Risk Assessment & Control Testing Flashcards

Under SAS 145 (AU-C 315), which set of factors does the auditor use to place a risk on the spectrum of inherent risk?

Answer: Complexity, subjectivity, change, uncertainty, and susceptibility to management bias or fraud

SAS 145 lists these inherent risk factors to assess the likelihood and magnitude of misstatement.

An auditor runs an analytic that matches the user ID that created a new vendor to the user ID that approved payments to that vendor. What is this procedure mainly testing?

Answer: Segregation of duties

The same user creating and paying a vendor indicates a segregation-of-duties conflict.

Which data analytic best tests the operating effectiveness of an automated three-way match control over the full population?

Answer: Reperforming the match of purchase orders, receiving reports, and invoices for all paid invoices

Reperformance across the full population directly shows whether the control worked as designed.

An auditor applies Benford's Law to expense amounts during risk assessment. What is the analysis designed to reveal?

Answer: First-digit distributions that deviate from expectation, which may indicate fabricated or manipulated amounts

Benford's Law flags unusual digit frequencies that can signal invented or altered numbers.

An ADA run over the full sales population flags 140 transactions as outliers. What is the appropriate next step?

Answer: Investigate the outliers, possibly in groups, to determine whether they are misstatements or control deviations

The AICPA ADA guide requires the auditor to evaluate flagged items rather than accept or dismiss them automatically.

Before relying on client-provided data for an ADA, what must the auditor evaluate?

Answer: The relevance and reliability of the data, including its completeness and accuracy

Information used as audit evidence must be shown to be relevant, complete, and accurate.

IT general controls over program change management were found ineffective. How does this most directly affect the auditor's control testing approach?

Answer: The auditor may not be able to rely on automated application controls consistently operating throughout the period

Weak change management means automated controls could have been altered, undermining evidence of consistent operation.