an equity or a debt security issued by an entity, including rights and obligations to acquire such an interest.

A direct financial interest is a financial interest that is owned directly by an individual or entity, or is under the control of an individual or entity. A financial interest that is beneficially owned through an intermediary (e.g., an estate or trust) is also considered a direct financial interest when the beneficiary either controls the intermediary or has the authority to supervise or participate in the intermediary’s investment decisions. A financial interest is beneficially owned when an individual or entity is not the recorded owner of the interest but has a right to some or all of the underlying benefits of ownership. With few exceptions (see below), direct financial interests by CPAs in attest entities impair independence.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 645

mes32502_ch19_627-671.indd 645 10/22/15 11:42 AM

An indirect financial interest arises when (a) an auditor or other covered member has a financial interest in an entity that is associated with an attest entity; (b) the financial interest is beneficially owned through an investment vehicle, estate, trust, or other intermediary; and (c) the auditor does not control the intermediary or have authority to supervise or participate in the intermediary’s investment decisions.

Indirect financial interests are generally permissible only if the amount involved is imma- terial with respect to the covered member’s income and wealth. For example, the ownership of shares in a mutual fund is considered to be a direct financial interest in the mutual fund. The securities that the mutual fund invests in are considered indirect financial interests to the covered member. Interpretation 1.240.030 indicates that if the mutual fund is diversified, and if the covered member owns 5 percent or less of the outstanding shares of the mutual fund, the investment would not be considered to constitute a material indirect financial interest in the underlying investments. However, if a covered member owns more than 5 percent of the out- standing shares of a diversified mutual fund, or if the mutual fund is not diversified, the cov- ered member needs to evaluate the underlying investments of the mutual fund to determine whether the investment in the mutual fund constitutes a material indirect financial interest in any of the mutual fund’s underlying investments.

Interpretation 1.240.030 offers the following example relating to investments in mutual funds. Assume that a nondiversified mutual fund owns shares in attest entity, Company A. Further assume that the mutual fund’s net assets are $10,000,000; the covered member owns 1 percent of the outstanding shares of the mutual fund, having a value of $100,000; and the mutual fund has 10 percent of its assets invested in Company A. The indirect financial interest of the covered member in Company A is $10,000. This amount should be measured against the covered member’s net worth (including the net worth of his or her immediate family) to determine if it is material.

You may have heard that in some circumstances, individuals can place their assets into a “blind trust” to avoid possible conflicts of interest. A blind trust is a trust in which the owner of the trust assets does not supervise or participate in the trust’s investment decisions during the term of the trust. Interpretation 1.245.020 addresses the question of whether CPAs can avoid impairing their independence by placing financial interests in an audited entity in a blind trust. Because the investments generally ultimately revert to the owner and the owner usually retains the right to amend or revoke the trust, both the blind trust and the underlying investments are considered to be direct financial interests of the covered member.

Interpretations in Code Sections 1.250, 1.255, 1.257, and 1.260 clarify other circum- stances, such as ownership in retirement plans, partnerships, LLCs, and insurance policies of various types. For example, if a CPA owns an insurance policy issued by an attest entity, independence is not considered to be impaired so long as the policy was purchased under the insurance company’s normal terms and procedures and does not offer an investment option. Some insurance policies allow the policy owner to invest part of the cash value in a variety of underlying investments (stocks, bond, etc.). These underlying investments are considered to be a financial interest. Thus, in such circumstances the CPA must determine whether the underlying investments are direct or indirect financial interests.

Generally a loan to or from an audited entity is considered to impair the member’s inde- pendence (Exhibit 19–1). However, there are situations in which a CPA is permitted to obtain loans from a financial institution for which he or she provides audits. Interpretation 1.260.020 permits the following types of personal loans from an audited entity that operates as a finan- cial institution:

∙ Automobile loans and leases collateralized by the automobile ∙ Loans fully collateralized by the cash surrender value of an insurance policy ∙ Loans fully collateralized by cash deposits at the same lending institution ∙ Credit cards and cash advances where the aggregate outstanding balance is reduced to

$10,000 or less by the payment due date

Final PDF to printer

646 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 646 10/22/15 11:42 AM

Such loans must be made in accordance with the financial institution’s normal lending procedures, terms, and requirements and must, at all times, be kept current as to all terms. Normal lending procedures, terms, and requirements are defined as lending procedures, terms, and requirements that are reasonably comparable to those relating to loans of a similar character given to other borrowers during the period in which the loan to the member is given.

Stop and Think: Could unpaid fees be considered an outstanding debt by the entity to the auditor—a direct financial interest on the part of the auditor?

The interpretations in Code Section 1.230 specify that if fees pertaining to services pro- vided more than one year prior to the date of the audit report remain unpaid, the auditor’s independence is impaired with respect to that entity. However, unpaid fees from an audited entity that is in bankruptcy do not impair the auditor’s independence.

Let’s test your intuition. Think about the following situations to determine if the financial interest represented is a direct financial interest, an indirect financial interest, or neither. Also decide whether the financial interest would impair the auditor’s independence. (1) The auditor owns a $1,000 investment in a mutual fund that spreads its holdings evenly across companies listed in the S&P 500. One of the auditor’s audit entities is an S&P 500 company. (2) The managing audit partner of the office owns stock in one of the office’s audited entities, but the amount is immaterial and the managing partner is not involved in the audit.

The first situation represents an indirect financial interest in the audited entity. The rela- tionship would not impair independence because the auditor owns very little of the fund and the fund is diversified over a large number of companies. The second scenario represents a direct financial interest by a covered member. Independence is considered impaired despite the fact that the amount of stock owned is immaterial.

Business Relationships Interpretations found in Code Section 1.275 essentially indicate that the independence of a CPA is impaired if the CPA performs a managerial or other signifi- cant role for an entity’s organization during the time period covered by an attest engagement. Such situations often arise when a former employee of the entity becomes employed by the CPA firm or, more commonly, when a CPA takes a job with a former audit entity. Interpreta- tions of this rule, however, provide for certain exceptions.

For example, a former employee of an attest entity cannot become a member of the attest engagement team or be placed in a position to influence the engagement for that entity unless

ESM Government Securities, Inc., Audit Partner Had “Loan” from Client

ESM Government Securities, Inc., was a Fort Lauderdale brokerage firm that specialized in buying and selling debt securities issued by the federal government and its various agencies. Its main customers were small to moderate-size banks and municipalities. The major type of transaction engaged in by ESM was known as a “repo,” in which a securities dealer sells a customer a large block of federal securities and simultaneously agrees to repurchase the securities at a later date at an agreed-upon price. A massive fraud was conducted at ESM by Ronnie Ewton and Alan Novick, who hid trading losses and other misap- propriations from ESM’s auditor, Alexander Grant. The trading losses incurred by ESM were transferred to an affiliated company. When the thefts and trading losses were finally tallied, there was a net deficit of $300 million for ESM.

Sadly, the audit partner, Jose Gomez, was aware of the fraud. Gomez was admitted as a partner to Alexander Grant in 1979. His major client was ESM Securities. Shortly after making partner, Gomez was informed by Novick that the company’s 1977 and 1978 financial statements had been misstated. Novick was able to convince Gomez not to withdraw Alexander Grant’s audit report on the assumption that ESM would recoup its losses. Novick was aware that Gomez was experiencing financial problems in spite of his salary as a partner. Over the course of the fraud (1977–1984), Gomez received approximately $200,000 in payments from Novick to relieve his financial woes.

E X H I B I T 1 9 – 1

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 647

mes32502_ch19_627-671.indd 647 10/22/15 11:42 AM

the subject of the attest engagement does not include any period of his or her former employ- ment or association with the entity. In addition, if an entity employee joins the CPA firm and becomes a covered member with respect to the entity, the CPA firm is not independent unless the former entity employee first disassociates from the entity essentially by terminating non- complying managerial and financial relationships with the entity (see Table 19–4 for details).

Next, consider the situation that arises when a CPA goes to work for an entity audited by his or her former CPA firm. This has been a controversial area, because unfortunately several of the high-profile frauds of the past decade were facilitated by former auditors. Interpretation 1.279.020 indicates that a firm’s independence is considered to be impaired with respect to an entity if a partner or professional employee leaves the firm and is subsequently employed by or associated with that entity in a key position unless a number of conditions are met (see the list of terms at the end of the chapter for the definition of a key position). These conditions require that the CPA be completely disassociated from the CPA firm, and that the firm take steps to ensure that the engagement team exercises sufficient professional skepticism and is not unduly influenced by the former employee of the firm (see Table 19–4 for details).

In fact, Interpretation 1.279.010 indicates that if a member of the attest engagement team or an individual in a position to influence the attest engagement has a job offer from or even develops the intention to seek or discuss potential employment with an attest entity, indepen- dence is impaired with respect to the entity unless the person promptly reports the situation to

Interpretations 1.279.010 and 1.279.020—Considering or Subsequent Employment or Association With an Attest Client*

Subsequent Employment or Association With an Attest Client

When partners and professional employees who leave their firms and are subsequently employed by, or associated with, one of the firm’s attest clients in a key position, the familiarity, self-interest, undue influence, or management participation threats to the member’s compliance with the “Independence Rule” would not be at an acceptable level and independence would be impaired unless all of the safeguards in items a–e of the following list are met:

Individual Safeguards: a. Amounts due to the former partner or professional employee for his or her previous interest in the firm and unfunded, vested retirement benefits can-

not be material to the firm, and the underlying formula used to calculate the payments remain fixed during the payout period. The firm may adjust the retirement benefits for inflation and pay interest on amounts due.

b. The former partner or professional employee is not in a position to influence the firm’s operations or financial policies. c. The former partner or professional employee does not participate or appear to participate in the firm’s business and is not otherwise associated with

the firm, regardless of whether he or she is compensated for such participation or association, once employment or association with the attest client begins.

Ongoing Attest Engagement Team Safeguards: d. The ongoing attest engagement team should consider whether to modify the engagement procedures to adjust for the risk that the former partner’s or

professional employee’s prior knowledge of the audit plan could reduce audit effectiveness. In addition, if the individual will have significant interac- tion with the attest engagement team, an appropriate individual in the firm should evaluate whether the existing attest engagement team members have sufficient experience and stature to deal effectively with the individual in conducting the engagement.

e. If the former partner or professional employee joins the attest client in a key position within one year of disassociating from the firm and has signifi- cant interaction with the attest engagement team, an appropriate professional in the firm should review the subsequent attest engagement to deter- mine whether the engagement team members maintained the appropriate level of skepticism when evaluating the individual’s representations and work. The professional applying this safeguard should have appropriate stature, expertise, and objectivity. In performing this review, the professional should consider relevant factors, such as the position that the individual assumed at the attest client, the position that the individual held at the firm, and the nature of the services that the individual provided to the attest client. The professional should take appropriate actions, as deemed necessary, based on the results of this review.

Considering Employment or Association with an Attest Client

When a member of the attest engagement team or an individual in a position to influence the attest engagement intends to seek or discuss potential employment or association with an attest client, or is in receipt of a specific offer of employment from an attest client, independence will be impaired with respect to the client unless the person promptly reports such consideration or offer to an appropriate person in the firm, and removes himself or herself from the engagement until the employment offer is rejected or employment is no longer being sought. When a covered member becomes aware that a member of the attest engagement team or an individual in a position to influence the attest engagement is considering employment or association with a client, the covered member should notify an appropriate person in the firm.

The appropriate person should consider what additional procedures may be necessary to provide reasonable assurance that any work performed for the client by that person was performed in accordance with the Integrity and Objectivity Rule. Additional procedures, such as reperformance of work already done, will depend on the nature of the engagement and the individual involved.

*The summary of interpretations shown here is not complete and has been excerpted, summarized, and abridged. Refer to the full set of rules and interpretations in the Code of Professional Conduct at www.aicpa.org.

T A B L E 1 9 – 4

Final PDF to printer

648 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 648 10/23/15 07:32 AM

an appropriate person in the firm and removes himself or herself from the engagement until the offer is rejected or employment is no longer being sought. If another employee of the CPA firm becomes aware that a member of the attest engagement team (or an individual in a position to influence the attest engagement) is considering employment with an attest entity, the employee should notify an appropriate person in the firm so the firm can take steps to prevent the impairment of its independence. In addition, in such cases the appropriate person in the firm should consider whether the firm should perform additional procedures to provide reasonable assurance that any work performed by the individual was in compliance with the “Integrity and Objectivity Rule.”

Practice I N S I G H T

Despite the restrictions on auditors accepting key positions for former audit clients, auditors con- tinue to be highly sought to fill high-level financial management positions. The breadth and depth of the business knowledge and expertise auditors develop by working with various clients over time makes them highly valuable to companies as prospective employees, especially once the auditor has reached the manager or partner level. Thus, companies continue to find various ways to hire for- mer auditors while allowing the auditors and their former firms to comply with professional standards.

Another type of business relationship can arise when a CPA is asked to serve as an hon- orary director or trustee for a not-for-profit entity. It is not unusual for members of a CPA firm to be asked to lend the prestige of their names to a charitable, religious, civic, or similar organization and for their firm to provide accounting and auditing services to the not-for- profit organization. Interpretation 1.275.010 allows a member to serve as a director or trustee for an audited not-for-profit entity “so long as his or her position is clearly honorary, and he or she cannot vote or otherwise participate in board or management functions.” Any of the organization’s documents that contain the member’s name must identify the member’s posi- tion as honorary.

Interpretation 1.275.005 permits a CPA to seek employment as an adjunct faculty mem- ber of an educational institution that is an audited entity of the CPA’s firm. Such a relationship does not impair independence provided that the CPA does not hold a key position at the edu- cational institution, does not participate on the attest engagement team, is not an individual in a position to influence the attest engagement, is employed by the educational institution on a part-time and nontenure basis, and does not assume any management responsibilities or set policies for the educational institution.

Effect of Family Relationships The issues related to a CPA’s financial or business interest in an entity may extend to members of the CPA’s family, according to Interpretation 1.270.010. Certain relationships between members of a CPA’s family and an audited entity are considered to affect the CPA’s independence. This is an area where the AICPA’s inde- pendence rules have been modified to recognize changing social factors such as dual-career families. A distinction is made in the Code’s Section 0.400 definitions of a covered mem- ber’s immediate family (spouse, spousal equivalent, or dependent, regardless of whether the dependent is related) and close relatives (parent, sibling, or nondependent child). As shown in Table 19–3, a covered member’s immediate family is subject to the Independence Rule. Table 19–3 indicates a few exceptions, the first of which is that a covered member’s spouse employed by an audited entity would not impair independence if he or she were not employed in a key position.

Financial or business interests by close relatives that are not members of the auditor’s immediate family, such as nondependent children, brothers, sisters, parents, grandparents, parents-in-law, and their respective spouses, do not normally impair independence. Interpre- tation 1.270.100 (see Table 19–3) lists the situations where independence would be impaired by a close relative. The two major situations that can impair independence are as follows:

∙ A close relative has a financial interest in the entity that is material to the close relative, and the CPA participating in the engagement is aware of the interest

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 649

mes32502_ch19_627-671.indd 649 10/23/15 07:32 AM

∙ An individual participating in the engagement has a close relative who could exercise significant influence over the financial or accounting policies of the entity (i.e., a key position)

For example, suppose a staff auditor’s brother works as the controller for an entity audited by the CPA firm. Because the staff auditor’s brother exercises influence over signifi- cant accounting functions for the entity, the staff auditor would not be allowed to participate in the audit of this entity.

Practice I N S I G H T

The PCAOB sanctioned a regional accounting firm and its partners for, among other things, violat- ing PCAOB independence standards. At the time of the firm’s audit of a client, the mother of one of the partners owned stock in the client along with warrants to purchase additional stock. The partner knew of his mother’s investments and their material nature to her. He also helped purchase the shares of stock before the audit commenced and then actually sold the shares for his mother after the issuance of the audit report. The partner and the firm also failed to conduct basic audit proce- dures during the course of this audit and other audits and, as a result, the firm was permanently revoked of its registration and the partner in question was permanently banned from association with a registered public accounting firm (PCAOB Release 105-2007-009).

Effect of Actual or Threatened Litigation Sometimes threatened or actual litigation between the entity and the auditor can impair the auditor’s independence. Such situations affect the CPA’s independence when a possible adversarial relationship exists between the entity and the CPA. Interpretation 1.290.010 cites three categories of litigation: (1) litigation between the entity and the CPA, (2) litigation by security holders, and (3) other third-party litigation where the CPA’s independence may be impaired.

In order for a CPA to provide an opinion on an entity’s financial statements, the relation- ship between the entity’s management and the CPA must be one of “complete candor and full disclosure regarding all aspects of the entity’s business operations.” When actual or threat- ened litigation exists between management and the CPA, complete candor may not be pos- sible. The following criteria are offered as guidelines for assessing independence when actual or threatened litigation exists between the audited entity and the CPA:

∙ The commencement of litigation by the present management alleging deficiencies in audit work for the entity would be considered to impair independence

∙ An expressed intention by the present management to commence litigation against the CPA alleging deficiencies in audit work would also impair independence if the auditor concluded that it is probable that such a claim will be filed

∙ The commencement of litigation by the CPA against the present management alleging management fraud or deceit would be considered to impair independence

Litigation by entity security holders or other third parties also may impair the auditor’s independence under certain circumstances. For example, litigation may arise from a class action lawsuit by stockholders alleging that the entity’s management, officers, directors, underwriters, and auditors were involved in the issuance of “false or misleading financial statements.” Generally, such lawsuits do not alter the fundamental relationship between the CPA and the entity. However, independence may be impaired if material entity–auditor cross- claims are filed. For example, suppose that a class action suit is filed and the current entity management intends to testify against the CPA, alleging that an improper audit was con- ducted. In such a situation, an adversarial relationship would exist and the CPA would no lon- ger be independent. When this occurs, the CPA should either withdraw from the engagement or disclaim an opinion because of a lack of independence.

Provision of Nonattest Services The AICPA Code of Professional Conduct restricts the types of nonaudit services that can be provided to attest entities. Interpretation 1.295.010 outlines these requirements and binds member CPAs to follow the relevant requirements of

Final PDF to printer

650 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 650 10/22/15 11:42 AM

other regulatory bodies where applicable. The Code permits CPAs to provide bookkeeping, systems implementation, internal audit outsourcing, and other services to nonpublic attest entities subject to certain conditions and limits. For example, a CPA may assist an audit entity in implementing a computer software package but may not “design” the financial information system by creating or changing the computer source code underlying the system. If the auditor makes any such modifications, the changes cannot be “more than insignificant.” In addition, the Code indicates that CPAs may not perform appraisal, valuation, or actuarial services if the results of those services will have a material effect on the entity’s financial statements and the service involves considerable subjectivity.

Interpretation 1.295.040 of the Code outlines general requirements for performing other professional services for attest entities. This interpretation basically indicates that in perform- ing nonattest services for an attest entity, the CPA should ensure that the entity assumes all management responsibilities. The entity must appropriately oversee and evaluate the ade- quacy and results of the nonattest services performed and be responsible for making signifi- cant judgments and decisions that are the proper responsibility of management. If the entity is unable or unwilling to assume these responsibilities (for example, the entity cannot oversee the nonattest services due to lack of ability, time, or desire), providing these services would impair the CPA’s independence with respect to any attest services to be provided to that entity.

Interpretation 1.295.040 indicates that prior to performing nonattest services the CPA should establish with the entity in writing the objectives of the engagement, the services to be performed, the entity’s acceptance of its responsibilities, the CPA’s responsibilities, and any anticipated limitations of the engagement.

Some of the examples offered in Interpretation 1.295.040 of management responsibilities that would be considered to impair a CPA’s independence include the following:

∙ Setting policy or strategic direction for the attest client ∙ Authorizing, executing, or consummating a transaction or otherwise exercising

authority on behalf of an entity ∙ Preparing source documents, in electronic or other form, evidencing the occurrence

of a transaction ∙ Having custody of entity assets ∙ Supervising the entity’s employees in the performance of their normal recurring

activities ∙ Determining which recommendations of the member should be implemented ∙ Establishing or maintaining internal controls, including performing ongoing

monitoring activities for an entity ∙ Reporting to those charged with governance on behalf of management ∙ Accepting responsibility for the preparation and fair presentation of the attest client’s

financial statements

So long as the CPA stays within the general guidelines described in Interpretation 1.295.040 and effectively manages threats to independence, the AICPA does not strictly pro- hibit the provision of most types of professional services to nonpublic attest entities. For example, the Code allows a CPA firm to provide outsourced internal audit services for an entity for which the member also performs a professional service that requires independence (i.e., an audit or other attest service) so long as the entity retains responsibility for directing and managing the internal audit function. Performing these extended audit services would not be considered to impair independence provided the member or his or her firm does not act or appear to act as either employee or management of the entity.

While the AICPA Code of Professional Ethics permits internal audit outsourcing for nonpublic attest entities, the SEC prohibits providing this and most other types of nonaudit professional services to public company audit entities. The ways in which SEC and PCAOB independence rules for the audits of public companies differ from AICPA standards are dis- cussed next.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 651

mes32502_ch19_627-671.indd 651 10/22/15 11:42 AM

SEC and PCAOB Independence Requirements for Audits of Public Companies The SEC’s mission is to protect investors and maintain the integrity of the capital markets in which the securities of publicly traded companies are bought and sold. As part of its mission, the SEC has authority to establish standards relating to financial accounting, auditing, and the professional conduct of public accountants in the context of public company accounting and auditing. The SEC delegates its authority to set standards for audits of public companies to the PCAOB but the SEC must review and approve those standards before they become effective.

In this section we discuss the primary areas in which the SEC and PCAOB independence rules differ from those of the AICPA Code of Professional Conduct. Until the past few years, the SEC’s independence rules for auditors of public companies closely followed those of the AICPA. However, in November 2000 the SEC implemented more stringent rules, which were further revised in January 2003, after Title II of the Sarbanes-Oxley Act required additional independence restrictions. You will better understand the reasoning behind the SEC’s audi- tor independence (and other) requirements if you keep in mind that they were in response to specific circumstances that came to light in the frauds of the early 2000s. For example, Arthur Andersen was earning more in consulting than in auditing fees at Enron, and David Duncan, Andersen’s lead partner on the Enron engagement, was compensated in part based on the amount of nonaudit services he sold to the company. Further, several of Enron’s employees in important accounting and finance positions were former Andersen auditors who had worked on the Enron audit engagement.

While most of the SEC’s independence rules are very similar to the AICPA’s, the changes resulted in some important differences relating to (1) provision of other professional services, (2) handling of human resource and compensation-related issues, and (3) certain required communications.11 The major differences in these three areas are discussed next.

Provision of Other Professional Services. The SEC’s rules with respect to services provided by auditors are predicated on three basic principles of auditor objectivity and independence: (1) an auditor should not audit his or her own work, (2) an auditor should not function in the role of management, and (3) an auditor should not serve in an advocacy role for the entity. Consistent with these principles, the SEC prohibits several types of professional services by accounting firms for public company audit and review entities, sometimes with the qualifier “unless it is reasonable to conclude that the results of these services will not be subject to audit procedures during an audit of the entity’s financial statements.” Note that the rules do not limit the scope of nonaudit services provided by accounting firms to nonpublic companies or to public companies that are not audit entities. Additionally, accounting firms are allowed to provide certain types of tax services to their audit entities.

The SEC specifies nine categories of nonaudit services that, with few exceptions, are considered to impair independence if provided to a public company audit entity. They are as follows:

∙ Bookkeeping or other services related to the accounting records or financial statements of the audit entity

∙ Financial information systems design and implementation

LO 19-6

11A number of other minor differences exist between AICPA and SEC independence rules, but this text focuses on only the major areas of divergence. For a thorough and detailed comparison of AICPA and SEC independence rules, search for the term “AICPA and SEC Independence Rule Comparison” at www.aicpa.org

Practice I N S I G H T

The PCAOB sanctioned a regional accounting firm and its partners for, among other things, providing prohibited services to a client. During the course of the audit, the audit firm actually made journal entries, generated the trial balances for the financial statements, made accounting decisions for the issuer, and generated the financial statements and footnotes. As a result of this and other violations, the firm was permanently revoked of its registration and the partner in charge was permanently banned from association with a registered public accounting firm (PCAOB Release 105-2007-009).

Final PDF to printer

652 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 652 10/22/15 11:42 AM

∙ Appraisal or valuation services, fairness opinions, or contribution-in-kind reports ∙ Actuarial services ∙ Internal audit outsourcing services ∙ Management functions or human resources ∙ Broker or dealer, investment adviser, or investment banking services ∙ Legal services ∙ Expert services

While the first eight categories of services listed above were prohibited under pre- Sarbanes SEC independence rules (“expert services” was added later), a number of excep- tions to these prohibitions were eliminated under the Act.

Consistent with the Sarbanes-Oxley Act, SEC regulations also prohibit any other service that the PCAOB determines impermissible. The PCAOB has added several independence- related rules of its own relating to audits of public companies. For example, while PCAOB independence rules do not prohibit the provision of tax services to audit entities in general, they do identify circumstances in which the provision of tax services impairs an auditor’s independence, including services that involve aggressive interpretations of applicable tax laws and regulations. The rules also treat registered public accounting firms as not indepen- dent of their audit entities if they enter into contingent fee arrangements with those entities for any professional services or if the firms provide tax services to members of management who serve in financial reporting oversight roles at an audit entity or to their immediate family members.

The SEC and PCAOB rules require that all audit and nonaudit services provided by a public company’s auditor be considered and approved by the company’s audit committee. This requirement is intended to facilitate the proper oversight by the audit committee on the external audit by requiring the audit committee to consider the potential effects of nonaudit services on the auditor’s objectivity and on investors’ perceptions of the auditor’s indepen- dence from the company.

Practice I N S I G H T

While SEC rules prohibit many types of consulting for public company audit clients, many public accounting firms are still heavily engaged in providing consulting services for nonaudit clients.

Human Resource and Compensation-Related Issues. SEC rules in this area are primarily concerned with the potential for audit partners to become “too close” to an engagement or an audited entity over time and with potential threats to an auditor’s objectivity resulting from employment and compensation arrangements that can create conflicts of interest. These rules can be summarized in three areas.

First, the lead and engagement quality review partners on the engagement team for a pub- lic company audit are prohibited from providing audit services to the company for more than five consecutive years.12 Once the partners “roll off” an entity, a five-year “time-out” period is required before they can return to their former duties with that entity. Audit partners other than the lead and quality review partners are prohibited from performing audit services for a particular entity for more than seven consecutive years, with a two-year time-out period.

Second, unless a one-year “cooling-off” period has passed, an accounting firm is prohib- ited from auditing a public company’s financial statements where a former member of the audit team is currently employed by the entity in a “financial reporting oversight role.”13

12The lead partner is the partner primarily responsible for the decisions made on an audit engagement. The engage- ment quality review partner is not directly involved with the decisions made during the engagement but instead is charged with reviewing significant evidence and conclusions to determine whether or not the engagement was con- ducted properly and conclusions appropriately made. 13The cooling-off period is defined as the one-year period preceding the commencement of audit procedures for the period that included the date the engagement team member was first employed by the audited entity.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 653

mes32502_ch19_627-671.indd 653 10/22/15 11:42 AM

Finally, the SEC does not consider an accounting firm to be independent from an audited public company if an audit partner receives compensation based on selling engagements to that entity for services other than audit, review, and attest services. This applies not only to audits of domestic issuers but also to audits of foreign subsidiaries and affiliates of U.S. issuers.

Practice I N S I G H T

While there are benefits associated with mandatory partner rotation, it comes with considerable cost. The first general auditing standard requires that the audit be performed by a person who has adequate technical training and proficiency as an auditor. While the five-year “time-out” requirement for the engagement partner provides for a new set of eyes and a fresh look at the engagement, it can also lead to a sharp drop-off in client-specific experience on the engagement every five years.

Required Communication. SEC rules also differ from those of the AICPA in requiring addi- tional communication between auditors and their entities’ audit committees and in requiring public company audit entities to reveal information regarding the fees paid to their auditors for any type of service.

The auditor of a public company must report to the company’s audit committee all “criti- cal accounting policies” used by the company, all alternative treatments within GAAP for pol- icies and procedures related to material items discussed with management, and other material written communications between the auditor and the company’s management. In addition, the audit committee must be responsible for the appointment, compensation, and oversight of the external auditor’s work. This requirement is important, because it establishes the audit committee as the entity to which the auditor reports, rather than management itself. Remem- ber that management is ultimately responsible for a company’s financial statements. Because the audit committee of a public company must be independent of management, establishing the audit committee as the point of contact for the auditor creates a healthier environment in which the auditor does not answer directly to or receive compensation from management.

Proxy statements and annual reports issued by public companies must contain disclo- sures regarding (1) audit fees, (2) audit-related fees, (3) tax fees, and (4) all other fees billed during the prior two fiscal years by the principal auditor of the company’s financial state- ments. Details must also be provided on the nature of services provided in earning “other fees.” The preapproval policies of the company’s audit committee must also be disclosed. A purpose of this requirement is to make companies more sensitive to public perceptions of auditor independence and objectivity.

Other Sections of the Code of Professional Conduct

Other sections in the Code of Professional conduct relate to General Standards and Account- ing Principles, Responsibilities to Clients, and Other Responsibilities and Practices.

General Standards and Accounting Principles This section of the Rules of Conduct contains two rules related to general standards and one rule related to accounting principles.

General Standards Rule (1.300.001): A member shall comply with the following standards and with any interpretations thereof by bodies designated by Council:

A. Professional Competence. Undertake only those professional services that the member or the member’s firm can reasonably expect to be completed with professional competence.

B. Due Professional Care. Exercise due professional care in the performance of professional services.

C. Planning and Supervision. Adequately plan and supervise the performance of professional services.

D. Sufficient Relevant Data. Obtain sufficient relevant data to afford a reasonable basis for conclu- sions or recommendations in relation to any professional services performed.

LO 19-7

Final PDF to printer

654 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 654 10/22/15 11:42 AM

The Code’s General Standards Rule essentially captures much of what is contained in the 10 generally accepted auditing standards pertaining to auditor conduct and makes it part of the Code. Interpretation 1.300.010 provides some additional clarification of “professional competence.” In particular, when a CPA agrees to perform professional services, he or she is expected to have the necessary competence to complete those services according to profes- sional standards. However, it is not necessary for the CPA to have all the technical knowl- edge required to perform the engagement at the time the engagement commences. The CPA may conduct additional research or consult with other professionals during the conduct of the engagement. This need for additional information does not indicate a lack of competence on the part of the CPA unless he or she fails to acquire the needed information. The technical, legal definition of “due care” is covered in Chapter 20.

Compliance with Standards Rule (1.310.001): A member who performs auditing, review, com- pilation, management consulting, tax, or other professional services shall comply with standards promulgated by bodies designated by Council.

This rule is straightforward yet important because it requires that members of the AICPA comply with professional standards when performing professional services, whether or not they are practicing in public accounting.

While the Compliance with Standards Rule addresses compliance with standards for pro- fessional services, the Accounting Principles Rule requires CPAs to report in compliance with appropriate accounting principles.

Accounting Principles Rule (1.320.001): A member shall not (1) express an opinion or state affir- matively that the financial statements or other financial data of any entity are presented in confor- mity with generally accepted accounting principles or (2) state that he or she is not aware of any material modifications that should be made to such statements or data in order for them to be in conformity with generally accepted accounting principles, if such statements or data contain any departure from an accounting principle promulgated by bodies designated by Council to establish such principles that has a material effect on the statements or data taken as a whole. . . .

Interpretation 1.320.020 reiterates that the AICPA Council has designated the Finan- cial Accounting Standards Board (FASB), the Governmental Accounting Standards Board (GASB), and the Federal Accounting Standards Advisory Board (FASAB) as the bodies authorized to establish accounting principles.

Interpretation 1.320.010 (and 2.320.010, which relates to members in industry), states that any representation regarding conformity with GAAP or other financial reporting frame- work in a letter or other communication related to an entity’s financial statements is subject to the Accounting Principles Rule. Thus, for example, if a member knowingly signs a represen- tation letter indicating that the financial statements were in conformity with GAAP when in fact they were not, he or she has violated the Accounting Principles Rule whether he or she is in public practice or working in a business position such as controller or CFO.

Responsibilities to Clients This section of the Rules of Conduct contains two rules related to a CPA’s responsibilities to his or her entities: Confidential Client Information and Contingent Fees.

Confidential Client Information Rule (1.700.001, excerpted): A member in public practice shall not disclose any confidential client information without the specific consent of the client.

The Confidential Client Information Rule and its interpretations generally prohibit the auditor from disclosing confidential entity information but specify five situations in which a CPA can disclose confidential information without the entity’s consent: (1) to meet disclosure and performance requirements under GAAP and GAAS; (2) to comply with a valid subpoena; (3) to allow a review of a member’s professional practice under the authority of the AICPA, a state CPA society, or a state board of accountancy; (4) to comply with an investigative or disciplinary proceeding; and (5) to allow a review of a CPA’s professional practice in conjunc- tion with the purchase, sale, or merger of the practice. In the last case, the CPA should take

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 655

mes32502_ch19_627-671.indd 655 10/22/15 11:42 AM

precautions that the prospective buyer does not disclose any confidential entity information to outside parties, usually through a confidentiality agreement. The prospective buyer should not use information they obtain to their advantage or disclose confidential information to outside parties.

Contingent Fees Rule (1.510.001, excerpted): A member in public practice shall not (1) Perform for a contingent fee any professional services for, or receive such a fee from, a client

for whom the member or the member’s firm performs (a) an audit or review of a financial statement; or (b) a compilation of a financial statement when the member expects, or reasonably might

expect, that a third party will use the financial statement and the member’s compilation report does not disclose a lack of independence; or

(c) an examination of prospective financial information; or (2) Prepare an original or amended tax return or claim for a tax refund for a contingent fee for

any client.

The Contingent Fees Rule goes on to explain that the prohibition of contingent fees applies during the period in which the member or member’s firm is engaged to perform any of the services listed and the period covered by any historical financial statements involved in any such services. A contingent fee is a fee that depends on the finding or result attained as a result of the member’s work. With respect to this rule, fees are not regarded as being contin- gent if fixed by courts or other public authorities, or, in tax matters, if determined based on the results of judicial proceedings or the findings of governmental agencies. It is permissible for a member’s fees to vary depending on other factors, for example, on the complexity of the services rendered.

If contingent fees were allowed for attestation-related services, users of those services might question the CPA’s independence. As mentioned previously, PCAOB independence rules do not allow auditors to provide any services to public company audited entities for a contingent fee, including tax services.

Other Responsibilities and Practices This section contains four rules of conduct that relate to other aspects of the profession: Acts Discreditable, Advertising and Other Forms of Solicitation, Commissions and Referral Fees, and Form of Organization and Name.

Acts Discreditable Rule (1.400.001): A member shall not commit an act discreditable to the profession.

This rule allows the AICPA to remove a member for committing acts that may affect the pro- fession’s reputation. For example, a CPA who is convicted of a serious crime could lose his or her membership in the AICPA. Some of the interpretations have been issued that identify acts considered discreditable under the Acts Discreditable Rule relate to the following:

∙ Discrimination and harassment in employment practices (.010) ∙ Solicitation or disclosure of CPA Examination questions and answers (.020) ∙ Failure to file a tax return or pay a tax liability (.030) ∙ Negligence in the preparation of financial statements or records (.040) ∙ Failure to follow requirements of governmental bodies, commissions, or other

regulatory agencies (.050) ∙ Confidential information obtained from employment or volunteer activities (.070) ∙ False, misleading, or deceptive acts in promoting or marketing professional

services (.090) ∙ Improper use of the CPA credential (.100) ∙ Failure to comply with records requests (.200)

Final PDF to printer

656 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 656 10/22/15 11:42 AM

For example, under Interpretation 1.400.200, records provided by the entity in the mem- ber’s custody or control should be returned to the entity even if there are fees still unpaid. If the CPA retains certain entity records such as journals or ledgers, the entity may be unable to continue operations. If a CPA does not appropriately respond to an entity’s request to return the entity’s accounting records within 45 days (absent extenuating circumstances), that mem- ber commits a discreditable act. The CPA may decline to provide entity records and other supporting records prepared by the CPA if there are fees due for the preparation of those records. The CPA’s working papers, by contrast, are the property of the CPA and need not be provided to the entity unless required by state or federal statutes or regulations, or contractual agreements.

A CPA also commits a discreditable act if he or she discriminates in hiring, promotion, or salary practices on the basis of race, color, religion, sex, age, or national origin. Similarly, a CPA commits a discreditable act when he or she, by virtue of his or her negligence, makes, permits, or directs another to make false or misleading entries in the financial statements or records of an entity. Another example of a discreditable act is the failure to file a tax return or pay the related tax liability.

Advertising and Other Forms of Solicitation Rule (1.600.001): A member in public practice shall not seek to obtain clients by advertising or other forms of solicitation in a manner that is false, misleading, or deceptive. Solicitation by the use of coercion, over-reaching, or harassing conduct is prohibited.

Interpretation 1.600.010 provides specific examples of activities that are prohibited by this rule. These include the following:

∙ Creating false or unjustifiable expectations of favorable results ∙ Implying an ability to influence any court, tribunal, regulatory agency, or similar

body or official ∙ Claiming that specific professional services in current or future periods will be

performed for a stated fee, estimated fee, or fee range when it is likely at the time of representation that such fees will be substantially increased and the prospective entity is not advised of that likelihood

∙ Making any other representations that would be likely to cause a reasonable person to misunderstand or be deceived

Commissions and Referral Fees Rule (1.520.001):

A. Prohibited commissions A member in public practice shall not for a commission recommend or refer to a client any

product or service, or for a commission recommend or refer any product or service to be sup- plied by a client, or receive a commission, when a member or the member’s firm also performs for that client

∙ an audit or review of financial statements; or ∙ a compilation of a financial statement when the member expects, or reasonably might expect,

that a third party will use the financial statement and the member’s compilation report does not disclose a lack of independence; or

∙ an examination of prospective financial information. This prohibition applies during the period in which the member is engaged to perform

any of the services listed above and the period covered by any historical financial statements involved in the listed services.

B. Disclosure of permitted commissions A member in public practice who is not prohibited by this rule from performing services for or receiving a commission and who is paid or expects to be paid a commission shall disclose that fact to any person or entity to whom the member recommends or refers a product or service to which the commission relates.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 657

mes32502_ch19_627-671.indd 657 10/22/15 11:42 AM

C. Referral fees Any member who accepts a referral fee for recommending or referring any service of a CPA to any person or entity or who pays a referral fee to obtain a client shall disclose such acceptance or pay- ment to the client.

Many professions, including doctors and lawyers, have been permitted to use referral fees. However, commissions and referral fees are prohibited for CPAs in situations where the CPA’s independence and objectivity are a focal point of attestation-related services.

Form of Organization and Name Rule (1.800.001): A member may practice public accounting only in a form of organization permitted by law or regulation whose characteristics conform to resolutions of Council.

A member shall not practice public accounting under a firm name that is misleading. Names of one or more past partners may be included in the firm name of a successor organization.

A firm may not designate itself as “Members of the American Institute of Certified Public Accountants” unless all of its CPA owners are members of the Institute.

This rule requires that the form of a CPA’s public accounting practice conform to law or regulations whose characteristics conform to AICPA resolutions. In recent years, virtually all states have passed laws that allow CPAs to practice as limited liability partnerships. This rule also prohibits firms from operating under names that may mislead the public.

A resolution by the AICPA Council requires, among other things, that a majority of the financial interests in a firm engaged in attest services be owned by CPAs. In recent years, alternative practice structures have evolved under which, for example, CPA firms were pur- chased by other entities, and (1) the majority of the financial interests in the attest firm was owned by CPAs and (2) all or substantially all of the revenues were paid to another entity in return for services and the lease of employees, equipment, and office space. If the CPAs who own the firm remain financially responsible, under applicable state law or regulation the member is considered to be in compliance with the financial interests provision of the resolu- tion. The revised Code of Professional Conduct addresses issues surrounding the structure of public accounting firms in detail in Code Section 1.220 but discussion of these issues is beyond the scope of this chapter.

Disciplinary Actions The AICPA has a number of avenues by which members can be disciplined for violating the Code of Professional Conduct. For violations that are not sufficient to warrant formal action, the PEEC can direct a member to take remedial or corrective actions. If the member rejects the committee’s recommendation, the committee can refer the case to a hearing panel of the Trial Board. Membership in the AICPA can be suspended or terminated without a hearing if the member has been convicted of certain criminal offenses (such as a crime punishable by imprisonment for more than one year or filing a false income tax return on an entity’s behalf) or if the member’s CPA certificate is suspended or revoked by a government agency. A mem- ber may also be expelled or suspended from the AICPA for up to two years for violating any rule of the Code of Professional Conduct. For more information on the AICPA’s disciplinary processes, see the bylaws of the AICPA on the AICPA’s website. In addition, because the Code of Professional Conduct has been adopted by most State Boards of Accountancy, which have authority to grant or revoke professional licenses, violations of the Code can result in suspension or revocation of a practitioner’s right to practice. Of course, the SEC and the PCAOB also have several options for pursuing disciplinary and even legal actions against auditors. These are briefly discussed in Chapter 20 in the context of auditor legal liability.

Don’t Lose Sight of the Forest for the Trees As you can see from the preceding discussion, the rules and interpretations relating to auditor independence and professional conduct are complicated subjects, involving a great deal of technical detail. A sense for the depth of detail involved is essential. However, we encourage

Final PDF to printer

658 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 658 10/22/15 11:42 AM

you not to lose sight of the big picture! The primary purpose of professional ethics rules is to establish a minimum level of professionalism to help auditors remain independent of the entities they audit and to be objective and honest in their judgments. The essence of even the mind-numbingly detailed independence requirements is that independence in fact and appear- ance is critical to the CPA’s reputation and the value she or he provides to society. Unfor- tunately, even practicing auditors can get so lost in the details of the specific requirements that they sometimes lose sight of the fundamental principles on which the rules are based. If you pursue a career in accounting, you should at least occasionally step back and review the fundamental principles of the Code of Professional Conduct, which involve appropriate professional and moral judgments in all you do, an obligation to honor the public trust, and a commitment to perform professional responsibilities with the highest sense of integrity.

Quality Control Standards

CPA firms are required to implement policies and procedures to monitor the firms’ practices and ensure that professional standards are being followed. In 1977 the AICPA started a volun- tary peer review program, and by January 1988 had instituted mandatory quality peer reviews, which still happen today. The program is structured in two tiers: one for firms that have public company audit entities and one for (usually smaller) firms that audit only private companies. The purpose of the quality review program is to ensure that firms comply with relevant qual- ity control standards.

In 2004, the PCAOB assumed the AICPA’s oversight responsibilities relating to the parts of firms’ practices relating to the audits of public companies and instituted a mandatory qual- ity inspection program for those firms. The PCAOB also took responsibility for the issuance of new quality control standards pertaining to firms that audit public company entities. The AICPA, however, maintains a Peer Review Program (PRP) designed to review and evaluate those portions of firms’ accounting and auditing practices that are not subject to inspection by the PCAOB. The goal of the PRP is to promote quality in the accounting and audit ser- vices provided by individual members of the AICPA and their firms. Reviews are performed by firms and individuals approved by the Peer Review Board. The AICPA’s National Peer Review Committee (PRC) oversees and approves reviews for firms that also require PCAOB inspection (and for firms that perform audits of non-SEC issuers pursuant to the standards of the PCAOB). All other firms may have their reviews approved by the National PRC or by another administrative entity approved by the Peer Review Board.

The AICPA’s PRP consists of two types of reviews: system reviews and engagement reviews. CPA firms that perform audits and related accounting work undergo system reviews, which focus on a firm’s system of quality control. The peer reviewer’s objective in a system review is to determine if the firm’s policies and procedures for quality control conform to professional standards and if the firm is complying with its quality control system. The peer reviewer gains an understanding of the company’s system of quality control and then tests the system by reviewing a sample of the firm’s engagements. CPA firms that don’t perform audits or similar engagements, but perform other accounting work such as reviews and compila- tions, undergo engagement reviews, which focus on work performed on particular selected engagements rather than the quality control system as a whole. Neither system nor engage- ment reviews include a review of a firm’s tax or consulting practice.

While the PCAOB adopted the AICPA’s quality control standards in April 2003, the AICPA has since released Statement on Quality Control Standards (SQCS) No. 8, “A Firm’s System of Quality Control,” which supersedes all previous SQCS. While the PCAOB has not yet adopted this standard, many auditing firms have already integrated its concepts into their systems of quality control for all audit entities, since it represents the state of the art in quality control for accounting firms. Thus, the remainder of this section discusses only the requirements of the newest standard, SQCS No. 8, which applies only to audit, attest, compilation, review, and any other services for which standards have been established by the AICPA. While not required, it is recommended that the guidance in this statement be applied to other services such as tax and consulting services.

LO 19-8

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 659

mes32502_ch19_627-671.indd 659 10/22/15 11:42 AM

System of Quality Control A firm’s system of quality control should be designed to provide the firm with reasonable assur- ance that the firm and its personnel comply with professional, legal, and regulatory require- ments and that the partners issue appropriate reports (SQCS 8.12). A firm’s system of quality control, however, has to be tailored to the firm’s size, the nature of its practice, its organization, and cost-benefit considerations. For a sole practitioner or small firm, a system of quality control is likely to be much less formal than for a national or international firm. For example, a sole practitioner with three professional staff members may use a simple checklist and conduct peri- odic informal discussions to monitor his or her firm’s compliance with professional standards. On the other hand, a large international CPA firm may develop involved, in-house procedures and assign full- or part-time staff to oversee and ensure compliance with the firm’s quality control system.

Elements of Quality Control SQCS No. 8 identifies the following six elements of quality control:

1. Leadership responsibilities for quality in the firm (“tone at the top”) 2. Relevant ethical requirements 3. Acceptance and continuance of entity relationships and specific engagements 4. Human resources 5. Engagement performance 6. Monitoring

Table 19–5 defines each of the elements. It should be apparent from the definitions that these elements are interrelated. For example, the human resources element encompasses criteria for professional development, hiring, advancement, and assignment of the firm’s

Elements of Quality Control

1. Leadership responsibilities for quality within the firm (the “tone at the top”): The firm should establish poli- cies and procedures designed to promote an internal culture based on the recognition that quality is essential in performing engagements. Such policies and procedures should require the firm’s leadership (managing partner or board of managing partners, CEO, or equivalent) to assume ultimate responsibility for the firm’s system of quality control. The firm should establish policies and procedures designed to provide it with reasonable assurance that any person or persons assigned operational responsibility for the firm’s system of quality control by the firm’s lead- ership has sufficient and appropriate experience and ability, and the necessary authority, to assume that responsi- bility (SQCS 8.19–20).

2. Relevant Ethical Requirements: The firm should establish policies and procedures designed to provide it with reasonable assurance that the firm and its personnel comply with relevant ethical requirements (SQCS 8.21).

3. Acceptance and Continuance of Client Relationships and Specific Engagements: The firm should establish policies and procedures for the acceptance and continuance of client relationships and specific engagements, designed to provide the firm with reasonable assurance that it will undertake or continue relationships and engagements only when the firm is competent to perform the engagement and has the capabilities, including time and resources, to do so; can comply with legal and relevant ethical requirements; and has considered the integrity of the client and does not have information that would lead it to conclude that the client lacks integrity (SQCS 8.27).

4. Human Resources: The firm should establish policies and procedures designed to provide it with reasonable assurance that it has sufficient personnel with the competence, capabilities, and commitment to ethical principles necessary to perform engagements in accordance with professional standards and applicable legal and regulatory requirements and enable the firm to issue reports that are appropriate in the circumstances. The firm’s policies and procedures should provide that personnel selected for advancement have the qualifications necessary for fulfill- ment of the responsibilities that they will be called on to assume (SQCS 8.31-32).

5. Engagement Performance: The firm should establish policies and procedures designed to provide it with reason- able assurance that engagements are performed in accordance with professional standards and applicable legal and regulatory requirements and that the firm issues reports that are appropriate in the circumstances. Such poli- cies and procedures should include the following (SQCS 8.35):

a. Matters relevant to promoting consistency in the quality of engagement performance. b. Supervision responsibilities. c. Review responsibilities. 6. Monitoring: The firm should establish a monitoring process designed to provide it with reasonable assurance that

the policies and procedures relating to the system of quality control are relevant, adequate, and operating effec- tively (SQCS 8.52).

T A B L E 1 9 – 5

Final PDF to printer

660 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 660 10/22/15 11:42 AM

personnel to engagements, which affect policies and procedures developed to meet quality control objectives. It is important for a firm to develop a system of quality control that takes each of these elements into account and to ensure that members of the firm understand the firm’s quality control policies and procedures. While not required, communication of the firm’s quality control system normally should be in writing, with the extent of documentation varying with the size of the firm. A firm’s quality control policies and the Code of Profes- sional Ethics should be covered in the firm’s training programs.

Table 19–6 provides some selected examples of the types of policies or procedures a firm might implement to comply with a sound system of quality control. The standards require that the firms continually monitor the appropriateness of the design and the effectiveness of the operation of their quality control system (SQCS 8.52). Firms should implement moni- toring procedures to identify and communicate circumstances that may necessitate changes and improvements to the firm’s system of quality control. Procedures for monitoring include the following:

∙ Review of records pertaining to the quality control elements ∙ Review of engagement documentation, reports, and entity financial statements ∙ Discussions with the firm’s personnel ∙ Review of summarized reports, at least annually, on the findings of the monitoring

procedures and the investigation of their causes so that improvements can be made

Selected Quality Control Policies and Procedures

Leadership Responsibilities for Quality within the Firm • Assign management responsibilities so that commercial considerations do not override the quality of the work per-

formed (SQCS 8. A5a). • Provide sufficient and appropriate resources for the development, documentation, and support of the firm’s quality

control policies and procedures (SQCS 8.A5b).

Relevant Ethical Requirements • Communicate the firm’s independence requirements to its personnel and, when applicable, others subject to them

(SQCS 8.22a). • Require personnel to promptly notify the firm of circumstances and relationships that create a threat to indepen-

dence so that appropriate action can be taken (SQCS 8.23b).

Acceptance and Continuance of Client Relationships and Specific Engagements • Require the firm to obtain such information as it considers necessary in the circumstances before accepting an

engagement with a new client, when deciding whether to continue an existing engagement, and when considering acceptance of a new engagement with an existing client (SQCS 8.28a).

• Establish policies and procedures that provide for obtaining an understanding with the client regarding the nature, scope, and limitations of the services to be performed (SQCS 8.29).

Human Resources • Ensure that the engagement partner has the appropriate competence, capabilities, and authority to perform his

role (SQCS 8.33b). • Establish policies and procedures to assign appropriate personnel with the necessary competence and capabilities

to perform engagements in accordance with professional standards and applicable legal and regulatory require- ments (SQCS 8.34a).

Engagement Performance • Establish policies and procedures setting out the nature, timing, and extent of an engagement quality control

review. Such policies and procedures should require that the engagement quality control review be completed before the report is released (SQCS 8.40).

• Establish policies and procedures for addressing and resolving differences of opinion within the engagement team; with those consulted; and, when applicable, between the engagement partner and the engagement quality control reviewer (SQCS 8.46).

Monitoring • Communicate to relevant engagement partners, and other appropriate personnel, deficiencies noted as a result of

the monitoring process and recommendations for appropriate remedial action (SQCS 8.55). • Establish policies and procedures designed to provide reasonable assurance that complaints and allegations that

the work performed by the firm fails to comply with professional standards and applicable legal and regulatory requirements and allegations of noncompliance with the firm’s system of quality control are appropriately dealt with (SQCS 8.60a-b).

T A B L E 1 9 – 6

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 661

mes32502_ch19_627-671.indd 661 10/22/15 11:42 AM

∙ Determination of any corrective actions to be taken or improvements to be made in the system, including providing feedback into the firm’s policies and procedures relating to education and training

∙ Communication of findings to appropriate firm management ∙ Follow-up on a timely basis by appropriate firm management and determination of

what actions are necessary, including modifications to the quality control system (SQCS 8.A64)

The AICPA requires member firms to have their practices reviewed by peer firms every three-and-a-half years.

PCAOB Inspections of Registered Public Accounting Firms In addition to the AICPA peer review programs discussed above, the PCAOB conducts regu- lar inspections of public accounting firms that are required to register with the Board. These inspections focus on selected audit and quarterly review engagements and evaluate the suffi- ciency of the quality control system of registered firms. The purpose of these inspections is to ensure that registered firms, in connection with their audits of public companies, comply with the Sarbanes-Oxley Act, PCAOB rules, SEC rules, and professional standards.

The PCAOB conducts special inspections on an ad hoc basis when it has specific cause, but the frequency with which regular inspections are conducted is established by law. Regis- tered firms that issue more than 100 audit reports for public companies per year are subject to an annual inspection, while those firms that regularly issue more than 1 but less than 100 audit reports in a year must be inspected at least once every three years.

Should a PCAOB inspection find that a firm, or anyone associated with it, may be in vio- lation of legislation, accounting regulations, any professional standard, or even the firm’s own quality control policies, the PCAOB can conduct a special investigation into the possible vio- lation. Following an investigation, the Board issues a draft report, at which time the firm has 30 days to respond to any allegations. At the end of this period, the Board then issues a final report outlining the violations; however, assuming such violations do not involve fraud, the firm is granted a 12-month period in which to take necessary corrective action. If sufficient action is taken, the PCAOB does not publicly reveal the specifics of the firm’s violations— otherwise, public disciplinary action ensues against responsible parties.

Mandatory inspections apply to all firms that audit public U.S. companies. However, if the accounting firm is not based in the United States, there may be some exceptions to the inspection requirements. For instance, at the PCAOB’s discretion, the Board may rely (at least in part) on foreign authorities to conduct inspections.

LO 19-9

KEY TERMS

Attest engagement. An engagement that requires independence as defined in AICPA Profes- sional Standards. Attest engagements include financial statement audits, reviews, and exami- nations of prospective financial information. Close relative. A parent, sibling, or nondependent child. Covered member. A member that is

a. An individual on the attest engagement team. b. An individual in a position to influence the attest engagement. c. A partner or manager who provides nonattest services to the attest entity beginning

once he or she provides 10 hours of nonattest services to the entity within any fiscal year and ending on the later of the date (i) the firm signs the report on the financial statements for the fiscal year during which those services were provided, or (ii) he or she no longer expects to provide 10 or more hours of nonattest services to the attest entity on a recurring basis.

Final PDF to printer

662 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 662 10/22/15 11:42 AM

d. A partner in the office in which the lead attest engagement partner primarily practices in connection with the attest engagement.

e. The firm, including the firm’s employee benefit plans. f. An entity whose operating, financial, or accounting policies can be controlled (as

defined by generally accepted accounting principles for consolidation purposes) by any of the individuals or entities described in parts (a) through (e), or by two or more such individuals or entities if they act together.

Ethics. A system or code of conduct based on moral duties and obligations that indicates how an individual should behave. Financial interest. An ownership interest in an equity or a debt security issued by an entity, including rights and obligations to acquire such an interest and derivatives directly related to such interest. A direct financial interest is a financial interest that is owned directly by an indi- vidual or entity, or is under the control of an individual or entity. An indirect financial interest is a financial interest that is beneficially owned through an investment vehicle, estate, trust, or other intermediary when the beneficiary does not control the intermediary or have authority to supervise or participate in the intermediary’s investment decisions. Generally accepted auditing standards. Measures of the quality of the auditor’s performance. Holding out. In general, any action initiated by a member that informs others of his or her status as a CPA or AICPA-accredited specialist constitutes holding out as a CPA. This would include, for example, use of the CPA designation on business cards or letterhead, or listing as a CPA in local telephone directories. Immediate family. A spouse, spousal equivalent, or dependent (whether or not related). Key position. A position in which an individual

a. Has primary responsibility for significant accounting functions that support material components of the financial statements.

b. Has primary responsibility for the preparation of the financial statements. c. Has the ability to exercise influence over the contents of the financial statements,

including when the individual is a member of the board of directors or similar governing body, chief executive officer, president, chief financial officer, chief operating officer, general counsel, chief accounting officer, controller, director of internal audit, director of financial reporting, treasurer, or any equivalent position.

For purposes of attest engagements not involving an entity’s financial statements, a key posi- tion is one in which an individual is primarily responsible for, or able to influence, the subject matter of the attest engagement, as described above. Period of the professional engagement. The period for which a member either signs an ini- tial engagement letter or other agreement to perform attest services or begins to perform an attest engagement for an entity, whichever is earlier. The period lasts for the entire duration of the professional relationship and ends with the formal or informal notification, either by the member or the entity, of the termination of the professional relationship or by the issuance of a report, whichever is later. Accordingly, the period does not end with the issuance of a report and recommence with the beginning of the following year’s attest engagement. Practice of public accounting. The performance for an entity, by a member or a member’s firm, while holding out as CPA(s), of the professional services of accounting, tax, personal financial planning, litigation support services, and those professional services for which stan- dards are promulgated by bodies designated by Council. Professionalism. The conduct, aims, or qualities that characterize or mark a profession or professional person.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 663

mes32502_ch19_627-671.indd 663 10/22/15 11:42 AM

REVIEW QUESTIONS

LO 19-2 19-1 Briefly describe the three theories of ethical behavior that can be used to analyze ethical issues in accounting.

LO 19-2 19-2 Why are companies like Kmart able to continue in business after experiencing fed- eral indictments, convictions of top executives, and bankruptcy, while accounting firms, like the once highly respected, financially strong Arthur Andersen, can be destroyed by a single federal indictment?

LO 19-4 19-3 What entities are involved in establishing standards and rules for the professional conduct of public accountants? Who establishes such standards for auditors of public versus private companies?

LO 19-5 19-4 What are the four major sections of the AICPA Code of Professional Conduct? What additional guidance is provided for applying the Rules of Conduct?

LO 19-4 19-5 Describe the six Principles of Professional Conduct, and indicate which CPAs are responsible for observing these six professional ideals.

LO 19-4 19-6 What are the eleven major sections of the Rules of Conduct in Part 1 of the Code of Professional Conduct?

LO 19-5 19-7 What types of personal loans from a financial institution are allowed by the Rules of Conduct? What is meant by normal lending procedures, terms, and requirements within this context?

LO 19-6 19-8 Summarize the major differences between the AICPA’s Code of Professional Con- duct independence rules and the SEC’s independence rules for auditors of public companies. Briefly describe why the SEC’s requirements diverged from those of the AICPA in the early 2000s.

LO 19-7 19-9 Generally, a CPA is not allowed to disclose confidential entity information with- out the consent of the entity. Identify four circumstances in which confidential entity information can be disclosed under the Rules of Conduct without the entity’s permission.

LO 19-7 19-10 Give three examples of acts that are considered discreditable under the Rules of Conduct.

LO 19-7 19-11 A CPA is allowed to advertise as long as the advertising is not false, misleading, or deceptive. Provide three examples of advertising that might be considered false, misleading, or deceptive. Why are such acts of concern to the profession?

LO 19-8 19-12 What is the purpose of a CPA firm’s establishing a system of quality control? List the six elements of quality control and provide one example of a policy or procedure that can be used to fulfill each element.

LO 19-8, 19-9 19-13 How are the roles of the PCAOB inspection program and the AICPA peer review program similar, and how are they different?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 19-1, 19-2, 19-4 19-14 Which of the following statements best explains why public accounting, as a pro- fession, promulgates ethical standards and establishes means for ensuring their observance?

a. Vigorous enforcement of an established code of ethics is the best way to prevent unscrupulous acts.

b. Ethical standards that emphasize excellence in performance over material rewards establish individual reputations for competence and character.

c. Ethical standards are established so that users of accounting services know what to expect and accounting professionals know what behaviors are acceptable, and so that discipline can be applied when necessary.

Final PDF to printer

664 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 664 10/22/15 11:42 AM

d. A requirement for a profession is to establish ethical standards that primarily stress responsibility to entities and colleagues.

LO 19-5 19-15 All of the following nonaudit services are identified by the SEC as generally impair- ing an auditor’s independence except

a. Information systems design and implementation. b. Human resource services. c. Management functions. d. Some specific tax services. e. All of the above are seen by the SEC as impairing independence.

LO 19-6 19-16 Under the SEC’s rules regarding independence, which of the following must an entity disclose?

a. Only fees for the external audit. b. Only fees for internal and external audit services provided by the audit firm. c. Fees for the external audit, audit-related fees, tax fees, and fees for other nonaudit

services performed by the audit firm. d. Only fees for systems implementation and design and nonaudit services per-

formed by the audit firm.

LO 19-4 19-17 The AICPA Code of Professional Conduct contains both general ethical principles that are aspirational in character and a

a. List of violations that would cause the automatic suspension of a CPA’s license. b. Set of specific, mandatory rules describing minimum levels of conduct a CPA

must maintain. c. Description of a CPA’s procedures for responding to an inquiry from a trial board. d. Complete list of all the different kinds of crimes that would be considered as acts

discreditable to the profession.

LO 19-5 19-18 In which of the following situations would a CPA’s independence be considered impaired according to the Code of Professional Conduct?

1. The CPA has a car loan from a bank that is an audit entity. The loan was made under the same terms available to all customers.

2. The CPA has a direct financial interest in an audit entity, but the interest is main- tained in a blind trust.

3. The CPA owns a commercial building and leases it to an audit entity. The rental income is material to the CPA.

a. 1 and 2. b. 2 and 3. c. 1 and 3. d. 1, 2, and 3.

LO 19-5 19-19 An audited entity company has not paid its 2015 audit fees. According to the AICPA Code of Professional Conduct, for the auditor to be considered independent with respect to the 2016 audit, the 2015 audit fees must be paid before the

a. 2015 report is issued. b. 2016 fieldwork is started. c. 2016 report is issued. d. 2017 fieldwork is started.

LO 19-5 19-20 Which of the following legal situations would be considered to impair the auditor’s independence?

a. An expressed intention by the present management to commence litigation against the auditor, alleging deficiencies in audit work for the entity, although the auditor considers that there is only a remote possibility that such a claim will be filed.

b. Actual litigation by the auditor against the entity for an amount not material to the auditor or to the financial statements of the entity arising out of disputes as to billings for management advisory services.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 665

mes32502_ch19_627-671.indd 665 10/22/15 11:42 AM

c. Actual litigation by the auditor against the present management, alleging manage- ment fraud or deceit.

d. Actual litigation by the entity against the auditor for an amount not material to the auditor or to the financial statements of the entity arising out of a dispute as to billings for tax services.

LO 19-4, 19-5, 19-21 A violation of the profession’s ethical standards is least likely to occur when a CPA 19-6, 19-7 a. Purchases another CPA’s accounting practice and bases the price on a percentage

of the fees accruing from entities over a three-year period. b. Receives a percentage of the amounts invested by the CPA’s audit entities in a tax

shelter with the entities’ knowledge and approval. c. Has a public accounting practice and is president and sole stockholder of a cor-

poration that engages in data processing services for the public. The CPA often refers his attest entities to the data processing company.

d. Forms an association—not a legally binding partnership—with two other sole practitioners and calls the association Adams, Betts & Associates.

LO 19-2 19-22 Rick, an independent CPA, must make an ethical judgment related to the audit of an entity. If he primarily focuses on whether his decision might yield unfair advantages for some at the expense of others, he is using

a. A utilitarian perspective. b. A rights-based approach. c. A justice-based perspective. d. Rule-based AICPA guidelines.

LO 19-2 19-23 During the audit of Moon Co., the auditor disagrees with management’s estimation of collectible accounts receivable. The possible misstatement amount is material. Which of the statements below should weigh more heavily for the auditor in this instance?

a. Moon management has the right to make company estimates. b. Requiring an adjustment to the allowance for doubtful accounts would give stock-

holders access to fair and adequate information. c. Accounts Receivable as stated by Moon Co. might turn out to be fully collectible. d. The interests of Moon Co., the auditor, and the public should be weighed equally

in the decision.

LO 19-7 19-24 Without the consent of the entity, a CPA should not disclose confidential entity information contained in working papers to a(n)

a. Authorized quality control review board. b. CPA firm that has been engaged to audit a former audit entity. c. Federal court that has issued a valid subpoena. d. Disciplinary body created under state statute.

LO 19-8 19-25 One of a CPA firm’s basic objectives is to provide professional services that conform with professional standards. Reasonable assurance of achieving this basic objective is provided through

a. A system of quality control. b. A system of peer review. c. Continuing professional education. d. Compliance with generally accepted reporting standards.

LO 19-9 19-26 In connection with the element of engagement performance, a CPA firm’s system of quality control should ordinarily include procedures covering all of the following except

a. Performance evaluation. b. Engagement performance. c. Supervision responsibilities. d. Review responsibilities.

Final PDF to printer

666 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 666 10/22/15 11:42 AM

PROBLEMS All applicable problems are available with Connect.

LO 19-6 19-27 Dean Wareham, an audit manager, is preparing a proposal for a publicly held com- pany in the manufacturing industry. The potential client is growing rapidly and introducing many new products yet still has a manual accounting system. The com- pany also has never undertaken any tax planning activities and feels that it pays a higher percentage of its income in taxes than its competitors. Additionally, it is concerned that its monitoring activities are inadequate because it does not have an internal audit department. Dean knows that the SEC has rules regarding auditor independence.

Required: 1. Prepare a summary of nonaudit services that Dean can include in his proposal

that do not violate the SEC’s independence rules. 2. How would your answer to requirement 1 differ if the potential client were not

publicly held? In other words, what additional nonaudit services could Dean include in his proposal? What conditions would have to be met in order for the firm to provide the additional services?

LO 19-5, 19-6 19-28 Each of the following situations involves a possible violation of the Independence Rule of the AICPA’s Code of Professional Conduct. Indicate whether each situation violates the Code. If it violates the Code, explain why.

a. Julia Roberto, a sole practitioner, has provided extensive advisory services for her audit entity, Leather Ltd. She has interpreted financial statements, provided fore- casts and other analyses, counseled on potential expansion plans, and counseled on banking relationships but has not made any management decisions. Leather is a privately held entity.

b. Steve Rackwill, CPA, has been asked by his audit entity, Petry Plumbing Supply, to help implement a new control system. Rackwill will arrange interviews for Petry’s hiring of new personnel and instruct and oversee the training of current entity personnel. Petry Plumbing is a privately held company. Petry will make all hiring decisions and supervise employees once they are trained.

c. Kraemeer & Kraemeer recently won the audit of Garvin Clothiers, a large man- ufacturer of women’s clothing. Jock Kraemeer had a substantial investment in Garvin prior to bidding on the engagement. In anticipation of winning the engage- ment, Kraemeer placed his shares of Garvin stock in a blind trust.

d. Zeker & Associates audits a condominium association in which the parents of a member of the firm own a unit and reside. The unit is material to the parents’ net worth, and the member participates in the engagement.

e. Jimmy Saad, a sole practitioner, audited Dallas Conduit, Inc.’s, financial state- ments for the year ended June 30 and was issued stock by the entity as payment of the audit fee. Saad disposed of the stock before commencing fieldwork planning for the audit of the next year’s June 30 financial statements.

f. Dip-It Paint Corporation requires an audit for the current year. However, Dip-It has not paid Allen & Allen the fees due for tax-related services performed two years ago. Dip-It issued Allen & Allen a note for the unpaid fees, and Allen & Allen proceeded with the audit services.

LO 19-5 19-29 The questions that follow are based on the Independence Rule of the AICPA Code of Professional Conduct as it relates to independence and family relationships. Check yes if the situation violates the rule, no if it does not.

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 667

mes32502_ch19_627-671.indd 667 10/22/15 11:42 AM

LO 19-4, 19-5, 19-30 Each of the following situations involves a possible violation by a member in industry 19-6, 19-7 of the AICPA’s Code of Professional Conduct. For each situation, indicate whether

it violates the Code. If it violates the Code, indicate which rule is violated and explain why.

a. Jack Jackson is a CPA and controller of Acme Trucking Company. Acme’s exter- nal auditors have asked Jackson to sign the management representation letter. Jackson has signed the management representation letter, even though he knows that full disclosures have not been made to Acme’s external auditors.

b. Mary McDermott, CPA, is employed in the internal audit department of the United Fund of America. The United Fund raises money from individuals and distributes it to other organizations. McDermott has audited Children’s Charities, an organization that receives funds from United Fund.

c. Janet Jett, CPA, formerly worked for Delta Disk Drive, Inc. She is currently inter- viewing for a new position with Maxiscribe, Inc., another manufacturer of disk drives. Jett has agreed to provide confidential information about Delta’s trade secrets if she is hired by Maxiscribe.

d. Brian Thorough, CPA, is currently employed as controller of TransLouisiana Oil Company. He has discovered that TransLouisiana has been illegally paying state environmental employees so that they will not charge TransLouisiana with dump- ing highly toxic chemicals into the bayous. Thorough discloses this information to the state attorney general.

e. Jill Burnett, CPA, was hired by Cooper Corporation to supervise its accounting department in preparing financial statements and presenting them to senior man- agement. Due to considerable time incurred on other financial activities, Burnett was unable to supervise the accounting staff adequately. It is later discovered that Cooper’s financial statements contain false and misleading information.

LO 19-5, 19-6 19-31 Perez, CPA, has been asked by a nonpublic company audit entity to perform a nonre- curring engagement involving implementing an IT information and control system. The entity requests that, in setting up the new system and during the period prior to conversion to the new system, Perez

∙ Counsel on potential expansion of business activity plans. ∙ Search for and interview new personnel. ∙ Hire new personnel. ∙ Train personnel. In addition, the entity requests that, during the three months subsequent to the con-

version, Perez ∙ Supervise the operation of the new system.

Situation Yes No

a. A partner’s dependent parent is a 5 percent limited partner in a firm entity. Does the parent’s direct financial interest in the entity impair the firm’s independence?

b. A partner assigned to a firm’s New York office is married to the president of an entity for which the firm’s Connecticut office performs audit services. If the partner does not perform services out of or for the Connecticut office, cannot exercise significant influence over the engagement, and has no involvement with the engagement, such as consulting on accounting or auditing issues, is the firm’s independence impaired?

c. A CPA’s father acquired a 10 percent interest in his son’s audit entity. The investment is material to the father’s net worth. If the son is aware of his father’s investment and the CPA participates in the audit engagement, is the firm’s independence impaired?

d. An audit partner has a brother who owns a 60 percent interest in an audit entity, which is material to the brother’s net worth. If the partner participates in the audit engagement, but does not know about his brother’s investment, is the firm’s independence impaired?

Final PDF to printer

668 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 668 10/22/15 11:42 AM

∙ Monitor entity-prepared source documents and make changes in basic IT- generated data as Perez may deem necessary without the concurrence of the entity.

Perez responds that he may perform some of the services requested but not all of them.

Required: a. Which of these services may Perez perform, and which of them may Perez not

perform? b. Before undertaking this engagement, Perez should inform the entity of all signifi-

cant matters related to the engagement. What are these significant matters that should be included in the engagement letter?

(AICPA, adapted)

DISCUSSION CASES

LO 19-2, 19-5, 19-6 19-32 Refer back to the hypothetical Sun City Savings and Loan case presented in this chapter, and consider each of the following independent situations:

a. Suppose that Pina, Johnson & Associates also audited one of the entities who had received one of the large loans that are in dispute. Sam Johnson is not involved with auditing that entity. Is it ethical for Johnson to seek information on the finan- cial condition of that entity from the auditors in his firm? What are the rights of the affected parties in this instance, and what are the costs and benefits of using such information?

b. Suppose that Johnson has determined that one of the entities that owes a disputed loan is being investigated for violating environmental laws and may be sued to the point of bankruptcy by the Environmental Protection Agency. Can Johnson use this information in deciding on the proper loan-loss reserve? What are the ethical considerations?

LO 19-4, 19-7 19-33 Schoeck, CPA, is considering leaving a position at a major public accounting firm to join the staff of a local financial institution that does write-up work, tax preparation and planning, and financial planning.

Required: a. Are the Rules of Conduct applied differently to CPAs who work for a local finan-

cial institution that is not CPA-owned, as compared to a major public accounting firm?

b. Do you think the rules should be applied differently to CPAs depending on the type of entity they work for?

LO 19-5, 19-6 19-34 For each of the following scenarios, indicate whether or not independence-related SEC rules are being violated, assuming that the audit entity is a public company. Briefly explain why or why not.

a. Adrian Reynolds now works as a junior member of the accounting team at Swiss Precision Tooling, a publicly traded manufacturing company. Three months ago, he worked as a staff auditor for Crowther & Sutherland, a local accounting firm, where he worked on the Swiss Precision Tooling audit team. Crowther & Sutherland is still the auditor for Swiss Precision Tooling.

b. Susana Millar finished working for Bircham, Dyson & Bell in August 2014. Dur- ing that time, she was a concurring partner on the Unigate Dairies assignment (the engagement period on this audit ended in April 2015). In February 2016, Susana took up a position as controller of Unigate Dairies. Bircham, Dyson & Bell is still the dairy’s auditor and plans to finish its current audit assignment in March 2016 (19 months after Susana left the firm).

Final PDF to printer

Chapter 19 Professional Conduct, Independence, and Quality Control 669

mes32502_ch19_627-671.indd 669 10/22/15 11:42 AM

c. Janay Butler, a senior auditor, is aware that under SEC rules her accounting firm should not conduct appraisal or valuation services for a public company audit entity. However, her manager has requested that she appraise some spe- cific large inventory items to verify a public entity’s estimates, which are relied upon by others.

d. Heath & Associates, CPAs, is the auditor of Halifax Investments, Inc., a public company. Heath makes most of its money by selling nonaudit services to audit entities, but it ensures every service it provides for Halifax is in accordance with SEC rules and is preapproved by the company’s audit committee. Last year, it billed the following to Halifax: audit fees $0.8 million, tax fees $2.3 million, and other fees $5.2 million. No services prohibited by the SEC were provided by Heath to Halifax, and the fee figures are appropriately disclosed in Halifax’s financial statements.

LO 19-2, 19-4 19-35 Your supervisor tells you that for the next month you will be working on an audit entity with a controller who loves to talk. She explains that the entity will want you to spend an hour or so talking about politics, sports, and life’s mysteries and you need to keep him happy. She also wants you to follow the time budget, which was based on prior years when those in your position would take work home each night to stay on budget. The prior auditors didn’t record the “social” time at the entity. Will you record all of your time, including “social” time, or only the time associated with the technical work of the audit?

Required: 1. Analyze this situation with its possible outcomes using a. The utilitarian theory. b. The rights-based approach. c. The justice-based approach. 2. Which approach do you feel is most appropriate in this situation, and why?

LO 19-2, 19-4 19-36 While completing a test of controls, you appropriately cleared two minor exceptions by examining related documents. The entity will need to do some serious digging to find the documents to resolve a third, similar, exception and wants to know if you really need the documents. You ask the in-charge senior, and he decides it was prob- ably not a serious potential problem and tells you to sign off to clear the third excep- tion without examining the underlying documents.

INTERNET ASSIGNMENT

LO 19-5, 19-6, 19-7 19-37 Visit the AICPA’s website (www.aicpa.org), under Research/Standards. Click on “Code of Professional Conduct.” Find the Independence Rule and its related inter- pretations in Part 1 of the Code of Professional Conduct. Research the relevant rules, interpretations, and ethics rulings to answer the following questions:

a. Would independence be considered impaired if a member joined a trade associa- tion that is an entity of the firm?

b. A member provides extensive advisory services for an entity. In that connec- tion, the member attends board meetings; interprets financial statements, fore- casts, and other analyses; and counsels on potential expansion plans and on

Final PDF to printer

670 Part 7 Professional Responsibilities

mes32502_ch19_627-671.indd 670 10/22/15 11:42 AM

banking relationships. Would independence be considered impaired under these circumstances?

c. If a member signs or cosigns checks issued by a debtor corporation for a credi- tors’ committee in control of the debtor corporation, which will continue to oper- ate under its existing management, would independence be impaired with respect to the debtor corporation?

d. A member has been designated to serve as an executor or trustee of the estate of an individual who owns the majority of an entity’s stock. Would independence be considered impaired with respect to the entity?

e. A member serves as a director or officer of a United Way or similar fund-raising organization. Certain local charities receive funds from the organization. Would independence be considered impaired with respect to such charities?

f. An entity of the member’s firm has not paid fees for previously rendered profes- sional services. Would independence be considered impaired for the current year?

HANDS-ON CASES

EarthWear Online

Ethics Review ethical challenges facing a Willis & Adams staff auditor and indicate what you would do if faced with a similar situation.

Visit Connect to find a detailed description of the case and to download required materials.

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch19_627-671.indd 671 10/22/15 11:42 AM

Final PDF to printer

mes32502_ch20_672-706.indd 672 09/30/15 02:21 PM

CHAPTER

20 20-1 Understand the four general stages in an audit-related

legal dispute. 20-2 Know the definitions of key legal terms. 20-3 Know the auditor’s liability to clients under common law. 20-4 Understand the auditor’s liability to third parties under

common law. 20-5 Understand the auditor’s legal liability under the

Securities Act of 1933. 20-6 Understand the auditor’s legal liability under the

Securities Exchange Act of 1934. 20-7 Be able to explain how the Private Securities Litigation

Reform Act of 1995, the Securities Litigation Uniform

Standards Act of 1998, and the Class Action Fairness Act of 2005 relieve potential legal liability from auditors.

20-8 Understand the auditor’s legal liability under the Sarbanes-Oxley Act of 2002.

20-9 Know how the SEC and PCAOB can sanction an auditor or audit firm.

20-10 Understand how the Foreign Corrupt Practices Act can result in legal liability for auditors.

20-11 Understand how the Racketeer Influenced and Corrupt Organizations Act can affect the auditor’s legal liability.

20-12 Be able to explain how an auditor can be held criminally liable under various federal and state laws.

AICPA, Code of Professional Conduct (ET 50-500) AU-C 240, Consideration of Fraud in a Financial Statement Audit AU-C 250, Consideration of Laws and Regulations in an Audit of Financial Statements AU-C 265, Communicating Internal Control Related Matters Identified in an Audit

AU-C 711, Filings with the U.S. Securities and Exchange Commission under the Securities Act of 1933 PCAOB Auditing Standard No. 16, Communications with Audit Committees (AU-C 260)

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

Additional Student Resources

A number of legal cases discussed in this chapter are described in detail in Connect including an in-depth look at the Phar-Mor trial, an actual auditor-liability case, with coverage of courtroom strategies and quotes based on trial transcripts.

673

mes32502_ch20_672-706.indd 673 09/30/15 02:21 PM

Legal Liability

I n Chapter 1 we presented an economic view of auditing, and we provided a house inspector analogy to illustrate the concepts. The auditor (or inspec- tor) adds value to the principal–agent relationship by providing an objective,

independent opinion on the quality of the information reported. However, what prevents the auditor from “looking the other way” or even from cooperating with management and issuing an unqualified report on financial statements that are materially misstated? The main deterrent, other than the individual’s ethical and professional principles, is the threat of legal liability. If a client or third party suffers a loss from such fraudulent behavior, the auditor’s personal wealth and professional reputation will be affected by litigation.

This chapter discusses auditors’ legal liability. The chapter starts by pre- senting an overview of legal liability that includes the stages of the auditor dispute process and briefly discusses the types of legal liability an auditor may encounter. Auditors’ liability under common law to clients and third parties is discussed first, followed by a discussion of statutory liability for both civil and criminal complaints.

Final PDF to printer

674 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 674 09/30/15 02:21 PM

Auditors can be held legally liable for actions that represent failure to perform professional services adequately. In this chapter we discuss the types of claims that can be brought against auditors, the types of plaintiffs that typically sue auditors, what must be proved to sue auditors successfully, and the defenses available to the auditor. Before discussing the details of the various legal theories, we provide a brief historical perspective and broad overview.

Historical Perspective Although auditors have always been liable to clients and certain third parties, claims against auditors were relatively uncommon before the 1970s. In fact, the number of claims against auditors in the past 25 years is nearly double the number of all claims previously brought.1 Not only did the number of claims rise, but their severity also increased. Following economic downturns and increased business failures, the number of lawsuits filed against auditors typi- cally rises. For example, the recession in the early 1990s led to an upsurge in litigation culmi- nating with a settlement related to savings and loan audits against Ernst & Young in excess of $400 million.

While some of the lawsuits brought against auditors were certainly legitimate, the 1980s and 1990s also found the profession expending enormous time and effort defend- ing against weak claims. During this time, it took large firms an average of three years and over $3 million to defend against a single weak claim under federal securities laws. “Practice protection costs” (e.g., litigation costs and the cost of professional liability insur- ance) soared and quickly became the second largest cost to public accounting firms behind the cost of human resources. The profession pushed for reform, and in the 1990s Congress passed litigation reform acts that provided some limits to auditor liability and made it more difficult to successfully sue auditors. The Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act) and the The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) refocused attention on auditor performance, duties, and legal liability after the capital markets were shaken by accounting frauds and an accounting crisis. While additional litigation will certainly follow, legal experts have noted that the number of large shareholder lawsuits against auditors has been declining in recent years. Experts attribute the recent decline in large shareholder claims against auditors to a legal case you will read about later in the chapter (i.e., Stoneridge Investment v. Scientific-Atlanta) and suggest it may also be due to the effect of regulation focused on improving audit and financial reporting quality, such as the Sarbanes-Oxley Act. Time will tell if the declining trend will continue.

The monetary size of the legal claims against auditors combined with the small number of large audit firms has made it difficult or impossible for the largest audit firms to obtain sufficient liability insurance. The largest audit firms are basically self-insured for small and large claims (e.g., less than $10 million and more than $100 million). It is generally believed that the single greatest threat to large firms and the audit profession is catastrophic legal liability. The collapse of Arthur Andersen illustrated how severe the lack of available audit services would be if another big firm collapsed. For this reason, some European countries have established caps that limit auditor liability. While such caps have been discussed in the United States, it seems unlikely that legislation capping liability will be forthcoming in the near future.

1Approximately 4,000 claims are currently being asserted against accounting firms in the United States each year, whereas in the late 1960s the number of such claims did not exceed a few hundred per year. See Goldwasser and Arnold, Accountants’ Liability (Practising Law Institute, 2014), for additional information on the magnitude and severity of claims.

Introduction

Final PDF to printer

Chapter 20 Legal Liability 675

mes32502_ch20_672-706.indd 675 09/30/15 02:21 PM

Overview of Auditor Legal Liability There are four general stages in the initiation and disposition of audit-related disputes: (1) the occurrence of events that result in losses for users of the financial statements, (2) the investi- gation by plaintiff attorneys before filing suit to link the user losses with allegations of mate- rial omissions or misstatements of financial statements, (3) the legal process that commences with the filing of the suit, and (4) the final resolution of the dispute.2 The first stage includes events that result in losses, such as client bankruptcy, financial distress, fraudulent financial reporting, and misappropriation of assets. The second stage, pre-suit investigation, may involve investigation activities by plaintiffs and their attorneys before initiating legal proceed- ings. For example, a board of directors may hire a public accounting firm other than their external auditors to investigate potential fraud. The legal process makes up the third stage involving activities such as filing of complaints, discovery, trial preparation, and the trial. The last stage involves the resolution of the dispute, which may include a summary judgment, a settlement to avoid or discontinue litigation, or a court decision on appeal after a trial.

Auditors can be sued by clients, investors, creditors, and the government for failure to perform professional services with due professional care. Auditors can be held liable under two broad categories of law:

1. Common law. Case law developed over time by judges who issue legal opinions when deciding a case (the legal principles announced in these cases become precedent for judges deciding similar cases in the future).

2. Statutory law. Written law enacted by the legislative branch of federal and state governments.

It is important to understand the differences between these two legal categories. Table 20–1 defines key legal terms, and Table 20–2 summarizes the auditor’s liability by category of law and actions resulting in liability.

Under common law, auditors can be held civilly, but not criminally, liable. Typical civil actions under common law allege that the auditor did not properly perform the audit. For example, under common law, an auditor can be held liable to clients for breach of contract,

LO 20-1

2See Chapter 2 in Z. Palmrose, Empirical Research in Auditor Litigation: Considerations and Data, Studies in Accounting Research #33 (Sarasota, FL: American Accounting Association, 1999), for a detailed discussion of the four stages of the process.

LO 20-2

Practice I N S I G H T

The Costs of Litigation: The following list provides the amounts of some of the larger audit-related lawsuits for the Big 4:

Audit-related litigation can be very expensive, but auditors do not have a monopoly on expensive litigation. Tax-related litigation is actually more frequent, and while many tax claims are for relatively small amounts, tax-related settlements can be very large. For example, in 2005, KPMG LLP settled a lawsuit with the U.S. Justice Department for $456 million for selling aggressive and improper tax shelters that helped wealthy Americans avoid taxes. In a related case with purchasers of the tax shelters, KPMG also agreed to pay $123 million.

Audit Firm Client Settlement Amount

EY Cendant $335 million

PwC Tyco 225 million

Deloitte Adelphia 210 million

Deloitte Parmalat 149 million

KMPG Rite Aid 125 million

Final PDF to printer

676 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 676 09/30/15 02:21 PM

Definitions of Key Legal Terms

Breach of contract Occurs when the client or auditor fails to meet the terms and obligations established in the contract (either expressly or implied), which is normally finalized in the engagement letter. Third parties may have privity or near privity of contract.

Civil law All law that does not relate to criminal matters. Class action Lawsuit filed by one or more individuals on behalf of all persons who may have invested on the basis of the same false and

misleading information. Criminal law Statutory law that defines the duties citizens owe to society and prescribes penalties for violations. Fraud Actions taken with the knowledge and intent to deceive. Gross negligence An extreme, flagrant, or reckless departure from professional standards of due care. This is also referred to as constructive

fraud. Ordinary negligence An absence of reasonable or due care in the conduct of an engagement. Due care is evaluated in terms of what other profes-

sional accountants would have done under similar circumstances. Privity A contract or specific agreement exists between two parties. Absent a contractual or fiduciary relationship, the accountant

does not owe a duty of care to an injured party. Scienter Acting with intent to deceive, defraud, or with knowledge of a false representation. Tort A wrongful act, other than a breach of contract, for which civil action may be taken.

T A B L E 2 0 – 1

Summary of Types of Liability and Auditors’ Actions Resulting in Liability

Type of Liability Auditors’ Actions Resulting in Liability

Common law—liability to clients Breach of contract Negligence Gross negligence/constructive fraud Fraud

Common law—liability to third parties Negligence Gross negligence/constructive fraud Fraud

Federal statutory law—civil liability* Negligence Gross negligence/constructive fraud Fraud

Federal statutory law—criminal liability* Willful violation of federal statutes

*Auditors may also be civilly and criminally liable under state statutes. Coverage of liability under specific state statutes is beyond the scope of this book.

T A B L E 2 0 – 2

negligence, gross negligence, and fraud. The auditor’s liability to third parties (e.g., investors and creditors) under common law is complicated by the fact that legal precedent differs by jurisdiction. In other words, the law applicable to a common-law case depends on the location where the case is tried (i.e., state by state). Some jurisdictions follow a common-law doctrine that provides a very narrow interpretation of auditors’ liability to third parties, while others follow a more liberal interpretation. Most common-law cases are decided in state courts, but there are circumstances where common-law cases can be decided in federal court (for exam- ple, a negligence claim may be brought in federal court where parties are from different states and the amount of damages being sought exceeds $75,000).

Under statutory law an auditor can be held civilly or criminally liable. A civil claim can result in fines and sanctions but not incarceration. While there are federal and state statutes, in this text we focus only on federal statutes. Federal statutes such as the Securities Act of 1933, the Securities Exchange Act of 1934, and the Sarbanes-Oxley and Dodd-Frank Acts (and related SEC rulings) provide the legal basis for action against auditors. Auditors are liable mainly for gross negligence and fraud under these statutes; however, some parts of the acts have been used to hold auditors liable for ordinary negligence. While under certain circum- stances an auditor can be held criminally liable under statutory law, there have been relatively few instances of major criminal actions against auditors.

Final PDF to printer

Chapter 20 Legal Liability 677

mes32502_ch20_672-706.indd 677 09/30/15 02:21 PM

The remainder of the chapter is organized according to the four categories of liability faced by auditors outlined in Table 20–2:

∙ Common law—liability to clients. ∙ Common law—liability to third parties. ∙ Federal statutory law—civil liability (clients and third parties). ∙ Federal statutory law—criminal liability (government).

Common Law—Clients

Common law does not require that the public accountant guarantee his or her work product. It does, however, require that the auditor perform professional services with due care. Due care or due professional care requires the auditor to perform his or her professional services with the same degree of skill, knowledge, and judgment possessed by other members of the profession. This includes, but is not limited to, an expectation that auditors will perform an audit in conformance with GAAS or relevant professional auditing standards, and that the audited financial statements will comply with GAAP. When an auditor fails to carry out con- tractual arrangements with the client, he or she may be held liable for breach of contract or negligence. The auditor can also be held liable to the client for gross negligence and fraud.

Breach of Contract—Client Claims A breach of contract occurs when the client fails to complete its obligation or when the audi- tor fails to complete the services agreed to in the contract. As discussed in Chapter 3, an engagement letter should establish the responsibilities for both the auditor and the client. In performing an audit, the auditor’s obligation is to examine the entity’s financial statements and issue the appropriate opinion in accordance with professional standards. The contract between the client and the auditor stipulates the amount of fees to be charged for the desig- nated professional services, and deadlines for completing the services are normally indicated or implied in the contract. If the client breaches its obligations under the engagement letter, the auditor is excused from his or her contractual obligations. If the auditor discontinues an audit without adequate cause, he or she may be liable for economic injury suffered by the client (Exhibit 20–1). Similarly, other issues (such as timely delivery of the audit report or failure to detect a material defalcation) can lead to litigation by the client against the auditor. When the auditor is found to have breached the contract, the auditor is only liable for damages caused by the breach.

Negligence—Client Claims A tort is a wrongful act, other than a breach of contract, for which civil action may be taken. If an engagement is performed without due care, the public accountant may be held liable for an actionable tort in negligence. The auditor typically faces larger legal damage assessments for a tort than for a breach of contract. Liability for negligence represents a deviation from a standard of behavior that is consistent with that of a “reasonable person.” When an individual such as a public accountant possesses special skills and knowledge, ordinary reasonable care is not sufficient. An oft-cited quote from Cooley’s Torts3 indicates the responsibility of those offering special skills:

In all those employments where particular skill is requisite, if one offers his services, he is under- stood as holding himself out to the public as possessing the degree of skill commonly possessed by others in the same employment, and if his pretensions are unfounded, he commits a species of fraud upon every man who employs him in reliance on his public profession. But no man, whether skilled or unskilled, undertakes that the task he assumes shall be performed successfully, and without fault

LO 20-3

3D. Haggard, Cooley on Torts, 4th ed., p. 472.

Final PDF to printer

678 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 678 09/30/15 02:21 PM

or error; he undertakes for good faith and integrity, but not for infallibility, and he is liable to his employer for negligence, bad faith, or dishonesty, but not for losses consequent upon mere errors of judgment.

Thus, a CPA has the duty to conduct an engagement using the same degree of care that would be used by an ordinary, prudent member of the public accounting profession.

To recover against an auditor in a negligence case, the client must prove the following:

1. The auditor had a duty to the client to conform to a required standard of care. 2. The auditor breached that duty by failing to act with due professional care. 3. There was a direct causal connection between the auditor’s negligence and the

client’s damage. 4. The client suffered actual losses or damages as a result.

Negligence suits by clients against auditors often allege that the auditor was negligent in not detecting a misstatement or fraud. Auditors’ defenses against client negligence claims include the following:

1. No duty was owed. 2. The client was negligent (contributory negligence, comparative negligence, or

management fraud). 3. The auditor’s work was performed in accordance with professional standards. 4. The client suffered no loss. 5. The alleged auditor negligence did not substantially contribute to the client’s loss

(lack of causal connection). 6. The claim is invalid because the statute of limitations has expired.4

4Statute limitations for negligence claims vary from jurisdiction to jurisdiction with a range of 1 to 6 years. The statute in most jurisdictions is 3 years or less. The statutes do not restrict auditor liability for fraud. A statute of limita- tions prescribes the period of time where certain kinds of legal actions can be brought to the courts.

Deloitte’s Withdrawal from Medtrans Audit Upheld

Medtrans, an ambulance service provider, retained Deloitte to audit its financial statements. Medtrans needed capital and sought $10 million in financing from an outside investor. Medtrans gave the potential investor unaudited financial statements showing profits of $1.9 million. Deloitte was in the process of com- pleting its audit during Medtrans’ negotiations with the outside investor. Deloitte proposed adjustments that resulted in Medtrans’ financial statements showing a $500,000 loss. Prior to Deloitte proposing the adjustments, the company’s CFO resigned after indicating that he could not sign the management repre- sentation letter. When presented with the proposed adjustments, Medtrans’ CEO threatened to get a court order forcing Deloitte to complete the audit. Deloitte withdrew from the engagement. Medtrans retained two other CPA firms, both of which were either discharged or withdrew. A third firm issued an unqualified audit report that contained the adjustments proposed by Deloitte.

Medtrans alleged that Deloitte’s wrongful withdrawal resulted in the company’s failure to complete the financing, and that the subsequent sale of the company was for significantly less than its true value. At trial Medtrans asserted that, under California law, a CPA firm could not, under any circumstances, with- draw from an engagement if it unduly jeopardized the interest of the client. The jury in this case ruled in favor of Medtrans and awarded the company nearly $10 million. Deloitte argued that the approved Cali- fornia jury instructions on the duration of a professional’s duty were contrary to professional standards, which authorize the auditor to resign.

In 1998 the California Court of Appeals reversed the decision, holding that judges should instruct juries about the profession’s standards. The court held that an auditor, by auditing financial statements, assumes a public responsibility that transcends any employment relationship with the client. This decision is significant because it held that an accountant’s duty of care can be based on professional standards rather than rules of law that are contrary to professional standards.

Sources: National Medical Transportation Network v. Deloitte & Touche, 98 D.A.R., 2850, 1998; and “Court Rules on Importance of GAAP and GAAS,” Journal of Accountancy (June 1998), p. 24.

E X H I B I T 2 0 – 1

Final PDF to printer

Chapter 20 Legal Liability 679

mes32502_ch20_672-706.indd 679 09/30/15 02:21 PM

The client can typically prove the existence of a duty of care based on the engagement contract. However, the auditor may be able to argue successfully that the client’s loss was due to the client’s negligence. Some states permit a defense of contributory negligence or in pari delicto (in equal fault) as a complete bar to recovery by a client. A recent case where the auditor successfully used the in pari delicto defense, Allegheny Health v. Price- waterhouseCoopers, is discussed in Connect. However, most states follow the view of comparative negligence because it is not as harsh as an all-or-nothing approach. Under the comparative negligence view, the jury is permitted to assess the relative fault of the parties. For example, if an entity’s system of internal control is deficient because the client failed to provide adequate training or personnel, any recovery by the entity against the auditor is reduced in proportion to the fault of the client. When top management of the client has engaged in fraud, the auditor may be able to attribute the fraud to management and prevent recovery for a negligently performed audit. This defense has been used successfully by audi- tors, including in the well-known Cenco, Inc. v. Seidman & Seidman case involving such circumstances. Exhibit 20–2 presents a summary of the Cenco case. In this instance, new management at the audit client alleged that Seidman & Seidman was negligent for not hav- ing uncovered the prior management’s fraudulent actions. The court ruled that, considering management’s involvement in the fraud, the CPA firm had not been negligent.

Another well-known case that alleged the accountant was negligent is 1136 Tenants v. Rothenberg, which relates to unaudited financial statements and the CPA’s failure to com- municate suspicious circumstances to the client. Exhibit 20–3 presents a summary of the case. The 1136 Tenants case established a duty on the part of a CPA doing work on unau- dited financial statements to communicate to the client any circumstances that give reason to believe that fraud may exist. One outcome of this case was the establishment of Statements on Standards for Accounting and Review Services, which prescribe procedures that CPAs should follow when performing engagements such as compilations and reviews (discussed in Chapter 21).

Fraud—Client Claims An auditor can be held liable to clients for fraud when he or she acted with knowledge and intent to deceive. Generally, however, actions alleging fraud on the part of the auditor result from lawsuits by third parties and thus are discussed in more detail in the next section.

The Cenco Case

For a number of years, management of Cenco, Inc., engaged in a massive fraud. The fraud began in the company’s Medical/Health Division and eventually spread to Cenco’s top management. By the time the fraud was made public, even the chairman and president were involved in the fraud. Seidman & Seidman was Cenco’s auditor throughout the period of the fraud.

The fraud involved primarily the inflating of inventories in the Medical/Health Division above their fair market value to increase its stock price. Thus, the fraud did not involve stealing from the company. Rather, the fraudsters had devised ways to steal from outsiders (e.g., creditors and insurers) to the benefit of existing shareholders.

Cenco’s new management filed breach-of-contract, negligence, and fraud claims against Seidman & Seidman, and a trial date was set. One day before the start of the trial, Seidman & Seidman offered to pay $3.5 million to settle the class action suit, but Cenco turned the offer down. Prior to submitting the case to the jury, the trial judge granted a directed verdict in favor of Seidman & Seidman on the claim that the CPA firm had aided and abetted the fraud. The case went to the jury on the three remaining counts of breach of contract, negligence, and fraud. The jury found that Seidman & Seidman was innocent on all counts. The verdict was appealed by Cenco. The U.S. Court of Appeals upheld the lower court and found that Seidman & Seidman had not been responsible for any liability for breach of contract, negligence, or fraud. The court held that the auditors of a corporation could use the fraud of corporate managers as a defense to claims against the auditor by the corporation.

E X H I B I T 2 0 – 2

Final PDF to printer

680 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 680 09/30/15 02:21 PM

Under common law, auditors can be held liable to third parties for negligence, gross negli- gence, and fraud. This area of liability is very complex, and court rulings are not always con- sistent across state and federal judicial jurisdictions. As mentioned earlier, most common-law claims are decided in state courts.

Ordinary Negligence—Third-Party Claims When an auditor fails to conduct an engagement with due care, he or she can, in some situa- tions, be held liable for ordinary negligence to third parties (plaintiffs) under common law. To prevail in a suit alleging negligence, the third party must prove all of the following:

1. The auditor had a duty to the plaintiff to exercise due care. 2. The auditor breached that duty by failing to act with due professional care. 3. There was a direct causal connection between the auditor’s negligence and the third

party’s injury (e.g., the financial statements were misleading and the third party relied on the financial statements).

4. The third party suffered an actual loss as a result.

The main difficulty faced by third parties in proving negligence against an auditor is showing that the auditor’s duty to exercise due care extended to them. Over time, four common-law standards have evolved for determining the types of third parties that can suc- cessfully sue auditors for ordinary negligence. The four legal standards are privity, near priv- ity, foreseen third parties (or Restatement Standard), and reasonably foreseeable third parties. The doctrine that will be applied in deciding a case depends on the precedents established in the state where the case is decided.

LO 20-4

The 1136 Tenants Case

Jerome Riker was a powerful New York City businessman with extensive business interests in the real estate industry in the 1960s. Riker diverted money from a number of trust funds of cooperatives that he managed for use in a personal real estate investment.

One of the cooperatives that was involved in the embezzlement was the 1136 Tenants’ Corporation. Riker had misappropriated approximately $130,000 of the cooperative’s funds. When the cooperative was unable to recover the funds from Riker, it filed a civil suit against the public accounting firm, Max Rothenberg & Company, which had prepared the annual financial statements and tax return. The plaintiffs alleged that the accounting firm should have discovered the embezzlement of funds by Riker.

One issue that arose during the trial was the contractual agreement between the public accounting firm and the 1136 Tenants’ Corporation. There was no written engagement letter, only an oral agreement between one of the firm’s partners and Riker. The cooperative alleged that the firm had been retained to do an audit, while the firm alleged that it had been retained only to prepare the tax return and perform “write-up” ser- vices. Another issue was the fact that the firm had identified some missing invoices and had not investigated these items further. The workpapers detailed $44,000 of expenses for which no supporting documentation could be located. These were fictitious expenses used by Riker to extract funds from the cooperative.

The court ruled that even if the firm had agreed to provide only write-up services, it had an obligation to notify the tenants about the suspicious nature of the missing invoices. Damaging to the firm’s defense was the admission by one of its partners that the engagement had been more extensive than that called for by a normal write-up engagement. The income statement also included an expense labeled “audit.” The court ruled in favor of the tenants and awarded them damages of more than $230,000. The decision was upheld upon appeal by the New York appellate court. The size of the judgment was far in excess of the fee of $600 paid to the firm.

This court decision resulted in two significant changes in the profession: • It reinforced the need by firms to have written engagement letters. • It led to the issuance by the AICPA of Statements on Standards for Accounting and Review Services.

E X H I B I T 2 0 – 3

Common Law—Third Parties

Final PDF to printer

Chapter 20 Legal Liability 681

mes32502_ch20_672-706.indd 681 09/30/15 02:21 PM

Privity The most restrictive view under common law is that auditors have no liability for ordinary negligence to third parties who do not have a privity relationship with the auditor. Privity means that a contract or specific agreement exists between two parties. Third par- ties to a contract between an auditor and a client, such as investors or creditors of the client, typically lack privity because they were not directly involved in the agreement between the auditor and the client and thus cannot successfully sue the auditor, even if the auditor was negligent. The landmark decision in this area, Ultramares v. Touche, held that the auditor was not liable to third parties who relied on a negligently prepared audit report. Exhibit 20–4 pro- vides a summary of the Ultramares case. The rationale for this finding by the New York Court of Appeals is summarized in a famous quote by Judge Benjamin Cardozo:

If a liability for negligence exists, a thoughtless slip or blunder, the failure to detect a theft or forg- ery beneath the cover of deceptive entries, may expose accountants to a liability in an indeterminate amount for an indeterminate time to an indeterminate class. The hazards of a business on these terms are so extreme as to enkindle doubt whether a flaw may not exist in the implication of a duty that exposes to these circumstances.

Thus the Ultramare doctrine is based on the premise that the potential liability of accoun- tants should be restricted in cases of ordinary negligence. States that have more recently fol- lowed the strict privity or Ultramares doctrine include Pennsylvania and Nevada.

Stop and Think: If a third-party plaintiff is in Pennsylvania and it determined to not have a privity relationship with the auditor, under what conditions might they be able to successfully sue an auditor under common law?

The privity requirement under the Ultramares doctrine does not apply when the auditor is charged with fraud. Furthermore, while Judge Cardozo followed a strict privity doctrine in the Ultramares case, he opened the door for third parties without privity to sue if the neg- ligence was so great as to constitute gross negligence, also known as constructive fraud. In other words, in a jurisdiction that follows the Utramares doctrine, plaintiffs can successfully

The Ultramares Case

Fred Stern & Company imported and sold rubber during the 1920s. This industry required extensive working capital, and the company used borrowings from banks for its financing activities. In 1924 Stern requested a $100,000 loan from Ultramares Corporation. Before deciding to make the loan, Ultramares requested that Stern provide an audited balance sheet. Touche, Niven & Company had just issued an unqualified audit report on the December 31, 1923, balance sheet.

Stern’s management asked Touche to provide 32 serially numbered copies of the audit report. Touche had audited Stern for three years and knew that the audit reports were being used by Stern to obtain external debt financing. Touche, however, did not know which specific banks or finance companies would be given the reports. The balance sheet showed assets of $2.5 million. Ultramares provided the $100,000 loan and additional loans totaling $65,000. In addition, Stern obtained bank loans of approximately $300,000 by providing the December 31, 1923, balance sheet audited by Touche.

In 1925 the company declared bankruptcy. It came to light during the trial that Stern had already been bankrupt in 1923 and that false accounting record entries had concealed the company’s problems. Ultra- mares alleged that Touche had been both negligent and fraudulent in its audit of Stern.

The jury in the case dismissed the fraud charges against Touche but ruled that Touche had been neg- ligent and awarded approximately $186,000 in damages. The trial judge overturned the jury’s verdict on the grounds that Ultramares had not been in privity with Touche. The appellate division of the New York Supreme Court voted 3 to 2 in favor of Ultramares, ruling that the judge had inappropriately overruled the jury verdict. Touche’s attorneys appealed the decision to the court of appeals, which ruled unanimously in favor of Touche, therefore upholding the privity doctrine. The quote included in the text by Judge Cardozo, the chief justice of the court of appeals, summarizes the decision.

E X H I B I T 2 0 – 4

Final PDF to printer

682 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 682 09/30/15 02:21 PM

sue auditors even if they do not have privity so long as the plaintiff can prove the auditors were guilty of gross negligence or fraud.

Near Privity While the Ultramares decision established a strict privity standard, a number of subsequent court decisions in other states have moved away from this standard over time. In 1985 the New York Court of Appeals expanded the privity standard in the case of Credit Alliance v. Arthur Andersen to include third parties whose relationship with the accountant approaches privity. In this lawsuit, Credit Alliance alleged that the auditor had known that the plaintiff was the client’s principal lender and had frequently communicated with the plaintiff regarding the audited financial statements. The court upheld the lender’s claim that Arthur Andersen had known that Credit Alliance was relying on the financial statements prior to extending credit. The court also ruled that there had been direct communication between the lender and the auditor regarding the client. The Credit Alliance case lists the following tests that must be satisfied for holding auditors liable for ordinary negligence to third parties: (1) the accountant must be aware that the financial statements are to be used for a particular purpose or purposes, (2) in the furtherance of which a known party or parties was intended to rely, and (3) there must have been some conduct on the part of the accountants linking them to that party or parties, which provides evidence of the accountants’ understanding of intended reliance.

In a 2010 case, the New York Supreme Court ruled in favor of the auditors because the plantiff’s evidence of near privity was based on one telephone call to the auditor, which the court ruled was insufficient “linking evidence” to establish near privity (Barrett v. Freifeld). In 2005, a court ruled that payment of some of the accountant’s fees by a third party for services provided to the client was not sufficient to establish near privity because there was no communication between the third party and the accountant (Carter v. Carlis). Based on these cases, it appears that a critical test is the third test, the requirement that the third party be known to the auditor and that the auditor has directly conveyed the audit report or acted to induce reliance on the audit report. Most third parties who are not in actual privity of contract with the auditors will not likely meet the demanding near privity standard, since the auditor will usually not have communicated directly with the plaintiff. States that have followed the near privity doctrine include Idaho, Illinois, Indiana, Montana, and New York.

It is important to remember that third-party plaintiffs in all jurisdictions are able to suc- cessfully sue auditors for gross negligence or fraud, regardless of their privity status.

Foreseen Third-Party or Restatement Standard The “middle ground” approach fol- lowed by the vast majority of states (and federal courts located within those states) expands the class of third parties that can successfully sue an auditor for negligence beyond near priv- ity to a person or limited group of persons whose reliance is actually foreseen, even if the specific person or group is unknown to the auditor. In essence, the courts in these jurisdictions have reexamined the notion of caveat emptor (“buyer beware”) and substituted the concept of public responsibility. Among the reasons that have been advanced by the courts for expanding the scope beyond near privity are (1) the increased liability of other professionals to nonpriv- ity users of their services, (2) the lack of fairness of imposing the burden of economic loss on innocent financial statement users, (3) the assumption that expanded liability will cause auditors to improve their auditing procedures, (4) the ability of auditors to obtain insurance against the increased risks, and (5) the ability of the auditors to pass the increased audit costs and insurance premiums on to their clients. However, as discussed earlier, large firms may not be able to obtain adequate liability insurance.

In 1968 a federal district court decision, Rusch Factors. v. Levin, applied Section 552 of the Restatement (Second) of the Law of Torts to an accountant’s third-party liability suit. The case is described in Exhibit 20–5. In brief, a company engaged Levin to audit the financial statements for the purpose of obtaining financing from Rusch Factors. The statements por- trayed the company as solvent. The plaintiff made a large loan to the company, which subse- quently went bankrupt. The federal district court found the public accounting firm negligent, relying on Section 552 of the Restatement in reaching its decision.

Final PDF to printer

Chapter 20 Legal Liability 683

mes32502_ch20_672-706.indd 683 09/30/15 02:21 PM

The Restatement is a compendium of common law prepared by legal scholars and pres- ents an alternative view to the traditional privity doctrine. Section 552 states the following:

One who, in the course of his business, profession, or employment . . . supplies false information for the guidance of others in their business transactions, is subject to liability for pecuniary loss caused to them by their justifiable reliance upon the information, if he fails to exercise reasonable care or competence in obtaining or communicating the information.

The liability . . . is limited to loss suffered (a) by the person or one of the persons for whose benefit and guidance he intends to supply the information, or knows that the recipient intends to supply it; and (b) through reliance upon it in a transaction which he intends the information to influence, or knows that the recipient so intends. . . .

The liability of one who is under a public duty to give the information extends to loss suffered by any of the class of persons for whose benefit the duty is created, in any of the transactions in which it is intended to protect them.

The Restatement broadens the auditor’s liability beyond those with privity or near privity to a small group of persons and classes who are or should be foreseen by the auditor as relying on the financial information. However, because the language of the Restatement is general, it is subject to different interpretations. The following examples abstracted from the Restate- ment help illustrate the possibilities for auditor liability.

The Rusch Factors Case

In this case, the plaintiff, Rusch Factors, Inc., had requested audited financial statements as a prerequisite for providing a loan to a Rhode Island corporation. Levin issued a clean audit opinion on the financial statements, indicating the company to be solvent when it was actually insolvent. Rusch Factors loaned the corporation $337,000 based on the audited financial statements. When the company went into receiver- ship, Rusch Factors sued Levin for a loss of $121,000.

The federal district court, sitting in Rhode Island, denied Levin’s motion to dismiss for a lack of privity. In finding Levin liable for negligence, the court concluded that the Ultramares doctrine was inappropriate and relied heavily on the Restatement (Second) of the Law of Torts. The court stated that the auditor had known that his certification was to be used and relied upon by Rusch Factors, and therefore he could be held liable for financial misrepresentations relied upon by foreseen and limited classes of persons.

E X H I B I T 2 0 – 5

Example 1 Cornelius Manufacturing Co. is negotiating for a $1,000,000 loan from the First National Bank of Sun City. The bank requires that Cornelius Manufacturing provide audited financial statements. Cornelius engages the public accounting firm of Cantbe & Mustbe (C&M) to conduct the audit, informing them that the audit is for the express purpose of obtaining credit from the First National Bank of Sun City. C&M accepts the engagement with the understanding that the financial statements are for the bank’s use. The First National Bank of Sun City goes into bankruptcy, and Cornelius submits the audited financial statements to Waldo National Bank without communicating with C&M. Waldo National Bank lends Cornelius the $1,000,000. The financial statements materially overstate the financial resources of Cornelius, and Waldo National Bank suf- fers a loss on the loan. In this example, the Restatement indicates that C&M is not liable to Waldo National Bank because Waldo was not a foreseen third party.

Example 2 The same facts apply as in Example 1, except that Cornelius says nothing to C&M about supplying the financial statements to the First National Bank of Sun City; Cor- nelius merely tells C&M that the company expects to negotiate a bank loan and is

Final PDF to printer

684 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 684 09/30/15 02:21 PM

Subsequent to the Rusch Factors case, a number of state and federal courts have followed the approach outlined in the Restatement Standard to determine third parties eligible to sue auditors for ordinary negligence. To successfully apply the Restatement Standard or Rusch Factors doctrine, the auditor has to be provided with sufficient description of the proposed use of the financial statements. A 2008 case, Travelers v. Reznick, illustrates this point. Trav- elers suffered a loss after issuing a performance bond, which is an insurance guarantee that a construction company will satisfactorily complete a construction project. Travelers sued the auditor for negligence because it had relied on the construction company’s audited finan- cial statements, which were later determined to be misstated. The auditor had been told by the construction company that the financial statements would be used by third parties when deciding whether to “extend credit or otherwise accept liabilities.” However, the Georgia court dismissed the case because the description was too broad and did not provide the audi- tors with specific knowledge that the audited financial statements would be used to support the issuance of performance bonds. Similarly, the courts have held that if a company fails subsequent to being acquired and the plan to acquire was unknown to the auditor, the acquir- ing company is not considered to be a foreseen third party (e.g., Western SEC. Bank v. Eide Bailly, 2010).

Several cases (e.g., Loop Corp. v. McIlroy, 2004; Tocchet v. Cater, 2003) have dealt with the issue of whether purchasers of a company’s stock on the open market should be foreseen users and can hold auditors liable under Restatement Section 552. Plaintiffs argue that federal securities laws impose public duties upon auditors that should extend to Section 552. If courts agree with the plaintiffs’ arguments, then auditors would owe a duty under Section 552 to every shareholder and perhaps to all potential investors in a publicly held corporation. Essen- tially, this would mean that all shareholders and potential shareholders could sue auditors for ordinary negligence under common law. Thus far, courts have ruled that Section 552 does not impose a public duty.

Reasonably Foreseeable Third Parties The courts of three jurisdictions (Mississippi, New Jersey, and Wisconsin) have used a more expansive view of auditors’ liability to third parties: reasonably foreseeable third parties. In the precedent-setting case in this area, Rosen- blum v. Adler, the New Jersey Supreme Court ruled that Touche Ross & Co. was responsible for damages incurred by all reasonably foreseeable third parties who had relied on the finan- cial statements. Exhibit 20–6 provides more details on this case.5

Another important case that followed this approach was Citizens State Bank v. Timm, Schmidt & Co. (1983). In this case, the bank sued the public accounting firm after relying on financial statements for one of its debtors that had been audited by Timm, Schmidt & Company. The Wisconsin court extended the scope of third parties to include all reasonably

5While the precedent set by the Rosenblum case in New Jersey has been followed by other states, subsequent legisla- tion in New Jersey (1995) overturned Rosenblum and restricts auditor liability to the near privity standard. Recent court cases in New Jersey have upheld the near privity standard (e.g., Dickerson v. Ernst & Young, 2003).

considering going to the First National Bank of Sun City. In this instance, the Restate- ment indicates that C&M would be liable to Waldo National Bank because Waldo was a foreseen third party.

Example 3 The same facts apply as in Example 2, except that Cornelius informs C&M that the company is planning on negotiating a bank loan without mentioning a specific bank. Again, under the Restatement, C&M would be liable to Waldo National Bank because Waldo was a foreseen third party.

Final PDF to printer

Chapter 20 Legal Liability 685

mes32502_ch20_672-706.indd 685 09/30/15 02:21 PM

foreseeable users. The court used a number of the reasons just cited for extending auditors’ liability beyond privity. The following quote from this case demonstrates the court’s thoughts.

If relying third parties, such as creditors, are not allowed to recover, the cost of credit to the gen- eral public will increase because creditors will either have to absorb the cost of bad loans made in reliance on faulty information or hire independent accountants to verify the information received. Accountants may spread the risk through the use of liability insurance.

A weakness in this argument is that the larger public accounting firms may not be able to secure sufficient liability insurance, or the cost of such insurance may be too costly to be affordable.

Since 1987 no state high court has adopted the foreseeability approach to accountant lia- bility, while a large number have approved or adopted one of the narrower standards.6 For example, in Bily v. Arthur Young (1992) the California Supreme Court expressly rejected the foreseeability approach in favor of the Rusch Factors or Restatement Standard. The court gave a number of reasons for rejecting the Rosenblum foreseeablity approach, including that the foreseeability rule exposes auditors to potential liability in excess of their proportionate share and that sophisticated plaintiffs have other ways to protect themselves from the risk of inaccu- rate financial statements (e.g., they can negotiate improved terms or hire their own auditor).

However, in Murphy v. BDO Seidman (2003), the California Court of Appeals ruled that “grapevine plaintiffs,” who alleged indirect reliance based on what others (e.g., stockhold- ers and stockbrokers) told them about the financial statements, had legal claims for ordinary negligence against the auditors so long as the auditor would have reasonably foreseen that stockholders or stockbrokers would tell other people of the content of the financial statements and that the other people would rely upon the misrepresentations in purchasing the corporate stock. The court ruled that nothing in the Bily decision precludes indirect reliance.

Figure 20–1 illustrates the four legal doctrines just covered and how moving from left to right there is a broader class of third parties eligible to sue auditors for ordinary negligence under common law.

Stop and Think: Why do we still link the names of old cases with the different legal doctrines in Figure 20–1?

6See Chapter 4 in Goldwasser and Arnold, Accountants’ Liability (Practising Law Institute, 2014).

The Rosenblum Case

The Rosenblum family agreed to sell its retail catalog showroom business, H. Rosenblum, Inc., to Giant Stores in exchange for Giant common stock. The Rosenblums relied on Giant’s 1971 and 1972 finan- cial statements, which had been audited by Touche Ross & Co. A year later, it was revealed that Giant Stores’ financial statements contained material misstatements. Giant Stores filed for bankruptcy, and the company’s stock became worthless. The Rosenblums sued Touche, alleging negligence. Touche did not know the Rosenblums and had not known that the financial statements would be relied on during merger negotiations.

The lower courts in this case did not allow the Rosenblums’ claims against Touche, on the grounds that the Rosenblums did not meet either the Ultramares privity test or the Restatement (Second) of the Law of Torts’ “foreseen third parties” test. The New Jersey Supreme Court overturned the lower courts’ decisions. The court held that the auditor had “a duty to all those whom the auditor should reasonably foresee as recipient from the company of the statements for its proper business purposes, provided that the recipients rely on the statements.” Thus the court concluded that auditors should be liable to all rea- sonably foreseeable third parties who rely on the financial statements. The court indicated that the audi- tor’s function had expanded from one of a watchdog for management to that of an independent evaluator of the adequacy and fairness of the financial statements presented by management to third parties. The court also cited the accountant’s ability to obtain insurance against third-party claims.

E X H I B I T 2 0 – 6

Final PDF to printer

686 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 686 09/30/15 02:21 PM

Because common law is built on case law, the precedent-setting cases are used to label the legal doctrines. If you are interested in reading a more recent actual court case that con- siders these legal doctrines you can read about the Anjoorian vs. Pascarella & Trench case in Connect.

Auditor Defenses The defenses presented earlier in this chapter under liability to clients are also available to auditors sued by third parties for ordinary negligence under common law. For example, a number of negligence suits against auditors have been successfully defended by demonstrating that the alleged negligence did not substantially contribute to the third- party’s losses (lack of causal connection). An additional defense in the area of third-party negligence, depending on the jurisdiction, is for the auditor to argue that the third party does not qualify as a foreseen party or does not have near privity.

7Following the Parmalat fraud, there were law suits against Deloitte’s and Grant Thornton’s international umbrella firms related to the Parmalat audit conducted in Italy. A New York federal judge accepted the case under the legal doctrine of “agency theory,” as the affiliate firms could be considered agents of the umbrella organization if the umbrella organization can exert significant control over the auditing policies and practices of the affiliate firms. In 2010 the case was transferred to an Illinois state court and in 2013 the Illinois court ruled in favor of Deloitte and Grant Thornton, who successfully used the in pari delicto (in equal fault) defense.

Common Law Doctrines for Third Parties Suing Auditors for Ordinary Negligence

*The foreseen third party, Restatement Standards, or Rusch Factors doctrine is the legal doctrine followed by most states.

F I G U R E 2 0 – 1

Narrowest definition of eligible third

parties

Broadest definition of eligible third

parties

Privity Near privity Foreseen or restatement

standard*

Reasonably foreseeable

Ultramares Credit Alliance Rusch Factors Rosenblum

Practice I N S I G H T

While the large international audit firms market themselves as global firms with uniform practices and quality control standards in offices worldwide, these entities are legally formed as a network of affili- ated firms (e.g., U.S. affiliate, Canadian affiliate, Japanese affiliate). To date, the courts have declined to find that an umbrella global audit entity is legally responsible for the misconduct of one of the affiliates in the network. However, the affiliate involved in the misconduct can be, and often is, held responsible. For example, as discussed later on in the chapter, Indian affiliate firms to Pricewater- houseCoopers International Limited (the global entity) were sanctioned and fined by the PCAOB and SEC for not following auditing standards in the massive 2009 accounting fraud at Satyam Computer Services headquartered in New Delhi, India.7

Fraud and Gross Negligence—Third-Party Claims If an auditor has acted with knowledge and intent to deceive a third party, he or she can be held liable for fraud. As noted earlier, common-law liability for fraud is available to any third parties in any jurisdiction. The plaintiff (third party) must prove

1. A false representation by the accountant. 2. Knowledge or belief by the accountant that the representation was false.

Final PDF to printer

Chapter 20 Legal Liability 687

mes32502_ch20_672-706.indd 687 09/30/15 02:21 PM

3. That the accountant intended to induce the third party to rely on false representation. 4. That the third party relied on the false representation. 5. That the third party suffered damages.

Courts have held that fraudulent intent or scienter may be established by proof that the accountant acted with knowledge of the false representation.

However, liability for fraud is not limited only to cases where the auditor was knowingly deceitful. Some courts have interpreted gross negligence as an instance of fraud (also referred to as constructive fraud). Gross negligence is defined to be an extreme, flagrant, or reckless deviation from professional standards of due care. An important case in this area is State Street Trust v. Ernst. In this case, the auditors issued an unqualified opinion on their client’s financial statements, knowing that State Street Trust Company was making a loan based on those financial statements. A month later, the auditors sent a letter to management of the client indicating that receivables had been overstated. The auditors, however, did not com- municate this information to State Street Trust Company, and the client subsequently went bankrupt. The New York court ruled that the auditor’s actions appeared to be grossly negli- gent and that “reckless disregard of consequences may take the place of deliberate intention.” In such cases, while fraudulent intent or scienter may not be present, the court “constructs” fraud due to the grossness of the negligence.

The Phar-Mor v. Coopers & Lybrand case is another example of how auditors were found guilty of fraud under both common and statutory law, even though the plaintiffs acknowl- edged that the auditors had no intent to deceive. Instead, the plaintiff successfully argued reckless disregard for the truth (i.e., gross negligence or constructive fraud) which gives rise to an inference of fraud. Thus, plaintiffs that are barred from suing for ordinary negligence in a particular jurisdiction, because they are not in privity or not foreseen users, can opt to sue the auditor for fraud because for the auditor to be found guilty under a fraud charge, the plaintiffs need only prove gross negligence. The Phar-Mor case write-up and excerpts from the actual trial are available in Connect.

In more recent cases (e.g., Houbigant v. Deloitte & Touche, 2003; Reisman v. KPMG, 2003) courts ruled that for an auditor to be found guilty of fraud, the plaintiffs must only prove that the auditor was aware that its misrepresentations might reasonably be relied upon by the plaintiff, not that the auditor intended to induce the detrimental reliance. In the Houbigant decision the court referred to the recent audit failures in its decision:

It should be sufficient that the complaint contains some rational basis for inferring that the alleged misrepresentation was knowingly made. Indeed, to require anything beyond that would be particu- larly undesirable at this time, when it has been widely acknowledged that our society is experienc- ing a proliferation of frauds perpetrated by officers of large corporations . . . unchecked by the “impartial” auditors they hired.

Auditor Defenses The defenses presented earlier in this chapter are also available to audi- tors sued for fraud or gross negligence. If the auditor has been only negligent, he or she can claim that his or her negligence did not rise to the level of gross negligence or fraud. The audi- tor can also raise the statute of limitations as a defense. Finally, the auditor can claim that the plaintiff’s lack of due diligence led unjustifiably to reliance on a false representation.

Damages under Common Law Plaintiffs who are awarded damages for an ordinary or gross negligence claim against an audi- tor are eligible for compensatory damages, which means they are awarded damages to return them to a position equivalent to where they would have been in the absence of the auditor’s negligence. Punitive damages, which are above and beyond the amount of damage awarded to compensate for actual losses, are awarded to punish outrageous conduct and may be awarded when the auditor is found guilty of fraud or constructive fraud under common law. Punitive

Final PDF to printer

688 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 688 09/30/15 02:21 PM

damages are not permitted under federal statutory law, which provides plaintiffs incentive to file fraud charges under common law (often in addition to statutory fraud charges). However, the Securities Litigation Uniform Standards Act of 1998 (discussed below) forces certain fraud charges to be brought in federal court under statutory law.

Where the damages to the plaintiff can be apportioned between contributing parties, the auditor is only liable for his or her share of the total damages. If apportionment is not pos- sible, some states follow the principle of joint and several liability. Joint and several liability means that the auditor can be responsible for the entire loss even if other parties contributed to the loss. Some courts have ruled that joint and several liability is inconsistent with the com- parative fault concept, and some state legislatures have abolished joint and several liability in favor of a proportionate fault approach (i.e., if the auditor is found to be 30 percent at fault, he or she is only liable for 30 percent of the damages awarded).

Statutory Law—Civil Liability

Various statutes have been passed at both the federal and state levels that are intended to protect the public from malfeasance in the marketplace. While not aimed directly at auditors, these statutes do raise the potential for auditor legal liability. The discussion in this chapter is limited to the major federal statutes.

The Securities Act of 1933, the Securities Exchange Act of 1934, and the Sarbanes- Oxley Act of 2002 are the three major federal statutes that provide the basis of legal liability for auditors. On the other hand, the Private Securities Litigation Reform Act of 1995 and the Securities Litigation Uniform Standards Act of 1998 provide some protection for auditors, and others, from securities litigation. The Foreign Corrupt Practices Act and the Racketeer Influenced and Corrupt Organizations Act (RICO) are two other federal statutes that have the potential of imposing liability on auditors. The reader should also note that most states also have securities laws and RICO statutes.

Securities Act of 1933 The Securities Act of 1933 generally regulates the disclosure of information in a registration statement for a new public offering of securities (i.e., new securities sold from the company to the public), whereas the Securities Exchange Act of 1934 regulates documents filed with the SEC and thus addresses new offerings as well as trading of securities after they are issued (i.e., traded from one investor to another).8 The SEC’s “S-forms” (e.g., S-1, S-2) are filed in connection with registration of securities under the 1933 Act. Common forms filed under the 1934 Act include the 10-K (annual report), 10-Q (quarterly reports), and the 8-K (material events report). While a number of sections of the Securities Act of 1933 may subject auditors to liability, Section 11 imposes a liability on issuers and others, including auditors, for losses suffered by third parties when false or misleading information is included in a registration statement. Section 11 states:

(a) Persons possessing cause of action; persons liable. In case any part of the registration state- ment, when such part became effective, contained an untrue statement of a material fact or omitted to state a material fact required to be stated therein or necessary to make the statements therein not misleading, any person acquiring such security (unless it is proved that at the time of such acquisition he knew of such untruth or omission) may, either at law or in equity, in any court of competent jurisdiction, sue—

(4) every accountant . . . who has with his consent been named as having prepared or certified any part of the registration statement. . . .

LO 20-5

8The term “security” means any instrument commonly known as a “security” (e.g., note, stock, bond, debenture, investment contract, certificate of deposit).

Final PDF to printer

Chapter 20 Legal Liability 689

mes32502_ch20_672-706.indd 689 09/30/15 02:21 PM

In contrast to the situation under common law, under the 1933 Act the plaintiff does not have to prove negligence or fraud, reliance on the auditor’s opinion, a causal relationship, or a contractual relationship. The plaintiff need only prove that

1. A loss was suffered by investing in the registered security. 2. The audited financial statements contained a material omission or misstatement.

The misstatement can be the result of mere ordinary negligence. Section 11 of the 1933 Act is more favorable for plaintiffs than is common law because the burden of proof is shifted to the auditor to prove that he or she was not negligent.

Stop and Think: Why would the Securities Act of 1933 impose the presumption of negligence, unless the auditor can prove otherwise? Isn’t our legal system built on “innocent until proven guilty”?

In other words, the auditor is presumed to have been negligent unless he or she can prove otherwise. The extremely plaintiff-friendly legal standards under the 1933 Act reflect the fact that audited financial statements are typically more crucial for purchase decisions for new public offerings because few other credible sources of information are typically available for new security issues.

One defense available to the auditor sued under Section 11 is that of “due diligence.” That is, the auditor must have made a reasonable investigation of the facts supporting or contradict- ing the information included in the registration statement. Such an investigation should be similar to one that a prudent person would make under similar circumstances. A leading case under Section 11 is Escott v. BarChris Construction, in which the court held that the auditor’s actions for events subsequent to the audited balance sheet date had not been conducted with due diligence. In this instance, the senior auditor reviewing subsequent events had not spent sufficient time on this important task and had accepted glib answers to key questions. The court determined that there had been sufficient danger signals that further investigation was necessary. The BarChris Construction case is also of interest because of the court’s ruling on certain accounting matters and its determination of materiality. A detailed summary of the BarChris case is provided in Connect.

A more recent and significant case under Section 11 and other sections of the 1933 Act was Bernstein v. Crazy Eddie. Exhibit 20–7 describes the case. Crazy Eddie, Inc., made a number of new public offerings of securities. Then the founder and president of the com- pany resigned, and the successor management team discovered that the financial statements issued by the company during the public offering were fraudulent. The company’s financial statements had been misstated through inflated inventory and improper transactions by the founder and his family. The court ruled against the auditors, indicating that the plaintiffs did not have to prove fraud or gross negligence. They had to prove only that the misstated infor- mation was material and that they suffered a loss.

Other important cases tried under the Securities Act of 1933 are Continental Vending (United States v. Simon) and National Student Marketing (United States v. Natelli). Both cases resulted in criminal proceedings against the auditor and are described in Connect.

Damages for a violation of Section 11 of the 1933 Act are generally equal to the differ- ence between the amount paid for the security and the value of the security at the time the lawsuit was brought. Punitive damages are not permitted under federal statutory law but, as noted earlier, may be recovered in a concurrent common-law fraud action.

Securities Exchange Act of 1934 This statute regulates documents filed with the SEC and is concerned primarily with ongo- ing reporting by companies whose securities are listed and traded on a stock exchange or that meet certain other statutory requirements. Typical reporting requirements under the

LO 20-6

Final PDF to printer

690 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 690 09/30/15 02:21 PM

1934 Act include the quarterly filing of a 10-Q form, the annual filing of a 10-K form, and the periodic filing of an 8-K form whenever a significant event takes place affecting the entity. While a number of sections of this statute may have liability consequences for the auditor, two sections are particularly important: Section 18 and Section 10(b), including Rule 10b-5.

Section 18 imposes liability on any person who makes a material false or misleading statement in documents filed with the SEC. The auditor’s liability can be limited if the audi- tor can show that he or she “acted in good faith and had no knowledge that such statement was false or misleading.” However, a number of cases have limited the auditor’s good-faith defense when the auditor’s action has been judged to be grossly negligent.

A common source of liability for auditors under the 1934 Act is Section 10(b) and Rule 10b-5. Section 10(b) provides for a wide scope of liability. Rule 10b-5 amplifies Section 10(b) and states that it is

unlawful for any person, directly or indirectly, by the use of any means or instrumentality of inter- state commerce, or of the mails, or of any facility of any national securities exchange, a. To employ any device, scheme, or artifice to defraud, b. To make any untrue statement of a material fact or to omit to state a material fact necessary

in order to make the statement made, in the light of the circumstances under which they were made, not misleading, or

c. To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person, in connection with the purchase or sale of any security.

Once a plaintiff has established that he or she can sue under Rule 10b-5, the plaintiff must prove the following elements:

1. A material, factual misrepresentation or omission. 2. Reliance by the plaintiff on the financial statements.

The Crazy Eddie Case

Eddie Antar was the founder of and major shareholder in Crazy Eddie. The company made several public offerings of securities, including the sale of shares held by Eddie Antar and his family. The prospectuses and financial statements from 1984 through 1987 erroneously gave the impression that Crazy Eddie was a rapidly growing firm. When Antar resigned his position as president, the successor management discov- ered that the financial statements issued prior to and included in the public offerings had been materially misstated. In particular, there was an estimated inventory shortage of $65 million, and the company’s net worth was really only $7 million.

The financial statements had been misstated by a number of schemes. Net income and inventory had been inflated through improper financial reporting practices. First, inventory marked for return to manu- facturers had been included as inventory merchandise. Second, certain consignments had been treated as sales. Last, there had been related inventory sales to the founder and members of his family that were later resold to others. The company had also overstated per-store sales figures. All of these actions appear to have been taken to support the price of Crazy Eddie stock and to directly benefit Antar and his family. The discovery of the extent of the problems was complicated by the fact that certain documents had been altered or destroyed prior to the new management’s assuming control.

The plaintiffs in this case were purchasers of the company’s stock prior to the disclosure of the fraudu- lent financial statements. They sued the public accounting firm, the board of directors, and others, alleg- ing that the accounting firm had violated GAAS and GAAP by failing to uncover the company’s fraudulent and fictitious activities. The plaintiffs were able to show that they suffered a loss and that the certified financial statements in the registration statements and prospectuses had been false and misleading in violation of Sections 11 and 12 of the Securities Act of 1933.

The court ruled against the public accounting firm and upheld the plaintiffs’ Section 11 and 12 claims. The court held that the plaintiffs did not have to prove fraud or gross negligence, only that any material misstatement in the registration statements was misleading and that they had suffered a loss. In this case, the auditor was unable to prove that they had exercised appropriate due professional care.

E X H I B I T 2 0 – 7

Final PDF to printer

Chapter 20 Legal Liability 691

mes32502_ch20_672-706.indd 691 09/30/15 02:21 PM

3. Damages suffered as a result of reliance on the financial statements. 4. Scienter.

The first element can include materially misleading information or the omission of mate- rial information. The second element, reliance, cannot be established if the damages or loss suffered by the plaintiff would have occurred regardless of whether the audited financial statements were misstated. For example, in the 2008 case of Maxwell v. KPMG, the courts ruled that even if the other elements necessary to sue under Rule 10b-5 could be established, Maxwell’s alleged reliance on the audited financial statements of an acquiring entity was irrelevant as Maxwell’s business model was doomed by the coming dot.com collapse, and thus Maxwell’s harm was not caused by KPMG’s audit. In a recent case, Dura Pharma- ceuticals v. Broudo, the courts ruled that the third element, damages, cannot be established by claims that the security price was artificially inflated as a result of materially misstated financial statements. Rather, the plaintiff must establish that the security price fell after the misstatement became known. The Dura Phamaceuticals case is described in more detail in Connect. The fourth element, scienter, is defined as intent to deceive, manipulate, or defraud. However, some courts have ruled that gross negligence or reckless behavior is sufficient to satisfy the scienter element.

Practice I N S I G H T

Scienter Pleading in the WorldCom Case: In the WorldCom pleading (In re WorldCom, Inc. Sec. Litig.), a court determined that the plaintiff adequately established scienter against the auditor without prov- ing auditor intent to deceive based on the fact that subsequent to the release of clean audit opinions the financial statements required enormous restatements and the company’s underlying books and records contained no support or documentation related to items that were highly materially mis- stated in accounting areas such as merger reserves.

A number of important cases have used Section 10(b) as a basis for actions against audi- tors. In Herzfeld v. Laventhol, the U.S. district court allowed recovery by an investor. The investor had purchased securities from the client prior to an audit conducted by Laventhol. After the audit, the client offered to refund all investments made prior to the audit. The plain- tiff declined the refund based on the audited financial statements and lost his investment when the company went bankrupt a year later. The plaintiff sued, claiming that the financial statements had been false and misleading because profits from the sale of properties were reported in the income statement even though there was some uncertainty about the collect- ibility of the related receivables. Laventhol’s opinion was qualified “subject to” the collect- ibility of the receivables. The court held that the disclosure of the qualification footnote had been inadequate and that Laventhol was liable “because of their active participation in the preparation and issuance of false and materially misleading accounting reports upon which Herzfeld relied to his damage.”

In Ernst & Ernst v. Hochfelder, which is described in more detail in Connect, the presi- dent of a brokerage firm, Leston Nay, induced brokerage customers to invest in high-yield accounts that he personally managed. The accounts were fictitious, and he used the funds for his own purposes. The defrauded customers sued Ernst & Ernst, arguing that the firm, as the auditor, should have been aware of Nay’s inappropriate control over the mail and that such knowledge would have led to discovery of the fraud. Ernst & Ernst argued that Rule 10b-5 did not encompass negligent behavior. The U.S. Supreme Court ruled that an action under Rule 10b-5 may not be maintained by showing that the defendant was negligent; the rule requires that scienter, or intent to deceive, be present. Unfortunately, the Supreme Court did not decide whether gross negligence or reckless behavior was sufficient for liability under Section 10(b). However, a number of subsequent decisions by lower courts have recognized that reckless behavior or gross negligence by the auditor satisfies the scienter requirement of Rule 10b-5. For example, in two high-profile fraud cases, WorldCom, Inc., and Tyco, Int’l Ltd., judges found that the complaints against the auditors met the initial pleading requirements of scien- ter, even though no intent on behalf of the auditors was claimed. Reckless conduct is behavior

Final PDF to printer

692 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 692 09/30/15 02:21 PM

that represents an extreme departure from standards of ordinary care; failure to see the obvi- ous or a disregard for the truth.

Prior to 1994, courts frequently held that an auditor who was not liable as a primary vio- lator of Section 10(b) and Rule 10b-5 could still be held liable for aiding and abetting if the auditor had knowledge and had substantially assisted in the primary violation. In fact, prior to 1994, the aiding and abetting approach was the primary strategy followed by attorneys seek- ing damages against auditors under Section 10(b). However, in 1994 the Supreme Court held in Central Bank v. First Interstate Bank that there is no aiding and abetting liability under Section 10(b). The Dodd-Frank Act called for the U.S. Comptroller General to reexamine the impact of allowing the aiding and abetting approach to find professionals, such as bankers and accountants, liable under the securities laws. Depending on the results of that study, it is con- ceivable that Congress will revisit the issue.9

After the Central Bank case, the strategy for holding auditors liable under Section 10(b) shifted to an attempt to broaden the definition of a primary violator, whereby an accoun- tant does not have to be the initiator or issuer of a misrepresentation in order to be consid- ered a primary violator. The auditor only would have to be a party to a “fraudulent scheme.” However, the question of whether an auditor who has made no public statement and has not violated a duty to disclose important matters may be held liable as a primary violator for “participating” in a fraud scheme may have been settled in the 2008 Supreme Court ruling in the Stoneridge Investment v. Scientific-Atlanta case. In this case, the defendant, a supplier, schemed with a cable television provider to inflate the cable provider’s reported advertis- ing revenue (offset by overcharging for supplies). The Supreme Court ruled that although the defendant knowingly participated in the fraud scheme on investors, it was not a primary violator of Section 10(b) because it had made no misleading statement that was relied upon by plaintiff investors. Based on the Central Bank and Stoneridge rulings, an accountant who assists in the preparation and issuance of fraudulent financial statements cannot be held liable under Section 10(b) if the accountant does not make false and misleading statements that are relied upon by investors.

The issue of what is necessary to establish primary liability under Section 10(b) can be significant in determining when an individual accountant may be held liable. This is an issue in the litigation arising out of the Enron–Andersen collapse. While Andersen as a firm clearly made statements that permit Section 10(b) claims, stating primary liability claims against most of the individual Andersen defendants has proved difficult for plaintiffs. See Exhibit 20–8 for more information on the Enron–Andersen litigation.

The proper measure of damages in most Section 10(b) cases is the out-of-pocket loss suf- fered by the plaintiff. The out-of-pocket loss is the difference between what the plaintiff paid or received for the securities and what he or she would have paid or received had there been no wrongful conduct by the auditor. Punitive damages are not permitted under federal statu- tory law, although, as noted earlier, such damages can sometimes be recovered in a concurrent common-law fraud action.

In the wake of the Enron and WorldCom accounting frauds, the Sarbanes-Oxley Act lengthened the statute of limitations for actions under Section 10(b) based on claims of “fraud, deceit, manipulation, or contrivance in contravention of a regulatory requirement concerning the securities laws.” The Sarbanes-Oxley Act provides that any action shall be brought no later than two years from discovery and within five years from when the fraudulent conduct occurred. This provision was the only portion of Sarbanes-Oxley that specifically affected private securities fraud actions. The prior statute of limitations were one and three years, respectively.

The book’s website (www.mhhe.com/messier10e) describes three other relatively recent cases tried under the 1934 Act: Continental Vending, Mini-Scribe, and Phar-Mor.

9The mandated study relates to private claims. The SEC has long had the ability to bring aiding and abetting claims against auditors and the Dodd-Frank Act lowered the standard from “knowingly” to “recklessly.” However, the SEC has not been active in pursuing aiding and abetting claims.

Final PDF to printer

Chapter 20 Legal Liability 693

mes32502_ch20_672-706.indd 693 09/30/15 02:21 PM

The Enron Case

In its early years, Enron Corporation, based in Houston, was a traditional natural gas pipeline company, delivering natural gas to businesses and utilities. However, changes in the government regulations of electrical power markets opened the door for change. Enron transformed itself into a market maker for numerous different energy-related commodities. Enron’s stock price surged during the late 1990s, moving Enron into the spotlight of U.S. business. It became the seventh largest company in the United States and was praised for being one of America’s most innovative companies.

In 2001, after showing profits for the previous several years, Enron reported a third-quarter loss of $618 million and a $1.2 billion reduction in owner’s equity related to off-balance sheet partnerships. The news resulted in a sharp drop in Enron’s stock price and a formal SEC inquiry. On November 8, 2001, Enron announced that it had overstated profits by $586 million, erasing almost all its profits from the past five years, collapsing the stock price, and diminishing the confidence of its clients. Within a month of this announcement, Enron filed for Chapter 11 bankruptcy. At the time, Enron’s was the one of the largest corporate bankruptcies in history.

The Enron collapse involved many players, including company executives, investment bankers, finan- cial analysts, and accountants. Enron’s auditor, Arthur Andersen, one of the largest national accounting firms at the time, quickly became the target of public scrutiny.

The government’s investigation of Enron’s accounting practices revealed a number of accounting improprieties, including misuse of special-purpose entities (SPE) to sell off underperforming assets at a profit. Because of undisclosed Enron guarantees related to the transactions, most of these “sales” were really schemes to overstate “paper” gains and understate liabilities.

Fueled by a public uproar, the government began criminal proceedings. The Justice Department accused top Andersen officials of directing employees to alter and/or shred Enron-related documents after it knew about the SEC investigation. In June 2002, Andersen was found guilty of one count of obstruction of justice, fined $500,000, and sentenced to five years’ probation. However, the criminal indictment in itself so severely harmed Andersen’s reputation that clients fled and the firm essentially liquidated within months.

In 2004 Andrew Fastow, Enron’s former CFO and principal player in the company’s accounting schemes, pleaded guilty to two counts of conspiracy and was sentenced to serve the maximum 10-year sentence.

In 2006 former Enron chairman Kenneth Lay and former president Jeffrey Skilling were convicted on numerous federal fraud and conspiracy charges. Shortly after the conviction, Lay died of a massive heart attack and his conviction was vacated. Skilling was sentenced to 24 years in prison.

E X H I B I T 2 0 – 8

Private Securities Litigation Reform Act of 1995, the Securities Litigation Uniform Standards Act of 1998, and the Class Action Fairness Act of 2005 Prior to the passage of the Private Securities Litigation Reform Act of 1995, auditors who were sued under federal statutory law were held to the legal doctrine of joint and several liability, which holds each defendant fully liable for all assessed damages, regardless of the extent to which he or she contributed to the injury. The 1995 Act amends the Securities Exchange Act of 1934 to provide, in general, for proportionate liability, where each defen- dant is liable solely for the portion of the damages that corresponds to the percentage of responsibility of that defendant. To encourage more forward-looking disclosures, the 1995 Act also reduced auditor liability by creating a legal “safe harbor” related to forward-looking financial statements (see a discussion of financial forecasts and projections in Chapter 21). The 1995 Act also amends the 1934 Act to include in federal law the auditor’s responsibility to detect fraud and requires auditors to promptly notify the audit committee and the board of directors of illegal acts. The Act further requires the auditor to notify the SEC within one business day when an entity’s management fails to take appropriate action in response to reports of material fraud.

A class action lawsuit allows a large number of people with a common interest in a mat- ter to sue as a group. The 1995 Act allows class members with the greatest financial losses to control the class action litigation, rather than “professional” plaintiffs who defer to attorneys

LO 20-7

Final PDF to printer

694 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 694 09/30/15 02:21 PM

initiating the litigation. Finally, the 1995 Act raises the pleading requirement at the beginning of a case. For example, no longer can plaintiffs plead a general claim of fraud and then use discovery proceedings to conduct a “fishing expedition” in the auditors’ workpapers and files in search of actionable conduct. Rather, the 1995 Act requires that misrepresentation claims state the time, place, and contents of the allegedly false representations; the identity of the person making them; facts providing strong inference that the auditor acted with intent to deceive; and what he or she obtained as a result of the fraud. In the 2007 case of Tellabs v. Makor, the Supreme Court held that in determining whether the plaintiff’s complaint provides evidence of scienter, a court must consider both sides of the story (i.e., fraud and nonfraud plausible causes), and the plaintiff “must demonstrate that it is more likely than not that the defendant acted with scienter.” See a description of the Tellabs case in Connect. Subsequent to the Tellabs case there have been a number of cases addressing what factual allegations satisfy the “strong inference” test (e.g., Colorado Retirement Fund v. Deloitte, 2009). For example, boilerplate allegations such as weak internal controls and GAAP or GAAS viola- tions alone are not adequate evidence of scienter. The increased pleading requirements may discourage baseless “deep-pockets” lawsuits where plaintiffs hope to pressure defendants to settle out of court because the legal costs to fight the lawsuit may be greater than the costs to settle. In cases connected to the 1995 Act, Xerion v. Resurgence and Isakov v. Ernst & Young, the judges ruled that “fraud by hindsight” is not a recognized pleading and neither is alleging a series of “red flags” without sufficient inference that the auditor was aware of the red flags (see also Exhibit 20–9).

In response to concerns that plaintiff lawyers were circumventing the Private Securi- ties Litigation Reform Act of 1995 by bringing class action suits involving nationally traded securities to state courts, Congress passed the Securities Litigation Uniform Standards Act of 1998. The purpose of the Uniform Standards Act was to “prevent plaintiffs from seeking to evade the protections that Federal law provides against abusive litigation by filing suit in State, rather than Federal Court.” The primary federal protections to which the 1998 Act refers are proportionate liability, disallowed punitive damages, and higher filing standards. As a result of the 1998 Act, most large class actions against auditors alleging securities fraud must now be brought in federal court. The 1998 Act defines a “covered class action” to include any law- suit or group of lawsuits where damages are sought on behalf of more than 50 persons. Thus, smaller class action lawsuits can still be pursued in state court. In an attempt to circumvent the Uniform Standards Act, attorneys brought a number of Enron-related lawsuits in Texas state court with each suit filed on behalf of fewer than 50 persons (e.g., see Newby v. Enron, 2002). However, when the same attorney files multiple “cookie-cutter” lawsuits with fewer than 50 persons, the court may determine that the cases constitute “covered class action.”

The Class Action Fairness Act of 2005 (“CAFA”) was passed in response to perceived abuses in nationwide class action lawsuits filed in various state courts. CAFA expands the federal jurisdiction to include most multistate class actions where there is more than $5 mil- lion in dispute. Legal experts believe that federal judges are more likely than state judges to dismiss dubious claims. CAFA also imposes increased judicial and regulatory scrutiny over the propriety of class action settlements because in some past settlements the only parties that actually benefited were the attorneys.

Auditor Litigation in the Madoff Ponzi Scheme

Several lawsuits have been brought by investors against the auditors of Madoff feeder funds. These feeder funds invested in Madoff’s fraudulent Ponzi scheme and ultimately lost money (see Exhibit 4–2). However, the alleged risk factors or red flags generally related to actions taken by the Madoff fraud team and not to the auditors of the feeder funds. Some of the cases have been dismissed and in dismissing the claim against the auditors, courts have pointed out that the Madoff fraud was sufficiently sophisticated as to go undetected by the SEC and others for two decades. Other cases against auditors of feeder funds are still working their way through the courts. Selected Sources: C. Salvatore, “2 KPMG Units Dodge Madoff Investor Suits,” Law360 (July 2014). B. Healy, “Court OK’s lawsuit against KPMG in Madoff Fraud,” The Boston Globe (May 2013).

E X H I B I T 2 0 – 9

Final PDF to printer

Chapter 20 Legal Liability 695

mes32502_ch20_672-706.indd 695 09/30/15 02:21 PM

Sarbanes-Oxley Act of 2002 The Sarbanes-Oxley Act is considered the most sweeping securities law since the 1933 and 1934 Acts. Its main objectives are to restore investor confidence in the securities markets and to deter future corporate frauds. The Act does include sections directly addressing legal liabil- ity, but the other aspects of the Act (e.g., the creation of the PCAOB, stricter independence rules, audits of internal controls, and increased reporting responsibilities) are more important to auditors’ performance and create new federal laws with which the auditor must comply. The creation of the PCAOB is the single most significant aspect of the legislation, ending decades of self-regulation by the accounting profession.

Although Congress created and passed the Sarbanes-Oxley Act, as is customary with sim- ilar legislation, Congress did not develop the detailed accounting and securities rules and regu- lations needed to execute the Act’s provisions. Instead, the Act delegates substantial authority and responsibility to the SEC to create the detailed rules and regulations. For example, Section 302 of the Sarbanes-Oxley Act directed the SEC to create rules requiring CEO and CFO certi- fication of periodic financial reports within 30 days of the legislation’s signing, which the SEC did.10 Similarly, the Dodd-Frank Act requires the SEC to adopt a “claw-back” rule to recover incentive-based compensation from current and former executive officers when the company is required to restate its previously issued financial statements to correct a material error.11

The Act does not prohibit the SEC from extending the rules beyond what is required by the Act. For instance, Section 802 stipulates that audit firms must retain their audit documen- tation for a period of five years, while the SEC’s final ruling extends the period to seven years. Failure to retain audit documentation can result in fines and imprisonment for up to 10 years.

Some of the most important provisions of the Sarbanes-Oxley Act are aimed at increas- ing the responsibility of corporate officers and directors for the reliability of their company’s financial statements. Congress understands that the primary culprits in corporate fraud are dis- honest officers and directors. Sections 302 and 906 of the Act require the chief executive and chief financial officers of each public company to certify personally, among other things, the fairness of the financial information and the company’s compliance with the 1934 Act in each quarterly and annual report filed with the SEC. Regarding executive certifications, the courts have ruled that merely signing documents governed by Section 302 that ultimately are shown to contain material misstatements does not automatically make the signatories liable for fraud.

Rather than address the various legal liability aspects of the Act in this section, we dis- cuss them in the pertinent sections that follow because most of the legal liability legislation in the Sarbanes-Oxley Act represents enhancements or revisions to existing laws.

LO 20-8

10U.S. Securities Exchange Commission, “Final Rule: Certification of Disclosure in Companies’ Quarterly and Annual Reports” (Release No. 33-8124, August 2002). 11At the writing of this text, the SEC had exposed a proposed claw-back rule for comment. The rule would require claw-back or recovery even if the executive officer was not engaged in misconduct and even if they were not involved in the financial reporting process.

Practice I N S I G H T

Personal Liability: After learning about auditor liability, some of you may wonder if legal liability extends to junior-level accountants or auditors. The answer is no in almost all cases, because staff should be supervised and their work should be reviewed by more experienced accountants. Thus, the firm, and potentially senior executives of the audit firm responsible for planning, reviewing, and overseeing the audit, ultimately face legal liability. However, liability and potential criminal action do extend to accountants and auditors of all levels if they commit fraudulent acts. Also, junior-level audi- tors are potentially subject to SEC and PCAOB sanctions discussed in the next section.

SEC and PCAOB Sanctions SEC Rule 102(e) empowers the SEC to suspend for any person the privilege of appearing and practicing before it if that person is found

1. To not possess the necessary qualifications to represent others before the SEC; including, but not limited to persons whose license to practice as an accountant has been revoked or suspended by any state, territory, district, and so forth.

LO 20-9

Final PDF to printer

696 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 696 09/30/15 02:21 PM

2. To be lacking in character or integrity. 3. To have engaged in unethical or improper professional conduct; including, but not

limited to felony conviction or misdemeanor conviction involving moral turpitude. 4. To have willfully violated or willfully aided and abetted any violations of the federal

securities laws or any rules or regulations promulgated pursuant to those laws.

This sanction can be applied not only to an individual auditor but also to an entire accounting firm. In a study of SEC sanctions against auditors who had opined on financial statements that later were determined to be fraudulently misstated, individual auditors were sanctioned in 99 percent of the cases and the firm was sanctioned in 33 percent of the cases.12 If a firm is suspended or barred from practice before the SEC, the impact on the firm’s clients can be severe. For example, if a firm is suspended, its clients may not be able to file their reports with the SEC on a timely basis. Typically, if a firm is faced with suspension, it will work out some type of consent agreement in which the firm does not admit guilt but agrees to lesser sanctions. These sanctions may include not taking on new SEC clients for a specified period and subjecting the firm to special reviews to ensure that the alleged problems have been cor- rected. For example, in 2004 Ernst & Young was sanctioned by the SEC for violating inde- pendence standards during the audit of PeopleSoft for the years 1994–1999. The sanctions included fines and a six-month suspension from accepting new SEC registrant audit cli- ents. Such suspensions can be very costly for large accounting firms.

The SEC can also impose fines, such as the $7 million fine imposed in 2001 on Arthur Andersen in connection with audits of Waste Management. The Waste Management case was particularly egregious because Andersen agreed to a plan to cover up Waste Management’s financial misstatements by adjusting them down over a period of years rather than correcting them immediately. It also followed on the heels of other Andersen audit failures at Sunbeam Corporation and the Arizona Baptist Foundation and was a foreshadowing of the Enron and WorldCom failures disclosed within a year of the $7 million Waste Management fine.

A study of SEC sanctions imposed on auditors found that the most common problems cited were the auditors’ failure to gather sufficient competent audit evidence, failure to exer- cise due professional care, insufficient level of professional skepticism, failure to obtain ade- quate evidence related to management representations, and failure to express an appropriate audit opinion.13

The Sarbanes-Oxley Act grants the PCAOB broad investigative and disciplinary authority over registered public accounting firms and persons associated with such firms. As directed by the Act, the board adopted rules relating to investigations and adjudications in September 2003. Under the rules, the PCAOB may conduct investigations concerning any acts or practices involving auditors of publicly traded firms that may “violate any provision of the Act, the rules of the Board, the provisions of the securities laws relating to the preparation and issuance of audit reports and the obligations and liabilities of accountants with respect thereto, including the rules of the SEC issued under the Act, or professional standards.” The Dodd-Frank Act grants the PCAOB the ability to share inspection findings with regulators in other countries, which will greatly improve the PCAOB’s ability to inspect registered foreign accounting firms.

When violations are detected, the board has the authority to impose sanctions. The sanc- tions can include revoking a firm’s registration, barring a person from participating in audits of public companies, monetary penalties (up to $750,000 per individual or $15 million per firm), and requirements for remedial measures, such as training, new quality control proce- dures, and the appointment of an independent monitor. In 2011, the PCAOB censured, sanc- tioned, and penalized Indian affiliate firms of PricewaterhouseCoopers International Limited for not following auditing standards in connection with the audit of Satyam Computer Ser- vices headquartered in New Delhi, India (PCAOB Release No. 105-2011-002). The penalty of $1.5 million imposed by the PCAOB and $6 million by the SEC is the largest civil penalty ever imposed on a registered foreign accounting firm. Sanctions included prohibition on the

12Beasley, J. Carcello, D. Hermanson, and T. Neal, “An Analysis of Alleged Auditor Deficiencies in SEC Fraud Investigations: 1998–2010,” report commissioned and published by the Center for Audit Quality, 2013. 13ibid

Final PDF to printer

Chapter 20 Legal Liability 697

mes32502_ch20_672-706.indd 697 09/30/15 02:21 PM

Indian affiliate firms of accepting new engagements to audit SEC issuers until an indepen- dent monitor determines that the Indian affiliate firms have made significant progress toward improving their system of quality controls. The PCAOB’s rules, disciplinary decisions, and sanctions are subject to the approval of the SEC.

Practice I N S I G H T

In 2008, the U.S. Justice Department brought a landmark enforcement action under the Foreign Cor- rupt Practices Act against Siemens AG based in Germany. Siemens pleaded guilty to violating U.S. anti-bribery statutes and agreed to pay $1.6 billion in fines and restitution. News reports indicate the external auditor, KPMG, provided warnings to Siemens regarding corruption.

Source: “How KPMG’s warning on Siemens was ignored,” Punch, www.punchng.com, January 15, 2009.

Practice I N S I G H T

Individual auditors can also be sanctioned and censured by the PCAOB. For example, the PCAOB sanctioned a manager at EY, for improperly removing, adding, and backdating audit working papers in advance of a PCAOB inspection. You can read about other settled disciplinary cases on the PCAOB’s website, www.pcaob.org.

Foreign Corrupt Practices Act The Foreign Corrupt Practices Act (FCPA) was passed by Congress in 1977 in response to the discovery of bribery and other misconduct on the part of more than 300 American companies. The Act was codified in 1988 as an amendment to the Securities Exchange Act of 1934. As a result, an auditor may be subject to administrative proceedings, civil liability, and civil penal- ties under the FCPA. The FCPA prohibits corporate officers from knowingly participating in bribing foreign officials to obtain or retain business. The FCPA also imposes record-keeping and internal control requirements on public companies. Basically, corporations must keep their books, records, and accounts in sufficient detail to accurately reflect transactions. Com- panies are also required to develop and maintain adequate systems of internal control.14 To comply with the provisions of the FCPA, many corporations have established codes of con- duct that prohibit bribery. Compliance with corporate codes of conduct should be checked by the audit committee and the internal auditors. The external auditor may detect activities that violate the FCPA; auditing standards require such violations to be communicated to manage- ment immediately.

Since 2008 there has been an uptick in the number of cases and related corporate penal- ties related to FCPA Enforcement. The best defense against the risk of enforcement under FCPA is a thorough and effective compliance program that takes into account the entity’s operations, products, services, and industry specific risks. To aid in the development of an appropriate compliance program, in 2012 the SEC and Department of Justice jointly issued landmark formal guidance on the statute that address the Act’s key elements.15

LO 20-10

14The FCPA’s requirement around internal control was a primary reason for the formation of COSO and the develop- ment of the COSO Internal Control Integrated Framework that was initially issued in 1993. 15The guidance, “A Resource Guide to the U.S. Foreign Corrupt Practices Act,” can be downloaded from the SEC’s website www.sec.gov.

Racketeer Influenced and Corrupt Organizations Act Although the Racketeer Influenced and Corrupt Organizations Act (RICO) was enacted by Congress in 1970 to combat the infiltration of legitimate businesses by organized crime, it has been used against auditors. RICO provides civil and criminal sanctions for certain types of illegal acts. A major factor in bringing an action under RICO is that the law provides for treble damages (i.e., three times the actual loss) in civil RICO cases. Racketeering activity includes a long list of federal and state crimes, with mail fraud and wire fraud the most common alle- gations against auditors.

LO 20-11

Final PDF to printer

698 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 698 09/30/15 02:21 PM

Generally, a single instance of racketeering activity is not sufficient to establish a pattern of racketeering. In the case of Reves v. Ernst & Young (1993), the Supreme Court established an “operations and management test” for auditors that requires that the plaintiff prove that the accounting firm participated in the operation or management of the client’s business. A description of this case is presented in Connect.

Prior to the Private Securities Litigation Reform Act of 1995, securities fraud was an offense under RICO. The reform Act eliminated securities fraud as an offense in civil suits under RICO unless the auditor is criminally convicted of the fraud. Thus, experts believe that after the reform Act, Section 10(b) and Rule 10b-5 violations will almost never be grounds for a civil damage claim against an auditor under RICO.16

16See Chapter 6 in Goldwasser and Arnold, Accountants’ Liability (Practising Law Institute, 2014).

Statutory Law—Criminal Liability

Auditors can be held criminally liable under the statutory laws discussed in the previous sec- tions if they commit illegal acts. In addition, auditors can be held criminally liable for various other federal and state laws, such as banking and insurance regulations. Criminal prosecutions require that some form of criminal intent be present. However, many of the laws described in this chapter contain provisions for criminal penalties to be levied if an auditor’s actions reflect gross negligence. In a famous quote from United States v. Benjamin, the Court stated that an auditor would be held criminally liable if he “deliberately closed his eyes to facts he had a duty to see . . . or recklessly stated as facts things of which he was ignorant.”

A number of significant cases against auditors have resulted in criminal prosecution, with auditors being assessed large fines and serving time in prison. Included among these cases are Continental Vending (United States v. Simon), National Student Marketing (United States v. Natelli), Equity Funding (United States v. Weiner), ESM Government Securities, Inc. (In re Alexander Grant & Co. Litigation) and HealthSouth Corporation (SEC v. Owens). Note that in addition to criminal prosecution of the auditors, the auditors’ firms were civilly liable for violat- ing various statutes and paid large sums to settle the cases. These cases are described in Connect.

Of course, the most damaging criminal conviction against an audit firm to date came in June 2002, when Arthur Andersen was found guilty of one count of obstruction of justice in the Enron investigation (see Exhibit 20–8). Ironically, in 2006 the U.S. Supreme Court unani- mously reversed the conviction due to vague instructions provided to the jury for determining whether Andersen obstructed justice. However, the Supreme Court’s decision did little to help Andersen because the 2002 conviction had already resulted in the dismantling of the firm.

Numerous sections of the Sarbanes-Oxley Act include criminal provisions. The Act enhances prosecutorial tools available in major fraud cases by expanding statutory prohi- bitions against fraud and obstruction of justice, increasing criminal penalties for traditional fraud and cover-up crimes, and strengthening sentencing guidelines applicable to large-scale financial frauds. The Act adds criminal penalties for defrauding shareholders of public com- panies and increases authorized penalties for securities and financial reporting fraud (e.g., up to 25 years in prison). It is expected that the Act’s increased penalties will result in longer prison terms because of the corresponding changes in the federal sentencing guidelines.

The Sarbanes-Oxley Act increases penalties for impeding official investigations. Because most frauds are discovered by employees rather than external auditors, the Act also strength- ens the legal protections accorded whistleblowers. It is common for employers to retaliate against informants by demoting or firing them. The Act makes it a felony punishable by 10-year imprisonment to retaliate against anyone who voluntarily comes forward to report suspected violations of any federal laws. Under the Dodd-Frank Act, whistleblowers who bring violations of securities law or of the FCPA to the attention of the SEC or U.S. Depart- ment of Justice are entitled to 10 percent to 30 percent of any government recovery in excess of $1 million.

LO 20-8, 20-12

Final PDF to printer

Chapter 20 Legal Liability 699

mes32502_ch20_672-706.indd 699 09/30/15 02:21 PM

As we noted in Chapter 19, individual ethics and integrity cannot be legislated. As such, the Sarbanes-Oxley Act will not be a cure-all for corporate reform. Greed, mismanagement, conflicts of interest, and professional failures will never completely disappear. However, most observers in the legal and accounting professions generally believe that the reforms imposed by the Sarbanes-Oxley Act were needed, contribute to improved governance, and send a sig- nal that society does not tolerate widespread deceit in financial reporting.

Minimizing Litigation Costs: The threat of legal liability serves to prevent or limit inappropriate behav- ior on the part of auditors. However, auditors cannot be expected to ensure the accuracy of either financial statements or the financial health of a business entity. Lawsuits against public accountants not only result in direct financial effects such as large settlement costs but also impact the profes- sion and society in other ways. Thus, the public accounting profession has an interest in minimizing auditors’ exposure to legal liability. The profession is increasingly exploring the possibility of utilizing alternative dispute resolution procedures (i.e., arbitration and mediation) as a means of reducing litigation costs. Using arbitration and mediation to settle disputes does not remove legal liability (except perhaps punitive damages), but it does provide important benefits such as an arbitrator with knowledge of auditing and accounting matters, less time-consuming litigation, and reduced adminis- trative and legal support costs of litigation.*

*See S. Gunther and A. Felsenfeld, “ADR Clauses in Accounting Engagement Letters,” Dispute Resolution Journal, Vol. 69, No. 3, 2014.

Practice I N S I G H T

KEY TERMS

Breach of contract. Occurs when the client or auditor fails to meet the terms and obligations established in the contract (either expressly or implied), which is normally finalized in the engagement letter. Third parties may have privity or near privity of contract. Civil law. All law that does not relate to criminal matters. Class action. Lawsuit filed by one or more individuals on behalf of all persons who may have invested on the basis of the same false and misleading information. Criminal law. Statutory law that defines the duties citizens owe to society and prescribes penalties for violations. Due professional care. A legal standard requiring that the auditor perform his or her profes- sional services with the same degree of skill, knowledge, and judgment possessed by other members of the profession. Engagement letter. A letter that formalizes the contract between the auditor and the entity and outlines the responsibilities of both parties. Fraud. Actions taken with the knowledge and intent to deceive.Generally accepted auditing standards. Measures of the quality of the auditor’s performance. Gross negligence. An extreme, flagrant, or reckless departure from professional standards of due care. Joint and several liability. The auditor can be responsible for the entire loss even if other parties contributed to the loss. Ordinary negligence. An absence of reasonable or due care in the conduct of an engagement. Privity. A party’s contractual or fiduciary relationship with the accountant. Professional skepticism. An attitude that includes a questioning mind and a critical assess- ment of audit evidence. The auditor should not assume that management is either honest or dishonest. Reasonable assurance. A term that implies some risk that a material misstatement could be present in the financial statements without the auditor detecting it. Scienter. Acting with intent to deceive, defraud, or with knowledge of a false representation. Tort. A wrongful act other than a breach of contract for which civil action may be taken.

Final PDF to printer

700 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 700 09/30/15 02:21 PM

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 20-1 20-1 Briefly describe the four stages of the auditor dispute process. LO 20-2, 20-3, 20-4 20-2 What is meant by proportionate liability? Contrast this legal doctrine with the doc-

trine of joint and several liability. LO 20-3 20-3 For what types of actions are auditors liable to a client under common law? Why would

the client prefer to sue the auditor for a tort action rather than for a breach of contract? LO 20-3 20-4 What elements must a client prove to maintain an action against an auditor for

negligence? LO 20-4 20-5 Distinguish among the four standards that have evolved for defining auditors’ liabil-

ity for ordinary negligence to third parties under common law. Why is this area of auditors’ liability so complex?

LO 20-5, LO 20-6 20-6 Distinguish between the Securities Act of 1933 and the Securities Exchange Act of 1934. Why is it easier for a plaintiff to sue an auditor under the Securities Act of 1933?

LO 20-6 20-7 What elements must a plaintiff prove in order to win action under Rule 10b-5 of the Securities Exchange Act of 1934? What was the significance of the outcome of the Ernst & Ernst v. Hochfelder case for auditors’ liability?

LO 20-7 20-8 What were the most significant components of the Private Securities Litigation Reform Act of 1995 and the Securities Litigation Uniform Standards Act of 1998? Did the ruling in Tellabs v. Makor make it easier or harder to hold auditors liable for fraud? Why?

LO 20-8, 20-12 20-9 In what ways does the Sarbanes-Oxley Act change criminal liability for auditors of public companies?

LO 20-9 20-10 What types of sanctions can the SEC and the PCAOB impose on auditors? LO 20-6, LO 20-9 20-11 How does the Dodd-Frank Act affect the auditing profession? LO 20-10 20-12 What types of activities should the auditor be alert to that may violate the Foreign

Corrupt Practices Act? LO 20-12 20-13 What actions can result in an auditor being held criminally liable under statutes and

regulations?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 20-2, 20-3, 20-4 20-14 Cable Corporation orally engaged Drake & Company, CPAs, to audit its finan- cial statements. Though the financial statements Drake audited included a materi- ally overstated accounts receivable balance, Drake issued an unqualified opinion. Cable used the financial statements to obtain a loan to expand its operations. Cable defaulted on the loan and incurred a substantial loss.

If Cable sues Drake for negligence in failing to discover the overstatement, Drake’s best defense would be that Drake did not

a. Have privity of contract with Cable. b. Sign an engagement letter. c. Perform the audit recklessly or with an intent to deceive. d. Violate generally accepted auditing standards in performing the audit.

LO 20-3 20-15 Which of the following best describes whether a CPA has met the required standard of care in auditing an entity’s financial statements?

a. Whether the client’s expectations are met with regard to the accuracy of audited financial statements.

Final PDF to printer

Chapter 20 Legal Liability 701

mes32502_ch20_672-706.indd 701 09/30/15 02:21 PM

Questions 20-20 and 20-21 are based on the following information: Dart Corporation engaged Jay Associates, CPAs, to assist in a public stock offering.

Jay audited Dart’s financial statements and gave an unqualified opinion, despite know- ing that the financial statements contained misstatements. Jay’s opinion was included in Dart’s registration statement. Hansen purchased shares in the offering and suffered a loss when the stock declined in value after the misstatements became known.

b. Whether the statements conform to generally accepted accounting principles. c. Whether the CPA conducted the audit with the same skill and care expected of an

ordinarily prudent CPA under the circumstances. d. Whether the audit was conducted to investigate and discover all acts of fraud.

LO 20-3, 20-4 20-16 Jenna Corporation approved a merger plan with Cord Corporation. One of the deter- mining factors in approving the merger was the financial statements of Cord, which had been audited by Frank & Company, CPAs. Jenna had engaged Frank to audit Cord’s financial statements. While performing the audit, Frank failed to discover fraud that later caused Jenna to suffer substantial losses. For Frank to be liable under common-law negligence, Jenna at a minimum must prove that Frank

a. Knew of the fraud. b. Failed to exercise due care. c. Was grossly negligent. d. Acted with scienter.

LO 20-4 20-17 Brown & Company, CPAs, issued an unqualified opinion on the financial statements of its client King Corporation. Based on the strength of King’s financial statements, Safe Bank loaned King $500,000. King Corporation and Safe Bank are both located in a state that follows the Ultramares doctrine. Brown was unaware that Safe would receive a copy of the financial statements or that they would be used by King in obtaining a loan. King defaulted on the loan.

If Safe commences an action for ordinary negligence against Brown, and Brown believes it will be able to prove that it conducted the audit in conformity with GAAS, Brown will

a. Be liable to Safe, because Safe relied on the financial statements. b. Be liable to Safe, because the statute of frauds has been satisfied. c. Not be liable to Safe, because there is a conclusive legal presumption that follow-

ing GAAS is the equivalent of acting reasonably and with due care. d. Not be liable to Safe, because there was a lack of privity of contract.

LO 20-5 20-18 How does the Securities Act of 1933, which imposes civil liability on auditors for misrepresentations or omissions of material facts in a registration statement, expand auditors’ liability to purchasers of securities beyond that of common law?

a. Purchasers have to prove only that a loss was caused by reliance on audited finan- cial statements.

b. Privity with purchasers is not a necessary element of proof. c. Purchasers have to prove either fraud or gross negligence as a basis for recovery. d. Auditors are held to a standard of care described as “professional skepticism.”

LO 20-5 20-19 To be successful in a civil action under Section 11 of the Securities Act of 1933 con- cerning liability for a misleading registration statement, the plaintiff must prove

Defendant’s Intent to Deceive

Plaintiff’s Reliance on the Registration Statement

a. Yes Yes

b. Yes No

c. No Yes

d. No No

Final PDF to printer

702 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 702 09/30/15 02:21 PM

LO 20-5 20-20 In a suit against Jay and Dart under the Section 11 liability provisions of the Securi- ties Act of 1933, Hansen must prove that

a. Jay knew of the misstatements. b. Jay was negligent. c. The misstatements contained in Dart’s financial statements were material. d. The unqualified opinion contained in the registration statement was relied on by

Hansen.

LO 20-5 20-21 If Hansen succeeds in the Section 11 suit against Dart, Hansen will be entitled to a. Damages of three times the original public offering price. b. Rescind the transaction. c. Monetary damages comparable to the loss suffered. d. Damages, but only if the shares were resold before the suit was started.

LO 20-6 20-22 Fritz Corporation, whose shares are publicly traded, engaged Hay Associates, CPAs, to audit its financial statements. Hay gave an unqualified opinion, despite knowing that the financial statements contained misstatements. Hay’s opinion was included in Fritz’s Form 10-K filed with the Securities and Exchange Commission. Samson purchased shares and suffered a loss when the stock declined in value after the mis- statements became known.

In a suit against Hay under the antifraud provisions of Section 10(b) and Rule 10b-5 of the Securities Exchange Act of 1934, Samson must prove all of the follow- ing except that

a. Samson was a foreseen user of the financial statements. b. Samson suffered a loss as a result of reliance on the financial statements. c. The stock purchase involved a national securities exchange. d. Hay acted with intent to deceive.

LO 20-7 20-23 Under the Private Securities Litigation Reform Act, Baker, CPA, reported certain uncorrected illegal acts to Supermart’s board of directors. Baker believed that failure to take remedial action would warrant a qualified audit opinion because the illegal acts had a material effect on Supermart’s financial statements. Supermart failed to take appropriate remedial action, and the board of directors refused to inform the SEC that it had received such notification from Baker. Under these circumstances, Baker is required to

a. Resign from the audit engagement within 10 business days. b. Deliver a report concerning the illegal acts to the SEC within one business day. c. Notify the stockholders that the financial statements are materially misstated. d. Withhold an audit opinion until Supermart takes appropriate remedial action.

LO 20-8, 20-9, 20-12 20-24 Which of the following is not a provision of the Sarbanes-Oxley Act? a. A requirement to retain audit workpapers for at least five years. b. It is a criminal offense to take any harmful action in retaliation against anyone who

voluntarily comes forward to report a suspected accounting or securities fraud. c. Broad investigative and disciplinary authority over registered public accounting

firms is granted to the Public Company Accounting Oversight Board. d. The statute of limitations for actions under Section 10(b) and Rule 10b-5 was

reduced to one year from the discovery of fraud and five years after the fraud occurred.

LO 20-10 20-25 Which of the following is a provision of the Foreign Corrupt Practices Act? a. It is a criminal offense for an auditor to fail to detect and report a bribe paid by

an American business entity to a foreign official for the purpose of obtaining business.

b. The auditor’s detection of illegal acts committed by officials of the auditor’s pub- licly held client in conjunction with foreign officials should be reported to the Enforcement Division of the Securities and Exchange Commission.

Final PDF to printer

Chapter 20 Legal Liability 703

mes32502_ch20_672-706.indd 703 09/30/15 02:21 PM

c. If the auditor of a publicly held company concludes that the effects on the finan- cial statements of a bribe given to a foreign official are not reasonably estimated, the auditor’s report should be modified.

d. Every publicly held company must devise, document, and maintain a system of internal accounting controls sufficient to provide reasonable assurance that inter- nal control objectives are met.

PROBLEMS All applicable problems are available with Connect.

LO 20-2, 20-3, 20-4 20-26 Becker, Inc., purchased the assets of Bell Corporation. A condition of the purchase agreement was that Bell retain a CPA to audit its financial statements. The purpose of the audit was to determine whether the unaudited financial statements furnished to Becker fairly presented Bell’s financial position. Bell retained Salam & Company, CPAs, to perform the audit.

While performing the audit, Salam discovered that Bell’s bookkeeper had embez- zled $500. Salam had some evidence of other embezzlements by the bookkeeper. However, Salam decided that the $500 was immaterial and that the other suspected embezzlements did not require further investigation. Salam did not discuss the matter with Bell’s management. Unknown to Salam, the bookkeeper had, in fact, embezzled large sums of cash from Bell. In addition, the accounts receivable were significantly overstated. Salam did not detect the overstatement because of Salam’s failure to fol- low its audit program.

Despite the foregoing, Salam issued an unqualified opinion on Bell’s finan- cial statements and furnished a copy of the audited financial statements to Becker. Unknown to Salam, Becker required financing to purchase Bell’s assets and furnished a copy of Bell’s audited financial statements to City Bank to obtain approval of the loan. Based on Bell’s audited financial statements, City loaned Becker $600,000.

Becker paid Bell $750,000 to purchase Bell’s assets. Within six months, Becker began experiencing financial difficulties resulting from the undiscovered embezzle- ments and overstated accounts receivable. Becker later defaulted on the City loan.

City has commenced a lawsuit against Salam based on the following causes of action:

∙ Ordinary negligence. ∙ Constructive fraud (gross negligence).

Required: In separate paragraphs, discuss whether City is likely to prevail on the causes of

action it has raised. Set forth reasons for each conclusion.

(AICPA, adapted)

LO 20-3, 20-4, 20-27 Astor Electronics, Inc., markets a wide variety of computer-related products 20-5, 20-6 throughout the United States. Astor’s officers decided to raise $1 million by selling

shares of Astor’s common stock in an exempt offering under Regulation D of the Securities Act of 1933. In connection with the offering, Astor engaged Apple & Company, CPAs, to audit Astor’s financial statements. The audited financial state- ments, including Apple’s unqualified opinion, were included in the offering memo- randum given to prospective purchasers of Astor’s stock. Apple was aware that Astor intended to include the statements in the offering materials.

Astor’s financial statements reported certain inventory items at a cost of $930,000 when in fact they had a fair market value of less than $100,000 because of techno- logical obsolescence. Apple accepted the assurances of Astor’s controller that cost

Final PDF to printer

704 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 704 09/30/15 02:21 PM

was the appropriate valuation, despite the fact that Apple was aware of ongoing sales of the products at prices substantially less than cost. All of this was thoroughly docu- mented in Apple’s workpapers.

Musk purchased 10,000 shares of Astor’s common stock in the Regulation D offering at a total price of $300,000. In deciding to make the purchase, Musk had reviewed the audited financial statements of Astor that accompanied the other offer- ing materials and had been impressed by Astor’s apparent financial strength.

Shortly after the stock offering was completed, Astor’s management discovered that the audited financial statements reflected the materially overstated valuation of the company’s inventory. Astor advised its shareholders of the problem.

Upon receiving notice from Astor of the overstated inventory amount, Musk became very upset because the stock value was now substantially less than what it would have been had the financial statements been accurate. In fact, the stock was worth only about $200,000.

Musk has commenced an action against Apple, alleging that Apple is liable to Musk based on the following causes of action:

∙ Common-law fraud. ∙ Negligence. ∙ A violation of Section 10(b) and Rule 10b-5 of the Securities Exchange Act

of 1934. The state law applicable to this action follows the Ultramares decision with

respect to accountants’ liability to third parties for negligence or fraud. Apple has also asserted that the actions should be dismissed because of the absence of any con- tractual relationship between Apple and Musk, that is, a lack of privity.

Required: Answer the following, setting forth your reasons for any conclusions stated. a. What elements must be established by Musk to support a cause of action based on

negligence? b. What elements must be established by Musk to support a cause of action based on

a Rule 10b-5 violation? c. Is Apple’s assertion regarding lack of privity correct with regard to Musk’s causes

of action for negligence and fraud?

(AICPA, adapted)

LO 20-5, 20-6 20-28 Butler Manufacturing Corporation planned to raise capital for a plant expansion by borrowing from banks and making several stock offerings. Butler engaged Meng, CPA, to audit its financial statements. Butler told Meng that the financial statements would be given to certain named banks and included in the prospectuses for the stock offerings.

In performing the audit, Meng did not confirm accounts receivable and, as a result, failed to discover a material overstatement of accounts receivable. Also, Meng was aware of a pending class action product liability lawsuit that was not disclosed in Butler’s financial statements. Despite being advised by Butler’s legal counsel that Butler’s potential liability under the lawsuit would result in material losses, Meng issued an unqualified opinion on Butler’s financial statements.

Union Bank, one of the named banks, relied on the financial statements and Meng’s opinion in giving Butler a $500,000 loan.

A couple of months after obtaining the Bank loan, Butler also raised $16,450,000 through stock offerings.

Shortly after obtaining the Union loan, Butler began experiencing financial prob- lems but was able to stay in business because of the money raised by the offerings. Then Butler was found liable in the product liability suit. This resulted in a judgment Butler could not pay. Butler also defaulted on the Union loan and was involuntarily

Final PDF to printer

Chapter 20 Legal Liability 705

mes32502_ch20_672-706.indd 705 09/30/15 02:21 PM

petitioned into bankruptcy. This caused Union to sustain a loss and Butler’s stock- holders to lose their investments. As a result,

∙ Union sued Meng for negligence and common-law fraud. ∙ The stockholders who purchased Butler’s stock through the offerings, as well as

stockholders who purchased shares subsequently traded on a national securities exchange, sued Meng, alleging fraud under Section 10(b) and Rule 10b-5 of the Securities Exchange Act of 1934.

These transactions took place in a jurisdiction providing for accountants’ liability for negligence to known and intended users of financial statements.

Required: Answer the following questions and give the reasons for your conclusions. a. Will Union be successful in its suit against Meng for 1. Negligence? 2. Common-law fraud? b. Will the stockholders who purchased Butler’s stock succeed against Meng

under the antifraud provisions of Section 10(b) and Rule 10b-5 of the Securities Exchange Act of 1934?

(AICPA, adapted)

LO 20-5, 20-6 20-29 Sleek Corporation is a public corporation whose stock is traded on a national securi- ties exchange. Sleek hired Garson Associates, CPAs, to audit Sleek’s financial state- ments. Sleek needed the audit to obtain bank loans and to offer public stock so that it could expand.

Before the engagement, Fred Hedge, Sleek’s president, told Garson’s managing partner that the audited financial statements would be submitted to Sleek’s banks to obtain the necessary loans.

During the course of the audit, Garson’s managing partner found that Hedge and other Sleek officers had embezzled substantial amounts of money from the corpora- tion. These embezzlements threatened Sleek’s financial stability. When these find- ings were brought to Hedge’s attention, Hedge promised that the money would be repaid and begged that the audit not disclose the embezzlements.

Hedge also told Garson’s managing partner that several friends and relatives of Sleek’s officers had been advised about the projected business expansion and pro- posed stock offering and had purchased significant amounts of Sleek’s stock based on this information.

Garson submitted an unqualified opinion on Sleek’s financial statements, which did not include adjustments for or disclosures about the embezzlements and insider stock transactions. The financial statements and audit report were submitted to Sleek’s regular banks, including Knox Bank. Knox, relying on the financial state- ments and Garson’s report, gave Sleek a $2 million loan.

Sleek’s audited financial statements were also incorporated into a registration statement prepared under the provisions of the Securities Act of 1933. The registra- tion statement was filed with the SEC in conjunction with Sleek’s public offering of 100,000 shares of its common stock at $100 per share.

An SEC investigation of Sleek disclosed the embezzlements and the insider trading. Trading in Sleek’s stock was suspended, and Sleek defaulted on the Knox loan.

As a result, the following legal actions were taken: ∙ Knox sued Garson. ∙ The general-public purchasers of Sleek’s stock offering sued Garson.

Required: Answer the following questions and give the reasons for your conclusions. a. Would Knox recover from Garson for fraud?

Final PDF to printer

706 Part 7 Professional Responsibilities

mes32502_ch20_672-706.indd 706 09/30/15 02:21 PM

b. Would the general-public purchasers of Sleek’s stock offerings recover from Garson

1. Under the liability provisions of Section 11 of the Securities Act of 1933? 2. Under the antifraud provisions of Rule 10b-5 of the Securities Exchange Act

of 1934?

(AICPA, adapted)

DISCUSSION CASES

LO 20-4, 20-5, 20-6 20-30 Conan Doyle & Associates (CD&A), CPAs, served as the auditors for Lestrad Cor- poration and Watson Corporation, publicly held companies traded on NASDAQ. Watson recently acquired Lestrad Corporation in a merger that involved swapping 1.75 shares of Watson for 1 share of Lestrad. In connection with that merger, CD&A issued an unqualified report on the financial statements and participated in the prepa- ration of the pro forma unaudited financial statements contained in the combined pro- spectus and proxy statement circulated to obtain shareholder approval of the merger and to register the shares to be issued in connection with the merger. Watson prepared a Form 8-K and Form 10-K in connection with the merger. Shortly thereafter, finan- cial disaster beset the merged company, resulting in large losses to the shareholders and creditors. A class action suit on behalf of shareholders and creditors has been filed against Watson and its management. In addition, it names CD&A as a codefen- dant, challenging the fairness, accuracy, and truthfulness of the financial statements.

Required: Discuss the various bases of CD&A’s potential civil liability to the shareholders

and creditors of Watson as a result of issuing an unqualified report on the audited financial statements of Watson and Lestrad and having participated in preparing the unaudited financial statements required in connection with the merger under

a. State common law. b. The federal securities acts.

(AICPA, adapted)

LO 20-8 20-31 Critics of the Sarbanes-Oxley Act do not believe the Act will be effective at deter- ring accounting frauds because it primarily relies on specifying new crimes and higher penalties (i.e., increasing the maximum fine and prison terms). Critics argue that if corporate executives are not deterred by the prospect of 5 or 10 years in prison (which existed pre-Sarbanes), the threat of imprisonment will have little or no practi- cal effect no matter what the maximum is raised to. Thus, critics conclude that the Act was more of an expression of political outrage than good policy.

Proponents of the Act believe the new crimes, increased penalties, and the other pro- visions in the Act will be effective at significantly reducing corporate accounting frauds.

Required: Provide arguments for both sides of the debate and formulate your own opinion.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_ch21_707-747.indd 707 10/22/15 11:48 AM

707

PART EIGHT

Assurance, Attestation, and Internal Auditing Services

CHAPTER 21 Assurance, Attestation, and Internal Auditing Services

Final PDF to printer

mes32502_ch21_707-747.indd 708 10/22/15 11:48 AM

CHAPTER

21 21-1 Know the definition of assurance services. 21-2 Be familiar with the types of assurance services offered

by CPAs. 21-3 Know the definition of an attestation engagement. 21-4 Know the types of attestation engagements. 21-5 Be familiar with the 11 attestation standards and how they

compare to the 10 generally accepted auditing standards. 21-6 Understand the type of attestation engagement that

involves reporting on an entity’s internal control over financial reporting.

21-7 Understand the type of attestation engagement that involves reporting on an entity’s financial forecasts and projections.

21-8 Be familiar with accounting and review services. 21-9 Understand the role of standards pertaining to and

services provided by internal auditors. 21-10 Be familiar with two specific type assurance services

offered by CPAs—WebTrust Services (together with the underlying Trust Services Principles and Criteria) and CPA PrimePlus.

Committee of Sponsoring Organizations of the Treadway Commission, Internal Control–Integrated Framework (New York: AICPA, 2013) AU-C 265, Communicating Internal Control Related Matters Identified in an Audit AU-C 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement AU-C 940, An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements

AT 101—Attest Engagements AT 201—Agreed-Upon Procedures Engagements AT 301—Financial Forecasts and Projections AR 60—Framework for Performing and Reporting on Compilation and Review Engagements AR 70—Preparation of Financial Statements AR 80—Compilation of Financial Statements AR 90— Review of Financial Statements IIA Professional Practices Framework AICPA/CICA Trust Services Principles and Criteria

LEARNING OBJECTIVES

Upon completion of this chapter you will

RELEVANT ACCOUNTING AND AUDITING PRONOUNCEMENTS*

Final PDF to printer

709

mes32502_ch21_707-747.indd 709 10/22/15 11:48 AM

Assurance, Attestation, and Internal Auditing Services

B ecause of their reputation for competence and objectivity, CPAs for many years have been asked to perform a variety of services beyond the audit of historical financial statements. However, prior to the development of

standards specifically relating to nonaudit attestation services, auditors found it difficult to provide such services within the bounds of auditing standards. To accommodate the demand for services by CPAs, the AICPA introduced attes- tation standards in 1986. The attestation standards are broader in scope than auditing standards so that they can be applied to the wide array of services being requested of accounting professionals. In 2001, the Auditing Standards Board completed a substantial revision and recodification of the attestation standards, and is, as of the writing of this edition, working on a revised, clarified version. The PCAOB adopted the AICPA attestation standards on an interim basis in April 2003 and those standards remain unchanged since that time.

In addition to accommodating society’s increasing demand for CPA- provided attestation services, the profession aggressively sought to expand the opportunities for assurance-related services in the late 1990s. The AICPA Special Committee on Assurance Services (“the Elliott Committee”) issued a report in 1996 that led to the AICPA establishing a program to promote various nontraditional assurance services. While the profession’s emphasis on nontra- ditional assurance services has cooled in the wake of Sarbanes-Oxley and the subsequent “back-to-basics” trend, some accounting firms continue to provide such services.

This chapter begins with an overview of assurance services (and an Advanced Module offers a brief overview of two specific types of such ser- vices). Attest services and standards are presented next. The reader should note that many of the so-called assurance services actually are conducted as attestation engagements. The chapter also covers other types of accounting services offered by CPAs. The last part of the chapter discusses the services and standards relating to internal auditing, an important area that has seen significantly increased emphasis over the past decade.

Final PDF to printer

710 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 710 10/22/15 11:48 AM

Figure 21-1 expands on Figure 1–2 and presents the relationship of assurance services to attest and auditing. As discussed in Chapter 1, the broad umbrella of assurance services includes attestation and auditing services, among others. The AICPA Special Committee on Assurance Services defined assurance services as follows:

Assurance services are independent professional services that improve the quality of information, or its context, for decision makers.

This definition captures a number of important concepts. First, the definition focuses on deci- sion making. Making good decisions requires quality information, which can be financial or nonfinancial in nature. Figure 21–2, adapted from the report of the AICPA Special Committee on Assurance Services, presents a model for decision making. You will note that information, the first fundamental concept in the decision model, is critical. Three types of information enter into the problem definition stage of the model: (1) environmental information, (2) pro- cess monitoring and diagnostic information, and (3) outcome feedback information. An assur- ance service engagement can help the decision maker search through this information in order to identify which pieces are relevant for the required decision.

The second fundamental concept relates to improving the quality of information or its context. In the decision model shown in Figure 21–2, an assurance service engagement can improve information quality by increasing confidence in the information’s reliability, rele- vance, and timeliness. Context can be improved via the format in which information is pre- sented or through the provision of other relevant benchmarking information.

The third important concept in the definition of assurance services is independence. As we indicated in our earlier discussions of financial statement auditing, independence is the hallmark of the accounting profession.

The last concept is embodied in the term “professional services,” which reflects the application of professional judgment to the information that is the subject of the assurance service. In summary, assurance services provided by accounting professionals can capture information, improve its quality, and enhance its usefulness for decision makers, in ways that are free from bias or conflict of interest.

LO 21-1

Assurance Services

The Relationship between Assurance Services, Attest, and AuditingF I G U R E 2 1 – 1

Auditing Attest

Assurance

PrimePlus Services

Financial Forecasts

CPA Risk

Advisory

CPA Trust

Services

CPA Performance

ViewNon-audit Reports on

Internal Control

Audits of Financial

Statements

Forensic Auditing

Compliance Auditing

Audits of Internal Control over Financial

Reporting

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 711

mes32502_ch21_707-747.indd 711 10/22/15 11:48 AM

Types of Assurance Services The AICPA, through its Assurance Services Executive Committee, initially identified and developed six general categories of assurance services. From this list you can get a feel for the breadth of activities for which assurance might be provided!

∙ Risk assessment—assurance that an entity’s profile of business risks is comprehensive and evaluation of whether the entity has appropriate systems in place to effectively manage those risks.

∙ Business performance measurement—assurance that an entity’s performance measurement system contains relevant and reliable measures for assessing the degree to which the entity’s goals and objectives are achieved or how its performance compares to that of competitors.

∙ Information system reliability—assurance that an entity’s internal information systems provide reliable information for operating and financial decisions.

∙ Electronic commerce—assurance that systems and tools used in electronic commerce provide appropriate data integrity, security, privacy, and reliability.

∙ Health care performance measurement—assurance about the effectiveness of health care services provided by HMOs, hospitals, doctors, and other providers.

∙ PrimePlus—assurance that specified goals regarding the elderly are being met by various caregivers.

To give you a better understanding of the nature of such services, this chapter’s Advanced Module offers a brief overview of two specific types of nonaudit attestation services devel- oped by the AICPA over the last several years (CPA Trust Services and PrimePlus Services).

LO 21-2

A Model for Decision Making and the Role of InformationF I G U R E 2 1 – 2

Start

Problem definition

Decision model selection/

specification

Decision model information

requirements

Information sourcing/finding

Information analysis and

interpretation

Evaluation of alternatives and

trade-o�s

Implementation of actions

Outcome feedback

Attest Engagements

Chapter 1 of Standard for Attestation Engagements (SSAE) No. 10 defines an attest engage- ment as follows:

Attest services occur when a practitioner is engaged to issue or does issue an examination, a review, or an agreed-upon procedures report on subject matter, or an assertion about subject matter, that is the responsibility of another party.

LO 21-3

Final PDF to printer

712 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 712 10/22/15 11:48 AM

In this definition, practitioner refers to a certified public accountant in the practice of public accounting. Because attestation engagements are not audits, the attestation standards use the term practitioner instead of auditor. The subject matter of an attest engagement may take various forms, including historical or prospective performance information, analyses (e.g., break-even analysis), systems and processes (e.g., internal control), physical charac- teristics (e.g., square footage of facilities), historical events (e.g., the price of market goods on a certain date), and behavior or actions (e.g., compliance with laws and regulations). The term assertion here refers to any declaration, or set of related declarations, about whether the subject matter is in conformity with the criteria selected. Examples of an assertion by management are “Gregorio’s Restaurants maintains effective internal control over financial reporting” and “Ticaboo Marine complies with all applicable maritime regulations.”

Stop and Think: How many parties are usually involved in attest services, and what is their relationship to one another?

Typically, an attestation engagement involves three parties: a user or users of information about which assurance is desired; a party responsible for the subject matter or the assertion, such as management; and a CPA. Figure 21–3 depicts the relationship among the three parties to an attestation engagement. Note the direction of the arrows in this figure. The responsible party is responsible for the subject matter or assertion to the user and acknowledges that responsibility to the CPA. The CPA expresses a conclusion to the user on the subject matter or assertion. In some cases, the engagement may involve only two parties because sometimes the user and the responsible party are the same.

The practitioner should use an attestation risk model to meet the standards of field- work in an attestation engagement. Attestation risk is defined in a manner similar to audit risk and is composed of the same basic components as the audit risk model discussed in Chapter 3 (inherent risk, control risk, and detection risk). The acceptable level of attestation risk should be set consistent with the type of engagement being performed.

Types of Attest Engagements Attestation standards generally provide for three types of engagements: examination, review, and agreed-upon procedures. The AICPA’s Statements on Standards for Attestation Engage- ments (SSAEs) provide additional guidance on these types of engagements. The PCAOB adopted the SSAEs along with the rest of the AICPA’s professional standards on an interim basis in April 2003.

LO 21-4

The Three-Party Relationship in an Attest EngagementF I G U R E 2 1 – 3

User

CPA Responsible

party

Expresses conclusion on subject matter

or assertion

Responsible for the subject matter or assertion

to the user

Acknowledges responsibility for the subject matter

or assertion

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 713

mes32502_ch21_707-747.indd 713 10/22/15 11:48 AM

Examination In an examination, the accounting practitioner expresses an opinion that (a) the subject matter is based on (or in conformity with) the criteria in all material respects or (b) the assertion is presented (or fairly stated), in all material respects, based on the criteria. The practitioner’s opinion may be used for general or limited distribution. If distribution is limited, the opinion must state the limitations on the use of the report. For example, a limited distribution report might indicate: “This report is intended for use only by Offshore Bank.” Because an examination engagement provides the highest level of assurance on an assertion, the practitioner must gather sufficient evidence to limit the attestation risk to a low level, and express positive assurance, similar to an audit report. In fact, sometimes audits are referred to as “examinations.”

Review In a review engagement, the practitioner does not express an affirmative opinion but rather expresses negative assurance. That is, the accountant indicates that no information came to his or her attention indicating (a) that the subject matter is not based on (or in con- formity with) the criteria in all material respects or (b) that the assertion is not presented (or fairly stated), in all material respects, based on the criteria. Distribution of a review report can also be either general or limited. A review engagement should provide sufficient evidence to limit the attestation risk to a moderate level.

Agreed-Upon Procedures An agreed-upon procedures engagement is one in which a practitioner is engaged by an entity to issue a report of findings based on specific procedures performed on the subject matter. The level of assurance provided by such an engagement depends on the nature and scope of the procedures that are agreed by the specified parties. Thus, for agreed-upon procedures engagements, acceptable attestation risk is a function of the intended level of assurance. Distribution of the report based on such an engagement is always limited to the specified users privy to the agreement. The report on an agreed-upon procedures engagement simply summarizes findings from the application of the agreed-upon procedures; it does not include an opinion.

Table 21–1 provides an overview of the types of attestation engagements.

Overview of Attestation Engagements

Type of Engagement Level of Assurance Attestation Risk Type of Report Report Distribution

Examination High Low Opinion General or limited Review Moderate Moderate Negative assurance General or limited Agreed-upon procedures Variable Variable Summary of findings Limited

T A B L E 2 1 – 1

Attestation Standards

Table 21–2 lists the 11 attestation standards and the 10 generally accepted auditing standards side-by-side so we can compare them easily.

General Standards As you can see in the table, there are five general standards for attestation engagements. All but the second and third general standards have counterparts in generally accepted auditing standards. The second standard requires that the practitioner have adequate knowledge of the subject matter. This requirement is important because, while it is assumed that CPAs under- stand financial statements, the subject matter of attestation engagements can take on a wide variety of forms, such as specific pieces of financial information, the accuracy of the vote tal- lies in a beauty pageant, or the amount of carbon emissions from a manufacturing plant. Such

LO 21-5

Final PDF to printer

714 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 714 10/22/15 11:48 AM

Attestation Standards Compared with Generally Accepted Auditing Standards

Attestation Standards Generally Accepted Auditing Standards

General Standards

1. The practitioner must have adequate technical training and proficiency to perform the attestation engagement.

2. The practitioner must have adequate knowledge of the subject matter. 3. The practitioner must have reason to believe that the subject matter is

capable of evaluation against criteria that are suitable and available to users.

4. The practitioner must maintain independence in mental attitude in all matters relating to the engagement.

5. The practitioner must exercise due professional care in the planning and performance of the engagement and the preparation of the report.

1. The audit is to be performed by a person or persons having adequate technical training and proficiency as an auditor.

2. In all matters relating to the assignment, an independence in mental attitude is to be maintained by the auditor or auditors.

3. Due professional care is to be exercised in the performance of the audit and the preparation of the report.

Standards of Fieldwork

1. The practitioner must adequately plan the work and must properly supervise any assistants.

2. The practitioner must obtain sufficient evidence to provide a reasonable basis for the conclusion that is expressed in the report.

1. The work is to be adequately planned and assistants, if any, are to be properly supervised.

2. A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed.

3. Sufficient appropriate evidential matter is to be obtained through inspection, observation, inquiries, and confirmations to afford a reasonable basis for an opinion regarding the financial statements under audit.

Standards of Reporting

1. The practitioner must identify the subject matter or the assertion being reported on and state the character of the engagement in the report.

2. The practitioner must state all of the practitioner’s significant reserva- tions about the engagement, the subject matter, and, if applicable, the assertion related thereto in the report.

3. The practitioner must state the practitioner’s conclusion about the sub- ject matter or the assertion in relation to the criteria against which the subject matter was evaluated in the report.

4. The practitioner must state in the report that the report is intended solely for the information and use of the specified parties under the following circumstances: • When the criteria used to evaluate the subject matter are determined

by the practitioner to be appropriate only for a limited number of parties who either participated in their establishment or can be pre- sumed to have an adequate understanding of the criteria.

• When the criteria used to evaluate the subject matter are available only to specified parties.

• When reporting on subject matter and a written assertion has not been provided by the responsible party.

• When the report is on an attestation engagement to apply agreed- upon procedures to the subject matter.

1. The report shall state whether the financial statements are presented in accordance with generally accepted accounting principles (GAAP).

2. The report shall identify those circumstances in which such principles have not been consistently observed in the current period in relation to the preceding period.

3. Informative disclosures in the financial statements are to be regarded as reasonably adequate unless otherwise stated in the report.

4. The report shall contain either an expression of opinion regarding the financial statements, taken as a whole, or an assertion to the effect that an opinion cannot be expressed. When an overall opinion cannot be expressed, the reasons therefore should be stated. In all cases where an auditor’s name is associated with financial statements, the report should contain a clear-cut indication of the character of the audi- tor’s work, if any, and the degree of responsibility the auditor is taking.

T A B L E 2 1 – 2

a requirement can be met by the CPA through education and practical experience. The CPA may also use a specialist to help meet this knowledge requirement.

The third standard is also important because it stipulates that the practitioner should per- form the engagement only if he or she has reason to believe that the subject matter is capable of evaluation against criteria that are suitable and available to users. Criteria are standards or benchmarks used to measure and present the subject matter and against which the practi- tioner evaluates the subject matter. Criteria can be established or developed by the entity, the responsible party, industry associations, or other groups, including those that do not follow due process procedures. With respect to attestation engagements for reporting on internal control for privately held companies (see discussion below), the practitioner can use criteria from the 2013 Committee of Sponsoring Organizations of the Treadway Commission’s docu- ment Internal Control—Integrated Framework (the COSO Framework). Criteria can be made

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 715

mes32502_ch21_707-747.indd 715 10/22/15 11:48 AM

available to users publicly by including the criteria in the presentation of the subject matter or assertion, or in the practitioner’s report. The criteria can also be such that they are available only to specified parties because the criteria are unique to a specific client and user.

Standards of Fieldwork The primary difference in the standards of fieldwork between the attestation standards and generally accepted auditing standards is that the attestation standards do not require an under- standing of the entity’s environment, including its internal control. Given the varied nature of services that can be performed under the attestation standards, such a requirement would be prohibitively restrictive. The approach to fieldwork for an attestation engagement should involve proper planning and supervision, and sufficient evidence must be gathered to provide a reasonable basis for the practitioner’s conclusion about the subject matter or assertion.

Standards of Reporting As you can see in Table 21–2, reporting standards for attestation engagements differ in a num- ber of respects from those of generally accepted auditing standards. First, in view of the wide variety of possible services and subject matter, the attestation standards do not make reference to consistent application of GAAP because the criteria involved in attestation engagements can vary widely depending on the subject matter. However, they do require that the report identify the subject matter or assertion and the type of engagement being performed. The reporting standards also require that the practitioner state any significant reservation about the engagement or presentation of the assertion. The fourth standard of reporting for attesta- tion services lists four situations where the use of the report is restricted to specified parties, for example, when the attest engagement involves the application of agreed-upon procedures.

Reporting on an Entity’s Internal Control over Financial Reporting (ICFR)

Over the past few decades, accountants have increasingly been asked to provide attest ser- vices on the effectiveness of an entity’s internal control. Impetus was given for such reporting when Congress passed the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA), which requires that the management of large financial institutions, whether pub- licly or privately held, issue a report on the effectiveness of the institution’s internal control. The Act also requires that these institutions engage accountants to attest to management’s report. As discussed in Chapter 7, the Sarbanes-Oxley Act of 2002 imposed similar require- ments on all publicly held companies. While an audit of internal control is not required of privately held companies by law (except private financial institutions subject to FDICIA requirements), these companies sometimes engage an accounting firm to provide an attesta- tion service relating to internal control.

In such cases, the practitioner should obtain from the responsible party a written asser- tion about the effectiveness of internal control. The responsible party may present the written assertion in either (1) a separate report that will accompany the practitioner’s report or (2) a representation letter to the practitioner. When management’s assertion does not accompany the practitioner’s report, the first paragraph of the report should also contain a statement of management’s assertion.

LO 21-6

Practice I N S I G H T

The banking crisis of 2007–2009 is a salient and painful reminder that an organization can get a clean opinion on “internal controls” at a transactional or detail level and still essentially be “out of control” from a broader risk management perspective. Both management and auditors should take care not to focus so much on the details of internal control that they miss more critical strategic and operational risk management issues.

Final PDF to printer

716 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 716 10/22/15 11:48 AM

Conditions for Conducting an Engagement Relating to ICFR In order for the practitioner to examine management’s assertions about the effectiveness of internal control in an attestation engagement, the following conditions must be met:

∙ Management of the entity accepts responsibility for the effectiveness of the entity’s internal control

∙ The responsible party evaluates the effectiveness of the entity’s internal control using suitable criteria (referred to as control criteria)

∙ Sufficient appropriate evidence exists or could be developed to support the responsible party’s evaluation

Criteria issued by the AICPA, regulatory agencies, and other bodies of experts that fol- low due process qualify as control criteria. For example, management may use the criteria provided by COSO’s Internal Control—Integrated Framework, or COSO’s more compre- hensive Enterprise Risk Management—Integrated Framework. Note, however, that all public companies in the U.S. to this point have chosen to use the COSO framework.

A practitioner is allowed to perform either of two types of attestation engagements for reporting on internal control: (1) examination (i.e., similar in scope and detail to an audit) or (2) agreed-upon procedures. The attestation standards specifically prohibit the practitioner from accepting an engagement to perform a review on management’s assertion relating to internal control.

Examination Engagement on an Entity’s ICFR The practitioner’s objective in an engagement to examine an entity’s internal control is to express an opinion on the effectiveness of the entity’s internal control, in all material respects, based on the control criteria. An engagement to examine internal control at a privately held company or other non-public entity must be integrated with an audit of the entity’s financial statements, and is conducted very similarly to the audit of internal control required of public companies, as described in Chapter 7.1

While performing an examination engagement relating to the entity’s internal control over financial reporting, the practitioner may encounter control deficiencies. Definitions of significant deficiencies and material weaknesses are similar in attestation and auditing stan- dards.2 As in auditing standards, the presence of one or more material weaknesses precludes the practitioner from concluding that the entity has effective internal control, necessitating an adverse opinion on the entity’s internal control over financial reporting. If the practitioner identifies significant deficiencies, they should be communicated to management and to those charged with governance.

Finally, the practitioner should obtain written representations from management, similar to those listed in Chapter 7. If management refuses to provide written representations, a scope limitation exists.

Reporting on Management’s Assertion about Internal Control The practitioner’s report should include the following:

∙ A title that includes the word independent in describing the practitioner ∙ An identification of the subject matter (internal control over financial reporting) and

the responsible party

1Until recently, examinations of a non-public entity’s ICFR were performed under the AICPA attestation standard AT 501. However, because such engagements are required to be integrated with an audit of the entity’s finanical statements, the ASB concluded that it was appropriate to move AT section 501 into generally accepted auditing stan- dards. Thus, examinations of non-public entities’ ICFR are now conducted under AU-C 940. 2See the definitions of control deficiency, significant deficiency, and material weakness in Chapter 7.

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 717

mes32502_ch21_707-747.indd 717 10/22/15 02:59 PM

∙ A statement that the responsible party is responsible for maintaining effective internal control over financial reporting

∙ A statement that the practitioner’s responsibility is to express an opinion on the effectiveness of an entity’s internal control based on his or her examination

∙ A statement that the examination was conducted in accordance with the standards established by the AICPA

∙ A statement that the practitioner believes the examination provides a reasonable basis for his or her opinion

∙ A paragraph stating that, because of the inherent limitations of any internal control, misstatements due to errors or fraud may occur and not be detected

∙ The practitioner’s opinion on whether the entity has maintained, in all material respects, effective internal control over financial reporting as of the specified date, based on control criteria

∙ A statement restricting the use of the report to the specified parties (if the report’s distribution is to be limited)

Again, these reporting requirements are similar to those for reporting on the audit of internal control over financial reporting as part of an integrated audit (see Chapter 7).

Financial Forecasts and Projections

Auditors are often asked to provide assurance with respect to prospective financial state- ments. Attestation standards (Chapter 3, SSAE No. 10) provide guidance for practitioners providing such services. The practitioner’s involvement may include (1) assembling or assisting the entity in assembling prospective financial statements or (2) reporting on pro- spective financial statements. In either of these situations, the practitioner can enter into an engagement to examine, apply agreed-upon procedures, or simply compile the prospective financial statements.

Types of Prospective Financial Statements Prospective financial statements contain financial information made up of either financial forecasts or financial projections. Financial forecasts are prospective financial statements that present an entity’s expected financial position, results of operations, and cash flows. They are based on assumptions reflecting conditions the responsible party expects to exist and the course of action it expects to take. Financial projections are prospective financial statements that present, given one or more hypothetical assumptions, an entity’s expected financial posi- tion, results of operations, and cash flows. These assumptions may not reflect the most likely or expected conditions. The primary difference between the two is that a financial projection is based on hypothetical assumptions rather than what is actually expected and is intended to respond to a specific question, such as “What would happen if the company were to outsource its customer support operations to India?” A financial projection is sometimes prepared to present one or more possible courses of action for evaluation.

Prospective financial statements are for either general use or limited use. General use of prospective financial statements refers to the use of the statements by persons with whom the responsible party is not negotiating directly. An example would be an offering statement containing prospective financial statements for an entity’s debt or equity securities.

Stop and Think: Why are financial forecasts for general use but financial projections are not?

LO 21-7

Final PDF to printer

718 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 718 10/22/15 11:48 AM

Because the intended users may not be able to question the responsible party to clarify any hypothetical assumptions made, the only appropriate basis of presentation for general-use prospective financial statements is the expected results. Therefore, only a financial forecast can be made available for general use; financial projections are not to be made available for general use if an accountant’s report is involved.

Limited use of prospective financial statements refers to use of the statements by the responsible party alone or by the responsible party and third parties with whom the respon- sible party is directly negotiating. Examples of limited use include negotiations for a bank loan, submission to a regulatory agency, or use solely within the entity. In such cases, the third party can question the responsible party about the prospective financial information and can question, understand, or even negotiate concerning the assumed conditions on which it is based. Thus, any type of prospective financial statement can be issued for lim- ited use.

While the responsible party is responsible for presentation of prospective financial state- ments, other parties, such as accountants, may assist in meeting the presentation guidelines specified in the attestation standards. Prospective financial statements preferably should be in the same format as the historical financial statements; however, they may be limited to the items shown in Table 21–3. A presentation that omits any item in Table 21–3 is referred to as a partial presentation.

Examination of Prospective Financial Statements An examination of prospective financial statements involves four steps: (1) evaluating the preparation of the prospective financial statements, (2) evaluating the support underlying the assumptions, (3) evaluating the presentation of the prospective financial statements for conformity with AICPA presentation guidelines, and (4) issuing an examination report. The accountant should be independent, have adequate technical training and proficiency to exam- ine prospective financial statements, and obtain sufficient evidence to issue an examination report. Exhibits 21–1 and 21–2 present examples of the standard examination report for a forecast and a projection, respectively. The only major difference between the two reports, aside from the description of the nature of the prospective information involved, is the para- graph limiting distribution of the projection to specified users.

The following circumstances may require a departure from the standard examination report:

∙ Departure from AICPA presentation guidelines ∙ Unreasonable assumptions ∙ Scope limitation

Minimum Presentation Guidelines for Prospective Financial Information*

• Sales or gross revenues. • Gross profit or cost of sales. • Unusual or infrequently occurring items. • Provision for income taxes. • Discontinued operations or extraordinary items. • Income from continuing operations. • Net income. • Basic and fully diluted earnings per share. • Significant changes in financial position. • A description of what the responsible party intends the prospective financial statements to present, a statement

that the assumptions are based on information about circumstances and conditions existing at the time the pro- spective information was prepared, and a caveat that the prospective results may not be achieved.

• Summary of significant assumptions. • Summary of significant accounting policies.

*Prospective financial statements that omit any item listed above are considered partial presentations.

T A B L E 2 1 – 3

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 719

mes32502_ch21_707-747.indd 719 10/22/15 11:48 AM

Example of a Standard Examination Report on a Forecast

Independent Accountant’s Report We have examined the accompanying forecasted balance sheet, statements of income, retained earn- ings, and cash flows of Panatta Company as of December 31, 2015, and for the year then ending. Panatta Company’s management is responsible for the forecast. Our responsibility is to express an opinion on the forecast based on our examination.

Our examination was made in accordance with attestation standards established by the American Institute of Certified Public Accountants and, accordingly, included such procedures as we considered necessary to evaluate both the assumptions used by management and the preparation and presentation of the forecast. We believe that our examination provides a reasonable basis for our opinion.

In our opinion, the accompanying forecast is presented in conformity with guidelines for presentation of a forecast established by the American Institute of Certified Public Accountants, and the underlying assumptions provide a reasonable basis for management’s forecast. However, there will usually be differ- ences between the forecasted and actual results, because events and circumstances frequently do not occur as expected, and those differences may be material. We have no responsibility to update this report for events and circumstances occurring after the date of this report.

E X H I B I T 2 1 – 1

Example of a Standard Examination Report on a Projection

Independent Accountant’s Report We have examined the accompanying projected balance sheet, statements of income, retained earnings, and cash flows of Hansen Company as of December 31, 2015, and for the year then ending. Hansen Com- pany’s management is responsible for the projection, which was prepared for the Panama City National Bank for the purpose of negotiating a loan to expand Hansen Company’s plant. Our responsibility is to express an opinion on the projection based on our examination.

Our examination was made in accordance with attestation standards established by the American Institute of Certified Public Accountants and, accordingly, included such procedures as we considered necessary to evaluate both the assumptions used by management and the preparation and presentation of the projection. We believe that our examination provides a reasonable basis for our opinion.

In our opinion, the accompanying projection is presented in conformity with guidelines for presenta- tion of a projection established by the American Institute of Certified Public Accountants, and the underly- ing assumptions provide a reasonable basis for management’s projection, assuming the granting of the requested loan for the purpose of expanding Hansen Company’s plant as described in the summary of significant assumptions. However, even if the loan is granted and the plant is expanded, there will likely be differences between the projected and actual results, because events and circumstances frequently do not occur as expected, and those differences may be material. We have no responsibility to update this report for events and circumstances occurring after the date of this report.

The accompanying projection and this report are intended solely for the information and use of Han- sen Company and Panama City National Bank and are not intended to be and should not be used by anyone other than these parties.

E X H I B I T 2 1 – 2

The presence of such events can result in a report that is either qualified or adverse. A disclaimer may also be issued, for example in the case of a severe scope limitation.

Agreed-Upon Procedures for Prospective Financial Statements An agreed-upon procedures engagement is significantly more limited in scope than is an examination. An accountant may perform an agreed-upon procedures attestation engagement for prospective financial statements provided attestation standards are complied with and each of the following applies.

1. The practitioner is independent.

Final PDF to printer

720 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 720 10/22/15 11:48 AM

2. Either (a) the party wishing to engage the practitioner is responsible for the subject matter, or (b) the party wishing to engage the practitioner is not responsible for the subject matter but is able to provide the practitioner with evidence of a third party’s responsibility for the subject matter.

3. The practitioner and the specified parties agree upon the procedures to be performed by the practitioner.

4. The specified parties take responsibility for the sufficiency of the agreed-upon procedures for their purposes.

5. The specific subject matter to which the procedures are to be applied is subject to reasonably consistent measurement.

6. Criteria to be used in the determination of findings are agreed upon between the practitioner and the specified parties.

7. The procedures to be applied to the specific subject matter are expected to result in reasonably consistent findings using the criteria.

8. Relevant evidence is expected to exist to provide a reasonable basis for expressing the findings in the practitioner’s report.

9. Where applicable, the practitioner and the specified parties agree on any materiality limits for reporting purposes.

10. Use of the report is restricted to the specified parties. 11. For agreed-upon procedures engagements on prospective financial information, the

prospective financial statements include a summary of significant assumptions.

The accountant must satisfy the requirement that the specified users take full responsi- bility for the sufficiency of the procedures to be performed by comparing the procedures to be applied to the written requirements of the specified users, discussing the procedures to be applied with an appropriate representative of the specified users, or reviewing relevant con- tracts with or correspondence from the specified users.

Exhibit 21–3 presents an example of a report on the use of agreed-upon procedures. Use of an agreed-upon procedures report is always explicitly restricted to the users specified in the report, since the users explicitly “agreed upon” the procedures to be performed, while other parties were not part of that agreement.

Compilation of Prospective Financial Statements A practitioner can perform a compilation of prospective financial information for a non- public entity. A compilation of prospective financial statements involves the following:

∙ Assembling, to the extent necessary, the prospective financial statements based on the responsible party’s assumptions

∙ Performing the required compilation procedures, which include reading the prospective financial statements with their summaries of significant assumptions and accounting policies and considering whether they appear to be (1) presented in conformity with the attestation standards and (2) not obviously inappropriate

∙ Issuing a compilation report

A practitioner should not issue a compilation report on prospective financial statements that exclude disclosure of the summary of significant assumptions. Exhibit 21–4 provides an example of a compilation report for a forecast. Note that the report explicitly indicates that the accountant does not offer assurance when providing a compilation service.

A practitioner may compile prospective financial statements for an entity even when he or she is not independent. The practitioner is also permitted to disclose the reason for the lack of independence, but such disclosure is not required. If the practitioner is not independent, the word “Independent” should not be included in the title of the report.

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 721

mes32502_ch21_707-747.indd 721 10/22/15 11:48 AM

Example of an Agreed-Upon Procedures Report for a Forecast

Independent Accountant’s Report on Applying Agreed-Upon Procedures

Board of Directors—Donnay Corporation Board of Directors—Clinkton Company

At your request, we have performed certain agreed-upon procedures, as enumerated below, with respect to the forecasted balance sheet, and the related forecasted statements of income, retained earnings, and cash flows of Matlin Company, a subsidiary of Donnay Company, as of December 31, 2015, and for the year then ending. These procedures, which were agreed to by the boards of directors of Donnay Corporation and Clinkton Company, were performed solely to assist you in evaluating the forecast in connection with the sale of Matlin Company to Clinkton Company.

This agreed-upon procedures engagement was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. The sufficiency of these procedures is solely the responsibility of the specified users of the report. Consequently, we make no representation regarding the sufficiency of the procedures described below either for the purpose for which this report has been requested or for any other purpose.

The procedures and associated findings are as follows: a. With respect to forecasted rental income, we compared the assumptions about expected demand

for rental of the housing units to demand for similar housing units at similar rental prices in the city area in which Matlin Company’s housing units are located.

No exceptions were found as a result of this comparison. b. We tested the forecast for mathematical accuracy.

The forecast was mathematically accurate. We were not engaged to and did not conduct an examination, the objective of which would be the

expression of an opinion on the accompanying prospective financial statements. Accordingly, we do not express an opinion on whether the prospective financial statements are presented in conformity with AICPA presentation guidelines or on whether the underlying assumptions provide a reasonable basis for the presentation. Had we performed additional procedures, other matters might have come to our atten- tion that would have been reported to you. Furthermore, there will usually be differences between the forecasted and actual results, because events and circumstances frequently do not occur as expected, and those differences may be material. We have no responsibility to update this report for events and circumstances occurring after the date of this report.

This report is intended solely for the use of the boards of directors of Donnay Corporation and Clinkton Company and is not intended to be nor should be used by anyone other than these parties.

E X H I B I T 2 1 – 3

Example of Standard Compilation Report for a Forecast

Independent Accountant’s Report We have compiled the accompanying forecasted balance sheet, statements of income, retained earnings, and cash flows of Schouten Company as of December 31, 2015, and for the year then ending, in accor- dance with attestation standards established by the American Institute of Certified Public Accountants.

A compilation is limited to presenting, in the form of a forecast, information that is the representation of management and does not include evaluation of the support for the assumptions underlying the fore- cast. We have not examined the forecast and, accordingly, do not express an opinion or any other form of assurance on the accompanying statements or assumptions. Furthermore, there will usually be differ- ences between the forecasted and actual results, because events and circumstances frequently do not occur as expected, and those differences may be material. We have no responsibility to update this report for events and circumstances occurring after the date of this report.

E X H I B I T 2 1 – 4

Final PDF to printer

722 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 722 10/22/15 11:48 AM

Many non-public businesses do not choose to contract for an audit of their financial state- ments. This typically occurs because the entity is small, the owner is involved in the day-to- day operations, and there are no loan covenants or regulations requiring an audit. However, these entities often employ a CPA to assist with preparing their financial statements, tax returns, or other financial documents.

Until 1977 there was relatively little guidance on how to perform or report on engage- ments involving unaudited financial statements. As discussed in Chapter 20, the 1136 Ten- ants’ case involved auditors’ liability for unaudited financial statements. One outcome of this case was the establishment of the Accounting and Review Services Committee by the AICPA. This committee was designated by the AICPA to issue Statements on Standards for Account- ing and Review Services (SSARS) in connection with services that relate to historical finan- cial statements, but that are less extensive than a financial statement audit.

SSARS provide guidance for three types of services: preparation of financial state- ments, compilation of financial statements, and review of financial statements. While preparation and compilation are somewhat similar in scope, compilation differs signifi- cantly from a review. The work done on a preparation, which essentially involves assisting a client in organizing financial information into the form of financial statements, provides no assurance; the accountant is required to include a legend on each page of the financial statements explicitly stating that no assurance is being provided. As with any other nonat- test bookkeeping/accounting service engagement, the accountant is not required to con- sider whether he or she is independent in performing a preparation and does not issue any kind of report.

A compilation engagement is similar to a preparation engagement except that a compila- tion requires a report to be issued; a compilation report is required when financial statements prepared by a CPA are to be submitted to a third-party user. For a compilation engagement, the practitioner must be independent or must disclose in the report that she or he is not inde- pendent. Although a compilation engagement requires independence (or disclosure of non- independence) and involves a report, neither a preparation nor a compilation is intended to provide any level of assurance about the fairness of the financial statements in accordance with a reporting framework.

A review, on the other hand, provides the accountant with a reasonable basis for express- ing limited assurance that no material modifications should be made to the financial state- ments. This can be compared to an audit, in which the auditor provides an explicit, affirmative opinion about whether the financial statements present fairly the financial position and results of operations of the entity. Figure 21–4 compares the assurance provided by an audit with the assurance provided by a review, a compilation, and a preparation engagement.

Preparation, compilation, and review engagements performed under SSARS specifically apply to engagements for which the output of the service is a set of historical financial state- ments. An accountant may provide other types of services, such as preparing a working trial balance; assisting in adjusting the account books; consulting on accounting, tax, and similar matters; preparing tax returns; and providing various manual or automated bookkeeping or data processing services, without having to comply with the standards for compilations and

LO 21-8

Accounting and Review Services

Assurance Levels for a Compilation, a Review, and an AuditF I G U R E 2 1 – 4

Preparation/ Compilation

No assurance

Limited assurance

Absolute assurance

Reasonable assurance

AuditReview

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 723

mes32502_ch21_707-747.indd 723 10/22/15 11:48 AM

reviews. As with an engagement to prepare (but not compile or review) financial statements, these types of services essentially are considered bookkeeping services for which indepen- dence is not required and for which no report is issued.

Compilation of Financial Statements A compilation is defined as presenting, in the form of financial statements, information that is the representation of management or owners without undertaking to express any assurance on the statements. While no assurance is provided, in conducting a compilation the accountant must have the following knowledge about the entity:

∙ The accounting principles and practices of the industry in which the entity operates ∙ A general understanding of the entity’s organization; its operating characteristics; and

the nature of its assets, liabilities, revenues, and expenses ∙ An understanding of the accounting principles and practices used by the entity

Compilation standards do not require the practitioner to perform procedures to verify or corroborate the financial statement information provided by the client. However, the accoun- tant must address significant questions that arise in the course of the compilation engagement. If the accountant has reason to believe the information supplied by the client is inaccurate, incomplete, or otherwise unsatisfactory, the accountant is required to obtain revised or cor- rected information before issuing a compilation report. The compilation standards require the accountant to possess an adequate level of knowledge about the accounting principles and practices of the client’s industry and have a general understanding about the nature of the cli- ent’s business. There are three forms of compilation reports:

∙ Compilation with full disclosure ∙ Compilation that omits substantially all disclosures ∙ Compilation when the accountant is not independent

The report should be dated as of the completion of the compilation. Additionally, each page of the financial statements should be marked with a notation such as “See Accountant’s Compilation Report.”

Compilation with Full Disclosure When the entity presents a set of financial statements that contain all necessary financial disclosures required by generally accepted accounting principles or another financial reporting framework, the accountant can issue a standard com- pilation report. Exhibit 21–5 is an example of such a report.

Example of a Compilation Report with Full Disclosure

We have compiled the accompanying balance sheet for Learn Medical Services as of December 31, 2015, and the related statements of income, retained earnings, and cash flows for the year then ended. We have not audited or reviewed the accompanying financial statements and, accordingly, do not express an opin- ion or provide any assurance about whether the financial statements are in accordance with accounting principles generally accepted in the United States of America.

Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America and for design- ing, implementing, and maintaining internal control relevant to the preparation and fair presentation of the financial statements.

Our responsibility is to conduct the compilation in accordance with Statements on Standards for Accounting and Review Services issued by the American Institute of Certified Public Accountants. The objective of a compilation is to assist management in presenting financial information in the form of finan- cial statements without undertaking to obtain or provide any assurance that there are no material modifi- cations that should be made to the financial statements.

E X H I B I T 2 1 – 5

Final PDF to printer

724 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 724 10/22/15 11:48 AM

Compilation That Omits Substantially All Disclosures Sometimes an entity may request that the accountant compile financial statements without adding all the necessary disclosures (footnotes, etc.). Many times this request is made to minimize the cost of the engagement. The accountant can compile such financial statements so long as the omission is clearly indicated in the report and the entity does not intend the omission to mislead the user. For example, the accountant may add the following paragraph after the conclusion paragraph: “Management has elected to omit substantially all of the disclosures required by accounting principles generally accepted in the United States of America. If the omitted disclosures were included in the financial statements, they might influence the user’s conclusions about the company’s financial position, results of operations, and cash flows. Accordingly, the financial statements are not designed for those who are not informed about such matters.”

Compilation When the Accountant Is Not Independent The Code of Professional Conduct allows an accountant to perform a compilation engagement even when he or she is not independent of the entity. However, the lack of independence must be disclosed in the report. As an example, the following sentence might be added as the last paragraph of the report when the accountant is not independent: “We are not independent with respect to Wah- weap Medical Services.” Unlike when performing an audit, the accountant may also disclose the reason(s) that his or her independence is impaired when performing a compilation. The wording of such an explanation might look something like this: “We are not independent with respect to Wahweap Medical Services as of and for the year ended December 31, 2015, because a member of the engagement team had a direct financial interest in Wahweap Medi- cal Services.” If the accountant elects to disclose a description about the reasons his or her independence is impaired, the accountant should ensure that all reasons are completely and accurately included in the description.

Review of Financial Statements A review is defined as the performance of inquiry and analytical procedures to provide the accountant with a reasonable basis for expressing limited assurance that no material modi- fications should be made to the statements in order for them to conform to the applicable financial reporting framework (e.g., GAAP). In conducting a review, the accountant’s work involves the following:

∙ Obtaining knowledge of the accounting principles and practices of the industry in which the entity operates

∙ Obtaining a general understanding of the entity’s organization, its operating characteristics, and the nature of its assets, liabilities, revenues, and expenses

∙ Obtain an understanding of the accounting principles and practices used by the entity in measuring, recognizing, recording, and disclosing all significant accounts and disclosures in the financial statements

∙ Asking the entity’s personnel about important matters, some examples of which are noted in Table 21–4

∙ Performing analytical procedures to identify relationships and individual items that appear to be unusual (the process followed for conducting analytical procedures is similar to the one described for audits in Chapter 5)

∙ Reading the financial statements to determine if they conform to the applicable financial reporting framework

∙ Obtaining reports from other accountants, if any, who have audited or reviewed the financial statements or significant components thereof

∙ Obtaining a representation letter from management (generally signed by the chief executive officer and chief financial officer)

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 725

mes32502_ch21_707-747.indd 725 10/22/15 11:48 AM

Note that a review engagement does not require the accountant to obtain an understand- ing of internal control, test accounting records by performing detailed tests, or corroborate inquiries, as would normally be done on an audit. However, if while conducting the review the accountant becomes aware of information that is incorrect, incomplete, or misleading, he or she should perform any additional procedures necessary to provide limited assurance that no material modifications to the financial statements are required. Table 21–4 shows examples of inquiries an auditor might make in the conduct of a review engagement.

Practice I N S I G H T

Because a review costs substantially less than an audit engagement, smaller privately held com- panies often choose to have an annual review to satisfy requirements associated with their lines of credit or commercial loans if such an approach is acceptable to the company’s creditors.

Examples of Inquiries Made during a Review Engagement

1. Inquiries concerning the client’s accounting principles and practices. 2. Inquiries concerning the client’s procedures for recording, classifying, and summarizing accounting transactions. 3. Inquiries concerning actions taken at stockholders’, board of directors’, and other committee meetings. 4. Inquiries of persons responsible for the financial statements concerning: • Whether the statements are in accordance with the applicable financial reporting framework. • Changes in the client’s business activities or accounting principles. • Any exceptions concerning other analytical procedures. • Subsequent events having a material effect on the statements.

T A B L E 2 1 – 4

Review Report A standard review report assumes that the financial statements are in accordance with generally accepted accounting principles (or another financial reporting framework). This includes all necessary disclosures. The review report should be dated as of the completion of the accountant’s inquiry and analytical procedures. Additionally, each page of the financial statements should contain a notation such as “See Accountant’s Review Report.” Exhibit 21–6 is an example of the standard review report.

Example of a Standard Review Report

We have reviewed the accompanying balance sheet of Sierra Company as of December 31, 2015, and the related statements of income, retained earnings, and cash flows for the year then ended. A review includes primarily applying analytical procedures to management’s financial data and making inquiries of company management. A review is substantially less in scope than an audit, the objective of which is the expression of an opinion regarding the financial statements as a whole. Accordingly, we do not express such an opinion.

Our responsibility is to conduct the review in accordance with Statements on Standards for Accounting and Review Services issued by the American Institute of Certified Public Accountants. Those standards require us to perform procedures to obtain limited assurance that there are no material modifications that should be made to the financial statements. We believe that the results of our procedures provide a reasonable basis for our report.

Based on our review, we are not aware of any material modifications that should be made to the accompanying financial statements in order for them to be in conformity with accounting principles gener- ally accepted in the United States of America.

E X H I B I T 2 1 – 6

Final PDF to printer

726 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 726 10/22/15 11:48 AM

Conditions That May Result in Modification of a Compilation or Review Report When the accountant conducts a compilation or review, he or she may become aware of situations that require modification to the standard report. Two particular situations are (1) a departure from generally accepted accounting principles and (2) a going concern uncer- tainty. If there is a departure from GAAP, the departure should be disclosed in a separate paragraph of the report. Exhibit 21–7 is an example of a review report modified for a depar- ture from GAAP.

If the accountant believes that there are questions concerning the continuing viability of the entity, the accountant should add wording similar to the following after the standard four paragraphs:

The accompanying financial statements have been prepared assuming that the company will con- tinue as a going concern. As discussed in Note x to the financial statements, the company has suf- fered recurring losses from operations and has a net capital deficiency that raises substantial doubt about its ability to continue as a going concern. Management’s plans in regard to these matters are also described in Note x. The financial statements do not include any adjustments that might result from the outcome of this uncertainty.

The process the accountant follows in determining whether the entity is a going concern is similar to the process used for assessing going concern issues during an audit, discussed in Chapter 17.

Example of a Modified Review Report for a Departure from GAAP

[Same wording as in the first three paragraphs of the standard review report] Based on our review, with the exception of the matter described in the following paragraph, we are

not aware of any material modifications that should be made to the accompanying financial statements in order for them to be in conformity with accounting principles generally accepted in the United States of America.

As disclosed in note 4 to the financial statements, accounting principles generally accepted in the United States of America require that inventory cost consist of material, labor, and overhead. Management has informed us that the inventory of finished goods and work in process is stated in the accompanying financial statements at material and labor cost only, and that the effects of this departure from accounting principles generally accepted in the United States of America on financial position, results of operations, and cash flows have not been determined.

E X H I B I T 2 1 – 7

Internal Auditing

Up to this point in the chapter, we have focused on nonaudit assurance and attestation services that are provided by public accountants. The remainder of the chapter focuses on the role of, standards pertaining to, and services provided by internal auditors.

The largest financial statement fraud in the history of the United States may not have been discovered were it not for the persistent investigative efforts of Cynthia Cooper and her internal audit team (see Exhibit 14–2). Cynthia Cooper, the whistle-blower of the $9 billion WorldCom fraud, was head of internal audit at the communications giant at the time. Despite being ordered by the company’s management to discontinue investigations in the areas where the fraud had been committed, Cooper’s team aggressively pushed ahead and eventually uncovered the massive fraud.

After the Enron and WorldCom frauds, the Sarbanes-Oxley Act of 2002 placed increased emphasis on the importance of public companies’ internal audit functions, and in August 2002 the New York Stock Exchange (NYSE) required all companies wishing to trade their securities on the exchange to have a viable internal audit function. The role of the internal

LO 21-9

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 727

mes32502_ch21_707-747.indd 727 10/22/15 11:48 AM

auditor has become increasingly crucial to effective corporate governance and to the success of large organizations.3

Internal auditing can be a challenging, rewarding, and varied career path. Many public accountants who work as external auditors eventually become internal auditors, and many internal auditors eventually take management roles within their organizations. These oppor- tunities arise because internal auditors are in a unique position to understand the organization from a perspective that is both broad and deep.

Internal Auditing Defined The Institute of Internal Auditors (IIA), which oversees and sets standards for internal audit- ing internationally, defines internal auditing as

. . . an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a sys- tematic, disciplined approach to evaluate and improve the effectiveness of risk management, con- trol, and governance processes.

This definition outlines the main goals of the profession and broadly states the methods whereby these goals may be achieved. The IIA has issued detailed and rigorous standards for the practice of internal auditing; however, it states that the mission of the internal auditing profession is “to enhance and protect organizational value by providing risk-based and objec- tive assurance, advice, and insight.”

The Institute of Internal Auditors Established in 1941, the IIA is an international professional association with world head- quarters in Altamonte Springs, Florida. The IIA has over 180,000 members in 116 countries, specializing in internal auditing, risk management, governance, internal control, IT audit, education, and security. The Institute is the recognized authority, principal educator, and acknowledged leader in certification, research, and technological guidance for the internal auditing profession worldwide. The IIA offers not only the general Certified Internal Auditor (CIA) certification but also specialty certifications in areas including government accounting and financial services.

IIA Standards The IIA’s professional guidance is organized into an International Professional Practices Framework. This framework consists of two categories of authoritative guidance:

Mandatory Guidance

∙ Core Principles for the Professional Practice of Internal Auditing ∙ Definition of Internal Auditing ∙ International Standards for the Professional Practice of Internal Auditing ∙ Code of Ethics

Strongly Recommended Guidance

∙ Implementation Guidance ∙ Supplemental Guidance

3Academic research confirms the importance of internal auditing. For example, a recent study indicates that high- quality internal auditing leads to more reliable externally reported earnings. (See D. Prawitt, J. Smith, and D. Wood, “Internal Audit Quality and Earnings Management,” The Accounting Review, July 2009).

Final PDF to printer

728 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 728 10/22/15 11:48 AM

The mandatory guidance for IIA members consists of the Core Principles for the Profes- sional Practice of Internal Auditing, the Definition of Internal Auditing (stated previously), the International Standards for the Professional Practice of Internal Auditing, and the Code of Ethics.

The Core Principles for the Professional Practice of Internal Auditing lay out the founda- tional characteristics of internal audit effectiveness. They are as follows:

∙ Demonstrates integrity ∙ Demonstrates competence and due professional care ∙ Is objective and free from undue influence (independent) ∙ Aligns with the strategies, objectives, and risks of the organization ∙ Is appropriately positioned and adequately resourced ∙ Demonstrates quality and continuous improvement ∙ Communicates effectively ∙ Provides risk-based assurance ∙ Is insightful, proactive, and future-focused ∙ Promotes organizational improvement

The International Standards for the Professional Practice of Internal Auditing are divided into three main areas: attribute standards, performance standards, and implementation standards.

Attribute standards address the characteristics of organizations and parties perform- ing internal audit activities, and performance standards describe the nature of internal audit activities and provide criteria against which the performance of these services can be evalu- ated. The standards in these two areas are similar in scope to the 10 generally accepted audit- ing standards applicable to external auditors. Table 21–5 presents the main categories of the IIA’s attribute and performance standards. Given the substantial variation in internal audit environments across the world, attribute and performance standards are necessarily general; however, the third category of IIA standards, known as implementation standards, are more detailed, providing guidance applicable to specific types of engagements.

Practice I N S I G H T

The IIA’s Standards require that a regular “quality assessment” be used to evaluate compliance with IIA standards, the internal audit activity and audit committee charters, the organization’s risk and control assessment, and the use of successful practices. Every internal audit function has to have an external quality assessment at least once every five years to be in compliance with IIA standards. (IIA Standard 1312).

Practice I N S I G H T

CIA candidates who have already earned the CPA designation are eligible to receive credit for Part IV of the CIA exam. Proof of certification along with an application and the payment of an administra- tive fee is required before credit is granted to the CIA candidate.

Code of Ethics As with most reputable professions, internal auditors must follow guidelines promoting ethi- cal conduct (see Chapter 19 for a discussion of the AICPA/PCAOB Code of Professional Conduct, which applies to CPAs and external auditors). The IIA Code of Ethics is important for internal auditors because the reliability of their work depends on a reputation for a high level of objectivity and personal integrity. The Code of Ethics specifies four main principles

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 729

mes32502_ch21_707-747.indd 729 10/22/15 11:48 AM

International Standards for the Professional Practice of Internal Auditing

Standard Definition

Attribute Standards

1000—Purpose, authority, and responsibility The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval.

1100—Independence and objectivity The internal audit activity must be independent, and internal auditors must be objective in performing their work.

1130—Impairment to independence or objectivity If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment.

1200—Proficiency and due professional care Engagements must be performed with proficiency and due professional care. 1300—Quality assurance and improvement

program The chief audit executive must develop and maintain a quality assurance and improvement program

that covers all aspects of the internal audit activity.

Performance Standards

2000—Managing the internal audit activity The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organization.

2100—Nature of work The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach.

2200—Engagement planning Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations.

2300—Performing the engagement Internal auditors must identify, analyze, evaluate, and document sufficient information to achieve the engagement’s objectives.

2400—Communicating results Internal auditors must communicate the results of engagements. 2500—Monitoring progress The chief audit executive must establish and maintain a system to monitor the disposition of results

communicated to management. 2600—Communicating the acceptance of risks When the chief audit executive concludes that management has accepted a level of risk that may be

unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, the chief audit executive must communicate the matter to the board.

T A B L E 2 1 – 5

IIA Code of Ethics Principles

Principles Definition

Integrity The integrity of internal auditors establishes trust and thus provides the basis for reliance on their judgment.

Objectivity Internal auditors exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined. Internal auditors make a balanced assessment of all the relevant circumstances and are not unduly influenced by their own interests or by others in forming judgments.

Confidentiality Internal auditors respect the value and ownership of information they receive and do not disclose information without appropriate authority unless there is a legal or professional obligation to do so.

Competency Internal auditors apply the knowledge, skills, and experience needed in the performance of internal auditing services.

T A B L E 2 1 – 6

of ethical conduct and some associated rules that underpin the expected conduct of IIA mem- bers: integrity, objectivity, confidentiality, and competency (Tables 21–6 and 21–7).

Internal Auditors’ Roles Internal auditors are called “internal” because they work within an individual entity and report the results of their work to management or (ideally) to the entity’s audit committee or board of directors. They are not typically expected to report to the public or to parties outside the

Final PDF to printer

730 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 730 10/22/15 11:48 AM

entity. However, internal audit functions differ widely in how they are managed and staffed. Some entities have internal audit functions that are staffed entirely “in-house,” while oth- ers are “co-sourced.” When an organization co-sources its internal audit function, the entity typically hires a public accounting firm or other professional services firm to provide inter- nal audit services in conjunction with the entity’s own internal auditors. This has become a significant source of revenue for many large professional services firms. Ideally the entity will have a chief audit executive (CAE), whose role is to oversee the internal audit function (whether in-house or co-sourced) and to help coordinate the work of the internal and external auditors. You will recall from Chapter 19, however, that SEC rules prohibit a public account- ing firm from providing internal audit services to a public company for which the accounting firm also provides a financial statement audit.

The roles played by internal auditors fall into two primary categories—assurance services and consulting services.

Assurance services involve the internal auditor’s objective assessment of evidence to provide an independent opinion or conclusions regarding a process, system or other subject matter. The nature and scope of the assurance engagement are determined by the internal auditor. There are gener- ally three parties involved in assurance services: (1) the person or group directly involved with the entity, operation, function, process, system, or other subject matter—the process owner; (2) the person or group making the assessment—the internal auditor; and (3) the person or group using the assessment—the user.

Consulting services are advisory in nature, and are generally performed at the specific request of an engagement client. The nature and scope of the consulting engagement are subject to agree- ment with the engagement client. Consulting services generally involve two parties: (1) the person or group offering the advice—the internal auditor, and (2) the person or group seeking and receiv- ing the advice—the engagement client. When performing consulting services the internal auditor should maintain objectivity and not assume management responsibility.4

4 Introduction to the International Standards for the Professional Practice of Internal Auditing (www.theiia.org).

IIA Rules of Conduct

Principles Expectations

Integrity Internal auditors: 1.1 Shall perform their work with honesty, diligence, and responsibility. 1.2 Shall observe the law and make disclosures expected by the law and the profession. 1.3 Shall not knowingly be a party to any illegal activity, or engage in acts that are

discreditable to the profession of internal auditing or to the organization. 1.4 Shall respect and contribute to the legitimate and ethical objectives of the organization.

Objectivity Internal auditors: 2.1. Shall not participate in any activity or relationship that may impair or be presumed to

impair their unbiased assessment. This participation includes those activities or relationships that may be in conflict with the interests of the organization.

2.2. Shall not accept anything that may impair or be presumed to impair their professional judgment.

2.3. Shall disclose all material facts known to them that, if not disclosed, may distort the reporting of activities under review.

Confidentiality Internal auditors: 3.1. Shall be prudent in the use and protection of information acquired in the course of their

duties. 3.2. Shall not use information for any personal gain or in any manner that would be contrary

to the law or detrimental to the legitimate and ethical objectives of the organization.

Competency Internal auditors: 4.1 Shall engage only in those services for which they have the necessary knowledge,

skills, and experience. 4.2 Shall perform internal auditing services in accordance with the International Standards

for the Professional Practice of Internal Auditing. 4.3 Shall continually improve their proficiency and the effectiveness and quality of their

services.

T A B L E 2 1 – 7

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 731

mes32502_ch21_707-747.indd 731 10/22/15 11:48 AM

In general, an organization’s internal audit function is deployed by management and the board of directors in the broad areas of evaluating risks and controls, evaluating compliance, and performing financial and operational auditing. Through these activities, internal audi- tors contribute to effective corporate governance within an organization, which includes all management-administered policies and procedures to control risk and oversee operations within a company. The IIA and other influential organizations, such as the NYSE, identify the internal audit function as one of the cornerstones of effective corporate governance.

Evaluating Risks and Controls As outlined by IIA Standard 2120, internal auditors are required to evaluate an entity’s risk management process. Although the internal audi- tor’s industry expertise allows him or her to stay abreast of general industry risks, it is his or her specific experience within the organization that enables an accurate assessment of risks relating to the integrity of financial and operational information, the safeguarding of assets, and compliance with laws and regulations. Internal auditors are often asked to determine the sources of these risks and may sometimes be called on to recommend approaches to manage identified risks.

As we discussed in Chapter 7, Section 404 of the Sarbanes-Oxley Act requires public companies to implement and annually assess internal control over financial reporting. Internal auditors have long been involved in evaluating and enhancing their organizations’ system of internal control over financial reporting and often play a substantial role in ensuring compli- ance with these new requirements. By testing and assessing internal control, internal auditors also facilitate senior management’s ability to provide the certifications required by Section 302 of the Sarbanes-Oxley Act—Corporate Responsibility for Financial Reports.

Practice I N S I G H T

The IIA offers a Certification in Control Self-Assessment (CSA) designed for practitioners of con- trol assessment. Professionals who hold the CSA designation include individuals from a variety of backgrounds. They use their knowledge about risk and controls to help their clients implement and maintain effective controls to achieve their objectives.

Reviewing Compliance In many industries, compliance with relevant laws and regula- tions is a complicated and important endeavor. For example, if a company fails to comply with the many requirements of the Occupational Safety and Health Act of 1970 (OSHA), the government can levy significant fines and penalties. Many other governmental agencies have also issued rules and regulations that must be followed by businesses and other organizations. Such agencies include the Environmental Protection Agency (EPA) and the Food & Drug Administration (FDA), among many others. Internal auditors play an important role in help- ing management ensure that the organization complies with the laws, rules, and regulations that apply to the entity, as well as in ensuring that employees comply with organizational guidelines and rules.

Financial Auditing Although the financial auditing performed by internal auditors involves many of the same concepts you have already studied in this text, it differs from the audits conducted by external auditors in several ways. For example, internal auditors do not generally audit periodic financial statements but tend to focus on specific financial issues as directed by management. The nature of their reporting is also different.

Stop and Think: Why might internal audit reports relating to financial auditing not fol- low a standardized format like those of external auditors?

Because the focus of the audit may relate to either general or specific factors, it is impos- sible to require a standardized internal audit report. Consequently, internal audit reports

Final PDF to printer

732 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 732 10/22/15 11:48 AM

are normally uniquely composed to fulfill the requirements of the particular assignment, as opposed to external audit reports, which are quite standardized. Exhibit 21–8 describes a real- life situation where an organization’s internal auditor uncovered a fraud while evaluating a specific financial area at the request of the organization’s management.

Operational Auditing Due to their unique position in an organization, internal auditors typically achieve a thorough understanding of how the organization operates, and internal auditors are thus able to provide various types of services to improve the entities in which they work. Operational audits serve a wide variety of purposes. They are primarily con- ducted to identify the causes of problems or to enhance the efficiency or effectiveness of operations. In many organizations, internal auditors spend most of their time performing operational audits. In fact, because they often spend relatively little of their time performing financial audits, the term internal auditing is often (incorrectly) used interchangeably with operational auditing.

Internal Audit Product Offerings In order to illustrate the diversity of services offered by internal auditors, refer to Figure 21–5, which shows how DuPont decided to deploy its internal audit resources. The figure illustrates two important points. First, the management of risk is the central focus of internal audit at DuPont. Risk management is important because a successful company must be able to not only deal with current problems but also anticipate and prepare for other potential obstacles. Second, the wheel in Figure 21–5 is not static, but contains several ongoing and interdepen- dent processes. A modern internal audit function must be adaptable and able to keep up with the changing demands of the modern business environment in large and complex organiza- tions like DuPont. Exhibit 21–9 offers a more detailed description of each of the product categories outlined in DuPont’s “internal audit product wheel.”

Interactions between Internal and External Auditors The objectives and types of work performed by internal and external auditors are often quite different, but there is considerable overlap, as you might imagine. External auditors do their work with the purpose of expressing an opinion as to whether the entity’s financial statements are free of material misstatements. Because external auditors rely on the concept of material- ity, they typically are not concerned with auditing a particular area in a great deal of depth— they gather evidence until they obtain reasonable assurance that no misstatements are present that would be considered material in the context of the financial statements taken as a whole. They then report externally, to parties outside of the organization being audited.

Internal Financial Audit Uncovers Employee Fraud

At a major research university, an internal audit team was called in to facilitate required budget cuts in the accounting department. The accounting department was understaffed and had only one staff member assigned to review procurement card transactions through the accounting office for staff and faculty. The internal auditor quickly identified some suspicious receipts that totaled $1,200. The investigation led to a single employee, and eventually over four vanloads of suspected unauthorized purchases were removed from the employee’s home and personal vehicle. The fraud amounted to approximately $60,000 and led to the criminal prosecution of the suspect. The internal audit function saved the accounting department money immediately, but by identifying several weaknesses in the department’s internal control system, it no doubt improved the efficiency and effectiveness of internal control for the entire university.

Source: Internal Auditor (June 2004), pp. 97–99.

E X H I B I T 2 1 – 8

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 733

mes32502_ch21_707-747.indd 733 10/27/15 08:46 AM

DuPont’s Uses of the Internal Audit Function

Source: Roth, James. Best Practices: Value-Added Approaches of Four Innovative Auditing Departments, pp. 9. Copyright © 2000 by The Institute of Internal Auditors. Used with permission. No parts of this material may be reproduced in any form without the written permission of The Institute of Internal Auditors. Permission has been obtained from the copyright holder, The Institute of Internal Auditors to publish this reproduction, which is the same in all material respects, as the original unless approved as changed. No parts of this material may be reproduced, stored in any retrieval system, or transmitted in any form, or by any means electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of The Institute of Internal Auditors.

F I G U R E 2 1 – 5

Internal Audit Product Wheel

System implementation

review

Business process

improvement

Self- assessment Consulting

Investigations Internal control

education

Process audit

Internal control

assessment

Risk

Internal auditors, on the other hand, assist management and the board of directors in evaluating and managing risk, assessing compliance with laws and regulations, assessing operational efficiency, and performing detailed financial audits of areas requiring particular attention. Because their objectives are often different from those of external auditors, the level of materiality is usually quite different as well. For example, in auditing for employee fraud, the amounts involved are usually far from material in terms of the financial statements taken as a whole. However, internal auditors can reduce the incidence of employee fraud, saving money and improving controls in the process.

Some of the work performed by internal auditors is directly relevant to the work of the independent auditor. For example, as discussed in Chapter 7, the external auditor can some- times make use of controls-testing work performed by the internal auditor. Similarly, Chapter 5 briefly discusses the external auditor’s use of work performed by the internal audit function in the context of the financial statement audit. Before relying on the work of internal auditors, the external auditor must evaluate the internal auditor’s objectivity and competence. If the external auditor decides that some reliance is justified, the cost savings in terms of the reduc- tion in the external audit fee can be significant.5

5For example, see Felix, W. L., Gramling, A. A., & Maletta, M. J. (2001), “The contribution of internal audit as a determinant of external audit fees and factors influencing this contribution,“ Journal of Accounting Research, Vol. 39, No. 3; and Douglas F. Prawitt, Nathan Y. Sharp, and David A. Wood (2011), “Reconciling Archival and Experimental Research: Does Internal Audit Contribution Affect the External Audit Fee?” Behavioral Research in Accounting: Fall, Vol. 23, No. 2.

Final PDF to printer

734 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 734 10/27/15 08:46 AM

Definitions of the Services Provided by DuPont’s Internal Auditors

Process Audits Internal auditing undertakes comprehensive analyses and appraisals of all phases of business activities and provides management with appropriate recommendations concerning the activi- ties reviewed. This product includes business process audits, which appraise the adequacy and efficiency of accounting, financial, and operating controls; information systems audits, which focus on technical IS audit activities, system implementation and application reviews; reviews of emerging technology; and new site reviews which occur in the early stages of start-up operations, joint ventures, or acquisitions to ensure that cost-effective internal control is in place.

Special Investigation This service provides the client with an independent review of facts and circum- stances surrounding an event or series of events and presents recommendations to management for appropriate resolution/action. Investigations are often associated with known or suspected wrongdoing, waste, fraud, abuse of company assets, other business ethics violations, and/or serious mismanagement.

System Implementation Review System implementation reviews are conducted as part of the preven- tion quadrant of internal auditing’s products. The system implementation review promotes the inclusion of cost-effective controls into systems prior to implementation and assures that the controls will operate as intended when implemented.

Business Process Improvement In limited circumstances, internal auditing may initiate or participate in internal control-related business process improvement activities. This product is used to identify and mini- mize control deficiencies in business processes and is designed to assist organizations in making process changes that result in strengthened internal control and optimal performance.

Internal Control Education This offering assists the client organization to reduce risk through an enhanced understanding of the business value of internal control and business ethics. Instructional ses- sions may be conducted by internal auditing or by the client with internal auditing support.

Internal Control Assessment This product provides the client with an overall opinion or assessment of the current state of internal control and future risks. Internal control assessments are conducted periodi- cally on a corporate, regional, SBU, and functional basis. The COSO model serves as the methodology for conducting these assessments.

Consulting This is an internal auditing activity normally provided in response to a request from man- agement. It is designed to provide expertise in the resolution of internal control issues. Consulting may involve answering questions, developing solutions to problems, recommending courses of action, and/ or formulating an opinion. Consulting may also involve the review of proposed procedures for internal control content.

Self-Assessment Self-assessments are performed by the client based upon a framework and facilitation provided by internal auditing. Internal auditing will be an active participant in self-assessment activities, which involve an assessment of risk and control activities within the business and/or function under review.

E X H I B I T 2 1 – 9

Advanced Module: Examples of Assurance Services— Trust Services and PrimePlus Services

Trust Services Electronic commerce involves individuals and organizations conducting business transactions without paper documents, using computer and telecommunications networks. This includes transactions through electronic data interchange (EDI), where formal contracts exist between the parties, and general business over the Internet, where the parties usually do not have a preexist- ing contractual relationship. Electronic commerce over the Internet and “cloud computing” have grown tremendously, as have the system requirements necessary to support these technologies.

LO 21-10

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 735

mes32502_ch21_707-747.indd 735 10/22/15 11:48 AM

This growth in technology has also led to some new concerns by businesses and individu- als. Businesses are concerned with maintaining reliable, secure, and effective systems and data storage, while individuals worry about such things as the security of their information (such as credit card numbers). To respond to these concerns, the AICPA and the Canadian Institute of Chartered Accountants (CICA) developed a set of principles that underlie a set of services called Trust Services. Trust Services are based on the Trust Services principles, tailored for different needs as described below. As seen in Table 21–8, Trust Services are built on five principles: security, availability, processing integrity, confidentiality, and pri- vacy. These are broad principles that are nontechnical and easy to understand. Using these principles, CPAs can offer a wide variety of advisory and assurance services to their clients.

Trust Services and SOC 2 and SOC 3 Reports In an attempt to organize and provide structure for CPAs, the AICPA has defined frameworks for Service Organization Control (SOC) reports. Recall in Chapter 6 we introduced the SOC 1 report. As discussed there, when a company outsources some function to a service organiza- tion (e.g., payroll) the controls of that service organization has the potential to directly affect the financial reporting of the company. In order to obtain assurance about the company’s financial statements, the company’s auditors need to know that controls that are relevant to financial reporting are in place at the service organization. Because a service organization usually has many clients, the service organization may decide to hire an auditor to provide a report on its financial controls so that the same SOC 1 report can be used by the auditors of several different clients. The auditor performs an engagement following AT section 801 and issues either a type 1 SOC 1 report on the design effectiveness of the controls of the service organization or a type 2 SOC 1 report, which covers both the design and operating effective- ness of controls at the service organization.

SOC 2 reports, on the other hand, are more broadly based reports that are issued by a prac- titioner in conjunction with a Trust Services engagement. As described in the section above, in a Trust Services engagement the practitioner reports if an entity (not necessarily a service organization) has maintained effective controls over its system with respect to Trust Services principles: security, availability, processing integrity, confidentiality, and privacy. SOC 2 engagements follow the same framework outlined in TSP section 100 and AT section 101. Unlike SOC 1 reports, a SOC 2 report is for restricted use only (i.e., it is for use by specified parties). Like SOC 1 reports, a SOC 2 report allows the option of type 1 or type 2 reports.

CPA WebTrust Three broad categories of risk are involved in carrying out electronic commerce: business practices, transaction integrity, and information protection. Because commerce over the Inter- net may involve transactions between parties who do not know each other, how can a con- sumer know that the entity behind the web page is “real”? How can the consumer be sure that

Trust Services Principles*

Security The system is protected against unauthorized access (both physical and logical). Availability The system is available for operation and use as committed or agreed. Processing Integrity System processing is complete, accurate, timely, and authorized. Confidentiality Information designated as confidential is protected as committed or agreed. Privacy The system’s collection, use, retention, disclosure, and disposal of personal information are in accordance with the

entity’s commitments and system requirements.

*Complete Trust Services Principles and Criteria may be found on the AICPA’s website.

T A B L E 2 1 – 8

Final PDF to printer

736 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 736 10/22/15 11:48 AM

the entity follows good business practices and that consumers will not be defrauded? Simi- larly, how can the consumer have assurance that electronic transactions will not be changed, lost, duplicated, or processed incorrectly? And how can the consumer be sure that private information will be protected? While setting up a web page on the Internet is relatively easy, establishing strong security controls can be complex and costly. As a result of these risks, consumers have legitimate concerns about transaction integrity and confidentiality. An objec- tive third party, such as a CPA, can provide assurance to customers about these risks. The WebTrust seal of assurance symbolizes to potential customers that a CPA has evaluated the website’s business practices and controls to determine that it conforms to the principles and criteria. Table 21–9 presents a WebTrust criterion and related disclosures for each of two principles for EarthWear Clothiers.

In order to obtain the WebTrust seal of assurance, an entity must meet all the Trust Ser- vices principles as measured by the Trust Services criteria and engage a CPA who is licensed by the AICPA to provide WebTrust service. Generally, this service will cover a period of three months or more. Once the seal is obtained, the entity can display it on its website pro- vided the assurance examination is updated regularly and the entity informs the practitio- ner of any significant changes in its business policies, practices, processes, or controls. The entity’s WebTrust seal will be managed by a trusted third-party service organization (the “seal manager”). If the entity receives an unqualified report, the practitioner notifies the seal manager that the seal can be displayed on the entity’s website and provides an expiration date. Unless update notification is received, the authorization to display the seal expires on the expiration date, and the seal manager will remove the seal’s display authorization. The seal displayed at the website can be verified by clicking on the seal, which displays a special WebTrust digital certificate.

A WebTrust assurance engagement is performed as an examination under the attestation standards described in this chapter. In examining an entity’s website, the practitioner would use guidance provided in SSAE No. 10 and COSO’s Internal Control—Integrated Frame- work. In such an examination, the practitioner expresses a positive opinion as to whether the presentation of assertions conforms to the AICPA’s Trust Services principles and criteria. Exhibit 21–10 presents EarthWear’s management’s assertions about its website. The report of management’s assertions is signed by the president and CEO and the chief financial officer. Exhibit 21–11 contains a public accounting firm’s unqualified report on those assertions. Note that because EarthWear is a publicly traded company and a WebTrust attestation service involves reporting on internal control, independence considerations prohibit the company’s

Selected WebTrust Criteria for EarthWear Clothiers

Processing Integrity

Criterion Controls

1. The entity maintains controls to provide reasonable assurance that • Each order is checked for accuracy and completeness. • Positive acknowledgment is received from the customer before

the order is processed.

• EarthWear’s order entry system automatically checks each order for accuracy and completeness.

• All customer order information is stored in a “shopping basket.” When the customer has finished shopping, the contents of the shopping basket are displayed. The customer clicks “yes” to accept the order.

Confidentiality

Criterion Controls

1. The entity maintains controls to protect transmissions of private customer information over the Internet from unintended recipients.

• Private customer information is protected during transmission by encryption technology.

• EarthWear has registered its domain name and Internet IP address. The address is unique.

• The company’s web page has a digital certificate that can be checked using features in a standard web browser.

• EarthWear’s webmaster updates and reviews the site daily to ensure that no improper content or links have been added.

T A B L E 2 1 – 9

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 737

mes32502_ch21_707-747.indd 737 10/22/15 11:48 AM

Management’s Assertions for EarthWear’s Website

EarthWear Clothiers, on its website for electronic commerce (at www.mhhe.com/earthwear), asserts the following:

• We have maintained effective controls to provide reasonable assurance that customers’ orders placed using e-commerce were completed and billed as agreed; and

• We have maintained effective controls to provide reasonable assurance that private customer infor- mation obtained as a result of e-commerce was protected from uses not related to our business during the period from December 16, 2015, through March 15, 2016, in conformity with the AICPA WebTrust Principles and Criteria.

Calvin J. Rogers James C. Watts President & CEO Chief Financial Officer

E X H I B I T 2 1 – 1 0

Accountant’s WebTrust Attestation Report for EarthWear’s Website

To the Management of EarthWear Clothiers:

We have examined the assertion by the management of EarthWear Clothiers regarding the effec- tiveness of its controls over transaction integrity and information protection for e-commerce (at www.mhhe.com/earthwear) based on the AICPA/CICA WebTrust Criteria during the period from December 16, 2015, through March 15, 2016.

These e-commerce disclosures and controls are the responsibility of EarthWear Clothiers manage- ment. Our responsibility is to express an opinion based on our examination.

Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants, and, accordingly, included: (1) obtaining an understand- ing of the EarthWear Clothier’s e-commerce business and information privacy practices and its controls over the processing of e-commerce transactions and the protection of related private customer informa- tion; (2) selectively testing transactions executed in accordance with disclosed business and information privacy practices; (3) testing and evaluating the operating effectiveness of the controls; and (4) performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion.

Because of inherent limitations in controls, errors or fraud may occur and not be detected. Further- more, the projection of any conclusions, based on our findings, to future periods is subject to the risk that: (1) changes made to the system or controls, (2) changes in processing requirements, (3) changes required because of the passage of time, or (4) the degree of compliance with the policies or procedures may alter the validity of such conclusions.

In our opinion, during the period from December 16, 2015, to March 15, 2016, EarthWear Clothiers, in all material respects

• maintained effective controls to provide reasonable assurance that customers’ orders placed using e-commerce were completed and billed as agreed, and

• maintained effective controls to provide reasonable assurance that private customer information obtained as a result of e-commerce was protected from uses not related to the company’s business based on the AICPA/CICA WebTrust Criteria.

The CPA WebTrust Seal of assurance on EarthWear Clothiers’ website for e-commerce constitutes a symbolic representation of the contents of this report and it is not intended, nor should it be construed, to update this report or provide any additional assurance.

This report does not include any representation as to the quality of the EarthWear Clothiers’ goods or services nor their suitability for any customer’s intended purpose.

Felix & Waller, CPAs Tucson, Arizona April 3, 2016

E X H I B I T 2 1 – 1 1

Final PDF to printer

738 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 738 10/22/15 11:48 AM

financial statement auditor, Willis & Adams, from providing a WebTrust attestation service to the company (see Chapter 19). Thus, EarthWear engaged another accounting firm, Felix & Waller, CPAs, to provide the service.

The first paragraph of the Felix & Waller report states that the assertions have been exam- ined. The second paragraph states that management is responsible for the assertions while the accountant’s responsibility is to express an opinion based on the examination. The third paragraph states the four steps that were undertaken to complete the examination of manage- ment’s assertions. In particular, Felix & Waller (1) obtained an understanding of EarthWear’s e-commerce business and information privacy practices and its controls over the process- ing of e-commerce transactions and the protection of related private customer information; (2) selectively tested transactions executed in accordance with the disclosed business and information privacy practices; (3) tested and evaluated the operating effectiveness of the con- trols; and (4) performed other procedures that it considered necessary. The opinion paragraph provides an unqualified opinion on EarthWear’s management’s assertions.

CPA PrimePlus Services The population in the United States and Canada is aging, and individuals are often living to ages at which they require some form of assisted living. The U.S. Census Bureau estimates that as of 2010, 18.5 million people in the United States were 75 years of age or older and they controlled many trillions of dollars in wealth. At the same time, younger generations are increasingly mobile. In many of these younger families, both spouses work outside the home, and they do not have adequate time to care for elderly relatives. The CPA can bring a level of assurance or comfort to the elderly person and his or her family members through PrimePlus services.

PrimePlus services are defined on the AICPA’s website as:

A unique, customizable package of services offered by Certified Public Accountants to assist the elderly in maintaining—for as long as possible—their lifestyle and financial independence. Prac- titioners who provide PrimePlus Services draw upon their strengths and competencies in a variety of areas, including cash flow planning and budgeting, pre- and post-retirement planning, insurance reviews and tax planning … the services included in each individual PrimePlus engagement will be based upon the needs and wants of each PrimePlus client as well as the skill set of the Prime- Plus practitioner.

The practitioner acts in the place of the absent family members and relies on qualified specialists, employed by the client or the responsible family member, to provide the services outside the scope of the practitioner’s expertise. The practitioner observes and reports on whether those service providers are meeting the needs of the client and the criteria for care established by the family members. This service is often combined with traditional finan- cial services, and the practitioner often establishes strategic alliances with other professionals (e.g., elder law attorneys, geriatric care managers, and social workers or medical personnel).

Practitioners can offer three types of PrimePlus services. The first is consulting/ facilitating services, which involve the practitioner consulting with the client or third party (the responsible individual) to establish the standards of care expected. Consulting services might also include assisting the client or third party in selecting the care provider and level of care for each type of care required. The second category of PrimePlus service is known as direct services. For example, the practitioner might receive, deposit, and account for the individual’s income; pay bills and conduct routine financial transactions for the client; and supervise investments and accounting for the estate. The third category of PrimePlus service is assurance services. In this type of service, the practitioner issues periodic reports about the quality of care provided to the elderly person. PrimePlus assurance services are conducted as agreed-upon procedures in attestation engagements as described in this chapter. This type of assurance service may involve the practitioner visiting the elderly person and inspecting docu- mentation such as logs, diaries, or other evidence to support that the contracted services have been provided at the appropriate level of care.

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 739

mes32502_ch21_707-747.indd 739 10/22/15 11:48 AM

KEY TERMS

Agreed-upon procedures. Specific procedures performed on the subject matter of an asser- tion while a practitioner is engaged by a client to issue a report of findings. Assurance services. Independent professional services that improve the quality of informa- tion, or its context, for decision makers. Attest services. A service when a practitioner is engaged to issue or does issue a report on subject matter, or an assertion about subject matter, that is the responsibility of another party. Compilation of financial statements. The presentation, in the form of financial statements, of information that is the representation of management or owners without undertaking to express any assurance on the statements. Electronic commerce. Business transactions between individuals and organizations that occur without paper documents, using computers and telecommunications networks. Examination engagement. An attest engagement designed to provide a high level of assur- ance through the performance of a full set of procedures similar to those used in an audit, pro- viding the accountant a reasonable basis for expressing an affirmative opinion that the subject matter is fairly stated in conformity with a set of criteria. Financial forecasts. Prospective financial statements that present an entity’s expected finan- cial position, results of operations, and cash flows. Financial projections. Prospective financial statements that present, given one or more hypothetical assumptions, an entity’s expected financial position, results of operations, and cash flows. Internal auditing. An independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effec- tiveness of risk management, control, and governance processes. Reasonable assurance. A term that implies some risk that a material misstatement could be present in the financial statements without the auditor detecting it. Review of financial statements. An attest engagement designed to provide a moderate level of assurance through the performance of inquiry and analytical procedures providing the accountant a reasonable basis for expressing limited assurance that no material modifications should be made to the statements in order for them to conform to the applicable financial reporting framework. Risk assessment process. The process through which management of an entity identifies, plans for, and controls the possible threats to achieving the entity’s objectives.

Additional Student Resources

Visit Connect for additional student resources that will allow you to assess your understanding of chapter concepts.

REVIEW QUESTIONS

LO 21-1 21-1 Define assurance services. Discuss why the definition focuses on decision making and information.

LO 21-5 21-2 Define an attest engagement. List the two conditions that are necessary, according to the third general standard for attestation engagements, in order to perform an attest engagement.

LO 21-3, 21-4 21-3 What types of engagements can be provided under the attestation standards? Give two examples of attestation engagements.

Final PDF to printer

740 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 740 10/22/15 11:48 AM

LO 21-7 21-4 How can the practitioner satisfy the requirement that specified users take respon- sibility for the adequacy of procedures performed on an agreed-upon procedures engagement?

LO 21-6 21-5 What kind of entity might request an attestation report on internal control, and why? LO 21-7 21-6 What are the two types of prospective financial statements? How do they differ from

each other? LO 21-8 21-7 What types of services can be performed under Statements on Standards for Account-

ing and Review Services? LO 21-8 21-8 What type of knowledge must an accountant possess about the entity in order to per-

form a compilation engagement? A review engagement? LO 21-9 21-9 Define corporate governance. Why do you think an effective internal audit function

is referred to as one of the cornerstones of corporate governance? LO 21-9 21-10 Explain how internal auditors can play a vital role in helping management comply

with the requirements of the Sarbanes-Oxley Act. LO 21-2 21-11 The AICPA Special Committee on Assurance Services developed six assurance ser-

vices with significant market potential for CPA firms. What are these six services? LO 21-10 21-12 List 3 important risks associated with electronic commerce. What are the Trust Ser-

vices principles and how do they relate to the risks you identified? LO 21-10 21-13 What elements does a WebTrust engagement focus on and why might an e-commerce

company consider purchasing such a service? LO 21-10 21-14 Why is PrimePlus potentially a major service for CPA firms? What types of Prime-

Plus services can a practitioner offer?

MULTIPLE-CHOICE QUESTIONS All applicable questions are available with Connect.

LO 21-1, LO 21-2 21-15 An assurance report on information can provide assurance about the information’s a. Reliability. b. Relevance. c. Timeliness. d. All of the above.

LO 21-3, 21-4 21-16 Which of the following professional services would be considered an attest engagement?

a. A management consulting engagement to provide IT advice to a client. b. An engagement to report on compliance with statutory requirements. c. An income tax engagement to prepare federal and state tax returns. d. Compilation of financial statements from a client’s accounting records.

LO 21-4 21-17 An accountant may accept an engagement to apply agreed-upon procedures to pro- spective financial statements, provided that

a. The prospective financial statements are also examined. b. Responsibility for the adequacy of the procedures performed is taken by the

accountant. c. Negative assurance is expressed on the prospective financial statements taken as

a whole. d. Distribution of the report is restricted to the specified users.

LO 21-7 21-18 Which of the following statements concerning prospective financial statements is correct?

a. Only a financial forecast would normally be appropriate for limited use. b. Only a financial projection would normally be appropriate for general use. c. Any type of prospective financial statement would normally be appropriate for

limited use.

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 741

mes32502_ch21_707-747.indd 741 10/22/15 11:48 AM

d. Any type of prospective financial statement would normally be appropriate for general use.

LO 21-8 21-19 When compiling the financial statements of a non-public entity, an accountant should

a. Review agreements with financial institutions for restrictions on cash balances. b. Understand the accounting principles and practices of the entity’s industry. c. Inquire of key personnel concerning related parties and subsequent events. d. Perform ratio analyses of the financial data of comparable prior periods.

LO 21-8 21-20 Which of the following statements is correct concerning both an engagement to compile and an engagement to review a non-public entity’s financial statements?

a. The accountant is not required to obtain an understanding of internal control. b. The accountant must be independent in fact and appearance. c. The accountant expresses no assurance on the financial statements. d. The accountant should obtain a written management representation letter.

LO 21-8 21-21 The standard report issued by an accountant after reviewing the financial statements of a non-public entity states that

a. A review includes assessing the accounting principles used and significant esti- mates made by management.

b. A review includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements.

c. The accountant is not aware of any material modifications that should be made to the financial statements.

d. The accountant does not express an opinion or any other form of assurance on the financial statements.

LO 21-8 21-22 Financial statements of a non-public entity that have been reviewed by an accountant should be accompanied by a report stating that

a. The scope of the inquiry and the analytical procedures performed by the accoun- tant have not been restricted.

b. All information included in the financial statements is the representation of the management of the entity.

c. A review includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements.

d. A review is greater in scope than a compilation, the objective of which is to pres- ent financial statements that are free of material misstatements.

LO 21-9 21-23 The general accreditation granted by the Institute of Internal Auditors is known as the

a. CFE. b. CGAP. c. CFSA. d. CIA.

LO 21-9 21-24 Which of the following is not one of the general areas of the IIA’s International Standards for the Professional Practice of Internal Auditing?

a. Performance standards. b. Implementation standards. c. Ethical standards. d. Attribute standards.

LO 21-9 21-25 The four principles of the IIA Code of Ethics are a. Confidentiality, competency, objectivity, and integrity. b. Objectivity, independence, compliance, and due diligence. c. Honesty, integrity, independence, and competency. d. Integrity, confidentiality, independence, and compliance.

Final PDF to printer

742 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 742 10/22/15 11:48 AM

LO 21-10 21-26 Which of the following is not a Trust Services principle? a. Processing integrity. b. Online privacy. c. Digital certificate authorization. d. Availability.

LO 21-10 21-27 Which of the following assurances is not provided by compliance with Trust Ser- vices principles?

a. There are procedures to protect the system against unauthorized physical access. b. The financial statements created by the system are free of material misstatements. c. The documented system availability objectives, policies, and standards have been

communicated to authorized users and controls are functioning as documented. d. Documented system processing integrity objectives, policies, and standards

have been communicated to authorized users and controls are functioning as documented.

LO 21-10 21-28 PrimePlus engagements are mainly designed to a. Provide guidance to assisted-living care facilities to enhance quality of life for the

elderly. b. Provide guidance to health care providers in giving high-quality health care. c. Assist the elderly to maintain their financial independence and desired lifestyle as

they age. d. Assist the elderly in perfecting their shuffleboard techniques.

LO 21-10 21-29 Which of the following is not a type of PrimePlus service? a. Assurance services. b. Consulting/facilitating services. c. Direct services. d. Systems design services.

PROBLEMS All applicable problems are available with Connect.

LO 21-6 21-30 Orange Grove Farms has approached your CPA firm with some questions. Orange Grove’s management has spoken with a bank about obtaining a loan to expand its operations. The bank has informed Orange Grove that the bank will not make the requested loan unless the company submits financial statements. Further, the inter- est rate on the loan will depend on whether Orange Grove’s financial statements are compiled, reviewed, or audited by an independent auditor. Orange Grove’s manage- ment is not familiar with the differences between these three services and wonders why the interest rate charged on the loan would depend on the type of service they obtain from your CPA firm.

Required: Describe for Orange Grove the differences between compilation, review, and audit

engagements. Be sure to include the level of assurance provided by each one as part of your explanation.

LO 21-7 21-31 Your client, Cheaney Rental Properties, has engaged you to perform a compilation of its forecasted financial statements for a loan with the National Bank of Rockwood.

Required: a. Describe the steps an accountant should complete when conducting a compilation

of prospective financial statements. b. Prepare a standard compilation report for Cheaney Rental Properties.

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 743

mes32502_ch21_707-747.indd 743 10/22/15 11:48 AM

LO 21-7 21-32 You are the manager of the examination engagement of the financial projection of Honey’s Health Foods as of December 31, 2015, and for the year then ended. The audit senior, Currie, has prepared the following draft of the examination report:

To the Board of Directors of Honey’s Health Foods:

We have examined the accompanying projected balance sheet and statements of income, retained earnings, and cash flows of Honey’s Health Foods as of December 31, 2015, and for the year then ending. Our examination was made in accordance with standards for an examination of a projection and accordingly included such procedures as we considered necessary to evaluate the assumptions used by management.

In our opinion, the accompanying forecast is presented in conformity with guidelines for presentation of a forecast established by the American Institute of Certified Public Accountants, and the underlying assumptions provide a reasonable basis for management’s projection. However, there will usually be differences between the projected and actual results because events and circumstances frequently do not occur as expected, and those differences may be material.

Libby & Nelson, CPAs

Required: Identify the deficiencies in Currie’s draft of the examination report. Group the defi-

ciencies by paragraph.

LO 21-8 21-33 The following report was drafted on October 25, 2015, by Major, CPA, at the comple- tion of an engagement to compile the financial statements of Ajax Company for the fis- cal year ended September 30, 2015. Ajax is a non-public entity in which Major’s child has a material direct financial interest. Ajax decided to omit substantially all of the disclosures required by generally accepted accounting principles because the financial statements will be for management’s use only. The statement of cash flows was also omitted because management does not believe it to be a useful financial statement.

To the Board of Directors of Ajax Company:

I have compiled the accompanying financial statements of Ajax Company as of September 30, 2015, and for the year then ended. I planned and performed the compila- tion to obtain limited assurance about whether the financial statements are free of material misstatements.

Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America and for designing, implementing, and maintaining internal control rel- evant to the preparation and fair presentation of the financial statements.

My responsibility is to conduct the compilation in accordance with Statements on Stan- dards for Accounting and Review Services issued by the American Institute of Certified Public Accountants. It is substantially less in scope than an audit in accordance with gen- erally accepted auditing standards, the objective of which is the expression of an opinion regarding the financial statements taken as a whole. I have not audited the accompanying financial statements and, accordingly, do not express any opinion on them.

Management has elected to omit substantially all of the disclosures required by accounting principles generally accepted in the United States of America. If the omit- ted disclosures were included in the financial statements, they might influence the user’s conclusions about the company’s financial position, results of operations, and cash flows.

I am not independent with respect to Ajax Company. This lack of independence is due to my daughter’s ownership of a material direct financial interest in Ajax Company. This report is intended solely for the information and use of the board of directors and management of Ajax Company and should not be used for any other purpose.

Major, CPA

Final PDF to printer

744 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 744 10/22/15 11:48 AM

Required: Identify the deficiencies contained in Major’s report on the compiled financial state-

ments. Group the deficiencies by paragraph where applicable. Do not redraft the report.

(AICPA, adapted)

LO 21-8 21-34 This question consists of 13 items pertaining to possible deficiencies in an accoun- tant’s review report. Select the best answer for each item. Indicate your answers in the space provided.

Jordan & Stone, CPAs, audited the financial statements of Tech Company, a non- public entity, for the year ended December 31, 2014, and expressed an unmodified opinion. For the year ended December 31, 2015, Tech issued comparative financial statements. Jordan & Stone reviewed Tech’s 2015 financial statements, and Kent, an assistant on the engagement, drafted the following accountant’s review report. Land, the engagement supervisor, decided not to reissue the prior year’s auditor’s report but instructed Kent to include a separate paragraph in the current year’s review report describing the responsibility assumed for the prior year’s audited financial statements. This is an appropriate reporting procedure.

Land reviewed Kent’s draft and indicated in the supervisor’s review notes (shown following the accountant’s review report) that there were several deficiencies in Kent’s draft.

Accountant’s Review Report We have reviewed the accompanying balance sheet of Tech Company as of

December 31, 2015 and 2014, and the related statements of income, retained earn- ings, and cash flows for the year then ended. A review includes primarily applying analytical procedures to management’s financial data and making inquiries of com- pany management. A review is substantially less in scope than an audit, the objective of which is the expression of an opinion regarding the financial statements as a whole.

Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America and for designing, implementing, and maintaining internal control relevant to the preparation and fair presentation of the financial statements.

Based on our review, we are not aware of any material modifications that should be made to the accompanying financial statements. Because of the inherent limita- tions of a review engagement, this report is intended for the information of manage- ment and should not be used for any other purpose.

The financial statements for the year ended December 31, 2014, were audited by us, and our report was dated March 2, 2015. We have no responsibility for updating that report for events and circumstances occurring after that date.

Required: Items 1 through 13 represent deficiencies noted by Land. For each deficiency, indi-

cate whether Land is correct (C) or incorrect (I) in the criticism of Kent’s draft.

(AICPA, adapted)

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 745

mes32502_ch21_707-747.indd 745 10/22/15 11:48 AM

Supervisor’s Review Notes C or I

1. There should be no reference to the prior year’s audited financial statements in the first (introductory) paragraph.

2. All the current-year basic financial statements are not properly identified in the first (intro- ductory) paragraph.

3. There should be no reference to the American Institute of Certified Public Accountants in the third (accountant responsibility) paragraph.

4. There should be no mention of management’s responsibility for internal control in the second (management responsibility) paragraph.

5. There should be no comparison of the scope of a review to an audit in the first (introduc- tory) paragraph.

6. Negative assurance should be expressed on the current year’s reviewed financial state- ments in the third (accountant responsibility) paragraph.

7. There should be a statement that no opinion is expressed on the current year’s financial statements in the first (introductory) paragraph.

8. There should be a reference to “conformity with generally accepted accounting prin- ciples” in the fourth paragraph.

9. There should be no restriction on the distribution of the accountant’s review report in the fourth paragraph.

10. There should be no reference to “material modifications” in the fourth paragraph.

11. There should be an indication of the type of opinion expressed on the prior year’s audited financial statements in the fifth (separate) paragraph.

12. There should be an indication that no auditing procedures were performed after the date of the report on the prior year’s financial statements in the fifth (separate) paragraph.

13. There should be no reference to “updating the prior year’s auditor’s report for events and circumstances occurring after that date” in the fifth (separate) paragraph.

LO 21-10 21-35 Rhett Corporation, a local sporting goods company, has asked your firm for assis- tance in setting up its website. Eric Rhett, the CEO, is concerned that potential cus- tomers will be reluctant to place orders over the Internet to a relatively unknown entity. He recently heard about companies finding ways to provide assurance to cus- tomers about secure websites, and Rhett has asked to meet with you about this issue.

Required: Prepare answers to each of the following questions that may be asked by Rhett. a. Why are customers reluctant to engage in e-commerce? b. What type of assurance can your firm provide to his customers concerning the

company’s website? c. What process will your firm follow in providing a WebTrust assurance service for

Rhett’s website?

LO 21-10 21-36 Mr. and Mrs. Greg Jun called your firm, Hillison & Reimer, in response to a bro- chure they received from Greg’s elderly mother. The Juns reside in Ann Arbor, Michigan, while Greg’s mother has retired to Tallahassee, Florida. In recent months, the Juns have become very concerned about Greg’s mother and her ability to care for herself. On a number of occasions, Greg has received calls from his mother’s friends expressing concern that she has not been eating properly and is not regularly taking her medicine for a heart condition.

Required: a. Describe the PrimePlus service to the Juns, including the types of services that

can be offered. b. Because the Juns’ concerns do not relate to areas of your expertise as a CPA,

explain to them how you will be able to provide assurance on the care providers.

Final PDF to printer

746 Part 8 Assurance, Attestation, and Internal Auditing Services

mes32502_ch21_707-747.indd 746 10/22/15 11:48 AM

DISCUSSION CASE

LO 21-3, 21-4, 21-37 The accounting profession is concerned about whether companies are in compliance 21-5, 21-6 with various federal and state environmental laws and regulations and whether they

have reported environmental liabilities in their financial statements. Environmental auditing typically refers to the process of assessing compliance with environmental laws and regulations, as well as compliance with company policies and procedures. AT Section 601, “Compliance Attestation,” allows a practitioner to perform agreed- upon procedures to assist users in evaluating management’s written assertions about (1) the entity’s compliance with specified requirements, (2) the effectiveness of the entity’s internal control over compliance, or (3) both.

Required: a. Discuss how a practitioner would conduct an agreed-upon procedures engage-

ment to evaluate an entity’s written assertion that it was in compliance with its state’s environmental laws and regulations.

b. Assume that this same entity maintained an internal control system that moni- tored the entity’s compliance with its state’s environmental laws and regulations. Discuss how a practitioner would evaluate the effectiveness of the entity’s inter- nal control over compliance.

INTERNET ASSIGNMENTS

LO 21-9 21-38 The IIA maintains its own website containing useful information about the Insti- tute and the internal auditing profession in general. Visit the IIA’s home page (www.theiia.org).

Required: a. Under the tab “Periodicals,” follow the link to the official magazine of the IIA

(Internal Auditor). What is the mission of this respected publication? b. Although the IIA does not require that its members obtain CIA certification, it is

becoming popular worldwide. What advantages are afforded to those who certify, according to the IIA’s website? Who might benefit from the CIA designation?

LO 21-10 21-39 The AICPA has developed an assurance service related to electronic commerce called WebTrust. Visit http://www.webtrust.org/.

Required: a. Under the “Overview of Trust Services” tab, find and list the four broad areas into

which the Trust Services principles are organized. b. Under the “Find a Seal” tab, scroll down and examine the WebTrust seal. What

stands out to you about what the seal communicates to users of internet com- merce sites?

LO 21-10 21-40 EarthWear has a number of competitors that sell goods over the Internet. Visit the home page for any two of EarthWear’s competitors. For example, visit the home page for Timberland (www.timberland.com), L.L. Bean (www.llbean.com), or Lands’ End (www.landsend.com).

Required: a. Determine if any of the sites provides any type of assurance on its electronic

commerce. Note that you may have to prepare to order a product before any assur- ances are presented on the site. (You may need to go into tools, properties, or page info in your browser to look for the certificates.)

Final PDF to printer

Chapter 21 Assurance, Attestation, and Internal Auditing Services 747

mes32502_ch21_707-747.indd 747 10/22/15 11:48 AM

b. If any of the sites provides assurance on electronic commerce, compare the assur- ances provided with the Trust Services principles and criteria.

HANDS-ON CASES

Additional Student Resources

Visit Connect for author-created problem material to be completed using IDEA software.

Final PDF to printer

mes32502_app_748-756.indd 748 10/23/15 07:30 AM

K PMG LLP, one of the four largest international public accounting firms, launched an initiative in 2009 to enhance the professional judgment and professional skepticism of its people and teams. KPMG collaborated with

two professors at Brigham Young University, Professors Steve Glover and Doug Prawitt, to emphasize these skills in its training. The result of this effort is re- freshed professional judgment content throughout KPMG’s audit training cur- riculum for all levels of audit professionals.

KPMG took the additional step of sharing and leveraging its professional judgment training content to create, again in collaboration with Brigham Young University Professors Glover and Prawitt, a monograph to help students accel- erate the development of their professional judgment while still in college. The monograph is titled Elevating Professional Judgment in Auditing and Account- ing: The KPMG Professional Judgment Framework. That monograph is avail- able free of charge for college students and professors on KPMG’s University Connection (university.kpmg.us). It is only available in electronic form because it comes as a pdf, with live internet links and audio files embedded. In addition, there are video files and an instructor’s manual available separately to profes- sors who register on KPMG University Connection.

This Professional Judgment Module is adapted from the KPMG Elevating Professional Judgment in Auditing and Accounting monograph. It covers some of the topics that are discussed and illustrated in more depth in the monograph. This module can be used as an introductory overview for the monograph or as a brief introduction to professional judgment for those who do not have space in the curriculum to assign the full monograph.

The KPMG Professional Judgment Framework, from which this module is adapted with permission from KPMG, LLP, was awarded the 2013 American Accounting Association/Deloitte Wildman Award. The Wildman award, first presented in 1979, recognizes a work that the judges view as “the most sig- nificant contribution to the advancement of the practice of public accountancy” published within the most recent five years.

Advanced Module: Professional Judgment Framework—Understanding and Developing Professional Judgment in Auditing

APPENDIX

Final PDF to printer

Appendix Advanced Module: Professional Judgment Framework 749

mes32502_app_748-756.indd 749 10/22/15 10:13 AM

As you prepare for a professional career, have you ever wondered what characteristics distin- guish an exceptional professional from one who is just average? One key distinguishing feature is the ability to consistently make high-quality professional judgments. Professional judgment, which is the bedrock of the accounting and auditing professions, is referenced throughout the professional literature. In some of your accounting or auditing classes, you may have had an instructor respond to a question with the classic answer, “That depends; it is a matter of profes- sional judgment.” This is often true in auditing, but it is not overly satisfying to a student who wonders exactly what good professional judgment looks like, or how he or she can develop the ability to make good professional judgments. The purpose of this module is to provide a very brief overview and introduction to help you understand what a good professional judgment process looks like, make you aware of common threats to exercising good judgment, and give you a head start in developing and improving your own professional judgment abilities.

A common question people have is, “Can you really teach good judgment?” Many believe that it is a gift; either you have it or you do not. Others would say you cannot teach good judgment; rather, it must be developed through the “school of hard knocks” after many years of experience. There is no question that talent and experience are important components of effective professional judgment, but it is possible to enhance your professional judgment skills through learning and applying some key concepts. As with other important skills, the sooner you start learning how to make good professional judgments, the better—which is why KPMG made a very significant investment of time and resources to produce the monograph from which this module is adapted to help the next generation of professionals get a head start on developing professional judgment.

Research in the areas of judgment and decision making over the last few decades indicates that additional knowledge about common threats to good judgment, together with tools and pro- cesses for making good judgments, can improve the professional judgment abilities of both new and seasoned professionals. With the movement in financial reporting toward more principles- based standards and more fair value measurements, exercising good professional judgment is increasingly important for auditors. While this module contains a brief overview of some of the most important topics, KPMG’s full monograph contains considerably more in-depth informa- tion about professional judgment in auditing, including additional coverage of judgment traps and biases, judgment in groups, and other topics. That monograph is titled Elevating Profes- sional Judgment in Auditing and Accounting: The KPMG Professional Judgment Framework; it is available without charge at under the Professional Judgment tab at university.kpmg.us.

A Model of a Good Judgment Process Let’s start with a common definition of judgment: Judgment is the process of reaching a deci- sion or drawing a conclusion where there are a number of possible alternative solutions.1 Judgment occurs in a setting of uncertainty and risk. In the areas of auditing and accounting, judgment is typically exercised in the following three broad areas:

∙ Evaluating evidence (e.g., deciding whether the evidence obtained from confirmations, combined with other audit evidence, provides sufficient appropriate audit evidence to determine whether accounts receivable is fairly stated)

∙ Estimating probabilities (e.g., determining whether the probability-weighted cash flows used by a company to determine the recoverability of long-lived assets are reasonable)

∙ Deciding between options (e.g., choosing audit procedure, such as inquiry of management, inspection, or confirmation)

The Importance of Professional Judgment in Auditing

1Making judgments can be distinguished from making decisions. Decision making involves the act of choosing among options or alternatives, while judgment, according to Webster’s 11th, involves “the process of forming an opinion or evaluation by discerning and comparing.” Thus, judgment is a subset of the process of decision making—many judg- ments are typically made in coming to a decision. However, for simplicity in this module, we often refer to the com- bined processes of judgment and decision making as “judgment,” “professional judgment,” or “making judgments.”

Final PDF to printer

750 Appendix Advanced Module: Professional Judgment Framework

mes32502_app_748-756.indd 750 10/22/15 10:13 AM

Of course, we do not need to invest significant time or effort when making easy or trivial judgments. However, as the judgments become more important and more difficult, it is help- ful to have a reliable, tested framework to help guide our judgment process. KPMG’s Profes- sional Judgment Framework is an example of such a framework. Following a good process will not make hard judgments easy or always guarantee a good outcome, but a well-grounded process can improve the quality of judgments and help auditing professionals more effectively navigate through complexity and uncertainty.

In the figure below, you will see the KPMG Professional Judgment Framework. The Framework includes a number of components, such as mindset, consultation, knowledge and professional standards, influences and biases, reflection, and coaching. At the core of the Framework, you will see a five-step judgment process.

Take a moment to examine the steps in the process at the center of the framework. These steps are rather simple and intuitive. However, while the KPMG Professional Judgment Framework provides a good representation of the process we should follow when applying professional judgment, it is not necessarily an accurate representation of the processes people follow consistently. The reality is that in a world of pressure, time constraints, and limited capacity, there are a number of judgment traps we can fall into. In addition, we can be subject to biases caused by self-interest or by unknowingly applying mental shortcuts.

The Professional Judgment Framework depicts constraints, influences, and biases that threaten good judgment with the box on the outer rim of the Framework labeled “Environment”

5 Articulate & Document Rationale

4 Reach

Conclusion

1 Clarify

Issues & Objectives

2 Consider

Alternatives 3

Gather & Evaluate

Information

Influences/Biases

Reflect on Lessons Learned

Coaching Reflect on Previous

Experience Coaching

ENVIRONMENT

Consultation

Knowledge/Professional Standards

Strategies for Avoiding Traps and Mitigating Bias

Mindset

Reproduced with permission from KPMG, LLP. © 2013 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of indepen- dent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.

Final PDF to printer

Appendix Advanced Module: Professional Judgment Framework 751

mes32502_app_748-756.indd 751 10/22/15 10:13 AM

and the triangle at the top labeled “Influences/Biases.” At the bottom of the Professional Judgment Framework, you will see Knowledge and Professional Standards, as these factors are foundational to quality judgments. These are environmental influences that can affect pro- fessional judgment. The “ribbon” of coaching and reflection running through the Framework is of great importance to the development of professional judgment in young professionals. In the next section of this module, we will highlight common judgment tendencies and the associated biases that can influence auditor judgment.

At the very center of the KPMG framework is “mindset.” It is important that auditors approach matters objectively and independently, with inquiring and incisive minds. Profes- sional skepticism, which is required by professional auditing standards, is an objective attitude that includes a questioning mind and a critical assessment of audit evidence. Professional skep- ticism is not synonymous with professional judgment, but rather, it is an important component or subset of professional judgment. Professional skepticism helps to frame our “mindset.”

Finally, wrapping around “mindset” in the Framework is “consultation.” At professional services firms like KPMG, consultation with others, including engagement team members, specialists, or other professionals, is a vital part of maintaining consistently high judgment quality and enhancing the exercise of appropriate professional skepticism.

Traps that Catch Us in the Early Steps of the Judgment Process As we mentioned earlier, in reality people often do not follow a good process due to com- mon judgment traps and tendencies that can lead to bias. These traps and tendencies are systematic—in other words, they are common to most people, and they are predictable. Some of these tendencies are judgment “shortcuts” that help simplify a complex world and facilitate more efficient judgments. These shortcuts are usually quite effective, but because they are shortcuts, they can lead to systematically biased judgments. As a simple illustra- tion of how our mental processes that normally serve us very well can sometimes lead to bias, consider “optical illusions” you may have seen on the internet.2 Our eyes and related perceptual skills ordinarily are quite good at perceiving and helping us to accurately judge shape similarity. However, optical illusions can predictably and systematically fool our eyes. Just as with perceptual biases, there are times when our intuitive judgment falls prey to sys- tematic traps and biases. Research provides convincing evidence that even the smartest and most experienced people similarly fall into predictable judgment traps and biases.

The “Rush to Solve.” One of the most common judgment traps is the tendency to want to immediately solve a problem by making a quick judgment. As a result, we under-invest in the important early steps in the judgment process and often go with the first workable alternative that comes to mind or that is presented. As a result of the rush-to-solve trap, we sometimes end up solving the wrong problem, or we settle for a suboptimal outcome because we did not consider a full set of alternatives.

Solving the Wrong Problem. Consider the following example. Two snack food compa- nies are competing for market share—let’s call them Ax Snack Company and Bobb Good- ies Inc. Bobb’s executives were convinced that Ax’s competitive advantage was attributable to the company’s distinctive, highly recognizable individual snack packaging design. The individual snack packages seemed to draw customers to the products. So, Bobb’s executives determined that to gain market share, they would need to develop individual package designs that were equally distinctive. They spent millions on improved packaging appearance for their snack foods to compete against Ax’s distinctive packaging. When increased market share did not follow, Bobb’s executive team realized that they knew relatively little about what custom- ers really wanted and what drove the consumption of their snack foods. Bobb’s executives decided to conduct market research, and along the way, they discovered an important and somewhat unexpected aspect of consumer behavior: regardless of the quantity of product they placed in a home, it would be consumed in relatively short order. Thus, Bobb’s executives

2KPMG’s Professional Judgment student monograph contains illustrations, audio files, and links to Internet files that vividly illustrate many of the concepts introduced in this module.

Final PDF to printer

752 Appendix Advanced Module: Professional Judgment Framework

mes32502_app_748-756.indd 752 10/22/15 10:13 AM

clarified the decision problem as “how to get larger quantities of snack products into consum- ers’ homes.” Accordingly, they focused less on the appearance of individual snack packages and instead introduced bulk packaging that made it easier and more convenient to get more snacks into consumers’ homes. The resulting gain in market share was dramatic.

This example illustrates one of the biggest traps we run into during the first couple of steps of the judgment process, which is under-investing in defining the fundamental issue. In the example above, Ax Snack Company’s distinctive packaging functioned as what could be called a “judgment trigger,” or an assumed or inherited issue that can lead the decision maker to skip the crucial early steps in the judgment process. It caused Bobb Goodies’ executives to focus, at first, on the wrong issue or problem. Judgment triggers can often be recognized when a particular alternative is used to define the problem in place of a well thought-out prob- lem definition. Often, the trigger comes from the way others have defined the issue, which is often formulated in terms of one potential solution. Alternatively, we may create triggers ourselves because we are in such a hurry to “solve” or to be decisive. Judgment triggers often lead to judgments made on incomplete facts or understandings.

How might you overcome the very common trap of skipping the first couple of elements in the judgment process that comes about through the rush to solve or through judgment triggers? The answer is to ask “what” and “why” questions. For example, you might initially answer a “what” question regarding retirement goals with, “I want to have a certain amount of money in a retirement fund.” That certainly is a worthy objective, but as with many ini- tial objectives, it is only a means to an end. Following up by asking why you want a certain amount of money can help you uncover the more fundamental objective, which might be something like, “to maintain a high quality of life in retirement.” Note that by clarifying the objective in this way, a number of additional approaches to achieving a high quality of life come to mind (such as good health, no debt, cost of living, location, availability of outdoor recreation, etc.). Carefully clarifying underlying objectives by asking “why” is a key step in making important judgments.

It often does not take a lot of time to consider the first step in the judgment process, but the more important the judgment, the more important it is to invest in clarifying the funda- mental issues and objectives. A little extra investment in clarifying the issue and objectives will almost always pay off, sometimes in a big way. One very powerful way to improve your professional judgment is to make sure you are not accepting a judgment trigger in place of a solid problem definition, but rather that you are taking time to ensure your problem definition is complete and correct.

Professional Skepticism and “Judgment Framing” At the core of an auditor’s ability to effectively question a client’s accounting choices is a fun- damental but powerful concept called “judgment framing.” This concept relates to the early steps in the judgment process. The definition of framing follows: Frames are mental struc- tures that we use, usually subconsciously, to simplify, organize, and guide our understanding of a situation. They shape our perspectives and determine the information that we will see as relevant or irrelevant, important or unimportant. Frames are a necessary aspect of judgment, but it is important to realize that our judgment frames provide only one particular perspective. This is similar to looking out one window of your home—it provides one view that might be quite different from the view through another window.

Frames are necessary and helpful, but the problem is that we often are not aware of the perspective or frame we are using. Also, our frame can blind us to the fact that there are other valid perspectives. In other words, frames help us make sense of things but they also make it difficult for us to see other views. By being proactive in our use of judgment frames, we can improve how well we do with the initial steps in the judgment process: clarifying issues and objectives and considering alternatives. This is important because a distinguishing charac- teristic of professionals who consistently exercise sound judgment is that they recognize the judgment frame they are using, and they are able to consider the situation through different frames, or what KPMG professionals refer to as a “fresh lens.” Sounds simple enough, but it

Final PDF to printer

Appendix Advanced Module: Professional Judgment Framework 753

mes32502_app_748-756.indd 753 10/22/15 10:13 AM

is not always easy to do! The concept of judgment framing is important because appropriately questioning management’s perspective by viewing the situation through other frames is fun- damental to professional skepticism.

For example, suppose the results of a substantive analytical procedure suggest that a cli- ent’s allowance for doubtful accounts is understated. The auditor’s approach to gathering fur- ther audit evidence will be different if the results are framed in the context of a change in business conditions or a change in the client’s credit policy as compared to an indicator of a likely error. This is not to say one frame is necessarily better than the other, but the auditor can boost his or her professional skepticism by considering both frames.

A key characteristic of those who make high-quality judgments is that they are frame- aware. They know how to seek and consider different frames to get a fuller picture of the situation. Seasoned, experienced auditors develop this ability and apply it in situations where they need to help client management see an alternative viewpoint on an important account- ing issue. For example, an alternative frame that auditors might use could be an investor or analyst perspective, or a regulator perspective. Or it might be a “hindsight” perspective—in other words, how will management’s judgment look if a regulator later questions it, or if it is reported in the press in six months? While experienced auditors are typically quite skilled at challenging frames and considering issues from different perspectives, this is an area where auditors entering the profession typically need improvement.

The Center for Audit Quality (CAQ), in its 2010 report on Deterring and Detecting Financial Reporting Fraud, indicates that “skepticism—a questioning mindset and an attitude that withholds judgment until evidence is adequate— promotes risk awareness and is inherently an enemy of fraud.” The report lists the following characteristics of skepticism.

• Questioning Mind—A disposition to inquiry, with some sense of doubt • Suspension of Judgment—Withholding judgment until appropriate evidence is obtained • Search for Knowledge—A desire to investigate beyond the obvious, with a desire to corroborate • Interpersonal Understanding—Recognition that people’s motivations and perceptions can lead

them to provide biased or misleading information • Autonomy—The self-direction, moral independence, and conviction to decide for oneself, rather

than accepting the claims of others • Self-Esteem—The self-confidence to resist persuasion and to challenge assumptions or conclusions

Summarized from Hurtt, “Development of a Scale to Measure Professional Skepticism,” Auditing: A Journal of Practice & Theory, May 2010, Vol. 29, No. 1, pp. 149–171.

Judgment Tendencies that Can Result in Bias Peoples’ judgments can be unintentionally biased due to underlying self-interest or because they unknowingly use mental shortcuts. For the most part, the shortcuts we use are efficient and often effective, but in certain situations, they can result in systematic, predictable bias. Keep in mind that the tendencies or shortcuts we will discuss are simplifying judgment strate- gies or rules of thumb that we have unknowingly developed over time to help us cope with the complex environments in which we operate. They are efficient and often effective, but because they are shortcuts, they can lead to lower-quality judgment in some situations. Here’s a quick example of a simplifying shortcut. When crossing a city street, say in New York City, some people don’t wait until they get a “walk” sign; rather, they move through intersec- tions by quickly looking to the left for oncoming traffic. If the coast is clear, they will take a step out into the street and then look to the right for traffic coming the other way. This is a very efficient and often effective shortcut strategy. Over time, it can become an unconscious, automatic part of how people cross the street in a busy city. However, if we were to use this shortcut strategy in London, where they drive on the other side of the street, it could result in a very bad outcome. Even in New York City, the shortcut can lead to a bad outcome if applied to all streets, since there are one-way streets that come from the other direction.

Final PDF to printer

754 Appendix Advanced Module: Professional Judgment Framework

mes32502_app_748-756.indd 754 10/22/15 10:13 AM

Similarly, the judgment shortcuts we commonly use are efficient and generally effective. However, there are situations where the use of a shortcut can predictably result in a lower quality or biased judgment. The good news is that once we understand the implications of a shortcut, we can devise ways to mitigate potential bias resulting from the shortcut. When it comes to crossing the street in London, transportation officials have devised rather ingenious ways to reduce the potentially serious consequences of using the “American” shortcut to start across the street looking first only to the left. They have placed signs on the sidewalk, on sign- posts, and even on the street, reminding visiting pedestrians of the direction of traffic flow. The signs are an attempt to get visitors out of the subconscious shortcut mode and apply more formal thinking, which is pretty important for the well-being of American tourists in London.

We will briefly introduce four common judgment tendencies that are most applicable and important for audit professionals: the availability tendency, the confirmation tendency, the overconfidence tendency, and the anchoring tendency.

The availability tendency is defined as: The tendency for decision makers to consider information that is easily retrievable from memory as being more likely, more relevant, and more important for a judgment.

In other words, the information that is most “available” to our memory may unduly influ- ence estimates, probability assessments, and other professional judgments. Like other mental shortcuts, the availability tendency often serves us well, but it has been shown to introduce bias into business and audit judgments. For example, an auditor may be inclined to follow the approach used in a prior period or on a recent engagement even if the approach is not the best for the current engagement. This tendency is especially powerful if the approach worked well on the prior engagement.

The confirmation tendency is defined as: The tendency for decision makers to seek for and put more weight on information that is consistent with their initial beliefs or preferences.

You may have heard the old joke, “My mind is made up; don’t confuse me with the facts!” Hundreds of years ago, leading philosophers recognized that once people have adopted a preference or an opinion, they tend to consider and gather information that supports and agrees with their preference. Research in psychology backs this up: people tend to seek con- firmatory evidence, rather than looking for something inconsistent with their opinions or pref- erences. After receiving this confirmatory evidence, decision makers often are confident that they have adequate evidence to support their belief. The more confirmatory evidence they are able to accumulate, the more confident they become. However, in many instances, we cannot know something to be true unless we explicitly consider how and why it may be false. As an example of the confirmation bias in auditing, research and reviews of working papers find that auditors may be prone to overrely on management’s explanation for a significant difference between the auditor’s expectation and management’s recorded value, even when the client’s explanation is inadequate.

The overconfidence tendency is defined as: The tendency for decision makers to overes- timate their own abilities to perform tasks or to make accurate diagnoses or other judgments and decisions.

When groups of people are asked to assess their own abilities, whether in auditing or in driving a car, a majority of the participants assess themselves as above average relative to the group being surveyed. But, of course, it is not possible for all participants to be above aver- age. This is a simple illustration of the fact that many of us are overconfident in our abilities and, as a result, we often tend not to acknowledge the actual uncertainty that exists. Over- confidence is a subconscious tendency that results from personal motivations or self-interest. Importantly, this tendency to be more confident than is justified is likely to affect us even when we are doing our best to be objective. Research indicates that many people, including very experienced professionals, are consistently overconfident when attempting to estimate outcomes or likelihoods. Studies involving practicing auditors demonstrate that auditors may be overconfident in their technical knowledge and their competence in auditing risky areas. In addition, partners and managers may be overly confident in the ability of less experienced people in completing complex tasks. Conversely, associates and senior associates may be overconfident in the competency of more experienced auditors to complete lower-level tasks

Final PDF to printer

Appendix Advanced Module: Professional Judgment Framework 755

mes32502_app_748-756.indd 755 10/22/15 10:13 AM

that they aren’t accustomed to performing on a regular basis. Such overconfidence can lead to a variety of suboptimal outcomes in auditing, including neglecting to ask for needed help or guidance, failing to acquire needed knowledge, poor task performance, budget overruns, assignment of audit tasks to underqualified subordinates, and underreview of subordinates’ working papers.

The anchoring tendency is defined as: The tendency of decision makers to make assess- ments by starting from an initial numerical value and then to adjust insufficiently away from that initial value in forming a final judgment.

To illustrate the anchoring tendency, managers often make salary decisions by adjust- ing from the starting point of an employee’s previous salary. A prospective employer might quickly realize the unreasonableness of the anchor (e.g., her previous employer only paid her $48,000 before she earned an MBA degree), but proposes a starting salary irrationally close to the starting point, or anchor. So, in this example, the job applicant is likely to receive a lower salary offer if the prospective employer knows her salary before she earned her MBA. There are two components of anchoring and adjustment—the tendency to anchor on an initial value and the tendency to make adjustments away from that initial value that are smaller than what is actually justified by the situation. The anchoring tendency clearly has direct relevance to auditing in many settings. For example, management’s estimate or unaudited account balance can serve as an anchor. The auditor is charged with objectively assessing the fairness of an account balance. But if his or her judgments are influenced by the amount asserted by man- agement in an unaudited account balance, that objectivity might be compromised. In other words, the auditor might become anchored to management’s estimate.

Mitigating the Effects of Judgment Biases The most important step in avoiding judgment traps and reducing bias caused by subcon- scious mental shortcuts or self-interest is “awareness.” By better understanding traps and biases, and recognizing common situations where they are likely to present themselves, we can identify potential problems and often formulate logical steps to improve our judgment. If we don’t have any idea where the common judgment traps are, or where we are likely to be systematically biased, we do not even have a starting point. As we said earlier, some of the most serious judgment traps have to do with the failure to follow a judgment process. In other words, we might be influenced by a judgment trigger, solve the wrong problem, fail to clarify our objectives, or push too quickly through the initial steps in the judgment process because we want to quickly arrive at a solution or conclusion. In terms of mitigating bias, the first step is to recognize situations where we might be vulnerable. Awareness, coupled with the termi- nology to identify and label the potential traps and biases, is key to improving judgment. In fact, research exploring mitigation techniques suggests that simply providing instructions to decision makers about the seriousness of a bias can reduce the effect of these biases.

While a thorough discussion of potential ways to mitigate biases is beyond the scope of this module, here are a few examples. Actively questioning our assumptions, which might include considering potentially disconfirming evidence or seeking more complete informa- tion, is a key approach in mitigating all of the judgment biases. Consulting with others can go a long way toward mitigating the effects of the availability tendency. Getting an outside view on a going-concern uncertainty assessment can help keep the auditor’s judgment from being too optimistic, or pessimistic, given recent, salient experiences. In other judgment and decision tasks, a helpful approach is to ask others to gather and evaluate information without revealing our preference. (We do not want to reveal our preference because it may affect their judgment just like it may affect our own.) Finally, we can also take steps to objectively evalu- ate the pros and cons for each alternative. In mitigating bias related to the anchoring tendency, it can be helpful to seek out and explicitly consider alternative anchors.

The bottom line is that we need to realize where and how we may be biased in order to develop simple approaches for mitigating the effects of those biases. And the good news is that once you are aware of traps and biases, the mitigation approach often is a matter of apply- ing logic and common sense. Bias-mitigation techniques are important, but just as important

Final PDF to printer

756 Appendix Advanced Module: Professional Judgment Framework

mes32502_app_748-756.indd 756 10/23/15 07:30 AM

in avoiding traps and mitigating bias is to bake the steps of good judgment, such as those pro- vided in the KPMG Professional Judgment Framework, into your judgment-making process. Thoughtfully applying the steps of a judgment process can in itself mitigate bias. And, finally, in auditing, the requirement to conclude and document provides the auditor the opportunity to carefully reconsider the preceding steps of good judgment and the possibility that judgment traps or biases may have influenced the final conclusion.

Conclusion

Professional judgment is an increasingly important subject in accounting and auditing. As accounting standards become more subjective and fair value measurement increasingly takes center stage, professionals will be required to apply more and better professional judgment on a consistent basis. In reality, none of us will ever make perfect judgments or be completely free from bias or from judgment traps. But by becoming aware of where we can fall prey to such influences and by practicing common sense mitigation techniques, including the steps in a judgment process, we can improve the quality of our professional judgment. And this, more than just about anything else you can do, will set you apart as an outstanding professional.

For more in-depth information about professional judgment in auditing, including addi- tional coverage of judgment traps and biases, judgment in groups, and other topics, see the award-winning monograph, Elevating Professional Judgment in Auditing and Accounting: The KPMG Professional Judgment Framework, available without charge under the Profes- sional Judgment tab at university.kpmg.us.

This summary is adapted from The KPMG Professional Judgment Framework: Elevating Professional Judgment in Auditing with permission from KPMG, LLP. © 2013 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Coopera- tive (“KPMG International”), a Swiss entity. All rights reserved.

Final PDF to printer

757

mes32502_idx_757-783.indd 757 10/14/15 08:43 AM

Index

Note: Page numbers followed by n refer to material in footnotes.

Accounts receivable subsidiary ledger, 347–348 Accrued expenses, 405 Accrued payroll expenses, 434 Accrued payroll liabilities, 437–439 Accuracy assertion

cash and, 532 for cash receipts transactions, 359, 361 classes of transactions and events during the period, 133, 355 data capture controls and, 207 human resource management process and, 432, 433, 435–436 inventory management process and, 461–463, 468–469 investments and, 544, 546 long-term debt and, 511, 515 presentation and disclosure, 134–135 for property, plant, and equipment, 494 purchasing process and, 398–403, 405, 407 revenue process and, 355–356, 359, 361–362, 365 for revenue transactions, 357–358 stockholder’s equity and, 515 summary, 11

ACFE. See Association of Certified Fraud Examiners (ACFE) Achieved level of audit risk, 101–102, 104 Achieved level of control risk, 354 ACLTM software

computing projected misstatement and upper misstatement limit using, 314–316

monetary-unit sampling terminology and, 328 Sample Records command, 309n5

Acquisitions and mergers, 189 Activity ratios, 163 Acts discreditable to the profession, 655–656 Actual level of audit risk, 101–102, 104 Adjusting entries, 149 ADPTM, 427 Adverse opinion, 22, 241, 244, 605–606, 618 Adverse reports, for material weakness, 241–242, 244 Advertising/solicitation, by CPA, 656 Aged trial balance of accounts receivable, 348, 366 Agency theory, 686n7 Agents, 5–6 Agreed-upon procedures

attest engagements and, 713 defined, 739 instead of auditing specific elements, accounts, or items, 615 for prospective financial statements, 719–721

AICPA. See American Institute of Certified Public Accountants (AICPA)

Aiding and abetting, 692, 692n9 AIG. See American International Group, Inc. (AIG) Allegheny Health v. PricewaterhouseCoopers, 679 Allocation assertion

account balances at the period end, 133 human resource management process and, 435, 436 inventory management process and, 463, 468–470

Access controls, in IT environment, 206 Accountability, control environment and, 185 Account analysis, 149 Account balances

at end of period, management assertions about, 133 financial statement auditing, 11, 18 selected, tests of, 519 substantive tests of (see Audit sampling; Classical variables

sampling; Monetary-unit sampling (MUS); Nonstatistical audit sampling)

tests of details of human resource management process and, 435–439 inventory management process and, 467–471 purchasing process and, 406–410 revenue process and, 364–369 substantive procedures, 84

Accounting and review services, 722–726 for compilation of financial statements, 722–724 for review of financial statements, 724–726

Accounting and Review Services Committee, 722 Accounting information systems, 48 Accounting principles

changes in, 603 Rules of Conduct on, 653–654

Accounting records, 135, 165. See also Record(s) Accounting scandals, 44. See also Fraud; specific firms by name Accounting Standards Codification (ASC; FASB)

overview of, 52 Subtopic 505-50, Equity Based Payments to Non-employees, 440 Topic 230, Statement of Cash Flows, 530 Topic 250, Accounting Changes and Error Corrections, 604 Topic 320, Investments—Debt and Equity Securities, 548 Topic 350, Intangibles—Goodwill and Other, 485–486, 485n1 Topic 360, Property, Plant, and Equipment, 497 Topic 450, Contingencies, 564 Topic 718, Compensation—Stock Compensation, 438, 549 Topic 740, Income Taxes, 413–414 Topic 820, Fair Value Measurements and Disclosures, 548 Topic 855, Subsequent Events, 568 Topic 985, Software, 485n1

Accounts difficult to audit, 352 significant, identification of, 232

Accounts payable auditing, 405 in purchasing process, 394

Accounts payable confirmation, 411–412 Accounts payable subsidiary ledger, 392 Accounts receivable

aged trial balance of, 348 auditing of revenue-related accounts, 362 confirmation process for, 370–374 days outstanding in, 164 in revenue process, 350

Final PDF to printer

758 Index

mes32502_idx_757-783.indd 758 10/14/15 08:43 AM

Arthur Andersen Baptist Foundation of Arizona and, 635, 696 Credit Alliance case and, 682 Enron and, 44, 635, 692, 693 failure of, 10, 44, 674 fees of, 44, 651 indictment of, 153 Sunbeam Corporation and, 635, 696 Waste Management and, 635, 696 WorldCom and, 388, 491, 691

ASB. See Auditing Standards Board (ASB) ASC. See Accounting Standards Codification (ASC; FASB) AS(s). See Auditing Standards (ASs) [PCAOB] Assertions. See also Management assertions; specific assertions

as attest engagement, 712 defined, 100, 131, 165, 375, 414, 441, 471, 520, 551 documentary evidence related to, 139 presentation disclosure, 410 of sellers, 8

Asset-backed securities, 508 Asset misappropriation, 41 Assets

intangible, 484–488 control risk assessment and, 486 inherent risk assessment and, 485–486 substantive procedures and, 486–487

misappropriation of, 114–115 return on, 165 safeguarding of, 247, 250 tangible

inspection for audit evidence, 139–140 inspection of, 268

Association of Certified Fraud Examiners (ACFE), 40, 110, 341, 541 Assurance

analogy of, 8–12 bucket analogy, audit testing hierarchy and, 145–146 defined, 13 demand for, 5–6 principals and agents and, 5–6

Assurance services about, 41–42 auditing and attestation services and, 12–13 defined, 13, 24, 710, 739 of internal auditors, 730 PrimePlus, 738 trust services and, 734–738 types of, 711

Assurance Services Executive Committee, 711 Attest, defined, 24 Attestation, defined, 13 Attestation report for EarthWear's website, 737 Attestation standards (ATs), 51, 427n1, 433, 713–715, 716n1 Attest engagement

defined, 661, 711–712 three-party relationship in, 712 types of, 712–713

Attest services, 41, 711–712, 739 Attitudes/rationalization to commit fraud, 112–113 Attribute sampling

applied to tests of controls, 271–289 audit procedures performance and, 281–283 calculate sample deviation and computed upper deviation rates and,

283–285 defined, 270, 290 drawing of final conclusions, 287–289 evaluation and, 283–287

Allocation assertion—Cont investments and, 547 long-term debt and, 511 property, plant, and equipment, 496–497 purchasing process and, 405, 407 revenue process and, 362, 365, 368–369

Allowance for sampling risk, 267–268, 290, 310, 328 Amazon, 440 American Accounting Association/Deloitte Wildman Award, 748 American Association of Public Accountants, 635–636 American Bankers Association, 534 American Institute of Certified Public Accountants (AICPA). See also

Auditing Standards Board (ASB) about, 51–52 Accounting and Review Services Committee, 722 Assurance Services Executive Committee, 711 attestation standards, 709 Audit Sampling, 288 Code of Professional Conduct, 51, 57–59, 70, 72, 636–638, 657 committees of, 51 Peer Review Program of, 658 publications of, 52 Rules of Conduct of, 639–658

accounting principles, 654 acts discreditable to the profession, 655–656 advertising and other forms of solicitation, 656 commissions and referral fees, 656–657 general standards, 653–654 independence, 641–653 integrity, 640–641 objectivity, 640–641 organizational form and name, 657 overview of part 1, 639 responsibilities to clients, 654–655

Special Committee on Assurance Services, 709–710 Statement on Quality Control Standards (SQCS) No. 8, A Firm’s

System of Quality Control, 659–661 Statements on Standards for Attestation Engagements

(SSAEs), 712 Trust Services Principles and Criteria, 735 Uniform CPA Examination, 38–39

American International Group, Inc. (AIG), 508 Analytical procedures. See also Substantive analytical procedures

about, 153–154 audit evidence, obtaining, 142 defined, 84, 90, 120, 165, 375, 414, 441, 471, 498, 520, 551, 585 expectations and, 155 final, 142, 572 in risk assessment process, 105 types of, 154

Anchoring tendency, 755 Andersen, Delaney & Co., 634 Anjoorian v. Pascarella & Trench, 686 Antar, Eddie, 690 Apple Inc., 439 Application controls

defined, 211, 375, 414, 441, 471 as information processing control, 188 in IT environment, 207–209

Application systems acquisition controls, in IT environment, 207 Appropriateness of audit evidence, 16, 135–136 Archiving

of audit documentation, 151–152 of audit files, 579

Arizona Baptist Foundation, 696 Army Audit Agency, 39

Final PDF to printer

Index 759

mes32502_idx_757-783.indd 759 10/14/15 08:43 AM

payroll-related accounts, 439–440 in purchasing process, 412

Auditing defined, 12, 24 demand for, 5–7 environment for (see Auditing environment) focus of, 4–5 payroll-related accounts, 434 prepaid expenses, 482 principals and agents and, 5–6 role of, 6–8 standards for (see Auditing standards) study of, 4–5

Auditing environment, 37–66 assurance services, 41–42 attest services, 41 auditors, types of, 38–40 business as context of auditing, 45–46 business objectives, strategies, processes, controls, transactions, and

reports, 48 business processes model, 48–49 compilation and review services and, 42 compliance audits, 41 corporate governance, 46 ethics, independence, and Code of Professional Conduct, 57–58 forensic audits, 41 internal control audits, 40–41 management advisory services (MAS) and, 42 operational audits, 41 organizations affecting public accounting profession, 49–52 other nonaudit services, 42 public accounting firms, 42–43 society’s expectations and auditor’s responsibilities, 45 tax preparation and planning services and, 42

Auditing Practice Releases, 52 Auditing Research Monographs, 52 Auditing standards, 52–57

Auditing Standards Board’s role in, 53 changes to, 616–617 generally accepted (see Generally accepted auditing standards

(GAAS)) International Auditing and Assurance Standards Board’s role

in, 53 International Standards on Auditing (ISA), 55 principles underlying an audit conducted in accordance with GAAS,

55–56 Public Company Accounting Oversight Board’s role in, 53 purpose of, 52–53 revenue recognition, fraud and, 117 roles of the ASB, PCAOB, and IAASB, 53 Statements on Auditing Standards (SAS) and, 55–56

Auditing Standards (ASs) [PCAOB] AS3, Audit Documentation, 147–148 AS5, An Audit of Internal Control Over Financial Reporting That Is

Integrated with An Audit of Financial Statements, 221–224, 230, 235, 236, 245, 423, 491, 583

defined, 59 Auditing Standards (AUs)

AU-C-540, Auditing Accounting Estimates, Including Fair Value Accounting Estimates and Related Disclosures, 549

AU-C-620, Using the Work of an Auditor’s Specialist, 550 AU-C-705, Modifications to the Opinion in the Independent

Auditor's Report, 606 AU-C-530.A14, 318–319 AU-C 320, Consideration of Materiality in Planning and Performing

and Audit, 85

illustration of, 271 performance of, 279–283 planning for, 271–279 population characteristics, defining, 272–273 sample selection for, 280–281 sample size determination and, 273–279 test objectives, determination for, 272

Attribute sampling tables, 276–278, 307 Attribute standards, of IIA, 728–729 AU codification, 55–57. See also Auditing Standards (AUs) Audit Analytics, 43n5 Audit committee

communications about fraud and, 119–120 in corporate governance, 46 defined, 46, 58, 76–77, 90 privately held companies and, 76n1 role of, 76–77

Audit completion, 20 Audit deficiencies, 159, 160, 370 Audit documentation

archiving and retention of, 151–152 content of, 147–148 defined, 166 examples of, 148–150 format of, 150 functions of, 146–147 organization of, 151, 152 ownership of, 151

Audit engagement, completing, 562–595 commitments and, 567–568 communications with those charged with governance and

management and, 582–584 contingent liabilities and, 564–567 final evaluation and

archiving and retention of, 579 final analytical procedures and, 572 final evaluation of audit results and, 576–578 financial statement presentation and disclosure and, 578–579 going concern considerations and, 579–582 independent engagement quality review and, 579 representation letter and, 573–575 working paper review and, 573

subsequent discovery of facts existing at the date of the auditor’s report and, 584–585

subsequent events review for audit of financial statements and, 568–571

subsequent events review for audit of internal control over financial reporting, 571–572

Audit engagement team requirements, 71–72 Audit evidence, 128–175

audit procedures for obtaining, 138–142 concepts of, 135–137 defined, 16, 24, 129, 166 electronic confirmations, 374 evaluation of, 137 management assertions and, 16 nature of, 135 other information used for, 135 relationship to audit report, 130 reliability of, 136–137 reliability of types of, 142–143 sufficiency and appropriateness of, 135–136

Audit files, 146, 579. See also Audit documentation Audit findings, evaluating

inventory, 471 materiality and, 88, 89

Final PDF to printer

760 Index

mes32502_idx_757-783.indd 760 10/14/15 08:43 AM

preliminary engagement activities, 71–77 unqualified/unmodified audit report and, 21–22

Audit programs, 81–82, 138, 149 Audit report(s). See also Financial statement audit report(s)

disclaimer, 605 evaluation of results of, 20 issuance of, 20 qualified, 22, 605 relationship to audit evidence, 130 support for, 147 unqualified

of audit of internal control over financial reporting, 241–242 explanatory language added to, 600–604 standard, 598–604

unqualified/unmodified, 21–22 departures from, 604–607

Audit results, evaluation of, 117–118 Audit risk, 15–16, 24, 100, 120 Audit risk model, 100–104

equation for, 101, 189 overview of, 117 as planning and evaluation tool, 104 qualitative approach to, 103 relationship to entity’s business risks, 103 use of, 102–104

Audit sampling, 262–298 attribute sampling applied to tests of controls, 271–289 confidence level and, 264, 267 defined, 290, 328 definitions and key concepts, 265–269 evidence choices, sampling and, 268–269 introduction to, 264–265 monetary-unit sampling and (see Monetary-unit sampling (MUS)) nonstatistical (see Nonstatistical audit sampling) sampling risk and, 264, 265–267 statistical sampling for, 269–270 substantive tests of account balances and, 300–336 (see also

Substantive tests of account balances, audit sampling and) substantive tests of account balances using, 318–321 tolerable and expected error and, 267–268 types of, 269–270

Audit Sampling (AICPA), 288 Audit services, 40–41 Audit strategy

defined, 90 documentation of, 81–82 planning, 78, 189–192 reliance, 192 substantive, 191–192

Audit supervision, 83, 147, 653 Audit team

fraud risk assessment process and, 111–115 responsibilities of members of, 43

Audit testing hierarchy, 143–146 Audit test(s)

of controls, 83–84 dual-purpose, 84 petty cash and, 541–542 results of, 117–118 risk assessment procedures, 83 substantive procedures, 84

AU(s). See Auditing Standards (AUs) Authority, control environment and, 184 Authorization assertion

cash and, 533 cash receipts transactions, 359, 360

Auditing Standards (AUs)—Cont AU-C 940, An Audit of Internal Control Over Financial Reporting

that Is Integrated with an Audit of Financial Statements, 716n1

Auditing Standards Board (ASB), 50 auditing standards and, 53–57 An Audit of Internal Control Over Financial Reporting That Is

Integrated With an Audit of Financial Statements, 221n1 changes to standards of, 616 generally accepted auditing standards (see Generally accepted

auditing standards (GAAS)) role of, 53 Statements on Auditing Standards (SAS) issued by (see Statements

on Auditing Standards (SAS)) unmodified audit reports, 599

Auditing transactions, difficulty of, 352 Audit memoranda, 149 Audit of internal control over financial reporting (ICFR)

auditor documentation requirements and, 240 evaluating identified control deficiencies and, 236–239 performing, 228–229 planning, 229–230 remediation of material weakness and, 239 test design and operating effectiveness of controls and, 234–236 testing controls, 231–233 written representations and, 239–240

An Audit of Internal Control Over Financial Reporting That Is Integrated With an Audit of Financial StatementsI (ABS), 221n1

Auditor reporting on internal control over financial reporting, 240–244 adverse, 241, 244 disclaimer for scope limitation and, 242 elements of, 241 overview of, 240 unqualified report and, 241–243

Auditor(s) bias of, 137 criminal liability and, 698–699 defenses for, 686–687 demand for more information and insight from, 616 for financial statement, 44–45 indemnification of, 76 independence of, 57–58 (see also Independence) legal liability of, 675–677 personal knowledge, evidence and, 136–137 principal, 600 professionalism of (see Professionalism) response, to risk assessment results, 115–117 responses, documentation of, 118–119 responsibilities under Section 404 and AS5, 222 risk assessment process of, 104–109 roles of, 729–732 society’s expectations and auditor’s responsibilities, 45 types of, 38–40

Auditor specialist(s), 498 Audit plan, 78, 81–82, 149. See also Planning audits Audit procedures

audit evidence, obtaining, 138–142 defined, 90, 120, 166 timing of, 202–203

Audit process, 17–23 audit evidence and, 130 audit reports and, 21–23 client acceptance and continuance, 70–71 major phases of, 17–21 overview of, 17–18 planning the audit, 20, 78–82

Final PDF to printer

Index 761

mes32502_idx_757-783.indd 761 10/14/15 08:43 AM

Business processes audit evidence and, 130 in audit process, 20 defined, 48 model of, 48–49

Business process improvement, 734 Business relationships, independence and, 646–648

Calabro Wireless, Inc. attribute sampling applied to tests of controls, 271 auditing standard costs and, 465 audit procedures and, 282–283 inventory management process at, 465 long-term debt and, 512–513 nonstatistical sampling and, 320–321 proof of cash and, 542 revenue process and, 366, 368, 371–372 sample size, determination of, 277

Canadian Institute of Chartered Accountants (CICA), 735 Capital Confirmation Inc., 374 Capital market, 5–6 Capital-stock accounts, 515–516 Cardozo, Benjamin, 681 Card scams, 458 Carter, Arthur, 58 Carter v. Carlis, 682 CaseWare Analytics, 278n7 Cash. See Financing/investing process Cash disbursements journal, 393 Cash discounts, authorization of, 360 Cash equivalents, 530, 552 Cash (modified cash) basis, 614 Cash receipts, 350 Cash receipts journal, 348 Cash receipts transactions

accuracy of, 361 classification of, 361 completeness of, 359–360 cutoff of, 361 occurrence of, 358–359

Causal connection, 680 Caveat emptor, 682 CDS (Credit-default swap), 508 Cenco, Inc. v. Seidman & Seidman, 679 Centennial Technologies, 458 Center for Audit Quality (CAQ), 753 Central Bank v. First Interstate Bank, 692 Certified fraud examiner (CFE), 40 Certified internal auditor (CIA), 38 Certified public accountant (CPA), 38–39, 738 Change controls, in IT environment, 206 Channel stuffing, 341 Check registers, 393 Checks, disbursements by, 393 Check tampering, 541 CIA (certified internal auditor), 38 CICA (Canadian Institute of Chartered Accountants), 735 Citizens State Bank v. Timm, Schmidt & Co., 684 Civil law, defined, 676 Civil liability, 676, 688–698

Class Action Fairness Act (2005), 693–694 Foreign Corrupt Practices Act (1977), 697 Private Securities Litigation Reform Act (1995), 693–694 Racketeer Influenced and Corrupt Organizations Act

(RICO, 1970), 698

classes of transactions and events during the period, 132–133, 355

human resource management process and, 432–433, 435–436 inventory management process and, 461, 463, 468 investments and, 544, 546 long-term debt and, 510–511, 515 property management process and, 491–492 purchasing process and, 399–403, 407 revenue process and, 355–356, 359, 360, 365 for revenue transactions, 357 stockholder’s equity and, 515 summary of, 11

Autonomy Corporation, 342 Availability, trust services and, 735 Availability tendency, 754 Available-for-sale securities, 544

Balance-related assertions, cash and, 532–533 Balance sheet accounts

direct tests of, 518 tax provision and, 413–414

Bank accounts, types of, 531–532 Bank Administration Institute, 534 Banking crisis of 2007-2009, 715 Bank reconciliation, 537–538 Bank reconciliation working paper, 534 Bank statements, cutoff, 536 Baptist Foundation of Arizona, 635 BarChris Construction Corp., 689 Barrett v. Freifeld, 682 Basic precision, 310–311 BBC, 458 BDO Seidman, 43 Bernard Madoff Investment Securities (BMIS), 115 Bernstein v. Crazy Eddie, 689 Best estimate, 302, 310 Bias of auditors, 137 Big 4 public accounting firms, 43, 204, 487, 551 Bill and hold sales, 342 Billing, 350 Billing schemes, 541 Bill of lading, 347 Bily v. Arthur Young, 685 Binomial model, of option pricing, 440 Black-Scholes-Merton model, of option pricing, 440, 548 Blank confirmation, accounts payable and, 411, 415 BMIS. See Bernard Madoff Investment Securities (BMIS) Board of directors, 46, 59 Bonds, 5–6, 510, 510n1 Bond trustees, 512n2 Book-to-physical adjustment, 468 Brainstorming sessions, 111 Branch accounts, 541 Branch imprest accounts, auditing, 541 Breach of contract, 676, 680 Bribery, 41 Bucket analogy, audit testing hierarchy and, 145–146 Burger, Warren, 7 Business cycles, 48 Businesses. See also Entity

as context of auditing, 45–46 model of, 48–49 overview of, 47, 339–340 risk and, 78, 104, 106–109, 120

Business performance measurement, 711 Business process categories, 48–49

Final PDF to printer

762 Index

mes32502_idx_757-783.indd 762 10/14/15 08:43 AM

as framework for auditors, 636–640 general standards and accounting principles, 653–654 independence, compilation of financial statements and, 724 Independence Rule, 641–644 principles of, 638 purpose of, 657–658 responsibilities to clients, 654–655 revisions to, 636–638 rules of conduct, 639–640

Codes of ethics, of IIA, 728–729 Codification(s). See Accounting Standards Codification (ASC; FASB) Collusion, internal control and, 198–199 Colorado Retirement Fund v. Deloitte, 694 Commission expense schemes, 394 Commissions, 656–657 Commitments, completing the audit engagement and, 567–568 Committee of Sponsoring Organizations (COSO)

COSO Report and, 714–715 Enterprise Risk Management—Integrated Framework, 716 framework for internal control(s)

components of internal control and, 181–182, 185–187 control activities and, 186–188 control environment and, 183–185 entity’s risk assessment process and, 185–186 information, communication, and, 188–189 monitoring of controls, 189 2013 revision of, 182

Guidance on Monitoring Internal Control Systems, 189 Internal Control—Integrated Framework, 225, 227, 714–716, 736

Common law, 675 Common law liability

to clients, 677–680 breach of contract and, 677 fraud and, 679–680 negligence and, 677–679

compared to other liability, 676 to third parties, 680–688

damages under common law and, 687–688 fraud and, 686–687 gross negligence and, 686–687 ordinary negligence and, 680–686

Communication(s) in audit of internal control over financial reporting, 245–246 control environment and, 188–189 information systems and, 195, 354, 397 of internal control-related matters, 204–205 management letter and, 584 purchasing process and, 397 regarding the audit of internal control over financial reporting, 583 required, by SEC, 653 revenue process and, 354 with those charged with governance and management, 582–584

Comparability, changes affecting, 603–604 Comparative financial statements, audit reports on, 611–613 Compensating controls, 224 Compensation, share-based, 440–441 Compensatory damages, 687 Competency, IIA principle of, 729–730 Compilation

compilation and review standards (AICPA), 51 defined, 723, 739 example, 723 of financial statements, 722–724 with full disclosure, 723–724 modifications of, 726 omitting disclosures, 724

Civil liability—Cont Sarbanes-Oxley Public Company Accounting Reform and Investor

Protection Act (2002), 695 SEC and PCAOB sanctions, 696–697 Securities Act (1933), 688–689 Securities and Exchange Act (1934), 689–693 Securities Litigation Uniform Standard Act (1998), 693–694

Clarity standard of ASB, 57 Class action, defined, 676 Class Action Fairness Act (CAFA, 2005), 693–694 Class action lawsuits, 693–694 Classical variables sampling, 270, 290, 328 Classical variables sampling,

substantive tests of account balances using, 321–328 about, 301 advantages of, 324 application of, 324–328 disadvantages of, 324 sample results calculation for, 326–328, 327n16 sample selection for, 325 sample size determination for, 325, 325n15 sampling unit, defining, 324–325

Classification assertion cash and, 533 cash receipts transactions, 359, 361 classes of transactions and events during the period, 133, 355 human resource management process and, 432, 433, 435, 436 intangible assets, 488 inventory management process and, 462, 463, 468, 470 investments and, 544 long-term debt and, 510, 511 prepaid insurance, 484 presentation and disclosure, 133 property, plant, and equipment, 496 purchasing process and, 399–401, 403–405, 407, 410 revenue process, 355, 356, 359, 361, 365, 369 revenue transactions, 358 summary of, 11

Classifications, changes in, 604 Claw-back rule, 695n11 Clean audit opinions, 608 Clean audit report, 21, 21n8, 25 Client acceptance/continuance, 18, 70–71 Client information, confidential, 654–655 Client risk, 101 Client(s)

common law and, 677–680 continuance with, 71 establishing an understanding with, 18, 72–76 negligence suits by, 677–679 prospective, acceptance of, 70–71 responsibilities to, 654–655

Close relatives, 648–649, 661 Closest reasonable estimate, 585 Cloud computing, 734 Coca-Cola, 440 Code of Ethics of IIA, 728–729 Code of Professional Conduct. See also Professional conduct

acts discreditable, 655–656 advertising and other forms of solicitation, 656 of AICPA, 51, 57–59, 70, 72, 636–638, 657 auditor relationship with entity and, 605 commissions and referral fees, 656–657 defined, 59 disciplinary actions, 657 form of organization and name, 657

Final PDF to printer

Index 763

mes32502_idx_757-783.indd 763 10/14/15 08:43 AM

Constructive fraud, 687 Consulting, 730, 734 Consulting services

Continental Vending, 689, 692 Contingent fees, 655 Contingent liabilities, completing the audit engagement for

audit procedures for identifying, 565 defined, 564, 585 legal letters and, 565–567

Contingent liability, 585 Continuance, 18 Contract, breach of. See Breach of contract Contractual basis, 614 Contributory negligence, 679 Control activities

cash disbursement transactions, 402–404 cash receipts transactions, 358–361 defined, 211 internal controls and, 186–188 for inventory transactions, 460–462 for payroll transactions, 431–434 petty cash and, 541–542 purchase return transactions, 404 purchase transactions, 398–401 purchasing process and, 397 revenue process and, 353–354 revenue transactions and, 355–358 sales returns and allowances transactions, 361 types of, 186–187 understanding, 195

Control deficiency defined, 211, 249 in internal control, 205 internal control over financial reporting (ICFR) and, 223, 236–239

Control deviations analyzing, 282–283 conditions, defined, 273 expected population deviation rate and, 275–278 tolerable deviation rate and, 274–275

Control environment control risk assessment and, 353 defined, 211 evaluation of, 230 ICFR and, 231 information systems and, 188–189 internal controls and, 183–185 purchasing process and, 396 understanding, 193–194, 353

Control risk (CR) assessed level of, relating to substantive procedures

human resource management process and, 434 inventory management process and, 462–463 purchasing process and, 404 revenue process and, 362

in audit risk model, 101 defined, 120, 211 purchasing process and, 396–398 revenue process and, 354 setting and documenting

human resource management process and, 431 inventory management process and, 459

Control risk (CR) assessment for business processes income statement accounts, 518 cash and, 532

of prospective financial statements, 720–721 services for, 42

Completeness assertion account balances at the period end, 133 accrued payroll liabilities and, 438 capital-stock accounts and, 515–516 cash and, 533 cash receipts transactions, 359–360 classes of transactions and events during the period, 131–132, 355 data capture controls and, 207 human resource management process and, 432, 435–436, 438 for intangible assets, 487 inventory management process and, 460–461, 463, 468–469 investments and, 544, 546 long-term debt and, 510, 515–516 prepaid insurance, 484 presentation and disclosure, 134 property, plant, and equipment, 494 property management process and, 492 purchasing process and, 399–400, 402–403, 405–409 revenue process and, 355–356, 359–360, 362, 364–366 for revenue transactions, 357 summary, 11

Completing the audit engagement. See Audit engagement, completing Compliance audits, 41 Compliance reports related to audited financial statements, 615–616 Computed upper deviation, calculation of, 283–285, 288–289 Computer-assisted audit techniques (CAATs)

about, 247 custom audit software, 248 defined, 211, 249, 471 generalized audit software and, 247–248 revenue process and, 357 scanning and, 142 test data, 249

Computer-based Uniform CPA Examination, 39 Confidence bounds, 323, 328 Confidence interval, 316n8, 323 Confidence level

audit sampling and, 267 as converse of sampling risk, 264 sample size and, 273–274, 306

Confidentiality IIA principle of, 729 IIA Rules of Conduct, 730 Rules of Conduct on, 654–655 trust services and, 735

CONFIRMTM, 374 Confirmation

for accounts receivable, 371–372 defined, 166, 520, 552 obtaining audit evidence and, 141 sampling and, 268

Confirmation.com, 537 Confirmation process for accounts receivable, 370–374

alternative procedures, 374 confirmation procedures and, 373–374 confirmation types, 371–372 timing and, 372

Confirmation tendency, 754 Conflict of interest, 6, 8–9 Consequentialist theory, 631 Consistency

audit report on financial statements and lack of, 603–604 changes affecting, 603–604 changes not affecting, 604

Final PDF to printer

764 Index

mes32502_idx_757-783.indd 764 10/14/15 08:43 AM

for property, plant, and equipment, 496 purchasing process and, 398–401, 403–404, 407, 409 revenue process and, 355–356, 359, 361, 366–367 revenue transactions, 358 summary of, 11

Cutoff bank statements, 536 Cycle of business, 48–49

Damages under common law, 687–689 punitive, 687–689, 692 under statutory law, 691

Data capture controls, in IT environment, 207–208 Data center controls, in IT environment, 206 Data validation controls, in IT environment, 207–208 Days of inventory on hand ratio, 164 Days outstanding in accounts receivable ratio, 164 DCAA. See Defense Contract Audit Agency (DCAA) Debt to equity ratio, 165 Decision making

assurances and, 13, 710–711 making judgments vs., 749

Deduction authorization form, 425 Defalcation, 110 Defense Contract Audit Agency (DCAA), 40 Defenses, for auditors, 686–687 Deficiencies, 204–205, 211, 223–224, 236–239, 250. See also

specific types Deloitte, Ernst & Young, 43 Deloitte & Touche, 58, 678, 686n7 Derivatives, 508, 520 Design deficiency, 223 Desired confidence level, 274, 290 Detection risk (DR), 101, 120, 306 Deterring and Detecting Financial Reporting Fraud (CAQ report), 753 Development controls, in IT environment, 207 Dickerson v. Ernst & Young, 684n5 Difference estimation, 319–320 Difference projection, 319, 326 Digital Equipment Corporation, 458 Digital format databases, 393 Direct and material effects, 79 Direct deposit records, 426 Direct financial interest, 644, 662 Direction of testing, 139 Direct services, PrimePlus, 738 Direct tests of balance sheet accounts, 518 Disaggregation, 155 Disbursements

human resource management process and, 427–428 purchasing process and, 393–394

Disciplinary actions, AICPA Code of Professional Conduct and, 657 Disclaimer audit reports, 605 Disclaimer for scope limitation, 242 Disclaimer of opinion, 618 Disclosure, footnote, 564 Disclosure assertion

capital-stock accounts and, 516 investments and, 547–548

Disclosure-classification assertion, 510 Disclosure items, for stockholders’ equity, 516 Disclosure(s)

for cash, 542–543 management assertions and, 134–135 omitting in compilations, 724 in property, plant, and equipment, 497

Control risk (CR) assessment—Cont concluding on achieved level of control risk, 200 documenting achieved level of control risk, 200 example of, 200–201 human resource management process and, 430–431 identifying specific controls to be relied upon, 199 for intangible assets, 486 inventory management process and, 457–459 investments and, 543–545 long-term debt and, 509–510 prepaid expenses and, 482–483 property management process and, 491–493 purchasing process and, 396–398 revenue process and, 353–354 stockholder’s equity and, 514–515 tests of controls and, 199–200

Controls of business, 48 monitoring of, 189, 195, 211, 354, 397–398 tests of, 83–84, 199–200

Cookie-cutter lawsuits, 694 Cooley on Torts (Haggard), 677–678 Cooling-off period, 652, 652n13 Cooper, Cynthia, 491, 726 Coopers & Lybrand, 687 Corporate governance, 46, 59, 731 Corroboration, 160 Corruption, 41 Corzine, Jon S., 437 COSO. See Committee of Sponsoring Organizations (COSO) COSO Report, 714–715 Cost accounting, 455 Cost accumulation and variance report, 454 Cost of litigation, 675, 699 Coverage ratios, 165 Covered class action, 694 Covered member, 642, 648, 661–662 CPA (certified public accountant), 38–39, 738 CPA WebTrust, 735–736 Crazy Eddie, Inc., 689, 690 Credit Alliance, 682 Credit Alliance v. Arthur Andersen, 682 Credit approval form, 346–347 Credit authorization, 349 Credit-default swap (CDS), 508 Credit memorandum, 348 Criminal law, defined, 676 Criminal liability, 676, 698–699 Criteria, 714 Critical audit matters (CAM), 616–617 Crossfooting, 365 Cross-referencing, in audit documentation, 150 Cumulative monetary amount sampling, 270n4 Current ratio, 163 Custom audit software, 248 Customer returns, 348 Customer sales order, 347 Customer statement, 347 Cutoff assertion

accrued payroll liabilities and, 438 cash and, 533 cash receipts transactions, 359, 361 classes of transactions and events during the period, 133, 355 human resource management process and, 432, 435–436, 438 inventory management process and, 462, 468–469 long-term debt and, 511

Final PDF to printer

Index 765

mes32502_idx_757-783.indd 765 10/14/15 08:43 AM

inventory management process at, 452–456, 461–463, 469–471 legal letter for, 566–567 long-term debt and, 511–512 management assertions and, 10, 16 materiality and, 88–89 partial working trial balance for, 149 property management process at, 489, 495 purchasing process at, 388–392, 398–401, 406–411 questionnaire for documenting understanding of, 119 questionnaire for documenting understanding of control

environment, 194 representation letter and, 574–575 revenue process at, 342–351 review of subsequent events, 569–570 standard bank confirmation form for, 535 substantive analytical procedures and, 157–158, 161–162 WebTrust criteria for, 736–737

Eastman Kodak Company, 488 Ebbers, Bernie, 491 EDI translator, 393 Effective interest method, 510, 510n1 Effectiveness

of audits, 266 audit testing hierarchy and, 143 operating, 199, 205

Efficiency of audits, 266 audit testing hierarchy and, 143

EFT (electronic funds transfer), 393 8K reports, 51, 688, 689–690 EITF, 52 Electronic accounting records, 135, 374 Electronic bank confirmation, 537 Electronic data interchange (EDI), 211, 734 Electronic forms, 393 Electronic funds transfer (EFT), 393 Electronic (Internet) commerce, 211, 711, 734–739 1136 Tenants v. Rothenberg, 679–680, 722 Elliott Committee, 709–710 Emerging Issues Task Force (EITF; FASB), 52 Emphasis-of-matter paragraph, 602–603, 610 Employment or association with attest client, 646–648 Engagement, 716, 739 Engagement activities, preliminary, 18, 71–77 Engagement and operating characteristics, inherent risk assessment and,

inventory management process and, 457 Engagement completion memorandum, 147 Engagement letter, 72–75, 90, 699 Engagement partner, name disclosure, 617 Engagement quality review, 579, 585 Engagement risk, 102, 120 Enron, 6 Enron scandal, 44, 153, 509, 634, 635, 651, 692, 693, 726 Enterprise Risk Management—Integrated Framework (COSO), 716 Entity. See also Businesses

effect of size on internal controls, 196–197 establishing understanding with, 72–76 industry, regulatory, and other external factors, 108 internal control of, risk assessment and, 109 limitations of, on internal controls, 197–199 multilocation or business unit considerations, 79 nature of, 106–108 nonpublic, 53 objectives, strategies, and related business risks, 108 performance measures, 108–109 privately held, 635–636

of restrictive loan covenants, 514 significant, identification of, 232 tests of details of, 84

Distribution theory, 321–323 Dividend-disbursing agents, 514 Dividends, auditing, 512, 516–517 Documentary evidence, reliability of, 137 Documentation. See also Audit documentation

of achieved level of control risk, 200 in auditing of revenue process, 345–348 of audit of internal control over financial reporting, of auditor, 240 of auditor’s risk assessment and response, 118–119 of audit strategy and audit plan, 81–82 documentary, 137 evidence, related to assertions, 139 of management, ICFR and, 227–228 original, 137 for substantive analytic procedures, 162 of understanding of internal control, 196

Document control risk, purchasing process and, 398 Document flowchart, 209 Document(s)

external, 138–139 inspection of, 139–140 inspection of, sampling and, 268 internal, 138 reliability of, 138–139 turnaround, 208 unused or inapplicable, 282 voided, 281

Dodd-Frank Wall Street Reform and Consumer Protection Act (2010) aiding and abetting under, 692, 692n9 amendments to Sarbanes-Oxley Act, 221 CEO salary disclosure and, 429 inspection findings and, 696 legal basis of, 676 passage of, 44–45 purpose of, 44–45, 674 whistleblowers and, 699

DR (detection risk), 101, 120, 306 Dual dating, 570, 585 Dual-purpose tests, 84, 90 Due diligence, 689 Due professional care, 653, 699 Duncan, David, 651 Dunlap, Al, 367 DuPont, 732–734 Dura Pharmaceuticals v. Broudo, 691

EarthWear Clothiers (example) account analysis working paper for, 150 audit evidence and, 16 audit of internal control over financial reporting and, unqualified

report of, 241–242 audit report issues on financial statements of, 21–22 audit strategy and audit plan documentation for, 82 bank reconciliation working paper for, 534 business processes of, 48–49 control risk assessment and, 193–194 description of, 4 engagement letter and, 72–75 financial ratios and, 162–165 financial statement auditor’s report of, 598–599 financing/investing process at, 483–484, 494–495 human resource management process at, 424, 428, 431, 438, 440 income statement accounts, 519–520

Final PDF to printer

766 Index

mes32502_idx_757-783.indd 766 10/14/15 08:43 AM

Explanatory paragraph, 601–602, 602n1, 610, 618 Extended bank reconciliation procedures, 538 Extent

of audit procedures, 100 defined, 55 of tests of controls, 235–236

External auditors about, 38 audit committee and, 46 interactions between internal auditors and, 732–734

External documents, 138–139 External payroll service providers, 433

Facilitating services, PrimePlus, 738 Factual (known) misstatements, 111, 328 Fair value, 548, 552 Fair value measurements

about, 548–549 evaluating reasonableness of, 551 how they are made, 550 need for specialized skills or knowledge, 550 testing, 550–551

Fair value method, Statement of Financial Accounting No. 123R, Share-Based Payment, 440

False representation, 686 Family relationships, independence and, 648–649 FASAB (Federal Accounting Standards Advisory Board), 654 FASB. See Financial Accounting Standards Board (FASB) Fastow, Andrew, 6, 693 FBI auditors, 40 FCPA (Foreign Corrupt Practices Act, 1977), 688, 697 FDA (Food & Drug Administration), 731 Federal Accounting Standards Advisory Board (FASAB), 654 Federal Bureau of Investigation (FBI), 40 Federal Deposit Insurance Corporation Improvement Act (FDICIA,

1991), 715, 34n4 Federal statutory law, 676. See also Statutory law Fees, contingent, 654–655 Fidelity Investments, 458 Fieldwork, standards of, 715 FIFO cost method, 470 Final analytical procedures, 142, 572 Financial Accounting Standards Board (FASB)

about, 52 Accounting Standards Codification (ASC) (see Accounting

Standards Codification (ASC; FASB)) Emerging Issues Task Force (EITF), 52 materiality defined by, 15 organizations affecting, 50 standards of, 342 Statement of Financial Accounting ASC Topic 718, 440 Statement of Financial Accounting Concepts No. 5, Recognition

and Measurement in Financial Statements of Business Enterprises, 341, 388

Statement of Financial Accounting Concepts No. 6, Elements of Financial Statements, 341, 388

Statement of Financial Accounting No. 123, Share-Based Compensation, 440

Statement of Financial Accounting Standards No. 123R, Share- Based Payment, 440

Financial auditing by internal auditors, 731–732 Financial forecasts and projections

agreed-upon procedures for, 719–721 compilation of, 720–721 defined, 717, 739 examination of, 718–719

Entity—Cont publicly held, 635–636 risk assessment process of, 185–186, 353

Entry-level controls, 225, 231–232, 249 Environmental Protection Agency (EPA), 731 Equity

ratio of debt to, 165 return on, 165

Equity Funding, 698 Ernst & Ernst v. Hochfelder, 691 Ernst & Young, 43, 648n5, 674, 694, 696, 698 Error controls, 209 Error(s)

defined, 110, 120 expected, 267–268 human, internal controls and, 198 most likely error, 310 overstatement, monetary-unit sampling and, 311–312 property management process, 493 spreadsheets, for reconciling accounts and, 463 tolerable, 267–268 types I and II, 266

Escott v. BarChris Construction, 689 ESM Government Securities, Inc., 646, 698 Ethics

assessing compliance with ethical and independence requirements, 72

codes of ethics, of IIA, 728–729 control environment and, 183 defined, 57, 59, 630, 662 example illustrating, 632–634 importance of, illustration of, 634–636 Professional Ethics Executive Committee (PEEC), 636n9, 637 theories of, 631–633

Evaluation, 160 Evaluation, attribute sampling and, 283–287 Evidence regarding management assertions, 16 Ewton, Ronnie, 646 Examination, as attest engagement, 713 Examination of prospective financial statements, 718–719, 739 Exception, 376, 415 Executive compensation, 429–430, 437, 439 Existence assertion

account balances at the period end, 133 accrued payroll liabilities and, 438 human resource management process and, 435–436, 438 intangible assets, 487 inventory management process and, 463, 468–469 investments and, 546 long-term debt and, 511 prepaid insurance, 484 property, plant, and equipment, 496 purchasing process and, 405, 407, 409 revenue process and, 362, 365, 367 summary of, 11

Expectations, substantive analytical procedures and. See Substantive analytical procedures

Expected error, 267–268 Expected misstatement, for monetary-unit sampling, 307, 328 Expected population deviation rate, 275–278, 290 Expense reimbursement schemes, 541 Expenses

accrued, 405 defined, 388 prepaid, 482–483, 498 recognition of, 388

Final PDF to printer

Index 767

mes32502_idx_757-783.indd 767 10/14/15 08:43 AM

examination of, 718–719 types of, 718–719

review of, 724–726 specified elements, accounts, or items of, 615 subsequent events review for audit of, 570–571

Financing/investing process, 480–559 capital-stock accounts and, 515–516 cash and

auditing, 530–531 bank account types, 531–532 control risk assessment and, 532 substantive procedures and, 532–543 substantive tests of details of transactions and balances,

532–533 dividends and, 516–517 income statement accounts

auditing, 517–518 control risk assessment and, 518 substantive analytical procedures and, 518–519, 519n3 substantive procedures and, 518–519

intangible assets and, 484–488 auditing, 484–485 control risk assessment and, 486 inherent risk assessment and, 485–486 substantive procedures and, 486–487

investments auditing, 543 control risk assessment and, 543–545 segregation of duties and, 544–545 substantive procedures and, 545–548

long-term debt and auditing, 508–509 control risk assessment and, 509–510 inherent risk assessment and, 509 substantive procedures and, 511–512

prepaid expenses and, 482–484 control risk assessment and, 482–483 inherent risk assessment and, 482

prepaid insurance and, 483–484 proof of cash and, 538–539 property, plant, and equipment

defined, 498 evaluating audit findings for revenue-related accounts, 497 substantive analytical procedures and, 493 tests of details of classes of transactions, account balances, and

disclosures and, 494–497 property management process and

auditing, 488–489 control risk assessment and, 491–493 inherent risk assessment and, 490–491

retained earnings, 517 stockholders’ equity, 512–515

auditing, 512–513 control risk assessment and, 514–515 segregation of duties and, 515

Financing process, 48. See also Financing/investing process Finished goods stores, 455 Flash 98 scam, 458 Flowcharts

auditor’s consideration of internal control and substantive procedures, 190

documenting understanding of internal control, 196 human resource management process, 424 inventory management process, 453 property management process, 489 purchasing process, 390–391

examples, 719, 721 minimum guidelines for, 718 types of, 717–718

Financial interest, 644, 662 Financial ratios, 162–165. See also specific ratios Financial relationships, independence and, 644–646 Financial reporting

fraudulent, 113–115 internal control over (see Internal control over financial reporting

(ICFR)) period-end, internal control over audit and, 231–232 risks, 225

Financial risks, identification of, management’s assessment of internal control over financial reporting and, 225

Financial statement accounts, purchasing process and, 389–399 Financial statement assertions, 10, 24 Financial statement audit

audit evidence regarding management assertions and, 16 audit risk and, 15–16 materiality and, 14–15 overview of, 14–16

Financial statement auditing auditors for, 44–45 business as context of auditing, 45–46 context of, 45 corporate governance, 46 environment of (see Auditing environment) housing inspection analogy, relating to, 9–10 internal controls and (see Internal control(s)) model of processes, 48–49 objectives, strategies, processes, controls, transactions, and reports

and, 48 process of (see Audit process)

Financial statement audit report(s), 596–626 adverse, 605 changes, projected, 616–617 comparative financial statements, 611–613 conditions requiring other types of, 607–611 departure from GAAP and, 609–610 departures from unqualified/unmodified, 604–607 disclaimer, 605 lack of auditor independence and, 610–611 materiality and, 606–607 other information in documents containing, 613–614 qualified, 605 scope limitation and, 607–609 special reporting issues, 611 special reports relating to, 614–616 standard unqualified/unmodified audit reports and, 598–604

for all entities other than public companies, 599–600 explanatory language added to, 600–604 for public companies, 598–599

types of, other than unqualified/unmodified, 605–606 Financial statement fraud, 41 Financial statement(s)

comparative, financial statement audit reports and, 611–613 components of, 130 fraudulent, 110–111 GAAP conformity, financial statement audit reports and,

609–610 management assertions and, 10–12 presentation and disclosure, 578–579 prospective

agreed-upon procedures for, 719–721 compilation of, 720–721

Final PDF to printer

768 Index

mes32502_idx_757-783.indd 768 10/14/15 08:43 AM

Fraudulent cash disbursements, 541 Fraudulent financial reporting, 113–115 Fraudulent intent, 687 Fred Stern & Company, 681

GAAP. See Generally accepted accounting principles (GAAP) GAAS. See Generally accepted auditing standards (GAAS) GAO (Government Accountability Office), 39–40, 50 GASB (Government Accounting Standards Board), 50, 654 GAS (generalized audit software), 247–248 General cash account, 531, 533–538 General controls

defined, 211, 376, 415, 441, 472 in information processing environment, 187 in IT environment, 206–207

Generalized audit software (GAS), 247–248 General ledger

human resource management process and, 428 inventory management process and, 455 purchasing process and, 394 revenue process and, 350

Generally accepted accounting principles (GAAP) defined, 59 departures from, 605, 609–610, 726

Generally accepted auditing standards (GAAS) about, 53–55 audit conducted in accordance with, principles underlying,

55–56 defined, 53–54, 618, 662, 699 field work standards, 54–55 general standards, 54 interpretation of, 55–57, 59 reporting standards, 55

General standards, 653–654 General use of prospective financial statements, 717 Ghost vendors, 394 Giant Stores, 685 Glover, Steven M., 748 Going concern considerations, 579–582, 602–603, 617 Gomez, Jose, 646 Goodwill, 485, 487 Goodwill impairment losses, 486 Governance, communication with those charged with, 582–584 Government Accountability Office (GAO), 39–40, 50 Government Accounting Standards Board (GASB), 50, 654 Government auditors, 39–40 Grant, Alexander, 646 Grant Thornton, 43, 686n7 Grapevine plaintiffs, 685 Gross negligence

defined, 676, 699 third-party claims and, 686–687

Gross profit percentage ratio, 164 Groupon Inc., 228 Guidance on Monitoring Internal Control Systems (COSO), 189

H. Rosenblum, Inc., 685 Haggard, D., 677n3 Haphazard sample selection, 288 Heading, in audit documentation, 150 Health care performance measurement, 711 HealthSouth Corporation, 698 Held-to-maturity securities, 544 Herzfeld v. Laventhol, 691 Hewlett-Packard, 342 Hierarchy of audit testing, 143–146

Flowcharts—Cont revenue process, 344–346 symbols of, 210 techniques of, 209–210

Food & Drug Administration (FDA), 731 Footing, 365 Footnote disclosure, for a contingency, 564 Forecasts, financial. See Financial forecasts and projections Foreign Corrupt Practices Act (FCPA,1977), 688, 697 Forensic auditors, 40 Forensic audits, 41 Foreseen third-parties or Restatement Standard, 680, 682–684 Formal subsequent-events review, 569–570 Four-column proof of cash, 538 Fox, Brian, 537 Frame, 273, 305 Framework, for professional judgment, 748–756

judgment framing, 752–753 judgment process model, 749–751 mitigating judgment bias effects, 755–756 professional skepticism, 752–753 traps early in process, 750–752 unintentional bias, 753–755

Framework for internal control(s) of COSO components of internal control and, 181–182, 185–187 control activities and, 186–188 control environment and, 183–185 entity’s risk assessment process and, 185–186 information, communication, and, 188–189 monitoring of controls, 189 2013 revision of, 182

Fraud. See also Scienter; specific company names attitudes/rationalization to commit, 112–113 auditing internal control over financial reporting and, 230 auditor liability for, 679 cash, audit procedures related to, 538–541 client claims of, 679–680 common law liability to third parties and, 686–687 common methods, financial statements and, 341 communication about, 119–120 conditions indicative of, 113–115 constructive, 687 control environment and, 186 defined, 110, 120, 676 disbursements and, 394 electronic bank confirmation example, 537 identified using analytic procedures, 158 incentives/pressures to commit, 112–113 inventory, auditor discovery of, 467 inventory scams at Centennial Technologies, 458 misappropriation of assets, 114–115 occupational, 41 opportunities to commit, 112–113 PCAOB sanction of Satyam for, 537 property management process, 493 reasons for occurrence of, 197 risk assessment for, 109–110 risk assessment process for, 111–115 risk of material misstatement (see Risk of material misstatement

(RMM)) risks related to revenue recognition, 341–342 stock-option abuses and, 437 types of, 110 uncovering of, by internal financial audit, 732

Fraud-related audit procedures, 538–541 Fraud risk triangle, 112

Final PDF to printer

Index 769

mes32502_idx_757-783.indd 769 10/14/15 08:43 AM

compilation of financial statements and, 724 control environment and, 184 defined, 59 family relationships and, 648–649 financial relationships and, 644–646 Independence Rule, 641–644 lack of, financial statement audit reports and, 605, 610–611 litigation and, 649 nonattest services and, 649–650 SEC and PCAOB independence requirements for audits of public

companies, 651–653 Independence Standards Board (ISB), 640n10 Independent auditors, 38, 600 Independent engagement quality review, 579 Independent source outside the entity, 136 Indexing, in audit documentation, 150 Indirect financial interest, 645, 662 Individual transactions, 18 Industry Audit and Accounting Guides (AICPA), 52 Industry data, comparisons based on, 157–158 Industry-related factors, inherent risk assessment and

inventory management process and, 456–457 purchasing process and, 396 revenue process and, 351–352

Information, control environment and, 188–189 Information asymmetry, 6, 8, 9, 24 Information processing controls, 187 Information risk, 7 Information system reliability, 711 Information systems

communication and, 195, 354, 397 control environment and, 188–189 purchasing process and, 397 revenue process and, 354

Information technology (IT) controls in environment, types of, 205–209 internal controls and, 181 specialists for, 193, 247

Inherent risk assessment. See also Risk assessment human resource management process and, 429–430 intangible assets and, 485–486 inventory management process and, 456–457 long-term debt and, 509 prepaid expenses and, 482 property management process and, 490–491 purchasing process and, 396 revenue process and, 351–352

Inherent risk (IR), 100, 120 In pari delicto, 679 Inquiry

audit evidence, obtaining, 140–141 defined, 166 in reviews of financial statements, 724–725 in risk assessment process, 105

In re Alexander Grant & Co. Litigation, 698 Inspection

of records or documents, 139–140, 166, 268 in risk assessment process, 105–106 of tangible assets, 139–140, 166, 268

Institute of Internal Auditors (IIA), 727–734 about, 727 attribute standards, 728 Code of Ethics of, 728–729 Control Self-Assessment (CSA) certification, 731 implementation standards of, 728 interactions between internal and external auditors, 732–733

Hobbes, Thomas, 630 Hofmeister, Joseph, 634 Holding out, 662 Honorary director, 648 Houbigant v. Deloitte & Touche, 687 Human errors, 198. See also Error(s) Human resource and compensation-related issues, 652–653 Human resource management process, 423–448

assessed level of control risk related to substantive procedures and, 434

auditing payroll-related accounts and, 434 control activities and tests of controls for payroll transactions,

431–434 control risk assessment and, 430–431 documents and records and, 425–426 evaluating audit findings, payroll-related accounts and, 439–440 financial statement accounts and transactions affected by, 425 flowchart of, 424 functions of, 426–428 inherent risk assessment and, 429–430 model of business processes and, 48 overview of, 424–429 segregation of duties and, 428–429 share-based compensation and, 440–441 substantive analytical procedures and, 434–435 tests of details of classes of transactions, account balances, and

disclosures and, 435–439 Human resources function, 426 Hypothetical assumptions, 717

IAASB (International Auditing and Assurance Standards Board), 52–53, 616–617

IAF (internal audit function), 76–77, 90 IASB (International Accounting Standards Board), 52 ICFR. See Internal control over financial reporting (ICFR) IDEA software, 278n7

computing upper deviation rate with, 284–285 in monetary-unit sampling, 310–311, 311n6 obtaining random numbers from, 280 projected misstatement and upper error limit, 314–316, 316n7 sample size computation using, 307–308 sample size computing with, 278–279, 310 statistical distribution of, 308n4 systematic selection, 280–281

IFAC (International Federation of Accountants), 52 IIA. See Institute of Internal Auditors (IIA) Illegal acts, 59, 79–80, 90 Immediate family, 648, 662 Impairment, 485, 488 Implementation standards of IIA, 728 Imprest account, 541, 552 Imprest cash account, 531 Inapplicable document(s), 282 Incentives/pressures to commit fraud, 112–113 Income statement accounts

auditing, 517–518 control risk assessment and, 518 substantive analytical procedures and, 518–519, 519n3

Incorrect acceptance, risk of, 266, 291, 325n15, 329 Incorrect rejection, risk of, 266, 291, 325n15, 329 Indemnification of auditors, 76 Independence, 641–653

assessing compliance with ethical and independence requirements, 72

assurances and, 13, 710 business relationships and, 646–648

Final PDF to printer

770 Index

mes32502_idx_757-783.indd 770 10/14/15 08:43 AM

communication with those charged with governance about, 582–584

computer-assisted audit techniques, 247–249 deficiencies of, 223–224 defined, 222–223, 249 management’s assessment process and, 225–228 management’s report on, 244–245 other reporting issues, 244–245 safeguarding of assets and, 247 service organizations and, 246 subsequent event review for audit of, 571–572

Internal control questionnaires, 194 Internal control(s), 178–218

auditing accounting applications processed by service organizations and, 203–204

in audit process, 18 collusion, 198–199 communication of matters related to, 204–205 components of, 183, 353–354 conditions for conducting an engagement, 716–717 control activities, revenue process and, 355–358 control revenue process and, 353–354 control types in IT environment, 205–209 COSO framework for, 181–189 defined, 180, 211 effectiveness of, 136–137 entity-level identification of, 231–232 entity’s financial reporting and, 715–717 evaluating design effectiveness of, 234 examination engagement, 716 flowcharting techniques and, 209–210 human errors or mistakes and, 198 information technology’s effect on, 181 management override of, 198 management’s assertion about, 716–717 monitoring, review process and, 354 over financial reporting (see also Internal control over financial

reporting (ICFR)) communication with those charged with governance about,

582–584 subsequent event review for audit of, 571–572

purchasing process and, 396–398 relevant to audit, 180–181 risk assessment and, 109 selecting controls to test and, 233 system of, in businesses, 48 understanding and documenting

human resource management process and, 430–431 inventory management process and, 459

understanding of control activities and, 195 control environment and, 193–194 documenting, 196 entity’s risk assessment process and, 194 entity's size and, 196–197 information system and communications, 195 limitations of internal control, 197–198 monitoring of controls, 195

Internal control(s), framework for. See Framework for internal control(s) of COSO

Internal control systems, 48 Internal documents, 138 Internal Revenue Service (IRS), 39, 41 International Accounting Standards Board (IASB), 52 International Auditing and Assurance Standards Board (IAASB),

52–53, 616–617

Institute of Internal Auditors (IIA)—Cont internal auditors’ roles, 729–732 mission of, 38 performance standards, 728 product offerings of, 732 Rules of Conduct, 730 standards, 727–728

Insurance, prepaid, 483–484 Insurance register, 482 Intangible assets

auditing, 484–485 control risk assessment and, 486 deficiencies in audit of, 487 defined, 484–485, 498 inherent risk assessment and, 485–486 substantive procedures and, 486–487 tests of details of, 487–488

Integrated audit, 41, 44, 59 Integrity

as auditor requirement, 640–641 control environment and, 183 IIA principle of, 729 IIA Rules of Conduct, 730 of spreadsheet generated information, 463

Intellectual property, 110 Intentional acts, 110 Interbank transfer schedule, 540 Interim substantive procedures, 203 Interim tests of controls, 202–203 Internal audit function (IAF), 76–77, 90 Internal auditing, 726–734

code of ethics and, 728–729 defined, 727, 739 IIA rules of conduct, 730 IIA standards for, 727–728 importance of, 727n3 internal and external auditors, interactions, 732–733 product offerings, 732 roles of auditors, 729–732 services provided by (DuPont), 734

Internal Auditing Standards Board (IASB) internal auditors’ roles, 729–732 internal audit product offerings of, 732 standards of, 342

Internal auditors, 13, 38–39, 729–732 Internal control assessment, 734 Internal control audits, 40–41 Internal control education, 734 Internal Control—Integrated Framework (COSO), 225, 227,

714–716, 736 Internal control over financial reporting (ICFR), 220–259. See also

Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act (2002)

additional required communications in audit of, 245–246 audit of

auditor documentation requirements and, 240 evaluating identified control deficiencies and, 236–239 performance of, 229 planning, 229–230 remediation of material weakness and, 239 test design and operating effectiveness of controls and,

234–236 testing controls, 231–233 written representations and, 239–240

auditor documentation requirements, 240 auditor reporting on, 240–245

Final PDF to printer

Index 771

mes32502_idx_757-783.indd 771 10/14/15 08:43 AM

Kmart, 634–635 Kozlowski, Dennis, 6, 430 KPMG, 43, 687, 697, 748 KPMG Professional Judgment Framework, 37, 748–756. See also

Professional judgment framework

Labor costs, 465 Lapping, 360, 376, 539 Laventhol, 691 Laws. See also Common law liability

civil liability and, 688–698 criminal liability and, 698–699 statutory, defined, 675 violation considerations, 79–80

Lay, Kenneth, 693 Lead partner, 652, 652n12 Lead schedule, 494–495 Ledgers

accounts payable subsidiary, 392 accounts receivable subsidiary, 348 general, 350, 394, 428, 455

Legacy systems, 189 Legal letters, contingent liabilities and, 565–567, 585 Legal liability, 672–706

auditor legal liability and, overview of, 675–677 civil, 688–698 common law and, 675–688

to clients, 678–680 damages under, 687–688 defined, 675 fraud and gross negligence, 686–687 overview, 675–676 to third parties, 680–686

criminal, 698–699 historical perspective on, 674–675 legal terms, defined, 676 statutory law and, 675–676 types of, 676

Letters of audit inquiry, 565–567 engagement, 72–75, 90, 699 legal letters, contingent liabilities and, 565–567, 585 to management, 584, 585 representation, 573–575, 585, 618

Levin, 682–683 Liability

accrued payroll, 437–439 defined, 388 joint and several, 688, 693, 699 legal, 672–706 (see also Legal liability) personal, 695 recognition of, 388 unrecorded, search for, 407

Liability recognition, 388 Lien, 482, 498 LIFO cost method, 470 Limited assurance, 724 Liquidity ratios, short-term, 163 Listings, 149 Litigation. See also Legal liability

costs of, 675, 699 independence and, 649 types of, 560

Lockbox system, 350 Logical units, 306, 309, 312 Long-term commitments, 568

International Federation of Accountants (IFAC), 52 International financial crisis of 2007–2009, 44 International Financial Reporting Standards (IFRS; IASB), 52 International Standards for the Professional Practice of Internal

Auditing, 728 International Standards on Auditing (ISA; IAASB), 52, 59 Inventory on hand, days of, 164 Inventory management, 455 Inventory management process, 450–479

auditing inventory and, 463 auditing standard costs and, 465 control activities and tests of controls for inventory transactions,

460–462 control risk assessment and, 457–459 document and record types and, 453–454 evaluating audit findings, inventory and, 471 flowchart of, 453 functions of, 455–456 inherent risk assessment and, 456–457 inventory scams at Centennial Technologies, 458 model of business processes and, 49 observing physical inventory and, 466–467 overview of, 452–456 relating assessed level of control risk to substantive procedures and,

462–463 relationship to other accounting processes, 452 segregation of duties and, 456 substantive analytical procedures and, 464 tests of details of classes of transactions, account balances, and

disclosures and, 467–471 Inventory master file, 454 Inventory status report, 454 Inventory turnover ratio, 164 Inventory write-downs, 457 Inverse relation, between sample size and materiality, 17 Investing process. See Financing/investing process Investments

auditing, 543 control risk assessment and, 543–545 segregation of duties and, 544–545 substantive procedures and, 545–548

Invoice, sales, 347 Invoice processing, 394 IR. See Inherent risk (IR) IRS (Internal Revenue Service), 39, 41 ISB (Independence Standards Board), 640n10 Issuance of stock, 512 Issuing costs, 510

Jobs, Steve, 439 Joint and several liability, 688, 693–694, 699 Journal of Accountancy (AICPA), 52 Journal(s)

payroll, 426 purchases, 392 sales, 347

Judgment, defined, 749 Judgmental misstatements, 111, 120 Judgment framing, 752–753 Judgment traps, 750–752 Junior-level accountants and auditors, 695 Justice-based approach to ethical behavior, 632–633

Key audit matters (KAM), 616–617 Key position, 647, 662 Kiting, 539–540

Final PDF to printer

772 Index

mes32502_idx_757-783.indd 772 10/14/15 08:43 AM

Material weakness adverse report for, 241–243 defined, 211, 249 indicators of, 236–237 internal control over financial reporting (ICFR) and, 205, 223 remediated, reporting on at interim date, 245 remediation of, 239 root cause analysis for, 244

Maxwell v. KPMG, 691 Medtrans, 678 Mergers and acquisitions, 189 MF Global, 437 Microsoft, 457 Mid-tier public accounting firms, 43 Mini-Scribe, 692 Mintz, S. M., 631, 633–634 Misappropriation, 110, 114–115 Misrepresentation, 690–691 Misstatement

causes and types of, 110–111 defined, 24, 110 detected, 311 expected, for monetary-unit sampling, 307, 328 factual (known), 328 likelihood and magnitude of, 223–224 management assertions and, 134–135 material

audit evidence, quality and quantity, 135 root cause analysis for, 244

material risk of (see Risk of material misstatement (RMM)) for monetary-unit sampling

defined, 306 expected, 307 tolerable, 306

overstatement, detected, 312–314 prior audits, detected in

property management process and, 490 purchasing process and, 396 revenue process and, 352

projected, 111, 120, 302, 310, 329 projected, calculation of, 314–316 sources of, 232–233 spreadsheet generated information and, 463 tolerable

defined, 90, 329 determining, in materiality, 87–88 example, 89 for monetary-unit sampling, 306

understatement, effect of, 316–317 upper limit on, calculation of, 310–314

Mistakes, internal control and, 198. See also Error(s) Modified review reports, 726 Monetary-unit sampling (MUS), 303–317

advantages, 301, 304 application, 304–305 audit performance and, 310 basic precision, 310–311 defined, 270, 270n4, 290, 329 disadvantages, 304 evaluation phase, 310–317 example, 310–311 final conclusions, drawing, 314–316 misstatements detected, 311 overstatement misstatements detected, 312–314 performance phase of, 308–310 planning for, 304–308

Long-term debt auditing, 508–509 control risk assessment and, 509–510 inherent risk assessment and, 509 substantive procedures and, 511–512

Loop Corp. v. McIlroy, 684 Loss, 680, 689

Madoff, Bernie, 115, 694 Maintenance controls, in IT environment, 207 Management

auditing internal control over financial reporting and, 225–228, 244–245

communications about fraud and, 119–120 communication with those charged with governance and

management letter and, 584 regarding audit of internal control over financial reporting,

582–583 financial reporting risks and related controls and, 225 fraud and, 112 locations to include in evaluation, 226 override of internal control by, 198 representations made to auditor, 239–240 responsibilities for internal control over financial reporting under

Sarbanes-Oxley Act, 222 Management advisory services (MAS), 42, 59 Management assertions. See also specific assertions

account balances at the period end, 133 categories of, 131–132 by category, 11 classes of transactions and events during the period, 131–132 definitions and summary, by category, 132 for EarthWear's website, 737 evidence regarding, 16 financial statements and, 10–12, 16 presentation and disclosure, 134–135 revenue-related accounts, 362

Management audit, 41 Management letters, 584, 585 Management override, of internal controls, 198 Manufacturing, 455 MAS (management advisory services), 42, 59 Material but indirect effects, 79 Material indirect financial interest, 644 Materiality

about, 85–89 application of, 80–82 assessment of, 85 audit findings, evaluating, 88, 89 defined, 14–15, 24, 618 establishing, 78–79, 86–87 example, 88–89 financial statement audit reports and, 606–607 overall, determining, 88–89 performance materiality, 79n2, 90 planning materiality, 79n2 simple size and, 17 tolerable misstatement, determining, 87–89

Material misstatement. See also Risk of material misstatement (RMM) audit evidence, quality and quantity, 135 root cause analysis for, 244

Material modifications, 724 Material omission or misstatement, 689 Materials costs, standard, 465 Materials requisition, 454 Material uncertainty, 617

Final PDF to printer

Index 773

mes32502_idx_757-783.indd 773 10/14/15 08:43 AM

Observation audit evidence, obtaining, 140 defined, 140, 166 in risk assessment process, 105–106 sampling and, 16–17

Occupational fraud, 41 Occupational Safety and Health Act (OSHA, 1970), 731 Occurrence assertion

capital-stock accounts and, 515–516 cash and, 533 cash receipts transactions, 358–359 classes of transactions and events during the period, 131, 355 data capture controls and, 207 human resource management process and, 432–433, 435, 436 inventory management process and, 460–461, 463, 468 investments, 544, 546 long-term debt, 510–511, 514 presentation and disclosure, 134 property management process, 491–492 purchasing process, 399–400, 402–403, 405, 407 revenue process, 355–357, 362, 365 revenue transactions, 355–357 stockholder’s equity, 514 summary of, 11

Olympus Corporation, 114 Omissions, 690–691 One-tailed test, 325n15 1136 Tenants v. Rothenberg, 679–680, 722 Open-order report, 347 Operating cash flow ratio, 163 Operating effectiveness, 199, 205 Operational auditing, 41, 732 Operation deficiency, 223 Opinions

adverse, 22, 241, 244, 605–606, 618 based in part on report of another auditor, 600–601 clean, 608 disclaimer of, 618 qualified, 618 unqualified/unmodified, 618

Opinion shopping, 58 Oppenheimer Funds, Inc., 458 Opportunities to commit fraud, 112–113 Option grants, 439 Order entry, 349 Ordinary negligence, 676, 680–686, 699 Organizational charts, 196 Organizational form, 657 Organizational name, 657 Organizational structure, control environment and, 183–185 Organizations affecting public accounting profession, 49–52. See also

specific organizations Other assets, 482 Other information, in audit evidence, 135, 166 Other-matter paragraph, 602 Out-of-pocket loss, 692 Output controls, in IT environment, 209 Overall materiality, 88–90 Overconfidence tendency, 754 Overhead costs, 465 Overstatement errors, 303 Ownership of audit documentation, 151

Parked inventory schemes, 342 Parmalat Finanziaria S.p.A., 536, 686n7 Payment of dividends, 512

population characteristics definition and, 305 projected misstatement and upper error limit using IDEA,

314–316 projected misstatement calculation and, 310 sample items selection, 308–310 sample size determination and, 306–308 text objectives determined and, 304, 304n3 understatement misstatements and, 316–317 upper limit misstatement, computing manually, 312–314

Monitoring, of controls, 189, 195, 211, 354, 397–398 Montini, Enio, Jr., 634 Mortgage-backed securities, 508 Most likely error, 310 Multinational corporations, 413–414 Murphy v. BDO Seidman, 685 MUS. See Monetary-unit sampling (MUS) Myers, David, 491

Narrative description, to document understanding of internal control, 196

National Association of State Boards of Accountancy (NASBA), 32n1 National Student Marketing, 689 Nature

of audit evidence, 135 of audit procedures, 100 defined, 55 of testing, 234–235

Nature of entity, 106–108 Nay, Leston, 691 Near privity, 680, 682 Negative assurance, 615 Negative confirmation request, 371–372, 376 Negligence

client claims of, 677–679 common law liability and, 677–679 gross, 676, 686–687, 699 ordinary, 676, 680–686, 699 statute of limitations for claims of, 678n4

Network operations controls. in IT environment, 206 Newby v. Enron, 694 New Century Financial Corporation, 584 New York Stock Exchange (NYSE), internal auditing and, 726–727 Nonattest services, 644, 649–650 Nonaudit services, 42 Nonissuers, 204 Nonpublic entities, 53 Nonresponse, 370, 372, 376 Nonsampling risk, 101, 120, 266, 290, 329 Nonstatistical audit sampling

defined, 289, 329 statistical sampling versus, 287–289 substantive tests of account balances using, 318–321

example of, 320–321 identifying individually significant items, 318 sample items selection, 319 sample results calculated, 319–320 sample size determined, 318–319

for test of controls, 287–288 Normal lending procedures, term, and requirements, 646 Novick, Alan, 646

Objectives of business, 48 risk assessment and, 104

Objectivity, 640–641, 729–730 Obligations assertion. See Rights and obligations assertion

Final PDF to printer

774 Index

mes32502_idx_757-783.indd 774 10/14/15 08:43 AM

Positive confirmation request, 371–372, 376, 415 Practice of public accounting, 662 Practice protection costs, 674 Practitioner, 712 Prawitt, Douglas F., 748 Precision

of an expectation, 154 basic, 310

Preliminary engagement activities, 18, 71–77 Prepaid expenses

auditing, 482 control risk assessment and, 482–483 defined, 498 inherent risk assessment and, 482

Prepaid insurance assertions for, 484 substantive analytical procedures and, 483 substantive procedures for, 483–484 tests of details, 484

Presentation, management assertions and, 134–135 Presentation and disclosure, 438–439 Presentation disclosure assertions, 410 PricewaterhouseCoopers International Limited, 537, 679, 686, 697 PricewaterhouseCoopers (PwC), 43 PrimePlus©, 41–42, 711, 738 Principal–agent relationship, 6–7 Principal auditor, 600 Principals, 5–6 Principles of Professional Conduct of AICPA, 638 Principles underlying an audit performed in accordance with GAAS, 59 Principles Underlying an Audit Performed in Accordance with GAAS,

55–56 Privacy, trust services and, 735 Privately held entity, 635–636 Private Securities Litigation Reform Act (1995), 688, 693–694 Privity, 676, 680, 681–682, 699 Privity doctrine, 681 Privity test, 685 Probability-proportional-to-size sampling, 270n4, 308–309, 318 Procedure, defined, 188 Procedures manuals, 196 Process audits, 734 Processes, of business. See Business processes Processing controls, in IT environment, 208–209 Processing integrity, trust services and, 735 Product costs, 388 Production data information, 454 Production schedule, 454 Professional competence, 653 Professional conduct

code of, 638 (see also Code of Professional Conduct) principles of, 638 rules of, 639–640

Professional Ethics Executive Committee (PEEC), 636n9, 637 Professionalism

AICPA Code of Professional Conduct and, 636–640 disciplinary actions for violation of, 657

AICPA Rules of Conduct and (see Rules of Conduct of AICPA) defined, 57, 630–631, 662 importance of, illustration of, 634–635 independence and (see Independence) standards for, 635–636

Professional judgment, 85 Professional judgment framework, 748–756

judgment framing, 752–753 judgment process model, 749–751

Payroll accounts audit findings and, 439–440 auditing, 434, 541 expense accounts, 435–436

Payroll checks, 426 Payroll expense accounts, 435–436 Payroll expenses, accrued, 434 Payroll journal, 426 Payroll liabilities, accrued, 437–439 Payroll master file, 426 Payroll master file changes report, 426 Payroll processing, 427 Payroll register, 426 Payroll-related accounts, auditing, 434 Payroll schemes, 541 Payroll service providers, 433 Payroll transactions, control activities and tests of controls, 431–434 PCAOB. See Public Company Accounting Oversight

Board (PCAOB) Peer Review Program (PRP) of AICPA, 658 PeopleSoft, 696 Peregrine Financial Group, Inc., 537 Performance of attribute sampling, 280–283 Performance audit, 41 Performance materiality, 79n2, 85, 90 Performance reviews, 186–187 Performance standards of IIA, 728–729 Period costs, 388 Period-end financial reporting process, 231–232 Periodic payroll reports, 426 Period of the professional engagement, 662 Personal liability, 695 Personnel records, 425 Pervasive effects on financial statements, 606 Petty cash fund, auditing, 541–542 PFGBest, 537 Phar-Mor, 457, 692 Phar-Mor v. Coopers & Lybrand, 687 Philips Electronics, 458 Physical controls, 187 Physical inventory, 466–467 Pickard, Irving, 115 Pinez, Emanuel, 458 Planned level of audit risk, 102 Planning, of attribute sampling, 271–279 Planning audits

about, 20 audit evidence and, 147 audit plan and strategy, 78 considering value-added services, 81 documenting, 81–82 general standards rule for, 653 identifying related parties, 80–81 preparing program, 81–82 strategy for, 189–192

Planning materiality, 79n2, 90 Planning services, 42 Poisson distribution, 311n6 Policy, defined, 188 Ponzi scheme, 115, 694 Population

for monetary-unit sampling, 305 sample size and, 278–279, 289–290 size of, monetary-unit sampling and, 307

Population characteristics attribute sampling and, 272–273 monetary-unit sampling and, 305

Final PDF to printer

Index 775

mes32502_idx_757-783.indd 775 10/14/15 08:43 AM

sanctions under, 696–697 Sarbanes-Oxley Act and, 44, 695 substantive analytic procedures, criticism of, 519n3 tolerable differences and, 159 unqualified audit reports, 598–599

Publicly held entity, 635–636 Punitive damages, 687–689, 692 Purchase order, 392 Purchase requisition, 391 Purchases journal, 392 Purchasing, 393–394 Purchasing process, 386–421

accounts payable confirmations and, 411–412 assessed level of control risk related to substantive procedures and,

404 auditing accounts payable and accrued expenses, 405 control activities and tests of controls

for cash disbursement transactions, 402–404 for purchase return transactions, 404 for purchase transactions, 398–401

control risk assessment and, 396–398 documents and records and, 390–393 evaluating audit findings and, 412 expense and liability recognition and, 388 financial statement accounts affected by, 389–399 flowcharts of, 390–391 functions of, 393–394 inherent risk assessment and, 396 model of business processes and, 48 overview of, 388–395 segregation of duties and, 395 substantive analytical procedures and, 405–406 tests of details of classes of transactions, account balances, and

disclosures and, 406–410 transaction types affected by, 389–399

Qualified audit reports, 605 Qualified opinion, 618 Qualitative approach to audit risk model, 103 Quality, of audit evidence, 135 Quality control and peer review standards (AICPA), 51 Quality control standards, 658–661

elements of, 659–661 system of, 659

Quality of information, assurances and, 13, 710 Quantification, 160 Quantity, of audit evidence, 135 Questionnaire for internal control, 193–194, 193n4, 196 Quick ratio, 163

Racketeer Influenced and Corrupt Organizations Act (RICO, 1970), 688, 698

Random-number selection, 280–281 Ratio analysis, 154 Ratio projection, 319 Raw materials stores, 455 Reasonable assurance, 15, 24, 222, 618, 699, 739 Reasonableness analysis, 154 Reasonable person, 677 Reasonably foreseeable third parties, 680, 684–686 Recalculation, for obtaining audit evidence, 141, 166 Receivables. See Accounts receivable Receivables turnover ratio, 164 Receiving, 394 Receiving report, 392, 454 Reclassification entries, 149

mitigating judgment bias effects, 755–756 professional skepticism, 752–753 traps early in process, 750–752 unintentional bias, 753–755

Professional services, 13, 651, 710 Professional skepticism, 45, 111, 699, 752–753 Profitability ratios, 164–165 Profit margin ratio, 164–165 Program flowchart, 209 Projected misstatements

calculating, 302, 310, 314–316 defined, 111, 120, 329

Projections, financial. See Financial forecasts and projections Proof of cash, 538–539, 552 Property, plant, and equipment

defined, 498 evaluating audit findings for revenue-related accounts, 497 substantive analytical procedures and, 493 tests of details of classes of transactions, account balances, and

disclosures and, 494–497 Property management process

auditing, 488–489 control risk assessment and, 491–493 flowchart of, 489 inherent risk assessment and, 490–493 occurrence and authorization and, 491–492 overview of, 489 segregation of duties and, 492–493 transaction types, 488

Proportionate liability, 693 Prospective client acceptance, 70–71 Prospective financial statements

agreed-upon procedures, 719–720 compilation of, 720–721 examination of, 718–719 minimum guidelines for, 718 types of, 717–718

Public accounting firms. See also Big 4 public accounting firms defined, 59 inspections of, 661 organizations affecting, 49–52

Public companies defined, 6 SEC and PCAOB independence requirements for audits of, 53,

651–653 standard unqualified audit report for, 598–599

Public Company Accounting Oversight Board (PCAOB) about, 50–51 audit deficiencies identified by, 370 Auditing Standard 3, Audit Documentation (AS3), 147–148, 579 Auditing Standard 5, An Audit of Internal Control Over Financial

Reporting That Is Integrated with An Audit of Financial Statements (AS5), 221–224, 229–230, 235–236, 423, 431, 491, 571, 583

Auditing Standard No. 11, Consideration of Materiality in Planning and Performing an Audit, 85

auditing standards and, 53, 59 authority of, 44, 53 changes to standards of, 616–617 fraud and, 537 independence requirements of, 651–653 inspections of registered public accounting firms, 658, 661 inspection teams from, 159, 160 professionalism and, 635–636 public entities, understanding, 107–108 role of, 53

Final PDF to printer

776 Index

mes32502_idx_757-783.indd 776 10/14/15 08:43 AM

Restatement standard, 680, 682–684 Retained earnings, 517 Retention, of audit documentation, 151–152 Retrospective application, for account changes and corrections, 604 Return on assets ratio, 165 Return on equity ratio, 165 Revenue process, auditing of, 338–384

assessed level of control risk related to substantive procedures and, 362

auditing revenue-related accounts and, 362 business overview, 339–340 confirmation process for accounts receivable, 370–374

alternative procedures and, 374 confirmation procedures and, 373–374 confirmation types, 371–372 timing and, 372

control activities and tests of controls for cash receipts transactions, 358–361 for revenue transactions, 355–358 for sales returns and allowances transactions, 361

control risk assessment and, 353–354 document and record types and, 345–346 evaluating audit findings for revenue-related accounts, 375 financial statement accounts affected by, 343–345 functions of, 349–350 inherent risk assessment and, 351–352 other auditing receivables, 374–375 overview of, 343–344 revenue recognition and, 341–342 segregation of duties and, 350–351 substantive analytical procedures and, 363–364 tests of controls and, 355–358 tests of details of classes of transactions, account balances, and

disclosures and, 364–369 classification and, 369 completeness and, 364–366 cutoff and, 366–367 existence and, 367 other presentation and disclosure assertions and, 369 rights and obligations and, 367–368 valuation and allocation and, 368–369

transaction types processed through, 343–344 Revenue process, model of business processes and, 49 Revenue recognition

complexity and contentiousness of, 352 fraud risks related to, 341–342

Reves v. Ernst & Young, 698 Review, defined, 724 Review engagement, as attest engagement, 713 Reviewing compliance, 731 Review of financial statements, 724–725, 739 Review report, 725–726 Review services, 42 RICO. See Racketeer Influenced and Corrupt Organizations Act

(RICO, 1970) Rights and obligations assertion

account balances at the period end, 133 human resource management process and, 435 intangible assets, 488 inventory management process and, 463, 468–469 investments and, 546 long-term debt and, 511 prepaid insurance, 484 presentation and disclosure, 134 property, plant, and equipment, 496 purchasing process and, 405, 407, 409

Reclassifications, changes in, 604 Record inspection, sampling and, 268 Record(s)

in auditing of revenue process, 345–348 defined, 135, 165 electronic, 135 inspection of, 139–140 reliability of, 138–139

Referral fees, 656–657 Register disbursement schemes, 541 Registrars, 514 Regulations, violation considerations, 79–80 Regulatory basis, 614 Reisman v. KPMG, 687 Related parties, identifying, 80–81 Related-party transactions, 342 Relevance

assurances and, 13 of audit evidence, 136, 166 defined, 16

Relevant assertion, 232, 249 Reliability

of audit evidence, 16, 136–137, 166 defined, 166 of internal audit function, 77 of records or documents, 138–139 of spreadsheet generated information, 463 of types of evidence, 142–143

Reliance audit strategy, 192, 211 Reliance on financial statements, 690–691 Reliance strategy

defined, 376, 415, 441, 472, 520, 552 internal control, understanding and documenting, 353, 396–397

Remediation defined, 249 of material weakness, 239

Remittance advice, 348 Reperformance, 142, 166, 268 Reporting

defined, 25 standards of, 715

Report(s). See also Audit report(s); Financial reporting; Financial statement(s); Internal control over financial reporting (ICFR)

adverse, 605 of another auditor, opinions based in part on, 600–601 of business, 48 compliance, related to audited financial statements, 616 COSO, 714–715 cost accumulation and variance, 454 disclaimer, 605 disclaimer for scope limitation and, 242 inventory status, 454 open-order, 347 payroll, periodic, 426 payroll master file changes, 426 receiving, 392, 454 review, 725 tax, 426

Representation letter, 573–575, 585, 618 Representative sample, 266, 291 Repurchase of stock, 512 Requisitioning, 393 Research In Motion, 488 Responsibilities

assignment to, control environment and, 184 to clients, 654–655

Final PDF to printer

Index 777

mes32502_idx_757-783.indd 777 10/14/15 08:43 AM

integrity, 640–641 objectivity, 640–641 organizational form and name, 657 overview of part 1, 639 responsibilities to clients, 654–655

Rusch Factors, Inc., 682–683 Rusch Factors doctrine, 683, 684 Rusch Factors v. Levin, 682–683

Safeguarding of assets, 247, 250 Safe harbor, 693 St. Jude Management Corp., 458 Salary authorizations, 425 Sales invoice, 347 Sales journal, 347 Sales returns and allowances transaction, control activities and tests of

controls, 361 Sample deviation, calculation of, 283–285 Sample selection

for classical variables sampling, 325 haphazard, 288 for monetary-unit sampling, 308–310 for nonstatistical sampling, 319 random-number, 280 systematic, 280–281

Sample size for classical variables sampling, 325 computing with attribute-sampling tables, 307 computing with IDEA software, 278–279, 307–308 inverse relation between materiality and, 17 for monetary-unit sampling, 306–308 for nonstatistical sampling, determining, 288, 318–319 population size and, 278–279, 289–290 for statistical sampling, determining, 273–279, 287–288

Sampling inferences based on limited observations and, 16–17 for substantive tests of details of account balances, 302–303

Sampling population, defined, 272–273 Sampling risk, 264, 265–267, 291, 329 Sampling units

for classical variables sampling, 324–325 defined, 273, 291, 329 for monetary-unit sampling, 305–306

Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act (2002)

about, 695 audit committee under, 46, 77 audit document retention under, 151–152 on audit file archiving and retention, 579 auditor responsibilities for internal control over financial reporting

under, 222 as basis of legal liability for auditors, 688 CEO and CFO requirements by, 45 certifications required by, 731 communication of internal control-related matters, 204 criminal provisions of, 698–699 entity’s internal controls and, 715 financial reports and, 573 impermissible services and, 651 independence restrictions and, 651 internal audit functions and, 726–727 internal control audits under, 40–41 investigative and disciplinary authority granted to PCAOB, 696 legal basis of, 676 loans to executives under, 430 management advisory services (MAS) and, 42

revenue process and, 362, 365, 367–368 summary of, 11

Rights-based approach to ethical behavior, 631–633 Riker, Jerome, 680 Risk assessment, 98–127

as assurance service, 711 auditing internal control over financial reporting and, 230 auditor’s response to results of, 115–117 communications about fraud and, 119–120 of control risk (see Control risk (CR) assessment) defined, 121 documentation of, 118–119 evaluation of audit test results and, 117–118 of inherent risk (see Inherent risk assessment) by internal auditors, 731 procedures for, 83, 138, 142

Risk assessment process assessing business risks, 78, 104, 106–109 auditor’s risk assessment procedures, 105–106 control environment and, 189–191 defined, 739 evaluation of entity’s process, 109 management’s strategies, objectives, and business risks, 104 overview of, 107 procedures for, 106–109 risk of material misstatement, 109–115 understanding, internal controls and, 194

Risk of incorrect acceptance, 266, 291, 325n15, 329 Risk of incorrect rejection, 266, 291, 325n15, 329 Risk of material misstatement (RMM)

assessment of, 109–115 business risk and, 106 causes and types of misstatements, 110–111 conditions indicative of fraud and fraud risk factors, 113–115 defined, 25, 101, 121 entity’s risk assessment process and, 109 fraud risk assessment process, 111–115 preliminary engagement activities and, 19 process of responding to, 116

Risk(s) audit, defined, 15–16, 24, 100, 101–104 audit risk model and, 101–104 business, assessment of, 78, 104, 106–109 business, risk of material misstatement, 106 control (see Control risk (CR); Control risk (CR) assessment) detection, 101 evaluating, 731 financial, 225 information, 7 inherent, 100 (see also Inherent risk assessment) of material misstatement (see Risk of material misstatement

(RMM)) nonsampling, 101, 120, 266, 290, 329 sampling, 264, 265–267, 291, 329

RMM. See Risk of material misstatement (RMM) Root cause analysis, 244 Rosenblum v. Adler, 684–685, 684n5, 685 RSM McGladrey, 43 Rule 203 exception, 602n1 Rules of Conduct of AICPA, 639–658

Final PDF to printer

778 Index

mes32502_idx_757-783.indd 778 10/14/15 08:43 AM

revenue process and, 350–351 stockholder’s equity and, 515

Seidman & Seidman, 679 Self-assessment, 734 Senate Banking Hearings of 1933, 58 Service Organization Control (SOC) reports, 204, 204n5, 427n1, 735 Service organizations

auditing accounting applications processed by, 203–204 for audit of internal control over financial reporting, 246–247

Services, 710, 739 Set control risk, purchasing process and, 398 S-forms, 688 Share-based compensation, 440–441 Sharp Electronics Corp., 458 Shipping, 349 Shipping documents, 347 Shipping orders, 454 Short-term liquidity ratios, 163 Side agreements, 341 Siemens AG, 697 Significant account or disclosure, 232, 250 Significant deficiency, 205, 211, 223, 250 Significant risk, 121 Skepticism, professional, 111, 699 Skilling, Jeffrey, 693 Skimming, 539 SOC 1, 2 and 3 reports. See Service Organization Control (SOC) reports Software. See also ACLTM software; IDEA software

custom audit, 248 generalized audit, 247–248 systems software controls in IT environment and, 206 test data and, 249

Solicitation, 656 SOX. See Sarbanes-Oxley Public Company Accounting Reform and

Investor Protection Act (2002) Special Committee on Assurance Services of AICPA, 709–710 Special investigation, 734 Special issues reporting, 611 Specialist(s)

assessing need for, 79 auditor, 498 information technology (IT), 193, 247

Special purpose entities (SPE), 509, 693 Special purpose financial statements, 614–615, 618 Special reports to financial statements, 614–616 SPE (Special purpose entities), 509, 693 Spreadsheets, for reconciling accounts, 463 SQCS (Statement on Quality Control Standards) No. 8, A Firm’s

System of Quality Control, 659–661 SSAEs (Statements on Standards for Attestation Engagements), 712 SSARS (Statements on Standards for Accounting and Review Services),

679 Staff Accounting Bulletin No. 108, Considering the Effects of Prior

Year Misstatements When Quantifying Misstatements in Current Year Financial Statements (SAB 108), 578

Standard bank confirmation, 533 Standard bank confirmation form, 534–536 Standard costs, 465, 472 Standard examination reports, 719 Standard for Attestation Engagements (SSAE), 711–712 Standard Form to Confirm Account Balance Information with Financial

Institutions, 535 Standard review reports, 725 Standard(s). See also Auditing standards

attestation, 713–715 elements of quality control and, 659–661

Sarbanes-Oxley Public Company Accounting Reform and Investor Protection Act (2002)—Cont

management responsibilities for internal control over financial reporting under, 221

material weakness and, 243 nonaudit services and, 42 passage of, 3, 44 PCAOB and, 51, 53 (see also Public Company Accounting

Oversight Board (PCAOB)) provisions of, 44 purpose of, 674 reform by, 44 SEC and, 51 Section 302, 731 Section 404, 221, 222, 243, 731 setting and enforcing of standards by, 44 statute of limitation for actions under Section 10(b), 692

SAS (Statements on Auditing Standards), 55–57, 59, 204n5, 427n1. (See also Auditing Standards (ASs) [PCAOB]; Auditing Standards (AUs))

Satyam Computer Services Ltd., 537, 686 Scaling the audit, 230 Scanning, for obtaining audit evidence, 142, 166 Scienter, 676, 687, 691, 694, 699 Scienter pleading in the WorldCom case, 691 Scope

defined, 55, 100, 121 limitation of, 242, 607–609, 618

financial statement audit reports and, 605, 607–608 Search for unrecorded liabilities, 408 Sears Holding Company, 634 SEC. See Securities and Exchange Commission (SEC) SEC v. Owens, 698 SEC Staff Accounting Bulletin No. 108, Considering the Effects of

Prior Year Misstatements When Quantifying Misstatements in Current Year Financial Statements (SAB 108), 578

Securities Act (1933), 51, 676, 688–690 Securities and Exchange Commission (SEC)

about, 50–51 aiding and abetting claims against auditors, 692n9 auditor indemnification and, 76 CEO salary disclosure and, 429 claw-back rule, 695n11 clean audit opinions, requirements for, 608 Enron investigation, 44 independence requirements of, 651–653 SAB No. 101, 341 sanctions, 696–697 Staff Accounting Bulletin No. 108, Considering the Effects

of Prior Year Misstatements When Quantifying Misstatements in Current Year Financial Statements (SAB 108), 578

stock-option abuses, investigating, 439 Securities Exchange Act (1934), 51, 676, 688–693, 697 Securities Litigation Uniform Standards Act (1998), 688, 693–694 Security, defined, 688n8 Security, trust services and, 735 Security controls, in IT environment, 206 Security of information, 734–735 Segregation of duties

control activities and, 187 human resource management process and, 428–429 inventory management process and, 456 investments and, 545 property management process and, 492–493 purchasing process and, 395

Final PDF to printer

Index 779

mes32502_idx_757-783.indd 779 10/14/15 08:43 AM

revenue process and, 363–364 tolerable difference, defining, 159–160

Substantive audit strategy, 191–192 Substantive procedures

cash and, 532–543 defined, 90 income statement accounts and, 518–519 for intangible assets, 486–487 interim, 203 internal controls and, 190, 201–202 investments and, 545–548 long-term debt and, 511–512 for prepaid insurance, 483–484 for property, plant, and equipment, 494–497 property management process and, 494–497 purpose of, 84, 138 relating assessed level of control risk to (see Control risk (CR))

Substantive strategy, 211 Substantive tests of account balances, audit sampling and, 300–336

classical variables sampling, 321–328 about, 301 advantages of, 324 application of, 324–328 disadvantages of, 324 sample results calculation for, 326–328, 327n16 sample selection for, 325 sample size determination for, 325, 325n15 sampling unit definition for, 324–325

monetary-unit sampling (MUS), 303–317 advantages of, 304 application of, 304–305 audit performance and, 310 basic precision, 310–311 disadvantages of, 304 drawing of final conclusions, 314–316 evaluation phase of, 310–317 example, 310–311 misstatements detected, 311 overstatement misstatements detected, 312–314 performance phase of, 308–310 planning for, 304–308 population characteristics definition and, 305 projected misstatement and upper error limit using IDEA,

nonstatistical audit sampling, 318–321 example of, 320–321 identifying individually significant items, 318 sample items selection, 319 sample results calculated, 319–320 sample size determined, 318–319

Substantive tests of transactions cash and, 532–533 defined, 84, 90, 376, 415, 441, 472, 498, 552 stored data and, 191

Sufficiency of audit evidence, 16, 135–136 defined, 135

Sufficient relevant data, 653 Sullivan, Scott, 491 Summary of significant assumptions, 720

of fieldwork, 715 of IIA, 727–728 of PCAOB, 59 quality control, 658–661 reporting, 715 restatement, 682–684 system of quality control and, 659

State Boards of Accountancy, 52 Statement on Quality Control Standards (SQCS) No. 8, A Firm’s

System of Quality Control, 659–661 Statements on Auditing Standards (SAS), 55–57, 59, 204n5, 427n1.

See also Auditing Standards (ASs) [PCAOB]; Auditing Standards (AUs)

Statements on Standards for Accounting and Review Services (SSARS), 679, 722

Statements on Standards for Attestation Engagements (SSAEs), 712, 736

State Street Trust v. Ernst, 687 Statistical sampling. See also Attribute sampling

defined, 291, 329 nonstatistical sampling versus, 269–270

Statistical sampling techniques attribute sampling, 270 classical variables sampling, 270 monetary-unit sampling, 270

Statute of limitations, for negligence claims, 678n4 Statutory law

civil liability and, 688–698 criminal liability and, 698–699 defined, 675

Stewardship, 6 Stockholders, 6 Stockholders’ equity, 512–515

auditing, 512–513 control risk assessment and, 514–515 segregation of duties and, 515

Stock-option abuses, investigating, 439 Stocks, 6, 512 Stoneridge Investment v. Scientific-Atlanta, 674, 692 Strategies of business, 48 Subject matter of attest engagement, 712 Subsequent event, 585 Subsequent events review

for audit of financial statements, 568–571 for audit of internal control over financial reporting, 571–572

Substantive analytical procedures, 154–162 cash and, 532–543 comparing expectation to recorded amount, 160 decision process of auditor for, 155 defined, 84, 142 developing expectations, 154 documentation requirements for, 162 example, 161–162 examples of expectations formed by, 156–159 final, 162 human resource management process and, 434–435 for income statement accounts, 518–519 for intangible assets, 486 inventory management process and, 464 investigating differences greater than tolerable difference, 160–161 investigation of differences for analytical procedures, 160–162 investments and, 545 long-term debt and, 511–512 for prepaid insurance, 483 purchasing process and, 405–406 purposes of, 84

Final PDF to printer

780 Index

mes32502_idx_757-783.indd 780 10/14/15 08:43 AM

Third parties, common law liability to, 680–688 damages under common law and, 687–688 fraud and, 686–687 gross negligence and, 686–687 ordinary negligence and, 680–686

Tick marks, in audit documentation, 150 Time cards, 425–426 Timekeeping, human resource management process and, 427 Timeliness, 13 Time sheets, 425–426 Times interest earned ratio, 165 Timing

accounts receivable confirmation, 372 of audit procedures, 100, 202–203 defined, 55 of tests of controls, 235

Timing differences, 372, 413 Timm, Schmidt & Company, 684 Tocchet v. Cater, 684 Tolerable deviation rate, 274–275, 291 Tolerable differences, 159–160. See also Substantive analytical

procedures Tolerable error, 267–268 Tolerable misstatement

defined, 90, 329 determining, in materiality, 87–88 example, 89 for monetary-unit sampling, 306

Top-down, risk-based approach, to identify controls to test, 231–233 Tort, 676–677, 699 Touche, Niven & Company, 681 Touche Ross & Co., 684–685 Tracing, 139 Trade loading, 341 Trading securities, 544 Transaction cycles, 130 Transactions

account balances and, 18 of business, 48 difficult to audit, 352 management assertions about classes of, 131–132 substantive tests of, 84

Transfer agents, 514 Travelers v. Reznick, 684 Treadway Commission, 227, 714–715 Trend analysis, 154 Trends, plotting, 158 Trial balance, working, 149 Troubled Asset Relief Program (TARP), 508 Trust services, 734–738 Turnaround documents, 208 Tyco Inc., 6 Tyco International Ltd., 430, 691–692 Type 1 and Type 2 (SOC) reports, 204, 427n1 Types I and II errors, 266 Types I and II subsequent events, 568–569

Ultramares Corporation, 682 Ultramares doctrine, 681–683, 685 Ultramares v. Touche, 681–682, 685 Unaudited financial statements, 722 Understandability assertion

human resource management process and, 435–436 inventory management process and, 463, 468, 470 investments and, 546 presentation and disclosure, 134

Sunbeam Corporation, 367, 635, 696 Supervision, 83, 147, 653 Supervision, human resource management process and, 427 Swartz, Mark, 430 Sweep account cash management strategy, 532 Symbols, in flowcharts, 209–210 Systematic errors, 375 Systematic selection, 280 System implementation review, 734 System reviews, 659 Systems flowchart, 209 Systems software controls, in IT environment, 206

Tangible assets, inspection of, 139–140, 268 Tanzi, Calisto, 536 Tax Advisor (AICPA), 52 Tax basis, 614 Tax preparation services, 42 Tax provision and related balance sheet accounts, 412–414 Tax reports and forms, 426 Teams for auditing

fraud risk assessment process and, 111–115 responsibilities of members of, 43

Tellabs v. Makor, 694 Templates, 147 Temporary differences, 413 10K reports, 51, 688, 689–690 10Q reports, 51, 688, 689–690 Test data, for computer-assisted audits, 249 Tests of bank reconciliation, 537–538 Tests of controls

about, 83–84 attribute sampling applied to, 271–287 for cash disbursement transactions, 402–404 cash receipts transactions and, 35–361 for control risk assessment, 199–200 defined, 90, 138, 376, 415, 441, 472, 498, 520, 552 human resource management process and, 431 interim, 202–203 for inventory transactions, 460–462 operating effectiveness of, 234–236 for payroll transactions, 431–434 for purchase return transactions, 404 for purchase transactions, 398–401 purchasing process and, 398 revenue process and, 355–358 (see also Revenue process,

auditing of) revenue transactions, 355–358 sales returns and allowances transactions, 361 substantive tests and, 191

Tests of details of account balances, sampling for, 302–303 of account balances and disclosures, 84, 376, 415, 441, 498,

520, 552 applying for audit sampling, 305 of classes of transactions, account balances, and disclosures,

364–369, 406–410, 435–439, 467–471 defined, 90 of intangible assets, 487 investments and, 546–548 of prepaid insurance, 484 for property, plant, and equipment, 494–497 of transactions, account balances, and disclosures, 494–497 of transactions and balances, cash, 533 types of, 84

Tests of selected account balances, 513

Final PDF to printer

Index 781

mes32502_idx_757-783.indd 781 10/14/15 08:43 AM

Value-added services, 81 Variable Interest Entities (VIEs), 509 Vendor invoice, 392 Vendor statement, 392 Voided document(s), 281 Voucher, 392 Voucher packet, 392 Voucher register, 392 Vouching, 139

Wage-rate authorizations, 425 Walkthrough

control activities and, 195 defined, 211, 250, 376, 415 internal control and, 354 internal control over financial reporting and, 233 tax provision audits and, 414

Wasendorf, Russell, 537 Waste Management, 491, 635, 696 WebTrust, 735–737 Western SEC Bank v. Eide Bailly, 684 W-4 forms, 425, 426 Whistleblowers, 699 Wildman Award, 748 Woodford, Michael, 114 Working papers. See also Audit documentation

bank reconciliation, 534 content of, 146–147 defined, 166, 585 example, 150, 576–577 review, 147, 573 sample, 283, 366, 483

Working trial balance, 149 WorldCom fraud, 388, 491, 692, 726

WorldCom, Inc. Sec. Litig., 691–692 Write-downs, 457 Write-off authorization, 348 Written representations, 239–240

Xerion v. Resurgence, 694 Xerox Corporation, 458

Zero-balance confirmation, 411, 415 Zero compensation expense, 440

purchasing process and, 405, 407, 410 revenue process and, 362, 365 summary of, 11

Uniform Certified Public Accountant Examination (AICPA), 38–39 Uniform CFE Examination, 40 Uniform CPA Examination (AICPA), 38, 52 Unintentional misstatements, 110 United States v. Benjamin, 698 United States v. Natelli, 689 United States v. Simon, 689 United States v. Weiner, 698 Unqualified/unmodified audit report

of audit of internal control over financial reporting, 241–243 in audit process, 21–22, 21n8 defined, 25 departures from, 604–607 financial statement audits and, 598–600 types of reports other than, 605–606

Unqualified/unmodified opinion, departures from, 618 Unused or inapplicable document(s), 282 Upper deviation rate, 285, 288–289 Upper error limit, 310 Upper-limit approach, 283–285 Upper misstatement limit, 312–313, 329 U.S. Justice Department, 693, 697 U.S. Treasury Department, 39 Utilitarianism, 631 Utilitarian theory of ethical behavior, 631, 633

Valuation assertion account balances at the period end, 133 capital-stock accounts and, 516 cash and, 533 human resource management process and, 435–436, 438 for intangible assets, 487 inventory management process and, 463, 468–470 investments and, 547 long-term debt and, 510–511, 515 for prepaid insurance, 484 presentation and disclosure, 134–135 for property, plant, and equipment, 496–497 purchasing process and, 405, 407, 409–410 revenue process and, 362, 365, 368–369 stockholder’s equity and, 515 summary of, 11

Final PDF to printer

mes32502_idx_757-783.indd 782 10/14/15 08:43 AM

Final PDF to printer

mes32502_idx_757-783.indd 783 10/14/15 08:43 AM

Final PDF to printer

cover
Auditing & Assurance Services
About the Authors
Why a New Edition?
Acknowledgments
Brief Contents
Table of Contents
PART 1 Introduction to Assurance and Financial Statement Auditing

Chapter 1 An Introduction to Assurance and Financial Statement Auditing

Tips for Learning Auditing
The Demand for Auditing and Assurance

Principals and Agents
The Role of Auditing

An Assurance Analogy: The Case of the House Inspector

Seller Assertions, Information Asymmetry, and Inspector Characteristics
Desired Characteristics of the House Inspection Service
Relating the House Inspection Analogy to Financial Statement Auditing
Management Assertions and Financial Statements

Auditing, Attest, and Assurance Services Defined

Auditing
Attestation
Assurance

Fundamental Concepts in Conducting a Financial Statement Audit

Materiality
Audit Risk
Audit Evidence Regarding Management Assertions

Sampling: Inferences Based on Limited Observations
The Audit Process

Overview of the Financial Statement Auditing Process
Major Phases of the Audit
The Unqualified/Unmodified Audit Report
Other Types of Audit Reports

Conclusion
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignment
Hands-On Cases

earthwear 2015
Chapter 2 The Financial Statement Auditing Environment

Types of Auditors

External Auditors
Internal Auditors
Government Auditors
Forensic Auditors

Types of Other Audit, Attest, and Assurance Services

Other Audit Services
Attest Services
Assurance Services
Other Nonaudit Services

Public Accounting Firms

Organization and Composition

A Decade of Challenge and Change for Financial Statement Auditors

Government Regulation

Society’s Expectations and the Auditor’s Responsibilities
The Context of Financial Statement Auditing

The Business Entity as the Primary Context of Auditing

A Model of Business

Corporate Governance
Objectives, Strategies, Processes, Controls, Transactions, and Reports
A Model of Business Processes: Five Components

Organizations That Affect the Public Accounting Profession

Securities and Exchange Commission (SEC)
Public Company Accounting Oversight Board (PCAOB)
American Institute of Certified Public Accountants (AICPA)
International Auditing and Assurance Standards Board (IAASB)
Financial Accounting Standards Board (FASB)
International Accounting Standards Board (IASB)

Auditing Standards

Three Sets of Auditing Standards: The Roles of the ASB, PCAOB, and IAASB
The 10 Generally Accepted Auditing Standards
Principles Underlying an Audit Conducted in Accordance with Generally Accepted Auditing Standards
Statements on Auditing Standards and the AU Codification

Ethics, Independence, and the Code of Professional Conduct
Conclusion
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Internet Assignments
Hands-On Cases

PART 2 Audit Planning and Basic Auditing Concepts

Chapter 3 Audit Planning, Types of Audit Tests, and Materiality

Client Acceptance and Continuance

Prospective Client Acceptance
Client Continuance

Preliminary Engagement Activities

Determine the Audit Engagement Team Requirements
Assess Compliance with Ethical and Independence Requirements
Establish an Understanding with the Entity

Planning the Audit

Audit Strategy and Plan
Assess Business Risks
Establish Materiality
Consider Multilocations or Business Units
Assess the Need for Specialists
Consider Violations of Laws and Regulations
Identify Related Parties
Consider Additional Value-Added Services
Document the Overall Audit Strategy, Audit Plan, and Prepare Audit Programs

Supervision of the Audit
Types of Audit Tests

Risk Assessment Procedures
Tests of Controls
Substantive Procedures
Dual-Purpose Tests

Materiality

Steps in Applying Materiality
An Example

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignments
Hands-On Cases

Chapter 4 Risk Assessment

Audit Risk

The Audit Risk Model
Use of the Audit Risk Model

The Auditor’s Risk Assessment Process

Management’s Strategies, Objectives, and Business Risks
Auditor’s Risk Assessment Procedures
Assessing Business Risks
Evaluate the Entity’s Risk Assessment Process

Assessing the Risk of Material Misstatement

Causes and Types of Misstatements
The Fraud Risk Assessment Process

The Auditor’s Response to the Results of the Risk Assessments
Evaluation of Audit Test Results
Documentation of the Auditor’s Risk Assessment and Response
Communications about Fraud to Management, the Audit Committee, and Others
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignment
Hands-On Cases

CHAPTER 5 Evidence and Documentation

The Relationship of Audit Evidence to the Audit Report
Management Assertions

Assertions about Classes of Transactions and Events during the Period
Assertions about Account Balances at the Period End
Assertions about Presentation and Disclosure

The Concepts of Audit Evidence

The Nature of Audit Evidence
The Sufficiency and Appropriateness of Audit Evidence
The Evaluation of Audit Evidence

Audit Procedures for Obtaining Audit Evidence

Inspection of Records or Documents
Inspection of Tangible Assets
Observation
Inquiry
Confirmation
Recalculation
Reperformance
Analytical Procedures
Scanning

Reliability of the Types of Evidence
The Audit Testing Hierarchy

An “Assurance Bucket” Analogy

Audit Documentation

Functions of Audit Documentation
Content of Audit Documentation
Examples of Audit Documentation
Format of Audit Documentation
Organization of Audit Documentation
Ownership of Audit Documentation
Audit Document Archiving and Retention
Substantive Analytical Procedures
Final Analytical Procedures
Short-Term Liquidity Ratios
Activity Ratios
Profitability Ratios
Coverage Ratios

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Internet Assignment
Hands-On Cases

PART 3 Understanding and Auditing Internal Control

Chapter 6 Internal Control in a Financial Statement Audit

Introduction
Internal Control—an Overview

Definition of Internal Control
Controls Relevant to the Audit
The Effect of Information Technology on Internal Control

The COSO Framework

Components of Internal Control
Control Environment
The Entity’s Risk Assessment Process
Control Activities
Information and Communication
Monitoring of Controls

Planning an Audit Strategy

Substantive Strategy
Reliance Strategy

Obtain an Understanding of Internal Control

Overview
Understanding the Control Environment
Understanding the Entity’s Risk Assessment Process
Understanding the Information System and Communications
Understanding Control Activities
Understanding Monitoring of Controls
Documenting the Understanding of Internal Control
The Effect of Entity Size on Internal Control
The Limitations of an Entity’s Internal Control

Assessing Control Risk

Identifying Specific Controls That Will Be Relied Upon
Performing Tests of Controls
Concluding on the Achieved Level of Control Risk
Documenting the Achieved Level of Control Risk
An Example

Substantive Procedures
Timing of Audit Procedures

Interim Tests of Controls
Interim Substantive Procedures

Auditing Accounting Applications Processed by Service Organizations
Communication of Internal Control–Related Matters

General Controls
Application Controls
Symbols
Organization and Flow

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Hands-On Cases

Chapter 7 Auditing Internal Control over Financial Reporting

Management Responsibilities under Section 404
Auditor Responsibilities under Section 404 and AS5
Internal Control over Financial Reporting Defined
Internal Control Deficiencies Defined

Control Deficiency
Material Weakness
Significant Deficiency
Likelihood and Magnitude

Management’s Assessment Process

Identify Financial Reporting Risks and Related Controls
Consider Which Locations to Include in the Evaluation
Evaluate Evidence about the Operating Effectiveness of ICFR
Reporting Considerations
Management’s Documentation

Performing an Audit of ICFR
Plan the Audit of ICFR

The Role of Risk Assessment and the Risk of Fraud
Scaling the Audit
Using the Work of Others

Identify Controls to Test

Identify Entity-Level Controls
Identifying Significant Accounts and Disclosures and Their Relevant Assertions
Understanding Likely Sources of Misstatements
Select Controls to Test

Evaluate the Design and Test the Operating Effectiveness of Controls

Evaluating Design Effectiveness of Controls
Testing and Evaluating Operating Effectiveness of Controls

Evaluating Identified Control Deficiencies

Examples of Control Deficiency Evaluation

Remediation of a Material Weakness
Written Representations
Auditor Documentation Requirements
Auditor Reporting on ICFR

Elements of the Auditor’s Report
Unqualified Report
Adverse Report for a Material Weakness
Disclaimer for Scope Limitation

Other Reporting Issues

Management’s Report Incomplete or Improperly Presented
The Auditor Decides to Refer to the Report of Other Auditors
Subsequent Events
Management’s Report Contains Additional Information
Reporting on a Remediated Material Weakness at an Interim Date

Additional Required Communications in an Audit of ICFR

Use of Service Organizations
Safeguarding of Assets
Generalized Audit Software
Custom Audit Software
Test Data

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Internet Assignments
Hands-On Cases

PART 4 Statistical and Nonstatistical Sampling Tools for Auditing

Chapter 8 Audit Sampling: An Overview and Application to Tests of Controls

Overview of Audit Sampling
Definitions and Key Concepts

Audit Sampling
Sampling Risk
Confidence Level
Tolerable and Expected Error
Audit Evidence Choices That Do and Do Not Involve Sampling

Types of Audit Sampling

Nonstatistical versus Statistical Sampling
Types of Statistical Sampling Techniques

Attribute Sampling Applied to Tests of Controls

Planning
Performance
Evaluation

Nonstatistical Sampling for Tests of Controls

Determining the Sample Size
Selecting the Sample Items
Calculating the Computed Upper Deviation Rate

Conclusion
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Hands-On Cases

Chapter 9 Audit Sampling: An Application to Substantive Tests of Account Balances

Sampling for Substantive Tests of Details of Account Balances
Monetary-Unit Sampling

Advantages
Disadvantages
Applying Monetary-Unit Sampling
Planning
Performance
Evaluation

Nonstatistical Sampling for Tests of Account Balances

Identifying Individually Significant Items
Determining the Sample Size
Selecting Sample Items
Calculating the Sample Results
An Example of Nonstatistical Sampling
Advantages
Disadvantages
Applying Classical Variables Sampling

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Hands-On Cases

PART 5 Auditing Business Processes

Chapter 10 Auditing the Revenue Process

Revenue Recognition
Overview of the Revenue Process

Types of Transactions and Financial Statement Accounts Affected
Types of Documents and Records
The Major Functions
Key Segregation of Duties

Inherent Risk Assessment

Industry-Related Factors
The Complexity and Contentiousness of Revenue Recognition Issues
The Difficulty of Auditing Transactions and Account Balances
Misstatements Detected in Prior Audits

Control Risk Assessment

Understand and Document Internal Control
Plan and Perform Tests of Controls
Set and Document Control Risk

Control Activities and Tests of Controls—Revenue Transactions

Occurrence of Revenue Transactions
Completeness of Revenue Transactions
Authorization of Revenue Transactions
Accuracy of Revenue Transactions
Cutoff of Revenue Transactions
Classification of Revenue Transactions

Control Activities and Tests of Controls—Cash Receipts Transactions

Occurrence of Cash Receipts Transactions
Completeness of Cash Receipts Transactions
Authorization of Cash Discounts
Accuracy of Cash Receipts Transactions
Cutoff of Cash Receipts Transactions
Classification of Cash Receipts

Control Activities and Tests of Controls—Sales Returns and Allowances Transactions
Relating the Assessed Level of Control Risk to Substantive Procedures
Auditing Revenue-Related Accounts
Substantive Analytical Procedures
Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Completeness
Cutoff
Existence
Rights and Obligations
Valuation and Allocation
Classification
Other Presentation and Disclosure Assertions

The Confirmation Process—Accounts Receivable

Types of Confirmations
Timing
Confirmation Procedures
Alternative Procedures

Auditing Other Receivables
Evaluating the Audit Findings—Revenue-Related Accounts
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Internet Assignments
Hands-On Cases

Chapter 11 Auditing the Purchasing Process

Expense and Liability Recognition
Overview of the Purchasing Process

Types of Transactions and Financial Statement Accounts Affected
Types of Documents and Records
The Major Functions
The Key Segregation of Duties

Inherent Risk Assessment

Industry-Related Factors
Misstatements Detected in Prior Audits

Control Risk Assessment

Understand and Document Internal Control
Plan and Perform Tests of Controls
Set and Document Control Risk

Control Activities and Tests of Controls—Purchase Transactions

Occurrence of Purchase Transactions
Completeness of Purchase Transactions
Authorization of Purchase Transactions
Accuracy of Purchase Transactions
Cutoff of Purchase Transactions
Classification of Purchase Transactions

Control Activities and Tests of Controls—Cash Disbursement Transactions

Occurrence of Cash Disbursement Transactions
Completeness of Cash Disbursement Transactions
Authorization of Cash Disbursement Transactions
Accuracy of Cash Disbursement Transactions
Cutoff of Cash Disbursement Transactions
Classification of Cash Disbursement Transactions

Control Activities and Tests of Controls—Purchase Return Transactions
Relating the Assessed Level of Control Risk to Substantive Procedures
Auditing Accounts Payable and Accrued Expenses
Substantive Analytical Procedures
Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Completeness
Existence
Cutoff
Rights and Obligations
Valuation
Classification and Understandability
Other Presentation Disclosure Assertions

Accounts Payable Confirmations
Evaluating the Audit Findings—Accounts Payable and Related
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignments
Hands-On Cases

Chapter 12 Auditing the Human Resource Management Process

Overview of the Human Resource Management Process

Types of Transactions and Financial Statement Accounts Affected
Types of Documents and Records
The Major Functions
The Key Segregation of Duties

Inherent Risk Assessment
Control Risk Assessment

Understand and Document Internal Control
Plan and Perform Tests of Controls
Set and Document the Control Risk

Control Activities and Tests of Controls—Payroll Transactions

Occurrence of Payroll Transactions
Authorization of Payroll Transactions
Accuracy of Payroll Transactions
Classification of Payroll Transactions

Relating the Assessed Level of Control Risk to Substantive Procedures
Auditing Payroll-Related Accounts
Substantive Analytical Procedures
Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Payroll Expense Accounts
Accrued Payroll Liabilities

Evaluating the Audit Findings— Payroll-Related Accounts
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Internet Assignment
Hands-On Cases

Chapter 13 Auditing the Inventory Management Process

Overview of the Inventory Management Process

Types of Documents and Records
The Major Functions
The Key Segregation of Duties

Inherent Risk Assessment

Industry-Related Factors
Engagement and Operating Characteristics

Control Risk Assessment

Understand and Document Internal Control
Plan and Perform Tests of Controls
Set and Document the Control Risk

Control Activities and Tests of Controls— Inventory Transactions

Occurrence of Inventory Transactions
Completeness of Inventory Transactions
Authorization of Inventory Transactions
Accuracy of Inventory Transactions
Cutoff of Inventory Transactions
Classification of Inventory Transactions

Relating the Assessed Level of Control Risk to Substantive Procedures
Auditing Inventory
Substantive Analytical Procedures
Auditing Standard Costs

Materials
Labor
Overhead

Observing Physical Inventory
Tests of Details of Classes of Transactions, Account Balances, and Disclosures

Accuracy
Cutoff
Existence
Completeness
Rights and Obligations
Valuation and Allocation
Classification and Understandability
Other Presentation and Disclosure Assertions

Evaluating the Audit Findings—Inventory
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignment
Hands-On Cases

Chapter 14 Auditing the Financing/Investing Process: Prepaid Expenses, Intangible Assets, and Property, Plant, and Equipment

Auditing Prepaid Expenses
Inherent Risk Assessment—Prepaid Expenses
Control Risk Assessment—Prepaid Expenses
Substantive Procedures—Prepaid Insurance

Substantive Analytical Procedures for Prepaid Insurance
Tests of Details of the Prepaid Insurance
Existence and Completeness
Rights and Obligations
Valuation
Classification

Auditing Intangible Assets
Inherent Risk Assessment—Intangible Assets
Control Risk Assessment—Intangible Assets
Substantive Procedures—Intangible Assets

Substantive Analytical Procedures for Intangible Assets
Tests of Details of Intangible Assets

Auditing the Property Management Process

Types of Transactions
Overview of the Property Management Process

Inherent Risk Assessment—Property Management Process

Complex Accounting Issues
Difficult-to-Audit Transactions
Misstatements Detected in Prior Audits

Control Risk Assessment—Property Management Process

Occurrence and Authorization
Completeness
Segregation of Duties

Substantive Procedures—Property, Plant, and Equipment

Substantive Analytical Procedures—Property, Plant, and Equipment
Tests of Details of Transactions, Account Balances, and Disclosures—Property, Plant, and Equipment

Evaluating the Audit Findings—Property, Plant, and Equipment
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignments
Hands-On Cases

Chapter 15 Auditing the Financing/Investing Process: Long-Term Liabilities, Stockholders’ Equity, and Income Statement Accounts

Auditing Long-Term Debt
Inherent Risk Assessment—Long-Term Debt
Control Risk Assessment—Long-Term Debt

Assertions and Related Control Activities

EarthWear Substantive Procedures—Long-Term Debt
Auditing Stockholders’ Equity
Control Risk Assessment—Stockholders’ Equity

Assertions and Related Control Activities
Segregation of Duties

Auditing Capital-Stock Accounts

Occurrence and Completeness
Valuation
Completeness of Disclosures

Auditing Dividends
Auditing Retained Earnings
Auditing Income Statement Accounts
Assessing Control Risk for Business Processes—Income Statement Accounts
Substantive Procedures—Income Statement Accounts

Direct Tests of Balance Sheet Accounts
Substantive Analytical Procedures for Income Statement Accounts
Tests of Selected Account Balances

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignment
Hands-On Cases

Chapter 16 Auditing the Financing/Investing Process: Cash and Investments

Auditing Cash
Types of Bank Accounts

General Cash Account
Imprest Cash Accounts
Branch Accounts

Control Risk Assessment—Cash
Substantive Procedures—Cash

Substantive Analytical Procedures—Cash
Substantive Tests of Details of Transactions and Balances—Cash
Auditing the General Cash Account
Fraud-Related Audit Procedures
Auditing a Payroll or Branch Imprest Account
Auditing a Petty Cash Fund
Disclosure Issues for Cash

Auditing Investments
Control Risk Assessment—Investments

Assertions and Related Control Activities
Segregation of Duties

Substantive Procedures—Investments

Substantive Analytical Procedures—Investments
Tests of Details—Investments
Understanding How Management Makes Fair Value Measurements
Considering Whether Specialized Skills or Knowledge Is Required
Testing the Entity’s Fair Value Measurements
Evaluating the Reasonableness of the Fair Value Measurements

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Internet Assignment
Hands-On Case

PART 6 Completing the Audit and Reporting Responsibilities

Chapter 17 Completing the Audit Engagement

Review for Contingent Liabilities

Audit Procedures for Identifying Contingent Liabilities
Legal Letters

Commitments
Review of Subsequent Events for Audit of Financial Statements

Dual Dating
Audit Procedures for Subsequent Events

Review of Subsequent Events for the Audit of Internal Control over Financial Reporting
Final Steps and Evidence Evaluation

Final Analytical Procedures
Representation Letter
Working Paper Review
Final Evaluation of Audit Results
Evaluating Financial Statement Presentation and Disclosure
Independent Engagement Quality Review
Archiving and Retention
Going Concern Considerations

Communications with Those Charged with Governance and Management

Communications Regarding the Audit of Internal Control over Financial Reporting
Management Letter

Subsequent Discovery of Facts Existing at the Date of the Auditor’s Report
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Internet Assignments
Hands-On Cases

Chapter 18 Reports on Audited Financial Statements

Reporting on the Financial Statement Audit: The Standard Unqualified/Unmodified Audit Report

The Standard Unqualified Audit Report for Public Companies
The Standard Unmodified Audit Report for All Entities Other Than Public Companies

Explanatory Language Added to the Standard Unqualified/Unmodified Financial Statement Audit Report

Modified Wording for Opinion Based in Part on the Report of Another Auditor
Circumstances Requiring Explanatory Language in an Additional Paragraph

Departures from an Unqualified/Unmodified Financial Statement Audit Report

Conditions for Departure
Types of Financial Statement Audit Reports Other Than Unqualified/Unmodified
The Effect of Materiality on Financial Statement Reporting

Discussion of Conditions Requiring Other Types of Financial Statement Audit Reports

Scope Limitation
Statements Not in Conformity with GAAP
Auditor Not Independent

Special Reporting Issues
Reports on Comparative Financial Statements

Different Reports on Comparative Financial Statements
A Change in Report on the Prior-Period Financial Statements
Report by a Predecessor Auditor

Other Information in Documents Containing Audited Financial Statements
Special Reports Relating to Financial Statements

Financial Statements Prepared According to a Special Purpose Framework
Specified Elements, Accounts, or Items of a Financial Statement
Compliance Reports Related to Audited Financial Statements

Big Changes Coming to Audit Reporting
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Hands-On Cases

PART 7 Professional Responsibilities

Chapter 19 Professional Conduct, Independence, and Quality Control

Ethics and Professional Conduct

Ethics and Professionalism Defined
Theories of Ethical Behavior
Example—an Ethical Challenge

An Overview of Ethics and Professionalism in Public Accounting

A Tale of Two Companies
Standards for Auditor Professionalism

The Newly Revised AICPA Code of Professional Conduct: A Comprehensive Framework for Auditors

Principles of Professional Conduct
Rules of Conduct

Integrity, Objectivity, and Independence

Integrity and Objectivity—Framework, Rule, and Interpretations
Independence

Other Sections of the Code of Professional Conduct

General Standards and Accounting Principles
Responsibilities to Clients
Other Responsibilities and Practices
Disciplinary Actions
Don’t Lose Sight of the Forest for the Trees

Quality Control Standards

System of Quality Control
Elements of Quality Control
PCAOB Inspections of Registered Public Accounting Firms

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Internet Assignment
Hands-On Cases

Chapter 20 Legal Liability

Introduction

Historical Perspective
Overview of Auditor Legal Liability

Common Law—Clients

Breach of Contract—Client Claims
Negligence—Client Claims
Fraud—Client Claims

Common Law—Third Parties

Ordinary Negligence—Third-Party Claims
Fraud and Gross Negligence—Third-Party Claims
Damages under Common Law

Statutory Law—Civil Liability

Securities Act of 1933
Securities Exchange Act of 1934
Private Securities Litigation Reform Act of 1995, the Securities Litigation Uniform Standards Act of 1998, and the Class Action Fairness Act of 2005
Sarbanes-Oxley Act of 2002
SEC and PCAOB Sanctions
Foreign Corrupt Practices Act
Racketeer Influenced and Corrupt Organizations Act

Statutory Law—Criminal Liability
Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Cases
Hands-On Cases

PART 8 Assurance, Attestation, and Internal Auditing Services

Chapter 21 Assurance, Attestation, and Internal Auditing Services

Assurance Services

Types of Assurance Services

Attest Engagements

Types of Attest Engagements

Attestation Standards

General Standards
Standards of Fieldwork
Standards of Reporting

Reporting on an Entity’s Internal Control over Financial Reporting (ICFR)

Conditions for Conducting an Engagement Relating to ICFR
Examination Engagement on an Entity’s ICFR
Reporting on Management’s Assertion about Internal Control

Financial Forecasts and Projections

Types of Prospective Financial Statements
Examination of Prospective Financial Statements
Agreed-Upon Procedures for Prospective Financial Statements
Compilation of Prospective Financial Statements

Accounting and Review Services

Compilation of Financial Statements
Review of Financial Statements

Internal Auditing

Internal Auditing Defined
The Institute of Internal Auditors
IIA Standards
Code of Ethics
Internal Auditors’ Roles
Internal Audit Product Offerings
Interactions between Internal and External Auditors

Advanced Module: Examples of Assurance Services—Trust Services and PrimePlus Services

Trust Services
Trust Services and SOC 2 and SOC 3 Reports
CPA WebTrust
CPA PrimePlus Services

Key Terms
Review Questions
Multiple-Choice Questions
Problems
Discussion Case
Internet Assignments
Hands-On Cases

Advanced Module: Professonal Judgment Framework—Understanding and Developing Professional Judgment in Auditing
Index

1. 2016-01-10T21:36:05+0000
2. Preflight Ticket Signature