5-19
5-78
a. The control environment is very important because it sets the tone for company
operations and creates both an expectation that controls are important. In such a setting,
the auditor would expect the controls to be well designed and operating effectively. If the
auditor finds controls to be well designed, the auditor would then plan an audit that relies
b. An audit program to gather evidence on three principles of the control environment is
contained in the table below. The specific steps in the program would depend on the
student assumptions as to how the organization complied with the COSO principle.
(Students may have variations of the program, but should cover most of the major
procedures).
COSO Principle
Audit Program
Integrity and Ethical
Climate
1. Examine the organization’s code of ethics or statement of
values to determine the completeness and adequacy of the
statements.
2. Review the procedures the company utilizes to communicate
3. Review communications to determine if the planned
4. Review compensation plans to determine if they might
provide a conflict with the code of ethics.
6. Determine if there is active follow-up on whistleblowing
7. Interview top management to understand their ethical views.
8. Use a randomly distributed questionnaire to determine
9. Determine the extent that the internal audit department or the
10. Where applicable (e.g. a new client), review background of
top management to determine if there are ethical problems,
2. Determine the extent that current accounting personnel
3. Determine the educational and experience background of key
4. Interview the chair of the Audit Committee to obtain his (her)
assessment of the accounting personnel competence.
5. Through observation, determine whether the accounting
6. Identify the risks associated with deficiencies in accounting
competencies.
7. Identify the continuing education requirements for
accounting personnel. Take a sample of accounting
Effective Board of
Directors
1. Determine the composition, experience, and background of
the board members to make an assessment of the financial
literacy of its members.
2. Review the competency of the board members during private
3. Review the agendas for the board meetings. Determine if
4. Determine if the board follows up on internal and external
audit recommendations.
6. Review the board charter to determine that it is sufficient to
7. Determine if the board performs a self-assessment each year
and how it reacts to areas needing improvement.
5-21
5-79
Objective: Determine whether there have been changes to important computer applications
during the year.
• Determine if there are changes in the computer program. If there are, test the integrity of the
controls after the changes.
• Consider submitting test transactions through the system to determine that it is working
properly.
• Take a random sample of transactions and determine that (a) key controls are operating and
(b) processing is complete.
5-80
Reperformance would be more rigorous then inspection of documentation. The auditor does not
always want to perform the most rigorous procedure possible because it is likely the most costly
to perform. However, when more persuasive evidence is needed, the auditor would tend to
5-81
Inquiry in conjunction with observation and/or inspection of documentation would most likely be
used. The auditor may inquire of audit committee members about their fraud discussions, may sit
5-82
Exhibit 5.11 provides a summary overview of important audit activities and decisions leading up
5-22
goods sold, inventory, receivables, and accounts payable. As part of identifying significant
5-83
A dual purpose test is a substantive test and a related test of a relevant control that are performed
5-84
Factor
If Auditor Assessment is:
Effectiveness of internal control as
Internal controls are effective
Less / less rigorous
Effect on Extent/Nature
of Substantive
5-85
Substantive audit procedures could include:
5-23
• Assessing the Potential Impairment of the Asset Additions through Inquiry of
5-86
a. Inspection of documentation. If the number of leased equipment pieces is small, examine
each lease agreement to ensure that the accounting for the item is correct given the
appropriate accounting guidance.
5-87
a. Yes, for public companies, if the auditor is going to issue a report on internal controls, the
auditor must audit the financial statements at the same time that the reports on internal
5-24
c. A finding of no material misstatements in the financial statements does not allow the
5-88
Important aspects of Exhibit 5.13 related to the opinion on internal controls include the
following:
5-89
a. Before analyzing any ethical issue, the auditor should always be confident in the facts. In
other words, the auditor needs to be sure that the differences are not just subjective and
that there are fundamental flaws in the application of internal control principles in the
organization. For example, the auditor should be sure that the ‘open door policy’ is not as
5-25
Develop Alternative Courses of Action: There are only two courses of actions available:
either issue an unqualified opinion on the client’s internal control over financial reporting
or issue an adverse opinion. If the audit manager disagrees with the audit partner’s course
of action, then the audit manager will have to decide whether to challenge the audit
Determine most likely consequences of the manager decision. The setting in which this
determination is necessary is if the partner decides to issue an unqualified opinion and the
manager determines that an adverse opinion would be more appropriate. The manager
could decide to take various actions including challenging the partner, writing a memo to
the file regarding the disagreement, or reporting the issue to the firm’s hotline. Most of
these actions would likely have negative consequences for the audit manager. However,
the audit manager would likely face negative consequences if the manager did nothing,
and then the client failed in the future.
Decide on Most Appropriate Course of Action for the Audit Manager. Insist that the
audit firm issue an adverse audit opinion on internal control. The difficult issue is what to
do if the audit partner disagrees. There are a few courses of actions the auditor should
take that include:
• Raise the issue with the engagement quality review partner during the review
• Document the difference in writing and insist that your opinion stays in the audit
working papers
• Raise the issue with the office managing partner
5-26
• No whistleblowing program, which also represents non-compliance with the
Sarbanes-Oxley Act (a violation of public law)
Fraud Focus: Contemporary and Historical Cases
5-90
a. Professional standards for auditors provide guidance on the many judgments and
decisions they make throughout the audit opinion formulation process. These standards
help auditors properly plan, perform, document, and supervise audits. Auditors who
follow the professional auditing standards are viewed as conducting a quality audit. The
underlying principles highlight that the auditor needs to obtain reasonable assurance as to
whether the financial statements are free from material misstatement; the standards
5-27
PHASE OF THE AUDIT OPINION
FORMULATION PROCESS
ACTIVITIES WITHIN THE PHASE
Phase I Making Client Acceptance and
Continuance Decisions
• Assess whether management uses an
acceptable financial reporting
framework
• Assess whether management
acknowledges and understands its
• Consider the results of tests of
controls, if applicable
Phase IV Obtaining Substantive
Evidence about Accounts, Disclosures,
and Assertions
• Perform appropriate substantive
procedures
Phase V Completing the Audit and
Making Reporting Decisions
• Complete review and communication
activities
• Determine the type(s) of opinion(s) to
issue
f. Auditors add value to the financial markets by making professional judgments and ethical
decisions associated with their evaluation of client financial statements. Professional
judgment involves applying relevant professional knowledge and experience to unique
5-28
5-91
5-29
5-92
a. The items in question are not unusual for General Motors or for other large
companies. It would be naïve to assume that accounting personnel were not aware of
the nature of the entries. The errors described in the Wall Street Journal reflect on the
5-30
b. Determining the residual value of cars coming off of lease is something that the
company should be used to doing. Most of the cars coming off of lease go to an
auction where they are purchased by General Motors dealers for resale. The company
should have good information available about current prices from auctions. Further,
c. The up-front rebates are collected from GM’s suppliers in advance of their purchase
of goods from the suppliers. The actual cash payment occurs before any goods are
accepted from the vendor. The vendors would be willing to pay the up-front rebates
in order to secure a volume of business from GM. In other words, they would become
The controls that would be expected to be in place include:
• Control Environment
o Commitment to competence
The auditor would test the controls and proper accounting as follows:
• Tests of Controls: The auditor would determine the existence of the controls and then
sample transactions to determine if they were properly flagged. In this case, there
5-31
d. The students will generally believe that GM’s “errors” were intentional, and thus
fraudulent. Such a perspective is supported by others. On June 4, 2006, in an article
“There was a string of errors, all going in one direction, giving a more positive light to
GM’s results,” said Charles Mulford, an accounting professor at the Georgia Institute of
Application Activities
5-93
a. There are many instances that the students can point to, all of which relate to the
respondents’ audits of American Fiber Green Products, Inc. Some examples include:
the audit was not properly planned, only a few auditing procedures were performed
5-94
The appropriate auditing standard is AS 3. AS 3 notes, in part, the following:
5-32
b. Support the basis for the auditor’s conclusions concerning every relevant financial
statement assertion, and
5-95
This is a project that the authors have used successfully to facilitate student identification of
5-96
This application activity provides the student with an opportunity to review a current inspection
report. While the deficiencies selected by students will differ, the inspection reports will likely
include deficiencies related to understanding the client’s controls, testing controls, and
5-97
The assertions are identified in ISA 315. The concepts in the assertions included in ISA 315 are
AU-C 315.
“Assertions used by the auditor to consider the different types of potential misstatements that
may occur fall into the following three categories and may take the following forms:
5-33
(ii) Completeness—all transactions and events that should have been recorded have been
recorded.
(b) Assertions about account balances at the period end:
(i) Existence—assets, liabilities, and equity interests exist.
(ii) Rights and obligations—the entity holds or controls the rights to assets, and liabilities
are the obligations of the entity.
(c) Assertions about presentation and disclosure:
(i) Occurrence and rights and obligations—disclosed events, transactions, and other
matters have occurred and pertain to the entity.
(ii) Completeness—all disclosures that should have been included in the financial
Academic Research Case
5-98
a. The authors examine the influence of two types of documentation on an auditor’s ability
to identify missing internal controls (i.e., a deficiency in internal control design).
5-34
observations via a walkthrough OR the auditor may only have the narrative and
observations via a walkthrough without a business process flowchart.
Blank
Client-Prepared
Internal Control Matrix
Internal Control Matrix
Business Process
Flowchart
Condition 1
Condition 2
NO Business Process
Flowchart
Condition 3
Condition 4
b. There were a total of five possible missing controls that could be identified. The best
possible combination of documentation was a blank control matrix along with a business
process flowchart (Condition 1).
Auditors exposed to Condition 1 identified an average of .58 missing controls (most
successful).
Auditors exposed to Condition 2 identified an average of .34 missing controls.
c. The findings of this study suggest that with both a business process flowchart and a blank
control matrix, auditors are able to identify more control deficiencies than auditors in the
other three documentation conditions. From a theoretical perspective, the findings
suggest that access to a client prepared matrix may inhibit an auditor’s ability to identify
5-35
d. After a pretest, a sample of 395 auditors of different experience levels participated in a
case study. Most of the participants were staff or senior auditors. All participants came
from one Big 4 CPA firm, but had some prior experience at another firm. The case study
first provided participants with detailed information about the company in general
(business process, management team, internal audit function, audit committee, other
e. Due to the breadth of documentation available, there may be other techniques not
examined in this study that prove to be more beneficial than the business process
flowchart. Furthermore, the business process flowchart is glorified without any analysis
of associated costs. Firms may realize that the time and resources involved in its creation
outweigh the benefit received.