UNIQUE PEDAGOGICAL FRAMEWORK ix
Detailed illustrations help students visualize
complex processes and important concepts.
Audit Strategy 3-23
Illustration 3.12 provides a diagram of the process used when developing the audit strat-
egy for an account or assertion. Notice that the left side of the diagram provides an overview of the reliance on controls approach described in this section.
Audit Reasoning Ex ample Existence of Inventory
Jennifer is auditing a private company that manufactures batteries for cell phones. The company
has good perpetual inventory records and inventory controls. In the prior year audit, tests of con-
trols confi rmed the company had excellent internal controls over inventory. In planning this year,
based on inquiries with various client personnel, the system has not changed. Therefore, Jennifer
is planning to test controls at an interim date, and if this year’s tests of controls confi rm that
controls continue to be strong, she will also perform substantive procedures on the existence of
inventory at an interim date.
Determine whether an internal control(s) can
mitigate the risk factor
Identify inherent risks at the account or assertion level
Test the
control(s)
Substantive Approach
Re
li
ance on Contro
l
s Approac
h
Is the control(s)
effective? Does it work?
Increase extent of detailed
substantive procedures
performed at year-end
Does the control(s)
exist?
NO
NO
NO
Perform less extensive
detailed substantive
procedures at interim
YES
YES
YES
ILLUSTRATION 3.12
Process used when developing
an audit strategy at the
account or assertion level
c03RiskAssessmentPartI.indd Page 3-23 24/01/19 9:35 PM F-0590 /208/WB02435/9781119401810/ch03/text_s
6-4 Chapter 6 Gaining an Understanding of the Client’s System of Internal Control
the COSO Framework
The COSO framework has global acceptance and is the most commonly recognized frame- work for understanding and evaluating a system of internal control. It has three dimensions, as shown in Illustration 6.1. First, the COSO framework discusses the objectives of internal
control. Second, the COSO framework discusses important components of internal control. Third, the COSO framework discusses how these objectives and components fit into an orga- nizational structure.
Control activities
Entity
Division
Operating unit
Function
Organizational structure
Components
Objectives
Information and communication
Monitoring activities
Operations
Reporting
Compliance
Risk assessment
Control environment
iLLuStrAtiO n 6.1
The relationship among the
three dimensions of internal
control: objectives, components,
and organizational structure
Objectives of Internal Control
The COSO framework depicted in Illustration 6.1 identifies three objectives of internal control
that allow organizations to focus on the differing purposes of internal control. These three
objectives are:
• Operations objectives. These pertain to the effectiveness and efficiency of the entity’s op-
erations, including operational and financial performance goals, and safeguarding assets
against loss.
• Reporting objectives. These pertain to internal and external financial and nonfinancial
reporting and may encompass reliability, timeliness, transparency, or other terms as set
forth by regulators, recognized standard setters, or the entity’s policies.
• Compliance objectives. These pertain to adherence to laws and regulations to which the
entity is subject.
(COSO, Internal Control—Integrated Framework, 2013)
These three objectives of internal control help the auditor understand why the controls are
important and the problems they are designed to prevent. Without understanding the in-
tention of management in implementing internal controls, it is harder to understand how
controls prevent, or detect and correct, financial statement misstatements. Management
and those charged with governance are concerned about adequately controlling the entity’s
operations, its financial reporting, and its compliance with laws and regulations. The exter-
nal auditor, on the other hand, is primarily concerned with the reporting objectives and the
operations objectives related to safeguarding of assets.
Components of Internal Control
The second dimension of the COSO framework depicted in Illustration 6.1 identifies five
integrated components of internal control:
• Control environment.
• Risk assessment.
• Control activities.
c06GainingAnUnderstandingOfTheClientsSystemOfInternalControl.indd Page 4 04/03/19 5:48 PM F-0590 /208/WB02435/9781119401810/ch06/text_s
Professional Environment boxes provide in-depth discussions of how concepts in a chapter are ap-
plied in the business world.
5-20 CHAPTER 5 A udit Evidence
Using the Work of Internal Auditors
The role of the internal audit function was introduced in Chapter 1. Internal auditors are
employees of the client who perform assurance and consulting activities designed to evaluate and improve the eff ectiveness of the entity’s governance, risk management, and internal con- trol processes. Not every client will have an internal audit function. For example, small and medium-sized companies, especially private companies, may not have the resources to staff
an internal audit function. But if the client does have an internal audit function, what role, if any, do the internal auditors play in the fi nancial statement audit? According to AU-C 610 internal auditors employees
of the client who perform assur-
ance and consulting activities
designed to evaluate and improve
the eff ectiveness of the entity’s
governance, risk management,
and internal control processes
Cloud 9 - Continuing Case
Josh will take responsibility for obtaining a specialist’s opinion on
the derivatives. He knows that W&S Partners has other staff (who
are not part of the audit team) who can provide additional expertise.
However, because he believes the accounts are so material to the
audit and derivatives have become such a big issue in audits in recent
years, he deems an external specialist’s opinion is also required. He
has some experience of using a derivatives specialist on prior audits,
and he also plans to ask Jo Wadley (the partner) to recommend a
suitable specialist.
Josh plans to investigate any possible connections between
the specialist and Cloud 9 that could adversely impact the special-
ist’s objectivity before engaging him for this audit.
Professional Environment Working with IT Auditors
Specialist IT auditors are often used in audits of clients with com-
plex information technology (IT) environments because the eff ec-
tive audit of the IT systems contributes to overall audit quality.
Large audit fi rms usually have such specialists within the fi rm, but
smaller audit fi rms could engage external IT consultants for this
part of the fi nancial statement audit. In general, reliance on an
IT specialist is appropriate when the fi nancial statement auditor
complies with the conditions of AU-C 620.
If the IT expert and the fi nancial statement auditor do not
work well together, audit quality can be impaired. For this rea-
son, researchers have investigated the factors that aff ect the way
that fi nancial statement auditors work with specialist IT auditors.
Brazel
12
reviewed this research evidence and drew the following
conclusions. First, responses from fi nancial statement auditors in
the United States who were surveyed about their experiences with
IT auditors indicated that they believe IT auditors’ competence
levels vary in practice. Financial statement auditors also said that
IT auditors appear to be overconfi dent in their abilities in some
settings, and questioned the value provided by IT auditors to the
fi nancial statement audit.
Second, Brazel suggests the research shows that both fi nan-
cial statement auditors’ IT ability and experience and the IT audi-
tor’s competence aff ect how these two professions interact on an
audit engagement. This indicates that audit fi rms need to ensure
that staff training and scheduling produce appropriate combi-
nations of fi nancial statement auditors and IT auditors on an
engagement.
Finally, Brazel argues that the research fi ndings demon-
strated that auditors need to consider the implications of fi nding
a balance between greater software-assisted audit techniques
training for financial statement auditors and greater use of IT
specialists for overall audit effi ciency and eff ectiveness.
The role of IT audit specialists could grow to become even
more than a support function for auditors. Some researchers
suggest that in e-businesses, the external fi nancial statement
auditor’s authority will be challenged by IT audit specialists be-
cause of technological change and its impact on auditing.
13
In
e-businesses, economic transactions are captured, measured,
and reported on a real-time basis without either internal human
intervention or paper documentation.
14
Auditing is likely to be-
come more real-time and continuous to refl ect the pattern of the
transactions. If traditional auditors are unwilling or unable to
adapt to the new environment, their role could be taken over by
IT specialists.
Other developments such as reporting using XBRL (eXten-
sible Business Reporting Language) provide challenges for au-
ditors as they have to adapt their techniques and approaches to
audit fi nancial information that is disaggregated and tagged. Us-
ers can extract and analyze XBRL data directly without re-entry
and the tag provides additional information about the calculation
and source of the data. This means auditors have to recognize that
their clients are reporting fi nancial data with diff erent levels of
information and users might have greater expectations of the data.
Learn more about XBRL at www.xbrl.org.
12
J. F. Brazel. “How do fi nancial statement auditors and IT auditors work together?” The CPA Journal,
November, 2008, pages 38–41.
13
A. Kotb, C. Roberts, & S. Sian. “E-business Audit: Advisory Jurisdiction or Occupational Invasion?” Critical
Perspectives on Accounting 23, no. 6 (2012), pages 468–82.
14
Kotb et al., 2012.
c05AuditEvidence.indd Page 5-20 1/15/19 9:44 PM f-1241 /208/WB02435/9781119401810/ch05/text_s
Each chapter concludes with an Audit
Decision-Making Example that takes students
through specific steps of the audit process
while offering solutions to issues presented
throughout the example.
3-32 CHAPTER 3 Risk Assessment Part I
Audit D ecision-Making Ex ample
Background Information
You have been assigned to the audit of inventory for a private
company that owns and operates a chain of retail jewelers. The
company’s sales revenue has grown by 300% in the last two years,
primarily by acquisitions. Seventy-eight percent of the value of the
company’s inventory is in wedding rings, diamonds, gold neck-
laces, and high-end watches. Because the company has grown
through acquisition, the company has not yet brought two ac-
quired companies (representing 35% of sales) under the company’s
inventory system. As a result, the company is currently operating
with three diff erent inventory-control systems. The core inventory
system being used by retail stores represents 65% of sales. Sixty
percent of inventory was tested in the prior year and controls over
the existence of inventory were eff ective.
The CFO’s top priority is to put all retail operations under this
one inventory-control system by the end of the fi scal year (Janu-
ary 31). He is particularly concerned about lower than expected
gross margins at some of the acquired stores, and he expects that
better inventory control will improve this situation. In addition,
gold prices have risen 15% in the last 12 months, and the company
is making sure it is not selling “confl ict diamonds” illegally traded
to fund confl ict in war-torn areas of Africa. Your responsibility is
to develop an audit strategy for testing the existence of inventory.
Identify the Audit Issue
The focus of attention in this instance is to develop an audit strat-
egy for testing the existence of inventory. The auditor may develop
a diff erent audit strategy for testing the valuation of that inventory.
Gather Information and Evidence
Important information includes:
• A signifi cant portion of the inventory is high in value, small
in size, and susceptible to theft.
• A good system of internal controls may not be operating
eff ectively and uniformly.
• The weak gross margins in some stores may be evidence of
inventory shrinkage or theft.
• Fraud risk may be high in some locations due to the opportu-
nity off ered by weak internal controls.
• The auditor needs to determine how internal controls aff ect
audit strategy, and whether the auditor wants one audit strat-
egy for part of the inventory and another audit strategy for
another part of the inventory.
Analysis and Evaluation of Alternatives
Analysis of risk:
• Inherent risk factors include valuable inventory that is sub-
ject to theft and misappropriation.
• Internal controls are not uniform. Based on prior year’s evi-
dence and a preliminary understanding of the system in the
current year, strong internal controls appear to operate over
only 60% of the inventory.
• It may be more effi cient to physically inspect inventory as of
one date and use one audit strategy for all inventory testing.
• Fraud risk is considered to be high at locations where inven-
tory controls are not strong.
Conclusions Regarding Audit Strategy for the Existence
of Inventory
• Inherent risk is set at the maximum because inventory is
high in value and susceptible to theft and misappropriation.
• Control risk is set at high, as 40% of inventory may not have
suffi cient internal controls.
• Fraud risk is considered high due to the opportunity off ered
by weak internal controls.
• This results in setting detection risk at low.
• Low detection risk impacts the nature, timing, and extent of
substantive testing. For example, the auditor will plan test-
ing of the physical existence of inventory at year-end, select
a larger number of locations to visit, and vary the extent of
inventory testing at each location depending on internal con-
trols over the counting of inventory at each location.
1. (LO 1) If a prospective new audit client does not allow the
auditor to contact its existing auditor:
a. the auditor should contact the existing auditor anyway because it is their duty.
b. the auditor should consider that a negative factor on the integrity of client management.
c. the existing auditor should contact the new auditor to tell them all about the client.
d. the auditor should respect the prospective client’s right to privacy.
Multiple-Choice Q uestions
CPAexcel
CPAexcel questions and other resources are available in WileyPLUS.
c03RiskAssessmentPartI.indd Page 3-32 24/01/19 9:35 PM F-0590 /208/WB02435/9781119401810/ch03/text_s
Many illustrations, such as work-
ing papers and confirmations,
present documents that students
will encounter in a real-world
audit.
Documentation—Audit Working Papers 5-27
alternative for environmentally conscientious customers. NME operates from three locations and produces a wide range of household products that it sells to supermarkets and specialty stores.
At the front of every audit fi le is a copy of the client’s trial balance that supports the fi -
nancial statements. The trial balance is then referenced into the appropriate lead and support- ing schedules in the audit fi le where audit work is documented for each account in the trial balance. At Bell & Bowerman, LLP, the trial balance is referenced using the letter “A”; cash and cash equivalents in various banks are referenced into the C Lead; accounts receivable are referenced into the E Lead; inventory accounts are referenced into the F Lead; property, plant and equipment are referenced into the K Lead; and so on.
The first working paper example is the cash and cash equivalents lead schedule
(see Illustration 5.8). The purpose of this lead is to summarize all general ledger accounts
that are combined into the cash and cash equivalents account on the financial statements. The lead schedule also has adjusting journal entries, if any, that are proposed by the auditor. In the top-left corner of the lead schedule are the client name, period-end, and currency unit (in this example, balances are rounded to the nearest thousand dollars). In the top center of the lead schedule is section identification (C). In the top-right corner, details of the working paper preparer and reviewers are documented. Next, details of the cash and cash equivalents balance are listed. For each item listed in the lead schedule, the following are noted:
• General ledger account number, per the client records.
• General ledger account name, per the client records.
• Preadjusted balance, any adjustments, and the audit-adjusted current-year balance per the client’s trial balance (TB).
• The prior-year balance, per the prior-year audit fi le (PY).
Bell & Bowerman, LLPClient: New Millennium Ecoproducts
Period-end: 12/31/2022
Currency unit: $000
C–LEAD
Reference: C-Lead
Prepared by: KM 1/21/2023
Reviewed by: SO 1/22/2023
Reviewed by: MM 1/24/2023
Lead schedule:
Account
no. Account name
Pre-
adjusted
balance
12/31/2022Adjustments
Adjusted
current-year
balance
12/31/2022
Prior-year
balance
12/31/2021 Variance
%
VarianceRef
Cash in Bank: Wells Fargo
$ 11,000 $0 $ 11,000TB PY 5% C01
Cash in Bank: U.S. Bank 134 0 134TB PY 0% C02
Cash in Bank: Barclays 126 0 126TB PY 0% C03
Cash in Bank: Citigroup 56 0 56TB PY 12% C0410400
10500
10100
10200
10300
Short -Term Deposits 5,796 0 5,796TB PY 4% C05
Total Cash and Cash
Equivalents
$17,112 $0 $17,112
$ 10,500
134
126
50
5,600
$16,410
$500
0
0
6
196
$702 4%
Key to audit tick marks (TM):
TB Agrees to client’s trial balance.
PY Agrees to prior-year audit file.
Background: No significant changes in banks or bank accounts from the prior period. Note: Analytical review on movements in the cash flows has
been performed on the cash flow schedule — see A1.1.
Comments: Cash and cash equivalents: In line with budget and change consistent with level of activity for the period (see also our review of the
statement of cash flows referenced in A1.1). Short-term deposits: Although the balance is very consistent with previous period, inclusion of
short-term deposits within cash and cash equivalents is acceptable (refer to C5).
ILLUSTRATION 5.8 Working paper example: Cash lead schedule
c05AuditEvidence.indd Page 5-27 1/15/19 9:44 PM f-1241 /208/WB02435/9781119401810/ch05/text_s
Audit Reasoning Examples apply chapter
concepts in brief real-world scenarios that
students might encounter in a professional
environment. They also provide real-world
company examples of chapter concepts.
Professional Skepticism and Audit Risk 3-15
Professional Skepticism
Auditors have a responsibility to plan and perform an audit with professional skepticism. Professional skepticism is an attitude adopted by auditors when conducting all phases of the audit. It means that auditors remain independent of the entity, its management, and its staff
when completing the audit work. In a practical sense, professional skepticism means au-
ditors maintain a questioning mind and thoroughly investigate all evidence presented by the client (AS 1015.07). For example, AU-C 200.A22 states auditors should be skeptical if any of the following arise during the audit:
• Audit evidence recently gathered that is contradictory to other evidence previously gathered.
• New information that brings into question the reliability of client documents or responses to auditor inquiries.
• Conditions that may provide evidence of possible fraud.
• Situations that indicate the need for additional audit procedures beyond what is required by generally accepted auditing standards.
Does maintaining professional skepticism mean auditors should assume client manage-
ment is being dishonest? The answer is no. Auditors should not assume management is dis- honest, but at the same time, auditors should not assume management is always honest or correct. Using professional skepticism means that even if auditors believe management and those charged with governance are being honest, they should gather reliable evidence to sup- port management’s responses to auditor inquiries and to support amounts and disclosures in the fi nancial statements. Throughout all phases of the audit, auditors should keep these questions in mind when gathering audit evidence: Is this information reliable? Do we need to perform more audit procedures? When auditors exercise professional skepticism during the risk assessment phase, it helps to ensure they are using appropriate assumptions when devel- oping their audit strategy that will be used in the risk response phase. In the reporting phase, auditors use professional skepticism when evaluating the evidence gathered and forming an opinion that the fi nancial statements are presented fairly.
professional skepticism an
attitude that includes a question-
ing mind, being alert to condi-
tions that may indicate possible
misstatement due to fraud or
error, and a critical assessment of
audit evidence
Audit Reasoning Ex ample Professional Skepticism
An auditor was auditing a recreational vehicle (RV) dealership. The auditor had obtained some
initial fi nancial information from the client showing unaudited results for the end of the third
quarter. Sales were up and profi t margins were up, making it the best year so far for the client.
Interim records showed that inventory was also up, and the client’s inventory records showed over
300 RVs on hand at the end of the third quarter. The audit senior went to talk to the audit man-
ager about the good news and the client’s performance. The audit manager asked the senior a key
question. “You did the inventory observation last year. How many RVs did the client have then?”
“I think it was about 210,” the senior replied. Then the audit manager asked, “How full was the lot
last year?” The senior replied that it was “almost overfl owing” the year before. The manager then
said, “Let’s look at this more skeptically. I don’t think they have storage capacity for another 90
RVs even though sales are up. There could be an error in the inventory records. This information
makes me believe that the existence of inventory is a very high inherent risk.”
Audit Risk
Audit risk is the risk that an auditor expresses an inappropriate audit opinion when fi nancial
statements are materially misstated (AU-C 200 Overall Objectives of the Independent Auditor
and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards and
AS 1101 Audit Risk). This means the audit report states the fi nancial statements are presented
fairly, in all material respects, when in actuality the fi nancial statements contain a material
error or fraud. While it is impossible to eliminate audit risk, auditors aim to reduce it to an
c03RiskAssessmentPartI.indd Page 3-15 24/01/19 9:35 PM F-0590 /208/WB02435/9781119401810/ch03/text_s
3-28 CHAPTER 3 Risk Assessment Part I
• Ongoing losses.
• Rapid growth.
• Poor cash fl ows combined with high earnings.
• Pressure to meet market expectations and profi t targets.
• Planning to list on a stock exchange.
• Planning to raise debt or renegotiate a loan.
• The client being about to enter into a signifi cant new contract.
• A signifi cant proportion of remuneration tied to earnings (that is, bonuses or stock options).
Audit Reasoning Ex ample Fraud at Toshiba: Part I
You may be familiar with Toshiba Corporation, a publicly traded Japanese company headquar-
tered in Tokyo that makes consumer electronics, household electronics, offi ce equipment, and more. In July 2015, the CEO of Toshiba announced he was resigning amid an accounting scandal in which profi ts had been overstated for the past seven years by approximately $1.9 billion (224.8
billion yen). What incentives and pressures were involved that led to the fraud? The technology industry is extremely competitive and Toshiba’s upper management set aggressive profi t targets.
The home electronics and appliances division was showing losses and the memory chip division was feeling pressure because of decreasing demand from Chinese electronics companies.
6
As an
example, in September 2012, the head of the digital products and service division was told by the CEO to improve a 24.8 billion yen loss into a 12 billion yen profi t in just three days!
7
Think about
how the external auditor would learn about the incentives given to lower-level management. How might an internal auditor learn about these incentives?
Opportunities to Perpetrate a Fraud
After identifying one or more incentives or pressures to commit a fraud, auditors assess
whether a client’s employees have an opportunity to perpetrate a fraud. Auditors utilize their
knowledge of how other frauds have been perpetrated to assess whether the same opportuni-
ties exist at the client. While the examples below of opportunities to commit a fraud suggest
a fraud may have been committed, their existence does not mean a fraud has defi nitely oc-
curred. Auditors must use professional judgment to assess each opportunity in the context of
other risk indicators and consider available evidence thoroughly.
Examples of opportunities that increase the risk that a fraud may have been perpetrated
include:
• Accounts that rely on estimates and judgment (discussed further in Chapter 9).
• A high volume of transactions close to year-end.
• Signifi cant adjusting entries and reversals after year-end.
• Signifi cant related-party transactions (discussed further in Chapter 4).
• Poor corporate governance mechanisms.
• Poor system of internal control (discussed further in Chapters 6 and 8).
• A high turnover of staff with accounting or internal control responsibilities.
6
E. Pfanner and M. Fujikawa, M. “Toshiba Slashes Earnings for Past Seven Years,” The Wall Street Journal,
September 7, 2015. https://www.wsj.com/articles/toshiba-slashes-earnings-for-past-7-years-1441589473
7
K. Nagata. “Pressure to show a profi t led to Toshiba’s accounting scandal,” The Japan Times, September 18,
2015. http://www.japantimes.co.jp/news/2015/09/18/business/corporate-business/pressure-to-show-a-profi t-
led-to-toshibas-accounting-scandal/#.WNJjNmQrLjA
c03RiskAssessmentPartI.indd Page 3-28 24/01/19 9:35 PM F-0590 /208/WB02435/9781119401810/ch03/text_s