Audit and Assurance Flashcards

What is the auditor's responsibility regarding the 'other information' included in documents containing audited financial statements?

Answer: To read the other information and consider whether there is a material inconsistency with the financial statements or a material misstatement of fact

Under CAS 720, the auditor reads other information in the annual report to identify material inconsistencies with the audited financial statements or material misstatements of fact. While the auditor does not audit this information, they must respond if inconsistencies or misstatements are identified.

In the context of IT controls, what is the difference between general IT controls and application controls?

Answer: General IT controls provide a foundation for all IT systems (access security, change management, operations); application controls are specific to individual applications (input validation, processing, output)

General IT controls (GITCs) are broad controls over IT infrastructure (access, change management, disaster recovery, operations) that support the effective functioning of application controls. Application controls are embedded in specific programs to ensure completeness, accuracy, and validity of transactions.

Under CAS 530, what factors affect the sample size in an audit?

Answer: The acceptable level of sampling risk, expected misstatement rate, population characteristics, and the tolerable misstatement

Sample size is influenced by the acceptable level of sampling risk (confidence level desired), the tolerable misstatement or rate of deviation, the expected misstatement or error rate in the population, and the characteristics and size of the population being tested.

What is a management letter (internal control deficiency report), and when is it issued?

Answer: A communication to management and those charged with governance identifying deficiencies in internal control observed during the audit

A management letter communicates internal control deficiencies and other observations noted during the audit that the auditor believes should be brought to management's attention. Significant deficiencies must be communicated in writing to those charged with governance under CAS 265.

What is the concept of professional skepticism in auditing?

Answer: An attitude that includes a questioning mind, being alert to conditions that may indicate possible misstatement, and a critical assessment of audit evidence

Professional skepticism (CAS 200) requires auditors to maintain a questioning mind, be alert to contradictory evidence, critically assess the sufficiency and appropriateness of evidence, and recognize that management may have motivations to misstate financial statements, without assuming dishonesty.

Under CAS 402, what must the auditor of a user entity consider when the entity uses a service organization?

Answer: How the service organization's processes and controls affect the user entity's internal control relevant to the audit, potentially using a Type 1 or Type 2 service auditor's report

CAS 402 requires the auditor to understand how the service organization affects the user entity's internal control, including the nature and significance of transactions processed. The auditor may obtain a Type 1 (design) or Type 2 (design and operating effectiveness) service auditor's report.