AUDITING A PRACTICAL APPROACH WITH DATA ANALYTICS 2ND EDITION BY RAYMOND N JOHNSON, LAURA DAVIS WILE

TEST BANK

AUDITING A PRACTICAL APPROACH WITH DATA ANALYTICS 2ND EDITION BY RAYMOND N JOHNSON, LAURA DAVIS WILEY, ROBYN MORONEY, FIONA CAMPBELL, JANE HAMILTON (CHAPTER 1_16) SOLUTIONS MANUAL Chapter 1-16

CHAPTER 1 Introduction and Overview of Audit and Assurance Learning Objectives 1.

2.

3.

4.

5.

6.

7.

8.

Differentiate among assurance, attestation, and auditing services.

Describe the different types of assurance services.

Explain the demand for audit and assurance services.

Discuss the different roles of the financial statement preparer and the auditor.

Identify the roles of different regulators and organizations that affect the audit profession.

Explain the concepts of reasonable assurance, materiality, and the nature of an unqualified/unmodified report on the audit of financial statements.

Explain the concept of reasonable assurance and the nature of an unqualified report on internal controls over financial reporting.

Discuss the audit expectation gap.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Assurance, Attestation, and Audit Services

2. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Different Assurance Services

3. B LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Different Assurance Services

4. C LO 2, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Different Assurance Services

5. C

For Instructor Use Only

LO 3, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Demand for Audit and Assurance Services

For Instructor Use Only

6. B LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Preparers and Auditors

7. A LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: The Role of Regulators and Regulations

8. D LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA BC: Governance Perspective, Section: The Role of Regulators and Regulations

9. D LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Report on Financial Statements

10. C LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Audit Report on the Financial Statements

11. B LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Audit Report on Internal Controls over Financial Reporting

12. B LO 8, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA PC: Professional Behavior, Section: The Audit Expectation Gap

ANSWERS TO REVIEW QUESTIONS

R1.1 An assurance service is any service provided by an independent practitioner that improves the quality of information, or its context, for decision makers. An independent practitioner can verify that the information meets relevant criteria, which provides assurance to users who intend to use the information for decision making. An assurance engagement has three parties: the assurance provider (auditor/practitioner), the party responsible for providing the information (client), and the intended users of the information (investors/lenders/others who rely on the information).

LO 1, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Assurance, Attestation, and Audit Services

R1.2 The criterion used in a financial statement audit to measure and evaluate subject matter is the applicable financial reporting framework used by the client. The most common framework

For Instructor Use Only

used in the U.S. is Generally Accepted Accounting Principles (GAAP).

LO 1, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Measurement Analysis and Interpretation, Section: Assurance, Attestation, and Audit Services

R1.3 Financial statements are not guaranteed to be free from error or fraud due to several limitations. These limitations include the nature of financial reporting, the nature of audit procedures and the need for the audit to be conducted within a reasonable period of time and within a reasonable budget. The nature of financial reporting causes limitations because it includes management‘s judgment when applying accounting standards and estimates. The nature of the audit procedures is a limitation because the auditors have to rely on management to provide all the necessary documentation needed for the audit. The auditor may arrive at an inappropriate conclusion if information is tampered with or excluded. The last limitation refers to the limited resources of time and money for an audit engagement. It would be impractical for auditors to examine every transaction. Therefore, auditors rely on sampling measures to provide an accurate representation of the population, and sampling cannot provide absolute assurance.

LO 2, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Different Assurance Services

R1.4 Management and those charged with governance can request an operational audit to help improve the efficiency and effectiveness of a company‘s operations. An organization‘s internal audit department typically conducts operational audits.

LO 2, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA BC: Governance Perspective, Section: Different Assurance Services

R1.5 Investors are interested in the information that financial statements can provide about their investment. This includes, but is not limited to, information regarding the profitability of the company, return on investment, going concern/continuity of operations, and dividend distributions.

An independent audit helps to ensure that the information in the financial statements is credible and of high quality.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA BC: Governance Perspective, Section: Demand for Audit and Assurance Services

R1.6 Both the preparer and the auditor have responsibilities regarding the company‘s financial statements. Management (the preparer) is in charge of preparing the financial statements. This includes ensuring the information is presented fairly and in compliance with GAAP, or other applicable financial reporting framework. Management is responsible for designing, implementing, and maintaining internal control over financial reporting, as well as providing auditors with all the necessary documentation and personnel needed to complete the audit. Auditors are responsible for providing an opinion on whether the financial statements are presented fairly and in accordance with the applicable financial reporting framework. The three responsibilities of auditors are to conduct the audit in accordance with the appropriate audit standards, plan and perform the audit with professional skepticism, and exercise professional judgment.

LO 4, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Reporting, Section: Preparers and Auditors

For Instructor Use Only

R1.7 The SOX Act of 2002, which emphasized a need for better governance over financial reporting, created the Public Company Accounting Oversight Board (PCAOB). The PCAOB is a non-profit corporation established to oversee the audits of public companies. The U.S. Securities and Exchange Commission (SEC) is a federal government agency whose role is to enforce and interpret securities laws. The SEC approves each new auditing standard established by the PCAOB before it can be implemented. The SEC and PCAOB work closely together to ensure standards are in place for both public companies and auditors to safeguard investors.

LO 5, BT: C, Difficulty: Medium, TOT: 10 min., AACSB: None, AICPA AC: Reporting, Section: The Role of Regulators and Regulations

R1.8 Some functions of the state boards of accountancy include issuing Certified Public Accountant (CPA) licenses, adopting and enforcing professional conduct rules for CPAs, enforcing continuing professional education requirements, and administering disciplinary actions. The National Association of State Boards of Accountancy (NASBA) is a professional organization that works to unite the interests of the 55 jurisdictions of state boards with regulative and legislative bodies.

LO 5, BT: AP, Difficulty: Easy, TOT: 10 min., AACSB: Analytic, AICPA PC: Professional Behavior, Section: The Role of Regulators and Regulations

R1.9 The principles of Generally Accepted Audit Standards (GAAS) start with the purpose of an audit, which is to provide an opinion on whether a company‘s financial statements are presented fairly and in accordance with GAAP. The next principle describes the premise upon which an audit is conducted. This outlines management‘s responsibility to prepare the financial statements in accordance with the applicable framework, manage and maintain internal controls over financial reporting, and provide the auditor with access to all documentation relevant to conduct the audit. The next principle outlines the responsibilities of the auditor, which explicitly states auditors have to be competent, comply with auditing standards, maintain professional skepticism and exercise professional judgment during an audit. While performing an audit, an auditor must obtain reasonable assurance that the financial statements are free from material misstatement, but also recognize it is not an absolute assurance due to several limitations. The last principle states that auditors must report the results of the audit in a formalized written report.

LO 5, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Reporting, Section: The Role of Regulators and Regulations

R1.10 Audit reports for private and public companies are very similar in content. Both reports contain the essential components: a title with the word ―independent,‖ an address to the shareholders/owners and board, identification of which financial statements were audited, an opinion on the outcome, a description of the responsibilities of the parties involved, a description of the conduct of an audit, a signature with the firm‘s name and a date indicating the end of fieldwork.

However, there are a few differences between the two. The title for an audit report of a public company includes the term ―registered‖ indicating the firm is registered with the PCAOB. Audit reports for public companies state the auditor is required to be independent from the company in accordance with U.S. federal securities laws and with regulations of the SEC and PCAOB. The report for a public company includes a paragraph referencing the audit of the firm‘s internal

For Instructor Use Only

controls over financial reporting. Public companies are required to have two audits, one for financial statements and the other for Internal Control over Financial Reporting (ICFR); whereas private companies are not required to have an audit of ICFR. A report of a public company will indicate the audit was performed in accordance with the standards of the PCAOB, whereas a private company report will indicate the audit was conducted in accordance with GAAS (issued by the AICPA). Finally, auditors must provide a statement about auditor tenure at the bottom of the audit report for public companies and must also include a section for the discussion of critical audit matters (CAM). Neither of these features is required for an audit report for a private company client.

LO 6, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Reporting, Section: Audit Report on Financial Statements

.11 The components of an auditor‘s report on internal controls over financial reporting include the title, address, opinion, reference to the financial statement audit, basis for opinion paragraph, scope paragraph, definition and limitations paragraph, signature and date. The title must include two important terms—―independent‖ and ―registered‖—signifying the auditor‘s independence and that the firm is registered with the PCAOB. The report is addressed to the board and shareholders of the company. The opinion paragraph states that an audit of the company‘s internal controls was conducted using the COSO Internal Control-Integrated Framework as the criteria, and then states whether or not the company maintained effective internal control. The next paragraph references the audit of the company‘s financial statements since public companies require two audits. The basis for opinion paragraph briefly describes the responsibilities of management and the auditor and mentions that auditors are required to be independent from the company. The scope paragraph briefly describes how an audit of ICFR is conducted. The definition and inherent limitations paragraph defines ICFR for users unfamiliar with the terminology and emphasizes that internal controls will not be able to prevent or detect all misstatements or errors. The report is signed by the firm and dated to represent the end of the fieldwork.

LO 7, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Reporting, Section: Audit Report on Internal Controls over Financial Reporting

R1.12 The audit expectation gap occurs when the auditor‘s professional responsibilities do not align with the financial statement users‘ beliefs. This gap is created when the user has unrealistic expectations for the audit. Some examples of unrealistic expectations are as follows:  the user may believe the auditor is providing absolute assurance instead of reasonable assurance,  the user may believe the auditor is guaranteeing future viability of the company,  the user may believe a favorable audit conclusion indicates complete accuracy instead of no material misstatements,  the user may believe the auditor will find any and all fraud when that is simply impossible, and  the user may believe the auditor has tested every transaction instead of a sample.

It is impossible for professional auditing standards to give users what they want because of inherent limitations with the conduct of an audit, such as the cost of an audit and completing the audit in a reasonable time frame.

For Instructor Use Only

Auditors sometimes do not meet professional standards because of time constraints in completing the audit (possibly being short staffed), not exercising enough professional skepticism, and not maintaining professional competence through continuing professional education.

LO 8, BT: AN, Difficulty: Medium, TOT: 10 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: The Audit Expectation Gap

SOLUTIONS TO ANALYSIS PROBLEMS

AP1.1 Although internal and external audit are different professional fields, they share some similar responsibilities. Both fields follow rules and regulations made by their respective professional organizations, the Institute of Internal Auditors (IIA) and the American Institute of Certified Public Accountants (AICPA). Additionally, external auditors of public companies must adhere to regulations set forth by the PCAOB and SEC. Internal auditors are typically employees of the organization and therefore cannot have the same level of independence from the organization as an external auditor can. Nevertheless, internal auditors are required to maintain independence from management to ensure objectivity and an unbiased attitude. External auditors cannot be employees of the audit client, and they must adhere to strict independence guidelines to ensure there are no conflicts of interest in performing the audit engagement.

The most common role for internal auditors is to monitor internal controls and improve the effectiveness of controls, governance, and risk management strategies. Internal auditors report their results to those charged with governance and typically do not report findings to the public. The role of the external auditors is to express an opinion on the fair presentation of the client‘s financial statements in accordance with the applicable financial reporting framework. For certain public company clients, external auditors also provide an opinion on the effectiveness of the client‘s internal controls over financial reporting. The external auditors report their opinion(s) to those charged with governance, and for public company clients, to interested users outside of the client.

LO 1, 2 BT: AN, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, Technology, AICPA AC: Research, Section: Assurance, Attestation, and Audit Services, Different Assurance Services

AP1.2 Users demand audited financial statements for various reasons. If the accounting firm performing the audit is perceived as incompetent, not independent, or unethical, then the value of the audit service is lost. Users will not be confident that the information management presents in the financial statements is unbiased and reliable. If users think the financial statements are unreliable, then they may not invest in the company, do business with the company, or lend money to the company. Therefore, a company does not want to be associated with an accounting firm that has a poor reputation or that is in violation of professional standards. That is why clients dropped Arthur Andersen after charges were brought against the firm.

LO 3, BT: AP, Difficulty: Hard, TOT: 15 min., AACSB: Analytic, AICPA PC: Professional Behavior, Section: Demand for Audit and Assurance Services

For Instructor Use Only

AP1.3 The solution will depend on the accounting firm chosen and the date of the analysis.

However, the answers should show for the Big 4: greater geographic coverage, larger numbers of staff and broader range of skills offered, greater claims to specialization and industry coverage, more publications available (particularly from the international offices), more consistent and sophisticated marketing.

LO 3,4, BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, Technology, AICPA AC: Research, Section: Demand for Audit and Assurance Services, Preparers and Auditors

AP1.4 a. Financial statement audits are mandatory for public companies, so overall demand is largely fixed or determined by economic conditions affecting the number of companies. However, for organizations that are not required by legislation to have an audit, there are two opposing pressures in times of economic recession. First, cost-cutting would result in fewer audits. Second, organizations with less credible financial statements will face the most difficulty in borrowing during a credit squeeze. This suggests that demand for auditing will increase in difficult times, because an audit will increase the credibility of the financial statements and thus increase access to external financing. b. Shifting from a mid-tier auditor to a Big 4 auditor would increase both costs and financial statement credibility for a company. Therefore, it can be argued that companies with greater need to reduce costs will shift ―down‖ from Big 4 auditors to mid-tier auditors, but companies with greater need for credibility (and financial advice) will shift ―up‖ from mid-tier auditors to Big 4 auditors.

LO 3, 4 BT: AP, Difficulty: Hard, TOT: 15 min., AACSB: Analytic, AICPA BC: Customer Perspective, Section: Demand for Audit and Assurance Services, Preparers and Auditors

AP1.5 The solution will vary based on the states selected by the student to research. In general, most states require a bachelor‘s degree and relevant accounting and business courses.

Some states, such as Texas and Colorado, require an ethics course. Some states allow candidates to sit for the CPA exam after completing a bachelor‘s degree with the relevant accounting courses, but a total of 150 hours of college credits are required to be licensed as a CPA. In addition to passing the CPA exam and meeting the education requirements, most states require 12 years of work experience in public accounting to be licensed.

LO 5, BT: AN, Difficulty: Basic, TOT: 20 min., AACSB: Technology, AICPA AC: Research, Section: The Role of Regulators and Regulations

AP1.6 To be registered with the PCAOB, a firm must complete a 27-page application (Form 1) and pay the required fees. The purpose of Form 1 is to capture information about the firm including contact information, number of employees, types of clients serviced by the firm, any ongoing or pending criminal or civil actions against the firm, quality control procedures, and names of issuers that the firm expects to provide audit services to in the current year. Form 1 is signed by a partner or authorized officer of the firm. The application fee is $500 for a firm that audits less than 50 issuers, $3,000 for a firm that audits 50-100 issuers, $29,000 for a firm that audits 101-1000 issuers, and $390,000 for a firm that audits 1001 or more issuers.

Once a firm is registered, annual fees are $100,000 for firms with more than 500 issuer

For Instructor Use Only

audit clients and more than 10,0000 personnel, $25,000 for firms with more than 200 issuer clients and more than 1,000 personnel, and $500 for all other firms. Registered firms have to file an annual report with the PCAOB on Form 2. Form 2 captures any updated information related to the firm and its audit clients, affiliations with other firms, and on-going or pending criminal or civil actions against the firm.

Registered firms must abide by PCAOB regulations and consent to be inspected on a regular basis. Firms that audit 100 or more issuers per year are inspected annually. Firms that audit less than 100 issuers per year are inspected once every three years.

LO 5, BT: C, Difficulty: Basic, TOT: 20 min., AACSB: Technology, AICPA AC: Research, Section: The Role of Regulators and Regulations

AP1.7 a. 1 b. 4 c. 6 d. 9 e. 8 f. 5 g. 9 h. 7 i. 1 j. 2 LO 5, BT:C, Difficulty: Easy, TOT: 15 min, AACSB: Technology, AICPA AC: Research, Section: The Role of Regulators and Regulations

AP1.8 1. C 2. B 3. C 4. B 5. A 6. B 7. C 8. B 9. A 10. C LO 6, 7 BT: C, Difficulty: Easy, TOT: 20 min, AACSB: Analytic, Technology, AICPA AC: Research, Reporting, Section: Audit Report on Financial Statements, Audit Report on Internal Controls over Financial Reporting

For Instructor Use Only

AP1.9 a. Answers may vary depending on which public company is selected to compare with the Amazon.com reports. Most likely both companies will have unqualified opinions on both the financial statements and internal controls. b. All accounting firms follow the standard audit report formats provided by the ASB (for private company audits) and the PCAOB (for public company audits). Having a uniform report format promotes consistency in the profession and is easier for financial statement users to understand.

LO 6, 7, BT: AN, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, Technology, AICPA AC: Research, Reporting, Section: Audit Report on Financial Statements, Audit Report on Internal Controls over Financial Reporting

AP1.10 Dear Kim, I enjoyed eating dinner with you the other night, old friend. I am writing to you because you had a difficult time understanding the audit profession and a few of its important aspects. I will describe to you the concept of ―reasonable assurance‖ and how it is determined, the ―professional skepticism‖ that all auditors must practice, and why your perceptions are a great example of what is called the ―expectations gap.‖ As auditors of a company, we are required to give our opinion on the level of confidence we have in the reliability that the financial statements are free of material misstatement. This confidence level is called ―reasonable assurance.‖ It is determined by using our professional judgment and by acquiring a significant amount of evidence to support this assurance. We cannot offer absolute assurance because there are several factors that make it impossible for us to detect every misstatement. First, we have a limited time to conduct the audit, therefore we cannot audit everything. We focus our time on the most impactful, or material, items on the financial statements. Second, there is a risk that management can collude to hide information or provide false information to us, but fraud is not a common occurrence. Finally, some items on the financial statements are subjective and can be very complex to audit. We cannot provide absolute assurance on an item that is subjective. ―Professional skepticism‖ is a concept that means auditors must have a state of awareness about the factors that could lead to material misstatement, be critical of the evidence and documents they receive from an organization‘s management and have a questioning attitude overall.

Although we are skeptical of management, this does not mean that we believe they are constantly trying to deceive us. There are many situations where we must rely on the information provided to us by the client‘s management team.

The perceptions that you had during dinner about the audit profession are a perfect example of the ―expectations gap.‖ We define the expectations gap as the difference between what the public believes auditors are providing and what the auditing profession is actually capable of doing.

Now that you have read my explanations of reasonable assurance and professional skepticism,

For Instructor Use Only

I hope I have provided you with a more realistic impression of my profession. Hope we can get together for dinner again soon!

Sincerely, LO 4, 6, 8 BT: S, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, Communication, AICPA PC: Communication, Section: Prepares and Auditors, Audit Report on Financial Statements, The Audit Expectations Gap

AP1.11 a. An audit is limited due to several factors. The nature of financial reporting causes a limitation of the audit. This refers to the subjectivity involved when a company is deciding which accounting methods or estimates to use. It can be difficult to audit an item that has been created based on judgment. Another limitation is the nature of audit procedures. Auditors select audit procedures that will detect material misstatements, as it is too costly to try and detect all misstatements. Also, auditors use sampling techniques when gathering evidence related to some financial statement items. A limitation of sampling is that the sample may not be representative of the population and the auditor will draw an incorrect conclusion. Finally, one of the bigger limitations auditors face is that of time. There is a need for an audit to be conducted within a reasonable period of time and at a reasonable cost. This time constraint on the audit can cause auditors to perhaps rush their work and not be as diligent as they would be otherwise. b. When looking at the reports in figures 1.7, 1.8, and 1.10 in Chapter 1, you can see these limitations referenced. The reports mention the reasonableness of accounting estimates, which refers to the subjectivity limitation. Also, you see the word ―material‖ in all three of these audit reports. Auditors are only concerned with material misstatements that could affect the decisions of financial statement users. Reasonable assurance is mentioned in every report. It is because of these limitations that auditors provide only reasonable assurance. Defined as a high, but not absolute, level of assurance, reasonable assurance means the auditor does not ―guarantee‖ that the financial statements are 100% accurate. Finally, the audit reports in Illustrations 1.7 and 1.8 include the phrase ―procedures included examining, on a test basis,‖ which refers to the limitation of using sampling. The auditor does not test all information, ; therefore, sampling risk exists.

LO 2, 4, 6, 7, 8 BT: AN, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Reporting, Section: Different Assurance Services, Preparers and Auditors, Audit Report on Financial Statements, Audit Report on Internal Controls over Financial Reporting, The Audit Expectation Gap

For Instructor Use Only

Cloud 9 a. A financial statement audit only focuses on determining if the financial statements are prepared according to the applicable financial reporting framework. A financial statement audit must be performed by an independent accounting firm under the supervision of a CPA. A compliance audit is performed to determine if an entity has followed rules, laws, or regulations with which it is required to conform. A compliance audit does not have to be performed by a CPA, but it must be performed by someone designated or approved by the body that enforces the rules, laws, or regulations. An operational audit focuses on the efficiency and effectiveness of an entity‘s activities. Typically, an operational audit is performed by employees of the company, but it can also be outsourced. The individual(s) performing the audit does not have to be independent and does not have to be a CPA. b. Reasonable assurance is a high level of assurance, but it is not absolute assurance. Absolute assurance implies a level of service that is akin to a guarantee or a certification. Because of the limitations of an audit (time constraints, subjectivity, and the nature of audit procedures), auditors can only provide reasonable assurance. c. An audit is more in depth and broader in scope than a review. An audit also provides a higher level of assurance, reasonable assurance as compared to a review, which only provides limited assurance. Since Chip is considering purchasing Stotez shoes, he would likely require more assurance that the financial statements are fairly presented and the information in the financial statements is reliable. d. Ron should consider the reputation of the firm and whether the firm has the expertise to conduct an audit of a company in the sports footwear industry. Since Ron‘s company is small, he would most likely consider using a regional or mid-tier firm because their work is tailored to companies of his size.

LO 1, 2, 3, 4, 6, BT: AN, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Reporting, Section: Assurance, Attestation, and Audit Services, Different Assurance Services, Demand for Audit and Assurance Services, Preparers and Auditors, Audit Report on Financial Statements

For Instructor Use Only

CHAPTER 2 Professionalism and Professional Responsibilities Learning Objectives   3.

4.

5.

6.

7.  

Explain what it means to be a professional and how these traits apply to auditors. Explain the structure of the AICPA Code of Professional Conduct. Apply the conceptual framework approach to ethical decision making for members in public practice.

Evaluate the ethical behavior needed to comply with rules of conduct on integrity and objectivity.

Evaluate the ethical behavior needed to comply with rules of conduct on independence.

Evaluate the ethical behavior needed to comply with rules of conduct on general standards.

Evaluate the ethical behavior needed to comply with other rules of conduct for members in public practice.

Evaluate an auditor‘s legal liability under common law. Evaluate an auditor‘s legal liability under statutory law.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

2. D LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

3. A LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

4. D LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

5. A LO 5, BT: E, Difficulty: Moderate, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

6. C

LO 5, BT: E, Difficulty: Moderate, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

7. D

LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

For Instructor Use Only

8. C LO 5, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

9. D LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Ethics

10. B LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Ethics, AICPA PC: Professional Behavior

11. D LO 8, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Professional Behavior

12. C LO 8, BT: AP, Difficulty: Moderate, TOT: 2 min., AACSB: None AICPA PC: Professional Behavior

13. B LO 9, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, AICPA PC: Professional Behavior

14. A LO 9, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, AICPA PC: Professional Behavior

For Instructor Use Only

ANSWERS TO REVIEW QUESTIONS R2.1 An Auditor’s concern for the public interest comes from the practitioner’s work and the recognition by practitioners of an obligation to society. Upon becoming licensed as a CPA, individuals also agree to accept the responsibility to follow professional standards (e.g., accounting and auditing standards), and a code of professional conduct (usually written into state rules or law). It is also important for auditors to be independent of management when serving the public interest. The public expects auditors to provide reasonable assurance that financial statements are free of material misstatement.

LO 1, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: Ethics, AICPA PC: Ethics

R2.2 The question is answered in the table below: Architecture

Public Accounting

Recognized by a Knowledge of building codes specialized body of and how to build structures knowledge

Auditing or Tax knowledge

To become a licensed architect A formal education a candidate must graduate from an accredited architecture process program (or its equivalent)

To become a CPA a candidate must complete150 semester hours of education including requirements in accounting and business

Standards govern- To become a licensed architect, ing admission to a candidate must complete an the profession education requirement, pass a professional exam, and complete an experience requirement

To become a licensed CPA a candidate must complete the state‘s education requirement, pass the CPA exam, and complete an experience requirement

Adherence to a code of ethics

Architects must follow the Code of Ethics and Professional Conduct of the American Institute of Architects

CPAs must follow the Code of Ethics of the state where they are licensed. AICPA members must also follow the AICPA Code of Professional Conduct.

Recognized status indicated by a license

State governments (through state boards of architect examiner) grant a license to practice architecture

State governments (through state boards of accountancy) grant a CPA license to practice public accounting

For Instructor Use Only

A public interest in The public interest in the work the work that of architects relates to building practitioners per- safety form

The public interest in the auditor‘s work related to the public‘s reliance on the auditor‘s opinion about the fair presentation of financial information. Tax accountants have a duty to the public regarding compliance with tax laws.

Recognition by practitioners of an obligation to society

Accountants have an obligation to ensure that fair presentation in financial statements supersedes their obligation to their clients.

The same is true for compliance with tax laws.

Architects recognize an obligation to follow building codes and at times put the public safety ahead of the wishes of their clients

LO 1, BT: S, Difficulty: Challenging, TOT: 20 min., AACSB: Ethics, AICPA PC: Ethics

R2.3 The AICPA’s Code of Professional Conduct (the Code) provides guidance to all members of the AICPA with respect to performance of their responsibilities. The Code consists of principles, rules, interpretations, and other guidance for AICPA members.

Part 1 of the Code includes rules for members in public practice (usually CPA’s) in CPA firms, Part II of the Code includes ethical rules for members in business (such as a CFO, a controller, or an accountant working in industry or government), and Part III includes ethical rules for other members (e.g., non-CPA members of the AICPA).

LO 2, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Ethics, AICPA PC: Ethics

R2.4 In this instance, the CPA’s best friend is the CFO of a new audit client. This causes two significant threats. First, a familiarity threat may exist due to a long relationship (the CPA’s best friend from college). A CPA may become too sympathetic to the client’s interests or too accepting of the client’s work or product. Second, a possible advocacy threat may exist due to the fact that the CPA may promote the client’s position to the point that his or her objectivity or independence is compromised.

The threats are significant and a safeguard exists if the CPA is not a partner in the office where the professional engagement takes place or in a position to influence the outcome of the engagement.

For Instructor Use Only

The safeguard would be for the CPA not to be involved in the prospective client’s audit engagement or if the non-partner CPA is involved, the work of the CPA must be reviewed by a partner in the CPA firm. This could reduce the threat to an acceptable level.

LO 2, 3, BT: E, Difficulty: Moderate, TOT: 15 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

R2.5 A self-interest threat exists because the new client’s audit fees will represent 25% of the audit firms ’revenues. In this case the threat exists from the large portion of the firm’s revenues to be derived from the audit of the prospective client. The reliance on such a large portion of the firm’s revenues may cause undue pressure from the prospective client regarding their audit (or loss of the client’s audit).

The self-interest threat is significant, but likely can be safeguarded. The tone at the top of the firm needs to emphasis integrity and objectivity in the audit work, and not subordinating judgment to that of the client. The audit engagement should be reviewed by a second partner not associated with the engagement prior to issuing the audit report. If the CPA is a sole practitioner, the CPA should have the work reviewed by another firm prior to issuing an opinion.

LO 2, 3, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

R2.6 The integrity and objectivity rule involves the performance of any professional service, wherein a member shall maintain objectivity and integrity; shall be free of conflicts of interest and shall not knowingly misrepresent facts or subordinate his or her judgment to others.

A CPA should not have a conflict of interest if a CPA or CPA firm provides professional service related to a particular matter involving two or more clients whose interests, with respect to that matter, are in conflict. This could be two clients (e.g., husband and wife) at the same time, who are in a legal dispute (e.g., divorce) with each other. A safeguard may be to use separate engagement teams who are provided clear policies and procedures on maintaining confidentiality, Further, a CPA should not knowingly misrepresent material facts, such as knowingly overstating earnings, as this could cause a material misstatement in the company’s financial statement.

A CPA should not give an unqualified or an unmodified opinion on financial statements that the CPA believes have a material misstatement.

A CPA in public practice should not subordinate his or her judgment to the judgment of others in the firm, such as going along with the opinion of another member of the audit team without doing independent research on a matter that is the CPA’s responsibility. A CPA in public practice should research the issue and present an alternative position if the CPA believes their firm is reaching the wrong decision.

For Instructor Use Only

LO 4, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: Ethics, AICPA PC: Ethics

R2.7 Yes, it is appropriate as a CPA firm must manage the appearance of independence. A CPA or an immediate family member, having an ownership interest in an attest client, are examples of the types of activities that impair the appearance of independence for a CPA firm. Therefore, it is important for a CPA firm to ask questions of an employee about his or her investments or the investments of his or her spouse (or immediate family member) to avoid the independence in appearance for the firm and its clients.

Section 1.200 of the Code specifies a number of circumstances that can impair the appearance of independence to guide CPAs in observable aspects of ethical conduct that is targeted to situations where CPAs may appear to have a conflict of interest. As a result, a CPA must think both about how his or her own activities could cause a threat to independence, as well as the activities of his or her spouse or other family members that could threaten independence. Refer to Illustration 2.5 for definitions of a covered member and activities that impair independence.

LO 5, BT: AN, Difficulty: Easy, TOT: 10 min., AACSB: Ethics, AICPA: PC: Ethics

R2.8 When a professional employee of a CPA firm leaves the firm and is subsequently employed by a firm’s attest client, independence can be impaired inasmuch as the professional employee may have continuing relationships, such as payout of the pension plan, with the CPA firm. Also, if the employee goes to work for an attest client, that employee may be familiar with the audit plan and/or staff working on the engagement, and there is a familiarity and undue influence risk that the former employee could influence the engagement. When a member of the attest engagement team or an individual in a position to influence the attest engagement intends to discuss potential employment from an attest client, independence will be impaired with respect to the client unless the CPA promptly reports such consideration or offer to an appropriate person in the firm, and removes himself or herself from the engagement until the employment offer is rejected or employment with the audit client is no longer being sought.

LO 3, 5, BT: AP, Difficulty: Moderate, TOT: 10 min., AACSB: Ethics, AICPA PC: Ethics

R2.9 The SEC and PCAOB rules related to auditor independence rules for public companies are stricter than the AICPA rules that apply to non-public entity audits. The following table lists a few instances and provides examples of how they are different.

For Instructor Use Only

Independence Issue

Example

Bookkeeping and financial statement preparation

The Sarbanes Oxley Act (SOX) of 2002 prohibits CPA firms from doing any bookkeeping or financial statement preparation services for a public company attest client.

The AICPA rules allow CPAs to do some bookkeeping and to prepare financial statements for a non-public audit client as long as they comply with the rules on non-attest services (ET 1.1295.000)

Internal Audit Outsourcing

The Sarbanes Oxley Act (SOX) of 2002 prohibits CPA firms from performing internal audit services for a public company attest client.

The AICPA rules allow CPAs to do perform internal audit services for a non-public audit client as long as they comply with the rules on non-attest services (ET 1.1295.000)

Financial Information System Design

The Sarbanes-Oxley Act of 2002 prohibits CPA firms from performing financial information system design and implementation services for a public company attest client.

The AICPA rules allow CPAs to help a client with financial information system design in an advisory capacity as long as the client makes final decisions. Implementation is more difficult for a CPA as it requires performing management functions that would impair independence. The key rules are the rules on nonattest services (ET 1.1295.000)

LO 5, BT: AP, Difficulty: Moderate, TOT: 15 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

R2.10 The AICPA Code of Professional Conduct lists the following 4 four aspects: a. Professional competence states that a CPA may undertake only those professional services that the member or members firm can reasonably expect to be completed with professional competence. An example of this standard exists when a CPA does not have sufficient competence to complete the engagement. For example, if an member who performs only audit services is approached by a client to perform tax services, the member should refer the engagement to another CPA with the appropriate qualifications. Alternatively, the CPA would have to develop the competence needed to perform the tax engagement before the work starts.

For Instructor Use Only

b.

The due care standard expects CPAs to exercise the professional care that would be expected of other CPAs performing the same work. For example, in the audit engagement, this would include following Generally Accepted Auditing Standards (GAAS).

c.

The planning and supervision standard states all engagements should be adequately planned and supervised. If a CPA is working on a review of financial statements, or a tax engagement, both engagements need to be adequately planned and supervised.

d.

In the performance of any professional services, CPAs should obtain sufficient, relevant information. The level of information relates to the services performed, and a CPA performing an audit engagement will need sufficient, competent evidence. A CPA preparing a tax return will need information that is appropriate sufficient and relevant to perform the engagement.

LO 6, BT: AP, Difficulty: Moderate, TOT: 15 min., AACSB: Ethics, AICPA PC: Ethics

R2.11 Henry Owens and the firm do not need to be independent to prepare tax returns or compiled financial statements. Henry and his firm are not in violation of the Code of Professional Conduct by taking on the contingent fee engagement to prepare a claim for damages from BP, based on ET 1.510 on Contingent Fees and ET 1.520 on Commissions and Referral Fees. However, when the firm prepares quarterly compiled financial statements it needs to state that the firm is not independent of the client.

LO 7, BT: E, Difficulty: Challenging, TOT: 15 min., AACSB: Ethics, AICPA PC: Ethics and Decision Making

R2.12 A third party may be defined as an individual, who is not the client, but who used the client’s audited financial statements in his or her decision making. In general, the plaintiff must prove the following when suing an auditor:  The auditor owed a duty of care to the plaintiff. The level of care owed to the plaintiff depends on state laws regarding privity. For example, under the Restatement of Torts standard the auditor owes a duty of care to any foreseen users of financial statements.  The auditor breached the duty by failing to act with due care (negligence). For example, an auditor would be negligent by failing to follow Generally Accepted Auditing Standards (GAAS).  The auditor‘s negligence was the proximate cause of the plaintiff‘s damage. For example, the plaintiff must show that they relied on the audited financial statements and that reliance was the proximate cause of the plaintiff‘s losses.  The plaintiff had actual damages. The plaintiff must show that the auditor‘s failure to follow GAAS resulted in damages (e.g., loss of an investment based on the financial statements). LO 8, BT: AP, Difficulty: Moderate, TOT: 15 min., AACSB: None, AICPA: None

For Instructor Use Only

R2.13 Because John Rodriguez purchased bonds in the primary market (e.g. a new issue of securities) the Securities Act of 1933 applies. John only needs to prove: 1. That he acquired the securities described in the registration statement, 2. That he incurred a loss, and 3. The financial statements included in the registration statement were materially false or misleading, LO 9 BT: A, Difficulty: Moderate, TOT: 10 min., AACSB: None, AICPA: None

R2.14 Because Mary Chen’s purchase of Fly By Night Airlines shares was in the secondary market the Securities Act of 1934 applies. As a result, under rule 10b-5 Mary must prove: 1. The financial statements contain a material, factual misrepresentation or omission, 2. The plaintiff incurred a loss, 3. The plaintiff relied on the financial statements, 4. Damages were suffered as a result of the reliance on the financial statements, and 5. Scienter, that the auditor either had actual knowledge of the falsity of the representation, or had a reckless disregard for the truth or falsity of the representation.

LO 9 BT: A, Difficulty: Moderate, TOT: 15 min., AACSB: None, AICPA: None

For Instructor Use Only

SOLUTIONS TO ANALYSIS PROBLEMS AP2.1 Step 1. Identify the Threat: This situation regarding substantial doubt may be an Undue Influence threat.

Step 2: Evaluate the Significance of the Threat: The going concern issue appears to be material to the users of the financial statements.

Step 3: Identify and Apply Safeguards: An audit firm must make its own independent judgment and not be swayed by the opinion of a former member of the CPA firm. The CPA firm should not subordinate judgment but instead the firm should act with integrity and objectivity. An Engagement Quality Central Reviewer (EQCR) should review the basis for a judgment about a "going concern" opinion, or a second partner review should be conducted, or a review should be completed by some other CPA who does not work at the CPA firm (in the case of a sole practitioner).

Step 4: Evaluate the Effectiveness of the Safeguards: If the firm acts in a way that it forms its own independent judgements about the going concern issue, the safeguards are effective.

Step 5: Document Threats and Safeguards Applied. The firm needs to document the discussion above in its working papers.

LO 2,3. BT: AP Difficulty: Basic, TOT: 15 min., AACSB: Ethics, AICPA PC: Ethics

AP2.2 a) Independence involves both Independence in Fact (A CPA should be independent from the client in terms of state of mind and acting with integrity and objectivity) and Independence in Appearance (A CPA should not have a direct investment in an audit client, or another financial interest that would appear to a reasonable third party to impair independence). b)

Carrying a note or an account receivable for audit fees that are past due creates a self-interest threat and impairs the firm‘s independence. (ET 1.230.010)

c)

Independence is impaired. The CPA cannot be an officer of the company during the period under audit. In both situations (1) or (2), the CPA is an officer of the companyduring the period of professional engagement which begins when the engagement letter is signed or the beginning of the year under audit, whichever comes first; and ends when the audit report is signed. Because the firm is not independent, it must resign the audit and not issue an audit opinion on the financial statements.

LO5. BT: AP, Difficulty: Moderate, TOT: 20 min., AACSB: Ethics, AICPA PC: Ethics

For Instructor Use Only

AP2.3 a. Under AICPA rules (ET 1.295) CPAs may perform bookkeeping and accounting services and remain independent if the following four conditions are met:   



The CPA must not have any other relationships, such as a financial interest that would impair his or her independence.

The client must accept full responsibility for the financial statements.

The CPA must not assume the role either of an employee or management in the client‘s operations (e.g., the CPA should not initiate transactions or sign checks).

The CPA must conform to professional standards in performing the attest engagement.

b.

If WTI is a public company, the SEC rules prohibit CPAs from performing bookkeeping and accounting services for SEC registrants. The Jones and Jones firm is not independent if WTI is a public company. The client (WTI) must prepare its own financial statements.

c.

Under AICPA rules, Jones and Jones can perform business valuation services and consulting services for non-public companies. These client services are acceptable for a private company so long as the CPA is not involved in implementing his or her advice. If the Jones and Jones firm is to remain independent, they must not assume management responsibility and the client must take full responsibility for key assumptions and any final decisions based on a consulting engagement. Jones and Jones must act strictly in an advisory capacity.

d.

Under the SEC rules, CPAs are prohibited from performing appraisal or valuation services, providing fairness opinions, or contribution-in-kind reports for SEC audit clients. Valuation services are not acceptable for a CPA to perform for a public company. This prohibited service is listed on page 2-21.

LO 5. BT: AP, Difficulty: Challenging, TOT: 30 min., AACSB: Ethics, AICPA PC: Ethics

AP2.4 a. Rule of Conduct 1. ET 1.200 - Independence

b. Effect of Rule Indeterminate. The information needed to assess the applicability of Interpretations ET 1.260.010 and ET 1.260.020 is not stated.

2. ET 1.310 – Compliance with Standards tal

No violation. GASB principles are recognized as authoritative pronouncements for governmenentities.

3. ET 1.400 – Acts Discreditable

Violation. This is considered to be an act discreditable to the profession.

For Instructor Use Only

4. ET 1.200 – Independence.

No violation. Retirement payments to individuals formerly engaged in the practice of public accounting are specifically permitted, absent certain conditions.

5. ET 1.200 – Independence.

Violation. The prohibition against direct financial interest applies to the period of the professional engagement (at the beginning of the year under audit through the time of expressing an opinion).

6. ET 1.300 - General Standards.

Violation. A member shall undertake only engagements that member or member’s firm can reasonably expect to complete with professional competence.

7. ET 1.510 - Contingent Fees.

No violation. A member’s fee may vary depending on the complexity of the engagement.

8. ET 1.600 – Advertising and Other Forms of Solicitation.

No violation. The rule can no longer be used to prevent members from using advertising that includes self-laudatory claims.

9. ET 1.200 - Independence.

Violation. Interpretation 1.277.010 states that a member cannot be an officer of the client during the time period covered by the financial statements.

10. ET 1.700 - Confidential Client Information

Indeterminate. No information is given as to whether the client approved disclosure of the information.

11. ET 1.100 - Integrity and Objectivity Violation. A member should not perform a professional service when he or she has a conflict of interest.

12. ET 1.600 - Advertising and Other Forms of Solicitation.

No violation. The rule can no longer be used to prevent members from using advertising that includes testimonials.

For Instructor Use Only

13.13.

ET 1.310 - Compliance with vices Standards.

No violation. The Accounting and Review SerCommittee is the body designated to promulgate standards for review services for nonpublic entities.

14. ET 1.200 - Independence

Violation. Interpretation 1.295 states a member’s independence is impaired by serving in the capacity of making management decisions for a bank client.

15. ET 1.520 - Commissions and Referral Fees.

Indeterminate. A member is allowed to pay a commission to another CPA or another third party to obtain a client provided disclosure is made to the client.

LO 4,5,6 & 7. BT:E, Difficulty: Moderate, TOT: 35 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

AP2.5 1. A member of the AICPA may practice public accounting in any form of organization permitted by state law or regulation as long as the characteristics of the organization conform to a resolution adopted by the Council of the AICPA. CPAs must own the majority (greater than 50 percent) of the financial interests in an attest firm.

Non-CPA owners must be actively engaged in providing services to the firm’s clients as their principal occupation. Bradley’s 50% ownership and provision of insurance services rather than professional accounting services, violates this characteristic.

2.

A member in the practice of public accounting may have a financial interest in a commercial corporation which performs, for the public, services of a type performed by public accountants and whose characteristics do not conform to resolutions of the Council, provided such interest is not material to the corporation’s net worth, and the member’s interest in and relation to the corporation is solely that of an investor.

Certainly, Gilbert’s 50% interest is material to Financial Services, Inc., and Gilbert’s status is not that of an investor. In this respect, Gilbert is in violation of Interpretation 1.800.

3.

Expressing an unqualified opinion on Grandtime’s financial statements, which did not disclose a material lien on the building asset, is a violation of both Rule 1.310 (Compliance with Standards) and Rule 1.320 (Accounting Principles). Rule 1.310 includes auditing standards promulgated by the Auditing Standards Board. These standards include the requirement that a member shall not permit his or her name to be associated with financial statements unless the member has complied with Generally Accepted Auditing Standards (GAAS). The third standard of reporting For Instructor Use Only

states that informative disclosures are to be regarded as reasonably adequate unless otherwise stated in the report. Since there was no disclosure of the building lien in the financial statements, Gilbert should have qualified his opinion.

ET 1.320 requires that a member shall not express an opinion that financial statements are presented in conformity with generally accepted accounting principles (GAAP) if such statements contain any departure from an accounting principle promulgated by the body designated by Council to establish such principles. GAAP requires disclosure of assets pledged as security for loans.

4.

Having Bradley inform the insurance company of the prior lien on Grandtime’s building is a violation of ET 1.700 of the Code, which enjoins a member from violating the confidential relationship between himself and his client without consent of the client. The lien should have been disclosed in Gilbert’s report on Grandtime’s statements, but it may not be disclosed by him independently to a third party unless the client agrees to such disclosure.

However, ET 1.700 should not be interpreted to preclude a CPA from correcting a previous error. In this case, Gilbert’s expressing an opinion that the financial statements were prepared in accordance with generally accepted accounting principles when, in fact, they were not, is a violation. Gilbert should have first exhausted all means to persuade Grandtime to correct the error by recalling the original financial statements and reissuing them in corrected form with a new auditor’s report.

LO 4,5,6,& 7. BT:E, Difficulty: Challenging, TOT: 35 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

AP2.6 1. This situation relates to ET 1.200 - Independence. The situation would be acceptable providing that Herb does not assume the role of an employee and the client is sufficiently knowledgeable of the company’s activities and financial condition and the applicable accounting principles so the client can reasonably accept responsibility for the work. For SEC purposes, responsibility for maintenance of the accounting records must be performed by accounting personnel employed by the client. Therefore, if Ethical was an SEC client, Herb could not perform this work.

2.

This situation relates to responsibilities to clients, ET 1.700 - Confidential Client Information. Herb has violated professional ethics because ET 1.700 states “A member shall not disclose any confidential information obtained in the course of a professional engagement except with the consent of the client.‖ This does not apply to a validly issued subpoena or summons enforceable by order of a court.

3.

This situation relates to ET 1.200 - Independence. If an employee or partner accepts more than a token gift from a client, even with the knowledge of the member’s firm, the appearance of independence may be lacking. Good advice would be For Instructor Use Only

to never accept anything from a client at a price less than what other independent buyers pay.

4.

This situation relates to ET 1.200 -Independence. Interpretation 1.200 states a member, or a firm of which the member is a partner or shareholder, shall not express an opinion on financial statements of an enterprise unless the member and the member’s firm are independent with respect to such enterprise. Independence will be considered to be impaired if a member or a member’s firm had any loan to or from an enterprise except as permitted in ET 1.1260. The exceptions pertain to certain collateralized loans, loans against insurance policies, and credit card and cash advances on checking accounts which meet certain balance requirements.

The exceptions do not include unsecured loans, thus this is a violation.

5.

This situation relates to ET 1.200 - Independence. Interpretation. ET 1.240 states that independence will be considered to be impaired if a member, or a firm of which he or she is a partner, had or was committed to acquire any direct or material indirect financial interest in the enterprise. Cash and Green would not have a problem performing an independent audit because Herb is not a managerial employee of the office doing the audit. With respect to the audit of Leverage Corp, Herb is not considered to be a covered member.

LO 4,5,6,& 7. BT:E, Difficulty: Challenging, TOT: 35 min., AACSB: Ethics, AICPA PC: Ethics, Decision Making

AP 2.7 The facts reveal negligence on Field's part in that the firm did not follow its own audit program nor did it make a proper investigation into the many irregularities and suspicious circumstances. Compliance with GAAP is of some evidentiary value to Field if it in fact complied with the principles set forth therein. However, the courts do not invariably accept GAAP as the conclusive test to disprove negligence. Furthermore, even if assuming GAAP were followed literally, GAAS certainly were not under the facts stated.

Field will undoubtedly rely upon the privity defense to avoid liability to Slade, a third party to the Field-Tyler contract. However, most jurisdictions recognize the standing of a third-party beneficiary to sue. Therefore, Slade would assert such status. In a majority of jurisdictions Slade would be regarded as a third-party beneficiary if it is within a known and intended class of beneficiaries. Other jurisdictions have gone even further in recognizing a duty is owed to those whom the CPA should reasonably foresee as recipients of the financial statements for authorized business purposes. There are insufficient facts to determine whether Field knew that Tyler intended to use the audited financial statements to secure credit from Slade. Therefore, it is not possible to determine whether the privity defense will bar recovery.

Fraud does not require that the party suing be in privity of contract with the defendant.

However, the most significant problem in proceeding based upon fraud is that fraud requires a knowledge of falsity (scienter) or a recognized substitute therefor. Based upon For Instructor Use Only

the facts, Field did not actually know of management's fraud. However, it may be guilty of conduct which may be deemed to be a reckless disregard for the truth. The courts also resort to the constructive fraud theory where the facts are compelling, i.e., a shutting of one's eyes to the obvious. Sometimes, the conduct is labeled gross negligence, and an inference of fraud may be drawn from this by the trier of fact.

LO 8. BT:E, Difficulty: Challenging, TOT: 35 min., AACSB: None, AICPA: None

AP2.8 City is likely to prevail against Winston based on constructive fraud. To establish a cause of action for constructive fraud, City must prove that:  Winston made a materially false statement of fact.  Winston lacked a reasonable ground for belief that the statement was true. Constructive fraud may be inferred from evidence of gross negligence or recklessness.  Winston intended another to rely on the false statement.  City justifiably relied on the false statement.  Such reliance resulted in damages or injury. Under the facts of this case, Winston is likely to be liable to City based on constructive fraud. Winston made a materially false statement of fact by rendering an unqualified opinion on Bell’s financial statements. Winston lacked a reasonable ground for belief that the financial statements were fairly presented by recklessly departing from the standards of due care in that Winston failed to investigate other embezzlements, despite having knowledge of at least one embezzlement, and Winston did not notify Bell’s management of the matter. Winston intended that others would rely on the audited financial statements. City justifiably relied on the audited financial statements in deciding to loan Astor $600,000 and damages resulted as evidenced by Astor’s default on the City loan.

City is not likely to prevail against Winston based on negligence. In order to establish a cause of action for negligence against Winston, City must prove that:  Winston owed a legal duty to protect City.  Winston breached that legal duty by failing to perform the audit with the due care or competence expected of members of the profession.  City suffered actual losses or damages.  Winston‘s failure to exercise due care proximately caused City to suffer damages. The facts of this case establish that Winston was negligent by not detecting the overstatement of accounts receivable because of its inadvertent failure to follow its audit program. However, Winston will not be liable to City for negligence because Winston owed no duty to City. This is the case because Winston was not in privity of contract with City, and the financial statements were neither audited by Winston for the primary benefit of City, nor was City within a known and intended class of third party beneficiaries who were to receive the audited financial statements.

LO 8. BT:E, Difficulty: Challenging, TOT: 20 min., AACSB: None, AICPA: None

For Instructor Use Only

AP2.9 1. True. The offering was filed with the SEC and was a public offering.

2.

True. This is the essence of the 1933 Act. The effect of The Securities Act of 1933 is to give to third parties who purchase registered securities similar rights against the auditor as are possessed by the client under law.

3.

True. Accountants have no liability if they can show that their work was adequate to support their opinion. (This is the “due diligence‖ defense).

4.

True. One defense available to the accountants is to demonstrate that the losses on loans were due to causes other than errors or omissions in the financial statements.

5.

True. Any action must be filed within three years after the securities have been offered to the public and within one year after the discovery of the error or omission.

6.

False. That is not the function of the SEC. The SEC does not pass judgment on the merit of securities, nor does it defend accountants.

7.

False. The fact that the financial statements are management’s responsibility is not a defense if the auditor knows of loans and collateral pledged that were not disclosed.

LO 9.. BT: AN, Difficulty: Moderate, TOT: 25 min., AACSB: None, AICPA: None

AP2.10 Part I a. No. It is unlikely that Peters will prevail. The facts do not involve liability in the sale of registered securities or liability for reports filed with the SEC. Because the stock transaction involved interstate commerce, Peters ’claim may be based on Section 17 (the antifraud provision) of The Securities Act of 1933 and Rule 10b-5 under The Securities Exchange Act of 1934. In either case, he will have to show fraud on the part of Doe, or a manipulative device or scheme, in connection with the sale of a security under the 1933 Act or the purchase or sale of a security under the 1934 Act. If this can be shown, an implied civil damage remedy is available to Peters against Doe. Although Doe was negligent, the United States Supreme Court, in the Hochfelder case, held that a violation of Rule 10b-5 requires scienter, something greater than mere negligence. Unless the violation of GAAS involves intent, or gross negligence, Doe would not be held in violation of Rule 10b-5.

For Instructor Use Only

b.

Likely. It is likely that Peters will prevail based upon his state’s common law action.

At common law, a key issue is whether Doe & Co. owed a duty of care to Peters.

Under the Restatement of Torts doctrine Peters would be a foreseen third party as a shareholder in the company. Doe & Co. would be responsible for not carefully following GAAS.

Part II Yes. Ira will likely prevail and recover damages from Baker. He will base his action on Section 11 of The Securities Act of 1933. Section 11 imposes liability on experts, including accountants, whose opinions appear in a registration statement. The experts are liable to all those who, in reliance on their opinions, purchase securities in a public offering under The Securities Act of 1933. Ira does not have to prove Baker was negligent in auditing Able. All he needs to allege and prove is that there is a materially false statement or omission of a material fact in the registration statement. The only defense that Baker may assert is that it exercised the degree of care that would be exercised by certified public accountants in similar circumstances. This is commonly referred to as the “due diligence‖ defense. Negligence by Baker is therefore a violation of Section II and makes Baker liable to Ira for his damages.

LO 8,9. BT: E, Difficulty: Challenging, TOT: 25 min., AACSB: None, AICPA: None

AP2.11 Crea will not be liable to the purchasers of the common stock. Although an offering of securities made pursuant to Regulation D is exempt from the registration requirements of The Securities Act of 1933, the antifraud provisions of the federal securities acts continue to apply. In order to establish a cause of action under Section 10(b) and Rule 10b-5 of The Securities Act of 1934, the purchasers generally must show that:  Crea made a material misrepresentation or omission in connection with the purchase or sale of a security;  Crea acted with some element of scienter (intentional or willful conduct);  Crea‘s wrongful conduct was material;  the purchasers relied on Crea‘s wrongful conduct; and that,  there was a sufficient causal connection between the purchaser's loss and Crea‘s wrongful conduct. Under the facts of this case, Crea’s inadvertent failure to exercise due care, which resulted in Crea not detecting the president’s embezzlement, will not be sufficient to satisfy the scienter element because such conduct amounts merely to negligence. Therefore, Crea will not be liable for damages under Section 10(b) and Rule 10b-5 of The Securities Act of 1934.

Crea is likely to be held liable to Safe Bank based on Crea’s negligence despite the fact that Safe is not in privity of contract with Crea. In general, a CPA will not be liable for negligence to creditors if the auditor’s report was primarily for the benefit of the client or for use in the development of the client’s business, and only incidentally or collateralFor Instructor Use Only

ly for the use of those to whom the client might show the financial statements. However, a CPA is generally liable for ordinary negligence to third parties if the audit report is for the identified third party’s primary benefit.

In order to establish Crea’s negligence, Safe must show that:  Crea had a legal duty to protect Safe from unreasonable risk;  Crea failed to perform the audit with the due care or competence expected of members of its profession;  there was a causal relationship between Safe‘s loss and Crea‘s failure to exercise due care;  actual damage or loss resulting from Crea‘s failure to exercise due care. On the facts of this case, Crea will be liable based on negligence since the audited financial statement reports were for the primary benefit of Safe, an identified third party, and Crea failed to exercise due care in detecting the president’s embezzlement, which resulted in Safe’s loss (Dark’s default in repaying the loan to Safe).

LO 8,9. BT: E, Difficulty: Challenging, TOT: 25 min., AACSB: None, AICPA: None

AP2.12 Johnson and Wiley do not have an independence problem based on Independence Interpretation 1.220.040. Johnson and Wiley CPAs did not perform prohibited attest services for the year ended December 31, 2025. During the calendar year ended December 31, 2024, prohibited services were performed by Fritz and Rufner, but Fritz and Rufner was not associated with Johnson and Wiley, CPAs. Fritz and Rufner discontinued performing prohibited non-attest services as of December 1, 2024. Johnson and Wiley CPAs acquired Fritz and Rufner as of January 1, 2025. As a result, no prohibited services were performed by Johnson and Wiley, the members of the former firm Fritz and Rufner, during the period covered by the 2025 financial statements.

LO 2,3,4,5. BT: E, Difficulty: Challenging, TOT: 25 min., AACSB: Ethics, AICPA: Ethics, Decision Making

For Instructor Use Only

Audit Decision Case C2-1 a. There are three ethical issues that need to be addressed: i. Does Thornson & Danforth need to be independent to complete an annual tax return for King Companies, Inc? ii. If James sells his ownership in the King Companies, Inc. on November 30, 2024, is Thornson & Danforth independent for the audit of King Companies, Inc. for the year ended December 31, 2025? iii. Is there a familiarity threat and is the threat adequately safeguarded? b. Gather appropriate information: Following is a summary of relevant information related to this case. The information is organized around the three issues identified above. i. Independence and tax returns: i. King Companies, Inc. is a private company and not subject to SEC rules. ii. Independence is required for attest services (e.g., audits or reviews of financial statements, or other attest engagements). iii. Preparing a tax return is a non-attest engagement and subject to rules regarding non-attest services (ET 1.295) ii. Independence and having a direct investment in an attest client. i. Having a direct financial interest in an attest client is a self-interest threat that cannot be safeguarded. (ET 1.240.010.01) ii. A CPA cannot have a direct financial interest in an attest client during the period of the professional engagement. (ET 1.240.010.01) iii. James cannot hold a direct investment during the period of the professional engagement. The period of the professional engagement begins when Thornson & Danforth sign an engagement letter or January 1, 2025, whichever comes first, and ends when the audit report is signed. iii. Familiarity Threat i. Because James Danforth previously owned stock in King Companies, Inc., it might appear to an independent third party that a familiarity threat exists (ET 1.000.010.12). ii. A familiarity threat can be safeguarded. c. Analyze information and evaluate alternatives. i. Independence and tax returns. i. The case is not clear about whether James Danforth performs any management responsibilities at King Companies, Inc. ii. Danforth must address the activities that impair independence summarized in Illustration 2.8. ii. Independence and having a direct investment in an attest client.

For Instructor Use Only

i.

It is important that James not sign an engagement letter prior to selling his ownership interest. ii. James sold his ownership interest in November of 2024, prior to the beginning of the period under audit (January 1, 2025). iii. Familiarity Threat. i. A familiarity threat might exist. ii. An adequate safeguard to preserve the audit firm‘s independence would be having Danforth‘s partner (Thornson or another partner) review and concur with material audit decisions prior to issuing the audit report. d. Draw a conclusion i. Independence and tax returns. i. As long as Danforth does not perform any management activities, Danforth can prepare the tax return for King Companies, Inc. and remain independent. A tax service is a nonattest service. As long as the CPA complies with section (ET 1.295) of the AICPA Code of Professional Conduct ii. Independence and having a direct investment in an attest client. i. As long as the engagement letter is signed in December 2024 or later, Danforth does not have a direct investment in King Companies, Inc. during the period of the professional engagement. Hence, the firm will be independent with respect to the audit of the financial statements for the period ended December 31, 2025. The key issue is a CPA cannot have a direct financial interest in an attest client during the period of the professional engagement. (ET 1.240.010.01) iii. Familiarity Threat i. The familiarity threat can be safeguarded, and the audit firm‘s independence preserved, by having a concurring partner review and concur with material audit decisions prior to issuing the audit report, will safeguard the familiarity threat. This situation is covered by the Conceptual Framework for Independence (ET 1.210.010) LO 2,3,4,5. BT: E, Difficulty: Challenging, TOT: 40 min., AACSB: Ethics, AICPA: Ethics, Decision Making

For Instructor Use Only

Cloud 9 Following is an evaluation of each of the items that might have a potential impact on independence for Cloud 9.

Issue

Evaluation

Jo Wadley and David Collier (Cloud 9‘s CFO) both serve on the board of directors of the local chapter of Special Olympics.

There may be a familiarity threat because Jo Wadley and David Collier serve together on the same board. However, the familiarity threat can be addressed by an independent review of the engagement by the firm‘s engagement quality control reviewer to determine that the audit team used an appropriate level of professional skepticism. Independence is not impaired by this relationship.

A tax senior in another office has a sister who consults with Cloud 9 on shoe design. Cloud 9 is her biggest client.

The sister who consults with Cloud 9 is a close relative of a member of W&S Partners. However, the tax senior is not likely a covered member. Further, the rules related to close relatives say that the relative should not hold a key position with Cloud 9. A consultant on shoe design would not be a key position. Independence is not impaired.

Fifteen employees of W&S Partners, ranging from partners to entry level staff, own shares in retailers that sell Cloud 9 shoes and apparel.

While 15 employees own stock in retailers who sell Cloud 9 shoes and apparel, they do not own stock in Cloud 9. Independence is not impaired.

A survey shows that 23 percent of professional staff working for W&S Partners have purchased Cloud 9 shoes in the past.

The fact that employees purchase Cloud 9 shoes does not impair independence. Generally, purchasing a client‘s products does not impair independence.

LO 2,3,4,5. BT: E, Difficulty: Moderate, TOT: 43 min., AACSB: Ethics, AICPA: Ethics, Decision Making

CHAPTER 3 Risk Assessment Part I: Audit Risk and Audit Strategy

For Instructor Use Only

Learning Objectives 1.

2.

3.

4.

5.

6.

Evaluate client acceptance and continuance decisions.

Identify the different phases of an audit.

Explain and apply the concept of materiality.

Explain professional skepticism and apply the audit risk model.

Explain how auditors determine their audit strategy and how audit strategy affects audit decisions.

Explain the fraud risk assessment process and analyze fraud risk.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Acceptance and Continuance Decisions

2. B LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Phases of an Audit

3. A LO 3, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

4. B LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

5. C LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

6. D LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

For Instructor Use Only

7. C LO 5, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

8. B LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

9. C LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

10. D

LO 6, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Fraud Risk

For Instructor Use Only

ANSWERS TO REVIEW QUESTIONS R3.1 Procedures governing the client acceptance/continuance decision exist because an audit firm does not want to be associated with a ―bad‖ client. A bad client can damage an accounting firm‘s reputation and the reputation of the audit profession. A bad client can also lead to significant legal costs for the firm. Factors to consider before making a decision are the integrity of management, competence issues, independence issues, special circumstances and unusual risks. If there is any indication of a possible threat to the integrity, objectivity, independence, professional competence or due care, the audit firm should not accept the entity as a client.

LO 1, BT: C, Difficulty: Medium, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Acceptance and Continuance Decisions

R3.2 The purpose of the engagement letter is to address the significant components of the audit such as the scope, timing, management and auditor responsibilities, objective, and limitations of an audit. Defining the terms of the audit will enhance understanding of expectations between the auditor and the client. All engagement letters contain the fundamental components of an audit. However, engagement letters can vary depending on specific client needs or special circumstances.

LO 1, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Acceptance and Continuance Decisions

R3.3 An audit consists of three main phases, the risk assessment phase, the risk response phase, and the reporting phase. The risk assessment phase involves acquiring knowledge about the client, identifying possible risks over financial reporting, performing a risk assessment, and developing an audit strategy. The risk response phase focuses on testing controls and account balances and transactions. The reporting phase involves an evaluation of the test results and concludes with an opinion regarding the client‘s financial statements. The three phases represent the workflow of the audit, however, information discovered in a later phase may impact conclusions drawn from an earlier phase. Therefore, auditors may need to revise the audit strategy when new information is found during any phase of the audit.

LO 2, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Phases of an Audit

R3.4 All audits are not the same from client to client. Audits need to be tailored to the client‘s needs since different companies have different risks. For example, a small local store may find a risk to be material that a large corporation may classify as insignificant. Also, audits for the same company could change year to year based on new and evolving risks of the entity and/or its industry. Finally, public, private, and not-for-profit entities have different standards and guidelines for conducting an audit.

LO 2, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Phases of an Audit

R3.5 The planning (overall) materiality guides the auditor through the planning and testing phases and is determined by the auditor using professional judgment. Materiality is any item that impacts decision making for financial statement users. Information is considered material based on its nature and/or magnitude. Auditors consider both qualitative and quantitative factors when setting the overall materiality of an audit. Planning materiality is typically a percentage of an appropriate benchmark from the financial statements, and it is reevaluated throughout the audit.

LO 3, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

For Instructor Use Only

R3.6 Materiality is assessed relative to an appropriate benchmark from the balance sheet or income statement. The most common benchmarks from the balance sheet include total assets or equity. Income statement benchmarks are generally profit before tax or total revenue. Auditors select the appropriate benchmark based on their knowledge of the client, the client‘s industry, and the needs of the financial statement users.

LO 3, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

R3.7 Planning materiality is set by the auditors during risk assessment and reflects a materiality level for the financial statements as a whole. If one error or an accumulation of errors meet or exceed the planning materiality level, then the financial statements are materially misstated.

Performance materiality is an amount less than planning materiality that is determined by auditors using their professional judgment. Performance materiality is used as a guide when planning audit procedures to be used for each account. Performance materiality is lower than planning materiality for the purpose of detecting smaller misstatements that may aggregate to an amount that is material to the financial statements as a whole. Both materiality measurements are reevaluated throughout the entire audit process.

LO 3, BT: C, Difficulty: Medium, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

R3.8 The materiality amount has an inverse relationship to the amount of work required to complete the audit. Setting the materiality to a lower dollar amount expands the number of items that are considered to be material in a given audit. The nature of the audit work will include more detailed auditing procedures, and the extent of the audit will require more items within an account to be tested to obtain more audit evidence (increase sample sizes). The timing of the audit will be impacted by having more detailed testing occurring at year-end instead of interim.

LO 3, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

For Instructor Use Only

R3.9 The statement, ―Auditors should only use professional skepticism when considering fraud risk,‖ is not true. Auditors should maintain professional skepticism during all phases of an audit to ensure independence is maintained and evidence is presented fairly. AU-C 200.A22 provides a number of examples where auditors should maintain skepticism, such as discovering contradictory evidence, documents that appear to be unreliable, potential fraudulent activity and any other situation in which additional audit procedures are needed. Professional skepticism is not exclusively limited to those situations. To comply with the auditing standards, auditors must always maintain professional skepticism during an audit.

LO 4, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

R3.10 An audit risk assessment starts by first identifying accounts and related assertions at risk of a material misstatement. Inherent risks exist due to external and internal factors of the client.

Certain risks require more consideration than others and are classified as significant risks.

Characteristics of significant risks involve potentially fraudulent activity, significant economic/accounting developments, complicated transactions, significant related party transactions, financial information with subjective measurements, or a transaction outside the client‘s normal course of business. Next, the auditor will assess control risk. For each account and related assertion, auditors identify whether a control is in place to effectively prevent or detect a material misstatement. Inherent and control risks together represent the risk of a material misstatement occurring on the client‘s financial statements. Detection risk is the risk the audit procedures will not detect a material misstatement. Auditors can never eliminate detection risks because audits can only provide reasonable assurance. Through investigation into the inherent and control risks of a firm, auditors can control the detection risk to achieve a low audit risk. Consideration given to the inherent, control and detection risks of an audit engagement helps auditors reduce the risk of arriving at an inappropriate conclusion.

LO 4, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

R3.11 When a client has a high susceptibility of an assertion to be misstated and ineffective/nonexistent internal controls, auditors identify the risk of a material misstatement occurring to be extremely high. When the risk of a material misstatement is high, auditors invest more time into testing and gathering evidence for that assertion. The more work performed in a highrisk area, the less likely it would be for a material misstatement to go undetected by the auditor.

Therefore, the detection risk would be set as low in that circumstance to achieve an overall low audit risk. A low detection risk means the auditor is lowering the risk that audit procedures will not detect a material misstatement.

LO 4, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

R3.12 In every audit, auditors must gain an understanding of a client‘s internal controls. If after gaining an understanding the auditors determine that internal controls are most likely weak or non-existent, they may decide not to test internal controls. It would be inefficient to test the effectiveness of internal controls if they are already determined to be weak or non-existent. Therefore, auditors would adopt a predominantly substantive approach and spend time verifying account balances and transactions with extensive detailed substantive procedures and adjust the nature, extent and timing of the audit accordingly.

LO 5, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

For Instructor Use Only

R3.13 In every audit, auditors will perform substantive procedures. When a reliance on controls approach is used, auditors will first determine the inherent and control risks of the firm. The auditor will determine if controls are in place and test the effectiveness of controls to mitigate risks.

If the internal controls are deemed effective, the auditor will perform less extensive detailed substantive procedures and possibly perform more substantive procedures at an interim date.

Ultimately, better controls result in less substantive testing for the auditor.

LO 5, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

R3.14 The auditor cannot conclude that the valuation assertion for inventory is not at risk by only testing the effectiveness of the physical controls over inventory. Physical controls only reduce the risk of unauthorized access to the facility. They do not eliminate the risk of a material misstatement occurring in the accounting records. Strong physical controls are more related to the existence of inventory, but other risk factors need to be considered regarding the valuation of inventory. Some other risk factors to consider include the accounting method chosen by management, authorization controls within the warehouse, human error and oversight procedures.

LO 5, BT: AP, Difficulty: Medium, TOT: 10 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

R3.15 Three factors are considered when assessing the risk of fraud. Auditors must investigate potential incentives, opportunities, and rationalizations that exist within a firm. Incentives refer to situations in which client personnel are more inclined to commit fraud due to an external or internal pressure. Some examples of fraud incentives are rapid growth of the company, threat of bankruptcy and operating in a competitive industry. After identifying incentives, auditors will assess potential opportunities within the firm to commit fraud. Opportunities refer to the circumstances within a firm that allow fraud to occur and go undetected. Some examples of opportunities include poor internal controls, high volume of transactions at year-end, a significant number of estimates, and/or complicated transactions. Lastly, auditors will evaluate the attitudes of management and other staff. An individual may rationalize fraudulent behavior to justify his or her actions. Some examples of rationalization within the culture of the organization include excessive focus on profits, understated or unincorporated ethical standards and poor compliance with regulations. Incentive, opportunity and rationalization are considered together, along with additional information, when determining if a firm has a high risk of fraud. Auditors must gain an understanding of the client‘s internal controls to assess the risk of fraud. If controls are weak or non-existent, there is heightened risk of fraud. A high risk of fraud does not suggest that a fraud exists, only that there is potential within the firm for one to occur. Auditors can include unpredictability in their audit plan as a way to detect fraud.

LO 6, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Fraud Risk

R3.16 The audit team partakes in a brainstorming session during the fraud risk assessment process. Members of the audit team use the knowledge acquired about the client to assess areas of increased risk and weaknesses in internal control in which fraud could be perpetrated or go undetected. Audit team members also discuss appropriate responses to fraud risks identified during the brainstorming session.

LO 6, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Fraud Risk

For Instructor Use Only

SOLUTIONS TO ANALYSIS PROBLEMS AP3.1 When deciding whether to continue the client relationship with Star Software, Jones & Parker should consider the following issues:  Star is experiencing financial hardship which puts significant pressure on management.

When a company is under financial stress, there is an increased risk of fraud.  Due to financial hardship, Star is planning to lay-off employees in the accounting and finance department and within the internal audit function. Fewer employees may not be able to keep up with the workload. If more experienced employees are laid off, there could be an increased risk of errors in the accounting records.  With fewer employees, internal controls could be weakened if appropriate modifications to the controls are not made. There may be less opportunity for separation of duties, less supervision, fewer authorizations of transactions, and fewer opportunities to independently verify the work of employees.  There is no indication of problems with management integrity.

Even though the client is experiencing hardship, Jones & Parker should continue the client relationship with Star Software. Management integrity is a key factor that influences the client continuance decision. There is no indication that Star‘s management is lacking integrity or behaving recklessly, rather Star‘s management is making tough decisions regarding how the company can continue operating.

LO 1, BT: AN, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Acceptance and Continuance Decisions

AP3.2 a. Since WaterFun granted permission for DDD to communicate with the predecessor auditor, DDD will contact the predecessor auditor and inquire about the following matters:  Information that might bear on the integrity of management  Disagreements with management about accounting policies, auditing procedures, or other significant matters  Communications to those charged with governance regarding fraud and noncompliance with laws or regulations by the entity  Communications to management and those charged with governance regarding significant deficiencies and material weaknesses in internal control  The predecessor auditor‘s understanding of the reasons for the change of auditors b. According to AU-C 210.10 and 210.A24, some key items that should be included in an engagement letter are:  The objective and scope of the audit of the financial statements, including reference to applicable legislation, regulations, GAAS, and ethical and other pronouncements of professional bodies to which the auditor adheres  The responsibilities of the auditor, such as arrangements regarding the planning and performance of the audit including the composition of the audit team  The responsibilities of management, including making available to the auditor draft financial statements and any other accompanying information in time to allow the auditor to complete the audit in accordance with the proposed timetable  The expectation that management will provide written representations  The agreement of management to inform the auditor of events occurring or facts discovered subsequent to the date of the financial statements, of which management may become aware, that may affect the financial statements

For Instructor Use Only



A statement that because of the inherent limitations of an audit, together with the inherent limitations of internal control, an unavoidable risk exists that some material misstatements may not be detected, even though the audit is properly planned and performed in accordance with GAAS 1. Identification of the applicable financial reporting framework for the preparation of the financial statements 2. Reference to the expected form and content of any reports to be issued by the auditor and a statement that circumstances may arise in which a report may differ from its expected form and content 3. The basis on which fees are computed and any billing arrangements 4. A request for management to acknowledge receipt of the audit engagement letter and to agree to the terms of the engagement outlined therein, as may be evidenced by management signing the engagement letter c. If DDD is not granted permission to communicate with the predecessor auditor, then DDD should inquire about the reasons and consider the implications of that refusal in deciding whether to accept the engagement with WaterFun (AU-C 210.11).

LO 1, BT: C, Difficulty: Medium, TOT: 25 min., AACSB: Technology, AICPA AC: Risk Assessment, Analysis and Management, Research, Section: Client Acceptance and Continuance Decisions

AP3.3 The client continuation decision is critical. Rebecca should evaluate and document the firm‘s ability to service the major client, Carolina Company Inc., and any other major clients for the coming year. The key factors to be evaluated are client integrity and any threats to the auditor‘s compliance with the fundamental principles of professional ethics (integrity, objectivity, independence, professional competence and due care). Although Carolina Company has been a client of the firm for several years, its integrity must still be reevaluated.

Rapid growth and the stress of being publicly traded can create pressures within the client that could compromise its integrity. This is particularly so in the case of Carolina Company because there is already evidence of difficulties in its financial systems.

A major issue confronting the audit firm is its ability to comply with the fundamental principles of independence. Rebecca should be particularly concerned with the firm‘s ability to be objective given its dependence on the large client‘s fees. Although Carolina Company is only one of the major clients experiencing rapid growth, fee dependence arises when a client‘s fees form a significant proportion of the audit firm‘s overall revenue.

Rebecca should also be concerned about the firm‘s ability to use professional competence and due care in audits for rapidly growing clients at a time when the audit firm is growing rapidly, and the client is undergoing major changes to its reporting requirements when transitioning to a publicly traded company. Issues that Rebecca should consider are: If the firm is not already registered with the PCAOB, does it want to take that step in order to keep Carolina Company as a client? Does the audit firm have the expertise to audit publicly traded clients? Does the audit firm have enough staff to audit a publicly traded company, including enough partners to comply with the SOX‘s mandatory partner rotation every 5 years? Does the firm have the staff resources to perform an audit Carolina‘s internal controls? What sort of auditing difficulties are likely to be created by the stretched financial systems at Carolina?

The client continuation decision must be properly documented, and the engagement letter drafted to reflect the responsibilities of both parties.

LO 1, BT: E, Difficulty: Hard, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Acceptance and Continuance Decisions

AP3.4

For Instructor Use Only

Auditors set planning materiality based on their judgment of the client and the user‘s information needs. Users, such as current and potential lenders, would be very interested in CC‘s ability to pay its debts when they fall due. Therefore, CC‘s current financial difficulty is a qualitative factor that auditors will consider when determining planning materiality. Auditors will likely set planning materiality at a lower level to gather more evidence about CC‘s financial stability and ability to pay debts.

Mark‘s firm will have its own materiality guidelines to follow regarding an appropriate benchmark and percentage to use for determining planning materiality. Since CC is a for-profit entity, the benchmark will most likely be ―income before taxes.‖ Because CC is a first-time client, Mark should consider using a lower percentage than what the firm recommends. For example, if firm guidance is 1-5% of income before taxes, then Mark should consider using 2-3% of income before taxes. A lower materiality level means the auditors will be testing more items and gathering more evidence which would be prudent with a first-time client, especially one that is experiencing financial difficulties.

LO 3, BT: AP, Difficulty: Basic, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

AP3.5 1. IR 2. DR 3. NA 4. IR 5. CR 6. DR 7. IR 8. NA 9. CR 10. IR LO 4, BT: AN, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

AP3.6  Inherent risks for inventory for Carl‘s Computers include:  Likelihood of rapid obsolescence of computer hardware and accessories – risk of incorrect valuation of obsolete product  Foreign exchange transactions – are contracts written in U.S. dollars? Are the transactions hedged against adverse movements in exchange rates, leading to difficulty ascertaining cost of purchase and incorrect creditor liability?  Competition from aggressive discounters - risk that inventory will not be held on hand to meet fluctuating sales, risk that inventory will be unsold because of competition which increases risk of obsolescence and valuation problems  Rapidly changing product lines – risk that suppliers will change and products will not meet the required standards which increases valuation problems  Correct inventory will not be received from suppliers due to inability to meet orders or confusion between U.S. importers and foreign suppliers – risk that purchase orders are unfilled or incorrectly filled, and payment for inventory not received  Dealing with multiple transportation companies (ships from overseas and trucks from ports) – could increase risk of goods not being received, or not received in a timely manner, and missing inventory

For Instructor Use Only

 

Many different products, a wide range of value per item – risk of incorrect calculations of inventory on hand Theft (either during transport or from the stores) would vary across products – risk that inventory account would be overstated if thefts were not identified

(b) Strengths of inventory control system:

      

Branch manager in each store and permanent staff who can receive consistent training in inventory control Permanent staff used to supervise part-time staff at stores Inventory held at central warehouse under control of specialist inventory supervisors Requisition required for transfer from central warehouse to branch store Weaknesses in inventory control system: Part-time staff may not be sufficiently trained or supervised despite procedures requiring this Inventory requisition authorized by branch manager rather than central manager Passing through central warehouse could delay receipt of product at branch, leading to overriding system to increase speed of delivery

Questions about inventory control system:  Who chooses and approves suppliers?  Is there segregation between inventory staff and those keeping inventory records? (c) Inventory would be a material balance because the company is an importer and retailer of

computer hardware and accessories. Inventory is likely to be the largest asset after property, plant and equipment. It is likely that the majority of sales are made for cash, so accounts receivable is unlikely to be a large balance (except for balances owing from credit card companies for card transactions). The inventory is also qualitatively material because the business model requires expert inventory management to deal with obsolescence and competition issues. Users of financial statements would be very interested in data such as inventory turnover.

The auditors would adopt different approaches for different types of inventory. They would focus more on larger value items with greater risk of obsolescence or product specification problems. They would also focus on products with greater risk due to more likely supplier problems, such as new suppliers for consumables, or complicated foreign transactions which create valuation issues. Focus would also be given to items with greater risk of being stolen, to ensure that the inventory balances are not overstated, and those items with greatest competition pressure, to ensure sales are valid.

LO 3, 4, BT: E, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality, Professional Skepticism and Audit Risk

AP3.7 Ajax generates one type of revenue by lending to customers. The finance charges paid by the customers (i.e., interest and fees) are Ajax‘s revenue. Ajax must pay interest and fees when it raises the funds on the wholesale money market. In addition, Ajax earns revenue through credit card sales. Ajax is paid an amount per credit card and a proportion of the interest charges paid by the customers to the credit card company.

The difference between the revenue earned by lending to the customers and the cost of raising the money paid to the money market participants, plus the credit card commission and interest, pays Ajax‘s running costs and contributes to its profit.

For Instructor Use Only

The major risks with Ajax‘s revenue relate to the style of its business. Loans are made by mobile lending officers who are paid on a commission basis. The lending officers appear to be alone when they visit clients, and we do not know what controls exist over the loan applications when the lending officer returns to the office (or submits the paperwork electronically). These factors suggest that control risk will be higher over the validity of the loans and credit card applications.

There is a possibility that some loans or card applications will not be processed at all or processed in a timely fashion. The facts also suggest that there could be a high risk of selling loans to customers who do not have the capacity to pay their debts. There is also the possibility that the ―little person‖ (relatively low net worth individual) who is the foundation of Ajax‘s business is not likely to pay his/her obligations as much as people who have good relationships with their banks.

In addition, the selling techniques used by the mobile lending officers could be potentially unscrupulous because of the pressure on the lending officers to make sales. These factors increase the inherent risk surrounding Ajax‘s revenue from collecting on their loans and interest payments.

LO 4, BT: AN, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

AP3.8 The journal entry which transfers amounts from the deferred (unearned) revenue account to the subscription revenue account is: Debit Deferred (Unearned) Revenue Credit Subscription Revenue This transaction reduces the liability account and increases the revenue account. As such, it has a direct effect on both the liquidity and profitability of All Tunes (ATS). The transaction improves the client‘s liquidity by decreasing current liabilities, so that the ratio of current assets to current liabilities increases. The client‘s profitability increases because revenue increases.

Controls over transfer of revenue from deferred revenue should be able to prevent or detect misstatements in the revenue account and deferred revenue account (liability) due to incorrect transfers. For example, processing a transaction twice would overstate revenue and liquidity.

Failure to make a transaction would understate revenue and liquidity.

LO 4, BT: AN, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

AP3.9  N  E  N  T  E  N  T LO 5, BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

For Instructor Use Only

AP3.10 a. The initial audit plan is to obtain evidence of revenue recognition by relying on internal controls. This type of audit strategy is based on an initial assessment of control risk as low. When control risk is low, auditors will test the operating effectiveness of internal controls (i.e., company‘s policies and procedures on revenue recognition), and rely less on substantive detail testing of account balances. b. If during testing of controls auditors detect deviations from controls that they were not expecting, they will make specific inquiries and will determine whether the potential risks of misstatement need to be addressed using substantive procedures. In the case of ATS, significant deviations from controls occurred in which revenue was incorrectly recognized immediately upon customer payment in advance. Therefore, the controls on revenue recognition are not operating effectively. The controls will have to be reassessed as ineffective and less reliable. In response to the reassessed level of control risk, the auditors should change the audit approach to a predominantly substantive approach.

The initially planned audit strategy of reliance on controls is no longer appropriate because the predominantly substantive approach will be more efficient and effective in obtaining sufficient appropriate audit evidence.

LO 5, BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Strategy

AP3.11 a. Factors affecting the preliminary assessment of inherent risk include:  Cheese is perishable, suggesting high risk of spoilage, affecting inventory valuation  Boutique cheese operation – highly skilled processes requiring skilled staff, and reliance on a few customers  Export sales, foreign exchange transactions – complicated transactions with risk of incorrect pricing, risk assessment  Tourism-based sales at shop and café – could be fluctuating demand  Competing incentives for export sales and café consulting businesses  Heavy reliance on export sales increases vulnerability of business to this source of revenue, and making product available to meet this demand Factors affecting the preliminary assessment of control risk include:  Effectiveness over quality control over cheese operations, affecting saleability of product (although quality control is apparently high)  Risk of product spoilage, affecting value of inventory  Controls over sales made by Jim, documentation, pricing, sales allowances  Lack of communication between Jim and brother Bob and other staff – affecting efficiency and effectiveness of management b. Reliance on controls approach is appropriate when control risk is assessed as low while a predominantly substantive approach is appropriate when control risk is assessed as high, and it is more efficient not to rely on controls.

For Sales The poor communication between Jim and other management and staff, plus his competing incentives and the lack of control over his actions means that control risk in these areas would be considered high. The validity of sales transactions, including the amounts and terms of the sale,

For Instructor Use Only

is at risk. There is also a risk that sales made to customers are not entered correctly in the accounts. Control risk for sales and accounts receivable is high, meaning that a predominantly substantive approach would be adopted in these areas.

For Inventory Control over production appears to be good, and inventory quality seems to be high. However, the inherent risk of inventory spoilage is great. This suggests that a lower assessed level of control risk could be adopted for inventory, leading to a reliance on controls approach. Testing the controls over inventory, and obtaining satisfactory results, would mean that less substantive testing would be required.

For Customer Receivables A predominantly substantive approach for sales is more appropriate because the adjustments to customer accounts do not appear to be adequately controlled. Rather than developing and implementing a policy and procedures on credit notes, Jim frequently issues credit notes to clients who complain about their statement without investigating it. Also, the lack of resources to follow the company‘s protocol (i.e., Jim is to too busy to respond to customer complaints) increases the control risk.

LO 4, 5, BT: AN, Difficulty: Hard, TOT: 40 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk, Audit Strategy

AP3.12 a.Pressures: The board members have shown through their selection of a new CEO with a reputation for ―toughness‖ and turning around businesses that they want a change in the company‘s results. The board has given the new CEO a 5-year contract with incentives for growth, profit and share price. The CEO also has the incentive to preserve his reputation.

Opportunities: The new CEO has a bonus that is tied to profit from continuing operations. This means that any write-offs that can be labelled as ―discontinued operations‖ will not affect his bonus. There is the opportunity to write down assets more than is required without affecting the bonus. In future periods, bonus payments will be higher because a lower amount of depreciation will be charged to continuing profits. In addition, selling off certain business components reduces recurrent depreciation charges and provides a cash resource to invest in other areas that are favored by the CEO. The new CEO also has a 5-year period to make these changes without risking termination.

Rationalizations: The focus is now on maximizing profits through boosting sales and cutting costs. There is less emphasis on compliance and more on pleasing the CEO. This suggests that efforts to boost profit will be received favorably and any attempt to obstruct the CEO, such as questioning accounting policies or business decisions, will not be received favorably. It is likely that the board of directors will support the CEO when it comes to financial reporting and internal control issues. Increasing stock prices also seems to say that the market approves the new actions. The CEO has been rewarded by the board, further encouraging this type of behavior. b.Potential frauds – the risk of fraudulent financial reporting is greater than the risk of asset misappropriation.

Examples: i. Backdating sales to the current period, postdating expenses to the next period (consistent with reported growth in sales, lower costs in latest results)

For Instructor Use Only

ii. Reclassifying assets and expenses as part of discontinued operations, overstating asset impairments, overstating losses on disposal of discontinued operations iii. Inappropriate classification of revenues and expenses in the current period to accentuate reported growth in profit, greater capitalization of expenses in the current period as assets (also to increase profit), understating liabilities (nonrecognition of accruals etc.) (c) Professional skepticism means that auditors maintain a questioning mind and thoroughly investigate all evidence presented by the client. This ―questioning mind‖ is especially critical when assessing and responding to the risk of fraud. Auditors should consider questions such as, ―Is this information reliable?‖ and ―Should we perform more audit procedures?‖ The audit team may consider assigning more experienced personnel to audit higher-risk accounts and also increase the amount of supervision over the work performed on higher-risk areas.

LO 4, 6, BT: AN, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk, Fraud Risk

AP3.13 Types of fraud in the oil and gas industry at the exploration and drilling level include: i. Unrealistic assumptions and improper assessment of projected returns on investment ii. Inappropriate calculation of royalty payments due to unclear requirements iii. Obtaining exploration licenses iv. Theft of inventory v. Misrepresenting the quality of the product being refined and processed vi. Bribery, especially in foreign countries, to obtain special privileges or win contracts Internet research may reveal more types of fraud. This information obtained from Ernst & Young brochure titled ―Fraud Risk Management, Oil and Gas Sector.‖ Fraud risk factors that increase the risk of fraudulent financial reporting for Pelican Oil: i. Lower demand for oil and fierce competition, which increases pressure on management to meet revenue targets ii. Revenue has decreased by 18% compared to the prior year, which increases pressure on management to remain profitable iii. Laying off employees, both in the field and in the corporate office, could impact the proper functioning of internal controls. With fewer employees, some duties may not be separated, thus creating opportunity for fraud. iv. In the oil and gas exploration and drilling industry, estimates are used to determine projected inventory and projected return on investment. Since estimates rely on judgment, there is opportunity for fraud in the creation of the estimate. v. Management may rationalize fraud by claiming other companies follow the same inappropriate accounting or assumptions. vi. Management may rationalize that any inappropriate accounting or assumption is just temporary until oil prices rebound.

LO 6, BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, Technology, AICPA AC: Risk Assessment, Analysis and Management, Section: Fraud Risk

AP3.14 (a) Students should conduct a literature review and write a report of the outcome of the legal case.

There are several useful texts and movies explaining the Madoff affair including: Markopolos, H. No one would listen, Wiley (2010) Arvedlund, E. Too Good to Be True: The Rise and Fall of Bernie Madoff, Penguin, (2009).

For Instructor Use Only

Chasing Madoff (2011 documentary film) The Wizard of Lies (2017 film) Here are helpful links about the role of David Friehling and his firm, Friehling & Horowitz, and the case against him: https://www.justice.gov/usao-sdny/united-states-v-david-g-friehling https://www.nytimes.com/2015/05/29/business/dealbook/madoff-accountant-avoids-prisonterm.html https://www.sec.gov/litigation/litreleases/2009/lr20959.htm https://newyork.cbslocal.com/2015/05/28/david-friehling-sentencing/ http://archive.fortune.com/2008/12/17/news/companies/madoff.auditor.fortune/index.htm (b) A summary of the allegations against Friehling and his firm, Friehling & Horowitz, should be compared with the relevant standards listed below. (Note that the firm Friehling & Horowitz was not registered with the PCAOB since it did not audit public companies. The firm was enrolled in the AICPA peer review program, but the firm had reported to the AICPA for 15 consecutive years that it did not conduct audits. Therefore, the firm was not subject to being peer-reviewed if it reported that audits were not conducted. But in reality, the firm was signing off on the financial statements of Madoff Investments. One outcome of the Madoff fraud and lack of audit inspection is that now the PCAOB inspects audits of broker dealers.)

Relevant standards: AICPA Code of Professional Conduct 110 (e.g., lack of independence, competence, professional behavior and due care allegations) QC 10 A Firm‘s System of Quality Control AU-C 200 - conduct of an audit AU-C 220 - quality control AU-C 230 - was there appropriate documentation?

AU-C 240 - fraud factors - were they properly identified?

AU-C 315 - understanding the client and assessing risk – did the auditor understand the business of hedge funds and assess Madoff‘s control systems?

AU-C 330 - responding to assessed risks – did the auditor respond appropriately to any risks identified?

AU-C 500 - audit evidence – was it sufficient and appropriate?

LO 6, BT: S, Difficulty: Hard, TOT: 120 min., AACSB: Analytic, Research, AICPA AC: Research, AICPA PC: Ethical Conduct, Professional Behavior, Section: Fraud Risk

For Instructor Use Only

SOLUTIONS TO AUDIT DECISION CASES C3.1 Risk of material misstatement (RMM) consists of inherent risk (IR) and control risk (CR). Planning materiality (PM) is based on the auditor‘s assessment of the client and its users‘ information needs.

Factors that impact the risk of material misstatement, and thus PM are:  A husband and wife own a majority of shares of the company. The husband is chairman and CEO, and the wife is a director and the CFO. Is there effective internal control? Or could the tone at the company be more ―laid back‖ with a family-style atmosphere? This situation could suggest higher CR and potentially calls for lower PM.  KCI has not been audited before, therefore, there is risk associated with opening balances.

This situation leads to higher IR and lower PM for opening balances and assessment of prior period accounting principles and application.  A new private equity investor owns 20% of KCI creating additional demand, together with the request from the bank for an audit, for financial statements. This increases IR, suggesting lower PM.  Use of part-time as well as permanent staff suggests variation in work force, problems in payroll and HR which can lead to greater IR and lower PM for payroll. Also consider the effectiveness of controls requiring segregation of staff if the workforce is fluctuating.  Laid-back management style suggests greater CR from ―tone at the top‖ issues, leading to lower PM.  Lack of employees taking regular vacation elevates CR. Ineffective supervision and segregation of duties and no opportunity to use another staff member in key roles when employees take vacation leading to lower PM.  Jonathan Jung is close to retirement. Should consider incentives for fraud and effectiveness of supervision of accounting staff. Seems to be inadequate segregation of duties (i.e., they ―help each other‖ during busy times). This leads to greater CR, lower PM. However, the one staff member is a college graduate and passed the CPA exam, suggesting accounting expertise.  Since the business is a retailer and there is increased movement of manufacturers going direct to consumers online (ex. through Amazon), there could be pressure from competition for market share now or in the future, which is an IR. Overall, there appear to be governance and staffing issues with the business. These issues create questions about specific control risks which should be assessed in greater detail. Greater control risks suggest lower planning materiality would be appropriate.

For Instructor Use Only

These risks are most relevant to: i. Board of director decisions - because of husband/wife control of the company and recent acquisition of a significant percentage of the company by a new private equity investor, there is a possibility of related party transactions ii. Control in the accounting department – staff shortages, inappropriate delegation, inadequate segregation of duties, closeness to retirement and lack of annual vacation by the head of the department, laid-back attitude of CFO iii. Staffing issues – use of part-time staff, questions about adequate training and supervision of staff LO 3, 4, BT: AN, Difficulty: Hard, TOT: 60 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality, Professional Skepticism and Audit Risk

C3.2 (a) Fraud risk factors: Eric and Patricia King have effective control, but not 100% ownership of the business. The presence of a new equity investor and the involvement of the bank increase the demand for credible reports. Management has a ―laid back‖ style, suggesting there is not effective control.

There is also the question of effective control over assets because the CFO is in control of financial statements and is a major investor in the company. The chairman of the board is the husband of the CFO, the CFO is a director – is there good oversight, i.e., good corporate governance?

The accounts have not been audited before, meaning that an independent external party has not previously reviewed the business‘s internal control and financial statements. Opening balances are particularly at risk.

Accounting staff rarely take vacation time, suggesting there has not been an opportunity to independently review their work. Are they hiding anything? There appears to be issues with segregation of duties and effective supervision and monitoring. For example, Jonathan has the tasks of making cash deposits and performing the bank reconciliation (these issues relate to the opportunity to commit fraud).

Jonathan is close to retirement and thus has a short ―horizon‖ in the business. Is there an attitude that he works so hard in the accounting department that he is ―owed‘ something (i.e., an attitude/rationalization issue)?

Is there effective supervision and /monitoring of the part time workers? They are people likely to have incentives for asset misappropriation due to their low wages. They could have an attitude that fraud is reasonable due to the low wages. Does the accounting staff have proper procedures for processing these short-term employment contracts? Who handles the HR duties?

Overall, the small size of the business means it is unlikely that the client has fully effective internal control systems. A great deal of reliance is placed on management supervision and there are factors that indicate that this supervision might not be totally effective. (b) Each fraud risk factor would require more time in the audit plan to gather evidence about the assertions relating to relevant accounts and transactions. The plan would include time on understanding the client‘s system of internal control, but additional control testing would only be warranted where the auditor intended to place reliance on the controls. The fraud risk factors appear to suggest that greater substantive testing would be required, especially for accounts relating to payroll, bank accounts, revenue recognition and expenses, and closing entries.

For Instructor Use Only

Fraud Risk Factor

Explanation as to why a risk

Suggested audit approach to address the risk

Key accounting staff not taking vacation

There is no independent review of the work of the key finance/accounting staff which could lead to the staff misappropriating assets and not being detected by anyone

Little reliance should be placed on internal controls.

More use of substantive testing of transactions and account balances (i.e., payroll and bank reconciliations).

Review unusual transactions/activity

Weak or ineffective internal controls

Poor segregation of accounting duties Poor supervision of staff Poor business management systems and processes

More substantive testing of transactions and balances, particularly revenue/accounts receivable, payroll, and accounts payable

Opening balances have not Could be errors carried forward been confirmed from prior years

Testing of opening balances

Poor corporate governRisk of management overriding of Test appropriateness of jourance- independence issues controls (see AU-C 240.32) nal/ledger entries Review of management estimates and adjustments Review timing difference issues for recognition of revenue and expenses LO 6, BT: AN, Difficulty: Hard, TOT: 45 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Fraud Risk

For Instructor Use Only

C3.3 Inherent industry risks: i. defense - high sensitivity of product information, customer information ii. fast rate of technological change for the industry iii. competitive market bidding to win government contracts Inherent entity risks: iv. high reliance on specialized nature of the products creates risk to revenue stream v. pricing of sophisticated product designed to meet customer (government) specifications vi. adequate security over designs, customer details – effect on personnel (e.g., security clearances required?), inventory management (secrecy over product components?) vii. new cloud-based inventory costing system replacing in-house system – does the new system provide comparable information; has it been tested and integrated with other client systems; because it is cloud-based, is it secure? viii. sophisticated nature of product design and costing information, questions about standard costing, inventory movements ix. adequate documentation for bidding processes x. potential government shutdowns and/or budget reductions LO 4, BT: AN, Difficulty: Hard, TOT: 35 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Professional Skepticism and Audit Risk

C3.4 Preliminary materiality assessment is based on the auditor‘s assessment of the risk of material misstatement and the client‘s users‘ information needs.

Inherent risk for MSI is high because of the sensitivity of the information surrounding its products and clients, its reliance on customized products, complex costing and pricing of products, and rate of technological change in the industry.

Control risk for MSI would be affected by the following factors: i. control over pricing and sales contracts, approval of credit ii. procedures to handle security risks relating to both products and clients iii. nature of the bidding process for government contracts iv. ability to gather accurate costing information to assist with bidding v. success of installation of new cloud-based inventory costing system vi. controls over personnel and payroll – particular reference to obtaining highly skilled staff required for product design and manufacture and obtaining security clearances, as required, for all staff working with sensitive information Control risk is likely to be assessed as high, although successful testing of product costing controls would reduce control risk. Together with high inherent risk, high to moderate control risk would result in a low planned detection risk, and a low planning materiality.

An estimate of planning materiality can be calculated using 5% of pre-tax income. The calculation is as follows: First quarter

$3,200,000

0.05

$160,000

Second quarter

$2,790,000

0.05

$140,000

Third quarter

Use estimate from

second quarter

$140,000

For Instructor Use Only

Fourth quarter

$112,000*

Estimate of planning materiality

$552,000

*Estimate fourth quarter pre-tax income: $2,800,000-(2,800,000*0.20) = $2,240,000 Multiply estimated fourth quarter pre-tax income by 5%: $2,240,000*0.05 = $112,000 Note: students may use other methods of calculating planning materiality, such as calculating a percentage of total revenues or total assets. Therefore, answers may vary.

LO 3, BT: AP, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality

C3.5 a. Students can do a quick internet search to learn about healthcare fraud involving hospitals.

The most common frauds involving hospitals are: i.

Upcoding - the process of misrepresenting patient diagnoses in order to receive higher reimbursement rates ii. Billing for services that are either not provided or not considered to be medically reasonable iii. Admitting patients who would benefit from alternative care iv. Receiving or supplying kickbacks for unlawful patient referrals v. Improperly coding services or treatments in order to receive reimbursement that would otherwise have not been paid vi. Falsification of patient records to prevent detection of submitted false claims Some specific fraud risk factors for BPH are: i. Incentives/pressures – The healthcare industry is very competitive and complex. Hospital administrators feel pressure to remain profitable and viable in an industry that faces growing costs and increased regulation every year. ii. Opportunities – Hospitals are generally large facilities that offer a broad and extensive array of services. There are many medical service providers, both employed by the hospital and those who are not, who have access to medical records and who participate in the assignment of medical codes which ultimately impact billing. If proper controls are not in place, there is opportunity for hospitals and other medical service providers to overbill for services provided or to bill for services that were not provided at all. Specifically, overbilling to government-sponsored health plans, such as Medicare and Medicaid, is one of the most common types of fraud committed by hospitals. iii. Attitudes/rationalization – Fraud, such as overbilling, could be rationalized by upper management by stating that it‘s not a material amount, or that it must be done to stay profitable, or that other hospitals are also overbilling (i.e., everyone is doing it). b. Based on the types of fraud prevalent in the healthcare industry, accounts at significant risk for material misstatement are revenue and accounts receivable since they are related to the billing process. Since hospitals employee many people with varied types of expertise and working different shifts, payroll would also be an area at significant risk for misstatement.

LO 6, BT: AN, Difficulty: Hard, TOT: 35 min., AACSB: Analytic, Technology, AICPA AC: Risk Assessment, Analysis and Management, Section: Fraud Risk

For Instructor Use Only

For Instructor Use Only

Cloud 9 a. Planning Materiality (PM) Students most likely will select Income before tax as the basis for calculating PM. It must be annualized to represent a full year of earnings. Income before tax is the most commonly used benchmark and makes sense because Cloud 9 is expecting to earn a profit for the year ended January 31, 2026. The most common percentage to use is 5%. However, students may choose to use a smaller percentage resulting in a lower PM due to the following considerations: i. Cloud 9 is concerned with increasing the brand‘s share of the US market ii. Management has an incentive to manipulate revenue based on growth targets expected and compensation attached to meeting those targets iii. Cloud 9‘s business has changed in terms of the opening of the retail store and high reliance on new inventory management systems iv. Evidence of theft at the stores – the risk of fraud with merchandise Calculation of PM based on 5% of annualized Income before tax: Income before tax at October 31, 2025

$27,007,692*

Divide by 75% to estimate annual income before tax

Annualized income before tax

$36,010,256

Multiply by 5%

× 0.05

PM at 5% *Calculated as: Revenues Cost of sales Selling and administrative Interest expense Other expense Income before tax

÷ 0.75

$1,800,513

$ 277,338,461 ($169,346,154) ($79,092,308) ( $1,438,461) ( $453,846) $27,007,692

For Instructor Use Only

b. Auditors must consider that misstatements that are less than planning materiality (PM) could be material once aggregated together. Therefore, they must perform procedures at the account or assertion level that are designed to detect misstatements that are less than PM. Performance materiality is an amount set by the auditors that is less than PM and is used to determine the nature and extent of audit procedures performed on accounts and transactions. Auditors must use professional judgment when determining an amount for performance materiality. Performance materiality could be different for each account based on risk assessment. The more risk associated with an account, the lower the performance materiality amount should be. Performance materiality may also change based on information discovered during the performance of tests of controls or substantive tests. c. If planning materiality (PM) is changed later in the audit, then performance materiality would also be impacted. If PM is decreased (lower $ amount), then performance materiality is decreased which means auditors must gather more evidence to conclude if misstatements have occurred. If PM is increased (higher $ amount), then performance materiality is increased which means auditors do not need to gather as much evidence to conclude if misstatements have occurred.

LO 3, 4, BT: AN, Difficulty: Hard, TOT: 45 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Materiality, Professional Skepticism and Audit Risk

CHAPTER 4 Risk Assessment Part II: Understanding the Client Learning Objectives 1 2.

3.

4.

5.

6.

7.

Apply procedures to gain an understanding of the client.

Explain how clients measure performance and how it impacts the auditor‘s risk assessment.

Explain how auditors use analytical procedures and audit data analytics when assessing risk.

Define related party transactions and explain how they affect the auditor‘s risk assessment.

Describe common corporate governance structures and how they impact the auditor‘s risk assessment.

Explain how a client‘s internal controls and information technology (IT) can affect risk.

Discuss how client closing procedures can affect risk and a client‘s reported results.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. D LO 1, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

For Instructor Use Only

2. C LO 1, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

3. C LO 1, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

4. A LO 1, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

5. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Approaches to Measuring Performance

6. D LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Analytical Procedures

7. C LO 3, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Analytical Procedures

8. B LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Related Parties

9. D LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Corporate Governance

10. A LO 6, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Internal Control and Information Technology

11. B LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Closing Procedures

For Instructor Use Only

ANSWERS TO REVIEW QUESTIONS R4.1 The importance of the risk assessment phase of a financial statement audit is for the audit team to gain an understanding of the client for the purpose of planning the audit and developing an audit strategy. When the auditors understand the characteristics and situation of a client, they can identify specific risks that may cause material misstatements, and plan the nature, timing, and extent of audit procedures to be performed.

LO 1, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

R4.2 The key factors auditors consider during risk assessment are: 1.

Understanding the entity and the industry – At the entity level, the auditor gains knowledge about the client such as the client‘s customers/suppliers, operations, reputation, sources of financing, and ownership structure. At the industry level, the auditor gains knowledge about the level of competition, demand for products/services, government support/regulation, and the general state of the economy.

2.

Compliance with laws and regulations – An assessment of the laws and regulations for a client and its industry that affects its operations.

3.

Client performance measurement – Learning how a client measures its own performance.

4.

Analytical procedures – Comparison of financial and non-financial information that assists auditors in developing expectations regarding the client.

5.

Related parties – Determining the client‘s related parties and gaining an understanding of transactions with related parties and required disclosures in the notes.

6.

Corporate governance – Learning about the client‘s corporate governance structure, including the board of directors and audit committee, if applicable.

7.

Understand internal controls, IT, and the client‘s digital mindset – The auditor must gain an understanding of the client‘s system of internal controls and the impact of IT. 8.

Closing procedures – Auditors must gain an understanding of internal controls over the client‘s closing process.

9.

Fraud risk – Auditors consider fraud risk factors such as incentives, opportunities, and rationalization to commit fraud.

LO 1, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

For Instructor Use Only

R4.3 Auditors examine client relations with customers and suppliers when weighing possible risks of a material misstatement. The areas to consider with customer relationships are the reputation of the customers, satisfaction of the customers, and the ability of the customers to pay on a timely basis. Dissatisfied customers are less likely to pay on time and less likely to remain a customer in the future. Dissatisfied customers could negatively impact certain accounts on the financial statements, such as the allowance for doubtful accounts, cash, and future sales. The impact of an unfavorable customer relationship is inversely related to the number of customers the client serves. If the client has many customers, one dissatisfied customer will not have as great of an impact on the financial statements as if the client only has one or a few major customers. The areas to consider with supplier relations are the reputations of the suppliers, the quality of goods provided, the timeliness of supplier delivery, the terms of significant contracts and payment methods, and the rate of return for goods that do not meet client standards. Conditions that could negatively affect business operations include significant amounts of goods returned to suppliers and untimely delivery of low quality goods. When the client consistently fails to pay the supplier on time, suppliers may refuse orders and put the client‘s operations at risk.

LO 2, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

R4.4 Liquidity is a company‘s ability to quickly convert assets to cash or cash equivalents. Solvency is the company‘s ability to meet its long-term obligations. Essentially, both pertain to whether or not a company can pay its debts. Liquidity has a short-term focus, whereas solvency focuses on the company‘s long-term obligations. This difference matters to auditors because it indicates different accounts at risk of material misstatement. Also, if a company is having liquidity issues today or has had them in the past, it may indicate potential solvency issues in the future.

LO 2, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Approaches to Measuring Performance

R4.5 Two examples of analytical procedures auditors use to assess the risk of material misstatement of sales revenue are time series analysis and regression analysis. With time series analysis, the auditor takes past sales information and analyzes it to predict future sales. For example, if the actual sales amount for the current year is much higher than the predicted sales, auditors will investigate further for a possible material misstatement. Regression analysis statistically measures associations between data, such as selling costs and sales. Auditors test the effects of changing the amount of selling costs on sales. For example, if the test resulted in an overstatement of sales relative to the selling costs, auditors will investigate for possible material misstatement.

LO 3, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Analytical Procedures

For Instructor Use Only

R4.6 A change in the gross profit margin could be due to the client paying more for inventory (increases COGS) or charging a different price on the goods sold. The auditor can investigate the cause by inquiring with management about any new adjustments in the purchasing of inventory and the pricing of products. Also, the auditor can compare the actual amount of change to the change that was predicted to occur in the budgeted financial statements to better investigate the change in the ratio.

LO 3, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Analytical Procedures

R4.7 Time series analysis analyzes regularly occurring data, such as revenue, by using past data to predict future data. This analysis is useful because it allows auditors to observe variations of data over the long-term and make inferences from their observations. Seasonal and unusual trends can be seen using this analysis as well.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Analytical Procedures

R4.8 A company and its related parties typically have a closer or friendlier relationship than a company and an independent or unrelated party. This means that the chance of special treatment or transactions that are not ―arm‘s length transactions‖ with related parties may arise during the normal course of business. It is the auditor‘s responsibility to remain professionally skeptical in making sure the client accounts for these special treatments according to their true substance and the client follows all disclosure requirements for related parties.

LO 4, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Related Parties

R4.9 Corporate governance is essentially the people, systems, and processes by which the entity is controlled or directed. Corporate governance is in place to ensure the company is wellmanaged. Therefore, all companies, not just public companies, should strive to have good corporate governance to add value to shareholders, owners, investors, and employees. However, only public companies are mandated, through federal legislation, to have a board of directors that includes an audit committee.

LO 5, BT: AN, Difficulty: Medium, TOT: 10 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Corporate Governance

For Instructor Use Only

R4.10 Executive directors are employees that serve on the company‘s board of directors. These executive directors are not independent of the company because they are employees. The audit committee is a sub-committee that is responsible for overseeing the accounting and financial reporting processes of the company and working with the auditors on audit related issues.

SOX Sec. 301 states that, ―Audit committee members must be independent members of the board of directors, not executive directors or otherwise affiliated with the issuer.‖ The audit team provides the audit committee with audit adjustments, therefore, the audit committee members must be independent of management that is responsible for preparing those financial statements.

LO 5, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Corporate Governance

R4.11 The auditor needs to understand the client‘s IT system because information technology is an integral part of most companies‘ processes such as recording, processing, and correcting.

There are many risks such as unauthorized access to computers and errors in programs that auditors must understand. An employee with unauthorized access to a key financial application may alter data that could cause material impacts to the financial statements to perpetrate fraud.

LO 6, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Internal Control and Information Technology

R4.12 Closing procedures include adjusting entries and closing entries at period end (month, quarter, or year-end). Auditors gain a thorough understanding of closing procedures due to their nature of being a high-risk area for material misstatements to occur. Auditors examine these procedures to ensure revenues and expenses are recorded in the correct period. An example of a monthly closing procedure is the accrual of utilities expense for the month. If a client does not accrue utilities expense, then utilities expense and accrued liabilities will be understated. An understated utilities expense will lead to overstated net income.

LO 7, BT: S, Difficulty: Hard, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Closing Procedures

For Instructor Use Only

SOLUTIONS TO ANALYSIS PROBLEMS AP4.1 Some relevant questions to ask Michael would include: What work has been done to provide evidence that there are no related parties and that there are no issues with the client‘s corporate governance structure?

Is the risk of material misstatement the same for a dollar of rental revenue as a dollar of retail revenue? The risk of material misstatement should drive the audit plan.

Since the client is new, what work has been done to understand the client, its industry (both rental and retail elements) and the effect of the industry and economic factors on the client?

What is the initial assessment of internal controls over financial reporting?

What are the significant transactions and accounts? Are sales/services provided on account or do customers pay at the time the sale is made or the service is provided?

What is the asset utilization pattern? How often are party supplies rented versus how often they are idle? Are the rentals seasonal or steady throughout the year?

Is the risk of fraud directly proportional to revenue? If not, how should the work on fraud be allocated?

What impact would IT have on the risks associated with the two segments of the business? How does IT relate to the rest of the client‘s internal controls? What is the initial assessment of IT general controls?

Are closing procedures the same for the two segments of the business?

LO 1, BT: AN, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

AP4.2 a. Issues that potentially impact the audit of Scooter Inc.:  Change from good economic conditions (solid employment growth, rising gas prices, easy access to credit for consumers) to financial crisis (recession with lower employment growth, falling gas prices, difficult access to credit).  Changing conditions such as lower gas prices and lower employment growth have slowed consumer demand for scooters. Consumer demand is also likely to be affected by less access to consumer credit for scooter purchases.  The changed economic conditions also likely adversely impact Scooter‘s access to funds (tighter finance market, slower cash flow to service debt). b.

Because of the current economic environment, Scooter‘s management may be under in-

For Instructor Use Only

creased pressure to meet performance targets; for example, for bonuses or to satisfy debt covenants. Pressure on management is a fraud risk factor. Therefore, there is greater risk of fraudulent financial reporting. Accounts that require closer examination are sales revenue and significant expenses (such as COGS). Auditors should closely examine Scooter‘s closing procedures and adjusting entries at year end. For sales revenue, the auditors should consider risk of fraudulent transactions such as back-dating sales from the next period to the current period, and other revenue recognition issues such as loaning scooters to potential customers and recording them as sales. To meet the requirements of the finance company, Scooter could inflate prices to be above $10,000 with an ―allowance‖ granted later to customers.

Auditors should consider the risk that expenses are forward-dated to the next period to improve the current period profit. There is also the risk that Scooter may not be recording some expenses, or incorrectly capitalizing expenses that should be on the income statement.

Alternatively, management may decide to ‗take a bath‘ and purposefully understate profits. A benefit of this tactic is it provides a low base from which to demonstrate an improvement in results in the following year.

LO 1, BT: AN, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client

AP4.3 a. AU-C 250.A19 states the following regarding indicators that a client has committed an illegal act: ―If the auditor becomes aware of the existence of, or information about, the following matters, it may be an indication of noncompliance with laws and regulations:  Investigations by regulatory organizations and government departments or payment of fines or penalties  Payments for unspecified services or loans to consultants, related parties, employees, or government officials or government employees  Sales commissions or agent's fees that appear excessive in relation to those ordinarily paid by the entity or in its industry or for the services actually received  Purchases made at prices significantly above or below market price  Unusual payments in cash, purchases in the form of cashiers' checks payable to bearer, or transfers to numbered bank accounts  Unusual transactions with companies registered in tax havens  Payments for goods or services made other than to the country from which the goods or services originated  Existence of an information system that fails, whether by design or accident, to provide an adequate audit trail or sufficient evidence  Unauthorized transactions or improperly recorded transactions  Adverse media commentary  Noncompliance with laws or regulations cited in reports of examinations by regulatory agencies that have been made available to the auditor

For Instructor Use Only



Failure to file tax returns or pay government duties or similar fees that are common to the entity's industry or the nature of its business.‖

b. AU-C 250.A20 states the following as specific procedures the auditor can use to obtain an understanding of an identified or suspected illegal act: ―Procedures an auditor may perform to address the requirements of paragraph .17 include the following:  Examining supporting documents, such as invoices, cancelled checks, and agreements, and comparing with accounting records  Confirming significant information concerning the matter with the other party to the transaction or intermediaries, such as banks or lawyers  Determining whether the transaction has been properly authorized  Considering whether other similar transactions or events may have occurred and applying procedures to identify them.‖ c. AU-C 250.A28 states the following regarding situations when an auditor has a duty to notify external parties about a client‘s noncompliance with laws and regulations: ―The auditor's professional duty to maintain the confidentiality of client information may preclude reporting identified or suspected noncompliance with laws and regulations to a party outside the entity. However, the auditor's legal responsibilities vary by jurisdiction, and in certain circumstances, the duty of confidentiality may be overridden by statute, the law, or courts of law. In the following circumstances, a duty to notify parties outside the entity may exist:  In response to inquiries from an auditor to a predecessor auditor, in accordance with the requirements of section 210, Terms of Engagement  In response to a court order  In compliance with requirements for the audits of entities that receive financial assistance from a government agency Because potential conflicts with the auditor's ethical and legal obligations for confidentiality may be complex, the auditor may consult with legal counsel before discussing noncompliance with parties outside the entity.‖ LO 1, BT: AN, Difficulty: Medium, TOT: 30 min., AACSB: Technology, Analytic AICPA AC: Research, Section: Understanding the Client

For Instructor Use Only

AP4.4 a. Prior period financial statements can be used to understand the client‘s financial performance and position over several periods. Past periods provide a benchmark for analyzing the current period. For example, trend analysis can reveal whether the client is growing, becoming more profitable, changing the mix of products and locations, and how cash flows change during the year. Detailed analysis can reveal whether the client is financing its operations through debt or equity, using short or long term debt, whether it is exposed to foreign currency movements (which it will be because of the imports from Asia) and how the exchange risk is being managed. The auditor can use the understanding gained from analyzing past financial statements to assess the risk of misstatement in individual accounts. b. Anticipated results (forecasts) can reveal where the client foresees risks and assist the audit in understanding how the client plans to handle them. Forecasts can be used to understand what changes the client believes the future will bring, and how they will impact the business.

Management forecasts and plans can be analyzed to reveal how growth will be financed. c. Industry averages provide a benchmark against which to assess the client. Is the client typical of the industry? How does it vary? Understanding the differences between the client and the other members of the industry can provide context for judging how the likely future economic conditions will affect the client, and which accounts are most likely to be at risk of material misstatement.

LO 1, 3, BT: C, Difficulty: Easy, TOT: 20 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client, Analytical Procedures

AP4.5 a. Possible explanations for the increasing gross profit margin and the declining profit margin include: a.

Cost of goods sold being misclassified as operating expenses (reducing cost of goods sold, increasing gross profit, increasing other expenses) b.

Understated purchase costs c.

Overstated closing inventory (reducing cost of goods sold, increasing gross profit, but also increasing profit margin which could be offset through other increased expenses) d.

Overstated sales this period e.

Increased advertising costs, reducing overall profit but generating more sales and higher sales prices f.

Increased other costs, for example interest costs or salaries, which have impacted adversely on overall profit but not on gross margin

For Instructor Use Only

b. Additional audit work should be performed in the following areas:  Cost of goods sold and various other expenses – auditors should perform procedures to verify expenses are recorded in the proper expense account.  Purchases – auditors should verify that inventory purchases are recorded in the proper time period.  Ending inventory – auditors should verify that ending inventory is appropriately valued and actually exists. Damaged or obsolete inventory should be marked down or removed from ending inventory.  Sales – auditors should verify that sales are recorded in the proper period and that sales actually occurred.

LO 2, 3, BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Approaches to Measuring Performance, Analytical Procedures

AP4.6 a. In the short term Bright Spark Fashion faces liquidity issues because the long-term debt is due to be retired two months after year-end. The business has just experienced the winter season, where sales are lower, and it is unlikely to have significant cash receipts from sales until the summer season. The summer inventory is ordered on a prepaid basis, which suggests that these orders have been paid for by the time the debt is due to be retired. Unless the debt is refinanced, the business may not have any funds until the summer period to pay for salaries, rent, and other commitments.

In the longer term, it appears that refinancing the debt for a further two year period will not be sufficient to ensure that the business avoids future cash problems. Refinancing every two years means that the business is in almost constant renegotiation talks with its banks. Greater certainty for the business would flow from a longer term finance agreement or a revolving credit line. In addition, the likely interest rate increase will adversely impact profit over the term of the loan.

Liquidity ratios include: Current ratio (CA/CL) Quick ratio ((cash + ST investment + net receivables) / current liabilities) Solvency ratios include: Debt to equity (liabilities/equity) Times interest earned (EBIT/interest expense) If the debt is not refinanced, it will have to be repaid from other sources. It is possible that another bank would make a loan (no impact on the ratios except in reclassifying a current liability as a noncurrent liability if the new debt has a longer term). It is possible that the owner of Bright Spark Fashion could inject more capital into the business (replacing debt with equity, which would reduce total liabilities and increase equity). Another possibility is that some assets could be sold to repay the debt (reducing both assets and liabilities). This course of action would likely require sales at less than book value, creating a loss which would reduce equity. b. The major risk is that Bright Spark Fashion will not be able to pay its debts as they fall due if

For Instructor Use Only

the loan is not refinanced. This means that it has a going concern issue unless the debt is renegotiated.

There is a risk that the bank will not process payments to suppliers because of the outstanding debt There is a risk that the owner of the business will have to obtain funds elsewhere at higher interest rates, adversely impacting profit and exposing the business to the risk of even shorter loan terms. This also creates a going concern risk because there is the risk that the funds will not be available for the next 12 months.

Jenna should plan to investigate the progress of the debt negotiations and obtain evidence that any loans that Ray Bright claims to negotiate are certain to be received. Jenna should also gather evidence about delivery of goods into the stores during the period between year-end and the audit report date.

LO 2, 3, BT: AN, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Client Approaches to Measuring Performance, Analytical Procedures

AP4.7 a. AU-C 550.10 defines an arm‘s-length transaction as follows: ―Arm's-length transaction. A transaction conducted on such terms and conditions between a willing buyer and a willing seller who are unrelated and are acting independently of each other and pursuing their own best interests.‖ b. AU-C 550.03 provides examples of how related party relationships and transactions may give rise to higher risks of material misstatement than transactions with unrelated parties. Some examples are: 1.

Related parties may operate through an extensive and complex range of relationships and structures 2.

Information systems may be ineffective at identifying or summarizing transactions and outstanding balances between an entity and its related parties.

3.

Related party transactions may not be conducted under normal market terms and conditions.

4.

Related party transactions may be motivated solely or in large measure to engage in fraudulent financial reporting or conceal misappropriation of assets.

There are fraud risk factors associated with related parties because one party may dominate another party and be able to exert influence or control over the non-dominant party (AU-C 550.A32). Without compensating controls the dominant party could: 1. Veto significant business decisions made by management or those charged with governance 2. Insist on being the final approver of significant transactions 3. Dismiss any debate on business decisions made by the dominant party 4. Participate in transactions that are not independently reviewed or approved (AU-C 550.A33) Without proper controls in place over transactions with a related party, there is increased risk of

For Instructor Use Only

material misstatement.

LO 4, BT: AN, Difficulty: Medium, TOT: 30 min., AACSB: Technology, Analytic AICPA AC: Risk Assessment, Analysis and Management, Research, Section: Related Parties

AP4.8 a. The group investigating the industry and economic factors will consider the following factors, according to AS 2110.09: a) Competitive environment b) Technological developments c) Regulatory environment including the applicable financial reporting framework and the legal and political environment d) External factors including general economic conditions The group investigating issues at the entity level will consider the following factors:  Nature of the entity including organizational structure, sources of funding, significant investments, size and complexity of operations, sources of earnings, and key suppliers and customers (AS 2110.10)  Selection and application of accounting principles such as significant changes in accounting principles, competencies of personnel involved in selection and application of accounting principles, accounts or disclosures in which significant judgment is used, emerging areas for which there is a lack of authoritative guidance, adoption of new accounting standards, and methods used to account for transactions outside the normal course of business (AS 2110.13)  Company objectives, strategies, and related business risks such as industry developments, new products and services, use of IT, new accounting requirements, expansion of the business, effects of implementing a strategy, current and prospective financial requirements, and regulatory requirements (AS 2110.15)  Company performance measures such as measures that form the basis for contractual commitments or incentive compensation arrangements, measures used by external parties, and measures the company uses to monitor its operations that highlight unexpected results (AS 2110.17)  Internal control including the control environment, company‘s risk assessment process, information and communication, control activities, and monitoring of controls (AS 2110.21) b. The fact pattern states there are four members of the audit committee, who are all independent directors. The fact pattern does not state if any of them are financial experts. If none of them are financial experts, then the entity does not comply with SOX section 301.

LO 1, 5, BT: AN, Difficulty: Medium, TOT: 25 min., AACSB: Technology, Analytic AICPA AC: Risk Assessment, Analysis and Management, Research, Section: Understanding the Client, Corporate Governance

AP4.9 Staff feedback comments suggest the following issues with the new IT system:  Risk that the patient database contains errors – The new system may not be using a

For Instructor Use Only

unique identifier for patients, such as a patient number. New patients were occasionally confused with old patients in the system. There should be a method of identifying new patients at the point of admission and assigning a unique identifier to their file at that point to be used for all future transactions and services relating to the patient.  Risk that the billing system contains errors - Power outage resulted in loss of patient invoice data. Backups do not appear to be used to prevent loss of data. Also, software was not calculating billing formulas correctly. Were all patient accounts corrected? What are the controls over who can make changes to the software? Only authorized staff should have access to make changes to the billing formula, and all changes should be authorized by an appropriate level of management.

The issues raised by staff relate to controls over data entry and processing in the new IT system. The problems suggest that control risk is high, especially in relation to revenue and receivables.

LO 6, BT: E, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Internal Control and Information Technology

AP4.10 The installation of a new IT system means that results of previous audits do not necessarily apply to the new audit. Shane Woodrow needs evidence that the new IT system operates as it was intended before he can place reliance on it.

Although the new IT system was not part of the audit in the last period, there could be evidence of its testing in a preliminary phase. This issue should be discussed with the ex-audit partner. In addition, there could be evidence of the process surrounding the order of the new system, including its customization to the client‘s requirements.

Risks in the new system include those associated with accurate initiating, recording, processing and reporting of inventory transactions (including non-routine transactions), whether the system can be overridden or bypassed by management or staff, whether there are sufficient controls over program changes, whether the information in the old IT system has been transferred to the new system appropriately, whether the new system produces sufficient management reports (ex. exception reports) to show that the client is monitoring its performance.

LO 6, BT: E, Difficulty: Hard, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Internal Control and Information Technology

AP4.11 a. b. c. d. e. f. g. h. i. j.

3. Board of directors 11. Closing procedures 8. Related party 1. Common-size analysis 9. Liquidity 12. Direct and material effect 15. Transaction-level risk 7. Analytical procedure 4. Audit committee 7. Analytical procedure

For Instructor Use Only

LO 1,2,3,4,5,7 BT C, Difficulty: Easy, TOT: 15 min, AACSB AC: Risk Assessment, Analysis and Management, Section: Understand the Entity and Industry, Client Approaches to Measuring Performance, Analytical Procedures, Related Parties, Corporate Governance, Closing Procedures

AP4.12 a. The auditor is required as per AS 2110 to understand the aspects of the client‘s business risk that increase the likelihood of material misstatement. Dunks has experienced consistent growth but there are doubts about its ability to continue to grow in the current economic climate. There is a risk that these conditions could place financial stress on the company through falling revenue and cash collections from customers and increased costs from adverse currency movements. There could also be difficulty sourcing products from suppliers in financial stress and collecting from customers. If currency exchange rates are more volatile because of the recession there is increased risk of incorrect purchase costs and exposure to foreign currency exchange risk (which could be hedged).

Senior managers rewarded through bonuses could be under pressure to find ways to increase revenues and cut costs. These pressures could increase the risk of fraudulent financial reporting. Also, the general attitude within the company towards profit targets could be interpreted as a poor attitude towards preventing fraudulent financial reporting.

The slower monthly reporting is a concern. It increases the risk that exceptions and performance evaluation are not being dealt with on a timely basis. It also suggests that the reporting system is under pressure for some reason, increasing the risk that the reports are not accurate, particularly with respect to monthly closing entries. b. Given the risk statements from part (a), specific focus would be on making sure that revenues are not overstated and expenses are not understated. This means that there would be a search for backdated revenues and postdated expenses. Documents (invoices, cash receipts and payments) related to sales for the first weeks of the new year and expenses for the last few weeks of the old year would be inspected. The auditor would inspect sales journal entries for the old year and expense documents to the journals for the new year.

Interim audit procedures would be directed towards investigating monthly closing procedures. Although these monthly closing entries will not impact the overall profit for the year (except the first and last month entries), they provide a guide to management‘s attitude towards closing entries in general and the adequacy of the closing entry system controls.

LO 1, 7, BT: E, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client, Closing Procedures

AP4.13 Answers will vary because students can select any 10 publicly traded companies.

LO 1, 7, BT: AN, Difficulty: Hard, TOT: 120 min., AACSB: Communication, Technology, Analytic, AICPA AC: Research, Section: Understanding the Client, Closing Procedures

For Instructor Use Only

SOLUTIONS TO AUDIT DECISION CASES C4.1 (Note to instructors: a discussion of the fraud risk factors of this case is included in the solution for Case 3.2 from Chapter 3.)

For prior period financial statements, the information could be used to calculate ratios and trends (i.e. analytical procedures). The auditor would gain an understanding of the client‘s main categories of revenue and expenses, and the relative importance of various assets and liabilities.

For industry comparison, the auditor can compare the client‘s results to other firms within the same industry. The following are some questions which when answered will provide information about the new client:  How similar is the client to other businesses in this industry?  What are the major trends developing in the industry, particularly as economic conditions change?  Does this client show the same trends? Why or why not?

Budgets can be analyzed to understand the client‘s expectations regarding growth (or decline) and also reveal shifts in revenue and expense patterns. The auditor would consider whether actual changes in business are reflected in the accounts (e.g. has the bank given the business a new loan to finance an expansion or new purchase of equipment?).

The auditor would also use the reports to understand the difference between peak and off-peak periods and how they affect the business‘s profits. Specific issues include provision for vacation and sick leave (apparently some accounting staff never take vacation) and the most senior staff‘s retirement-related provisions.

The auditor should also obtain information about customers, vendors, performance at the different store locations, and quantity and/or type of inventory and compare these to the financial data. For example, does inventory quantity vary proportionately with sales, payroll expense with employee numbers? Why or why not? Do all five locations show consistent performance or does a certain location, (or locations), perform significantly better than the others? If there is a significant difference in performance across stores, what is driving the difference? For the parts delivery aspect of the business, are parts delivered out of one central location or store? Or does each store have the capability for parts delivery?

LO 1, 3 BT: AN, Difficulty: Hard, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Understanding the Client, Analytical Procedures

For Instructor Use Only

C4.2 a. Since MSI is a public company, SOX requires a board of directors and an audit committee within the board of directors. SOX section 301 details the requirements and duties of an audit committee. Audit committee members must be independent from MSI. When looking for a new audit committee member, the individual cannot be MSI management or any other type of MSI employee and cannot have any other affiliation with MSI. For example, if MSI has a loan with a bank and a senior manager from the bank is on MSI‘s board of directors, the senior bank manager cannot be on the audit committee because his employer is conducting business with MSI. Also, audit committee members cannot accept any consulting or advisory fees from MSI. Ideally, audit committee members should have some financial knowledge and experience since they will be dealing directly with the auditors. Retired CFOs and retired auditors are examples of individuals who have financial expertise that can strengthen the audit committee and improve its effectiveness. b. According to AS 1301, the auditor should discuss the following items with the audit committee before the audit begins:  Significant discussions with management regarding the application of accounting principles and auditing standards (AS 1301.04)  The objective of the audit, responsibilities of management, and responsibilities of the auditor (AS 1301.05)  Matters the audit committee may be aware of, such as violations of laws (AS 1301.08)  Overview of the audit strategy, including the timing of the audit, and significant risks (AS 1301.09)  Other matters if applicable, such as nature and extent of specialized knowledge needed to perform the audit, intention to use the work of internal auditors, and intention to use the work of auditors from another accounting firm (AS 1301.10)  Changes to the initial audit strategy or to significant risks initially identified (AS 1301.11) LO 5, BT: AP, Difficulty: Medium, TOT: 45 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Corporate Governance

C4.3 See BPH Excel spreadsheet for the trend analysis, common-size analysis, and ratios. Content in the student memos will vary. Students should recognize how hospitals are different from a manufacturer or retailer and discuss details such as the following: a.A hospital provides services rather than selling products. Therefore, inventory consists more of medical supplies that are used as part of providing a service. Inventory represents less than 1% of total assets of BPH. For a typical retailer or manufacturer, inventory can be 25-30% of total assets. Therefore, auditors will spend significantly less audit time verifying inventory for BPH as compared to audits of wholesale/retail clients. b.Long-term investments represent about 50% of total assets for BPH. Based on its magnitude alone, auditors should spend significant audit time understanding the composition of the account, the accounting principles used, and verifying the account balance. Investment returns are critical to BPH‘s ability to provide charity care; therefore, the audi-

For Instructor Use Only

tors should gain a thorough understanding of how the investments are accounted for and how decisions are made about selling investments to cover costs. c.Property and equipment is approximately 33% of total assets. A hospital cannot provide services without its facility and medical equipment (such as x-ray machines, surgical equipment, and hospital beds). Based on its magnitude and importance to operations, auditors should spend significant audit time verifying the account balance and additions and disposals of property and equipment. Also important is gaining an understanding of how BPH determines if equipment is impaired and how the impairment loss is determined. d.BPH does not have much debt, especially when compared with a for-profit business. BPH relies on donations to fund operations. Auditors should gain an understanding of the donation process and verify that amounts are properly categorized as with donor restrictions or without donor restrictions. e.Recognition of revenue and collection of receivables is an area that has a higher risk of material misstatement. Services provided by the hospital are categorized by medical codes. Improper coding leads to improper billing and improper recording of revenue and receivables. The complexity of collecting from insurance companies, Medicare, Medicaid, and individual patients also makes it challenging to estimate the allowance for doubtful accounts. The receivables turnover in days hovers around 53 days, which appears reasonable. f.The current ratio and the quick ratio are low, hovering around 1.00. That would imply that BPH might be struggling to pay current debts as they come due. However, BPH has a large balance of long-term investments that could be liquidated as needed to pay current debts. The auditors should gain an understanding of BPH‘s policy for cash management and maintaining liquidity. g.In terms of long-term solvency, BPH appears to be in good shape. The debt ratio is low (about 33%) because BPH does not carry much long-term debt. h.The investment return (statement of operations) increased 320% from the prior year, but there was only a 13% increase in the long-term investment account. Perhaps the financial markets had a ―banner‖ year and overall stock market values increased for the year, causing the increase in investment returns. The auditors should gain an understanding regarding the large increase in the investment return.

LO 1, 3, BT: AN, Difficulty: Hard, TOT: 60 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Risk Assessment, Analysis and Management Section: Understanding the Client, Analytical Procedures

For Instructor Use Only

Cloud 9 Part I Students can identify some key market factors by researching on the internet and from their own experiences as consumers of footwear. Student answers will vary.

Economic characteristics/Supplier information/Regulatory Some helpful websites: IBIS World: https://clients1.ibisworld.com/reports/us/industry/default.aspx?entid=969 Footwear Distributors and Retailers of America https://fdra.org/ Competitive environment/Product information/Customer information Competition is high and increasing, with price and quality the deciding factors: i.

The ability to supply footwear retailers with products in a timely manner is an important success factor against competitors. Footwear is subject to fashion trends. ii.

Image and functionality are two of the most important characteristics consumers use to differentiate footwear. An aggressive marketing campaign, often using sports and fitness preferences, is key to establishing brand recognition. iii.

The industry is relatively capital intensive – need for warehousing, transportation, inventory – is high and may create barriers to entry. iv. While entry from new wholesalers can be difficult based on agreements between existing wholesalers and retailers, the trend in the industry is for the customer to buy directly from the manufacturer. Cloud 9 has responded well to this trend by opening its own store, thereby taking out the wholesaler. v.

Discount stores are surpassing department stores – this may impact Cloud 9‘s current customer base and sales opportunities. vi. To boost repeat customer visits, retailers are developing loyalty programs. While Cloud 9 started a program this year, it remains to be seen if the benefits will be achieved given the low regularity of consumers purchasing athletic footwear.

Technology and Systems Technological advances in this industry have mainly been in the areas of replacing the need for skilled labor with computerized automation of inventory control: i.

Computers allow inventory to be stored on an international basis; allowing for more efficient transportation and distribution ii.

Distribution management software allows advanced order management, inventory management, and delivery systems to be combined in one seamless supply chain iii.

An on-line presence will provide a competitive advantage through increased marketing power and the ability to provide product information.

For Instructor Use Only

Part II a. See Excel spreadsheet for trend analysis and common-size (vertical) analysis.

See next pages for selected ratios calculated from January 31, 2025 and 2024 financial statements, and the October 31, 2025 trial balance. The trial balance can be converted into financial statements for purposes of calculating ratios.

If data not available to calculate an average (ex. average inventory for 2024), then use the ending balance.

Conclusions from the ratio analysis: i.

Liquidity is strong and has improved from 2024 to 2025 as shown by the increase in the current ratio and quick ratio. ii.

The activity ratios improved slightly from 2024 to 2025, suggesting that inventory is moving well and customers are paying on time. If customers are given 60 days to pay, then collection time is right on target. Payment of vendors also seems to be reasonably on time assuming vendors allow Cloud 9 thirty days to pay. iii.

The debt to equity ratio decreased from 2024 to 2025 implying less reliance on debt to fund operations. In the long run, less reliance on debt is considered less risky because less debt translates to improved solvency. iv. The profitability ratios have remained very consistent from 2024 to 2025. Cloud 9 has a goal of increasing revenue by 3% for fiscal year end 2026. But with the costs associated with the new store opening, Cloud 9 is expecting profitability to decrease a bit for fiscal year end 2026.

Overall, there are no significant fluctuations noted in the ratio analysis.

In the vertical analysis, the components of the income statement as a percentage of revenue and the components of the balance sheet as a percentage of assets have remained relatively stable from 2024 to 2025. The trend analysis, or horizontal analysis, highlights some large changes in account balances from 2024 to 2025: i.

Cash has significantly increased, possibly caused in part by the $7 million loan from August 2025. ii.

Inventory has decreased slightly from 2024 to 2025 and is still low in the 10/31/2025 trial balance. This seems a bit contradictory, especially given that a retail store was opened in 2025. Also, accounts payable decreased in 2025. Perhaps Cloud 9 has implemented changes to avoid overstocking which can be costly, especially if shoes ―go out of style‖ before they can be sold. iii.

There were significant changes in some debt accounts, such as long-term debt and current portion of long-term debt.

Select ratios calculated from January 31, 2025 and 2024 financial statements:

For Instructor Use Only

Liquidity Ratios

2025

2024

Current ratio = CA/CL

151,895,192 = 2.21 68,719,231

151,175,962 = 1.84 82,307,693

Acid-test (quick) ratio = Liquid assets/CL

11,692,308+62,361,538 = 1.08 9,780,769+60,361,539 = 0.85 68,719,231 82,307,693

Inventory turnover in days

365 ÷ 222,496,154 = 90.6 days (54,773,077+55,615,385)/2

365 ÷ 207,838,462 = 97.6 days 55,615,385

Receivables turnover in days

365 ÷ 364,953,846 = 61.3 days (62,361,538+60,361,539)/2

365 ÷ 345,965,385 = 63.7 days 60,361,539

Payables turnover in days

365 ÷ 222,496,154 = 34.1 days (20,615,385+20,915,385)/2

365 ÷ 207,838,462 = 36.8 days 20,915,385

Gross operating cycle

61.3 + 90.6 = 151.9 days

63.7 + 97.6 = 161.3 days

Net operating cycle

151.9 – 34.1 = 117.8 days

161.3 – 36.8 = 124.5 days

Debt to equity

89,426,923 = 66.5% 134,403,846

104,650,001 = 86.7% 120,615,384

Times interest earned

35,438,461 + 1,257,692 = 29.2 35,353,846 + 1,730,769 = 21.4 1,257,692 1,730,769

Solvency ratios

Profitability ratios Gross profit margin

364,953,846-222,496,154 = 39.0% 364,953,846

345,965,385-207,838,462 = 39.9% 345,965,385

Profit margin

22,680,769 = 6.2% 364,953,846

22,273,077 = 6.4% 345,965,385

Return on assets

22,680,769 = 10.1% (223,830,769+225,265,385)/2

22,273,077 = 9.9% 225,265,385

Return on stockholders‘ equity

22,680,769 = 17.7% (134,403,846+120,615,384)/2

22,273,077 = 18.5% 120,615,384

For Instructor Use Only

Select ratios calculated from the October 31, 2025 trial balance: Liquidity Ratios

2025

Current ratio = CA/CL

163,869,231 = 2.5 66,494,150

Acid-test (quick) ratio = Liquid assets/CL

13,446,154+69,780,769 = 1.25 66,494,150

Solvency ratios Debt to equity

95,071,072 = 65.1% 146,121,166

Times interest earned

27,007,692 + 1,438,461 = 19.8 1,438,461

Profitability ratios Gross profit margin

277,338,461-169,346,154 = 38.9% 277,338,461

Profit margin

17,496,154 = 6.3% 277,338,461

Instructor also has the option to annualize the October 31, 2025 income statement to calculate activity ratios, return on assets, and return on stockholder‘s equity. b. Answers from students will vary. Some examples of items to include in the memo to Suzie outlining potential problem areas or areas that need special emphasis are: i.

Revenue is always a high risk area because of the risk of overstatement of revenue.

With the new retail store opening, there could be a higher risk of errors with the reporting of revenue. Since Cloud 9 has a goal of increasing sales by 3%, management may feel pressure to overstate revenue. ii.

Since accounts receivable is closely linked with revenue and represents approximately 26% of total assets, it also has a risk of overstatement. iii.

Inventory represents approximately 25% of assets; therefore, it is a material item on the balance sheet, and the related cost of sales on the income statement is approximately 60% of revenue. Plus, since inventory/cost of sales is closely linked to the generation of revenue, it should be carefully audited. iv. The investments (derivatives) account is approximately 6.5% of total assets. Special attention should be devoted to this item because of the complexity and subjectivity of valuing derivatives. v.

Cloud 9 has had significant activity with long-term debt, including a large decrease in the current-portion of long term debt. Cloud 9 also took on an additional $7 million loan in 2025. The details of the long-term debt activity should be investigated.

For Instructor Use Only

vi.

Property, plant, and equipment represents approximately 27% of total assets; therefore, it is a material account. It has increased from 2024 to 2025 and to the 10/31/25 trial balance. Some of the increase is probably due to the opening of the retail store.

LO 1, 3, BT: E, Difficulty: Hard, TOT: 120 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Risk Assessment, Analysis and Management, Section: Understanding the Client, Analytical Procedures

CHAPTER 5 Audit Evidence

Learning Objectives 1.

2.

3.

4.

5.

Define management assertions about classes of transactions, account balances, and related disclosures.

Discuss the characteristics of audit evidence.

Apply the procedures for gathering audit evidence, including the use of audit data analytics.

Evaluate when it is appropriate for auditors to use the work of others.

Document the details of evidence gathered in working papers.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. D LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions

2. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions

3. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions

4. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Characteristics of Audit Evidence

5. D

For Instructor Use Only

LO 2, BT: AN, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Characteristics of Audit Evidence

6. D LO 3, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

7. B LO 3, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

8. A LO 3, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

9. B LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

10. A LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Using the Work of Others

11. D LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Using the Work of Others

12. C LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Documentation – Audit Working Papers

For Instructor Use Only

ANSWERS TO REVIEW QUESTIONS R5.1 Financial statements cannot collectively be considered statements of fact because many items are subjective and are estimated based on management judgment. Instead, financial statements are claims and assertions made by management regarding recognition, measurement, presentation, and disclosure of information in the financial statements. Financial statements are management‘s way of implicitly or explicitly stating the organization‘s financial position through its claims and assertions.

LO 1, BT: AN, Difficulty: Medium, TOT: 10 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions

R5.2 The audit risk model aids in determining the quality of audit evidence needed. If the risk of material misstatement is high, auditors will set detection risk low to keep overall audit risk low.

When detection risk is low, auditors want to decrease the risk of their procedures not detecting a material misstatement. Therefore, they will conduct more substantive procedures and plan to collect higher quality evidence to prevent material misstatements from not being detected.

Higher quality evidence is relevant to the assertion being tested and it comes from a reliable source, typically from outside of the client or obtained by the auditor directly.

LO 2, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Characteristics of Audit Evidence

R5.3 Auditors use audit evidence to arrive at an appropriate conclusion regarding a client‘s financial statements; therefore, the reliability of that audit evidence is critical to the audit. Reliability is essential because the client may have an incentive to misstate or distort evidence. Auditors consider the source, accuracy and completeness, authenticity, and susceptibility to management bias of audit evidence when assessing its reliability. Examples of reliable sources of evidence would be information obtained from a third party outside of the client, direct knowledge obtained by the auditor, and client accounting records if internal controls are strong.

LO 2, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Characteristics of Audit Evidence

R5.4 Inspection is an audit procedure that involves examining documents and physical assets.

By inspecting physical assets, auditors can see with their own eyes that the asset exists, thereby supporting the existence assertion. Inspection of physical assets also provides evidence to support the completeness assertion, when the auditor determines that the inspected asset is actually recorded. Auditors verify in the client‘s records that the asset that has been inspected is actually recorded.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

R5.5 When considering the occurrence assertion, auditors search for evidence to support that the transactions and events that have been recorded have actually occurred and pertain to the

For Instructor Use Only

entity. On the other hand, with the existence assertion, auditors seek evidence to support that the account balances of assets, liabilities, and equity interests exist. The difference between the two assertions is that the occurrence assertion relates to transactions and events, while the existence assertion relates to the account balances on the balance sheet. The completeness assertion seeks evidence to support that anything that should have been recorded in the financial statements has been recorded. This is regardless of whether the evidence is related to transactions and events, account balances, or presentation and disclosure.

LO 3, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

R5.6 Procedures for gathering audit evidence are: a. Inspection of documents and assets – Involves examining documents and physical assets. Inspection can be used during risk assessment, as a test of controls, and as a substantive procedure. The direction of testing can further explain the inspection process:  Vouching – Occurs when auditors select transactions from the ledger and work backwards to examine the source documents.  Tracing – Occurs when auditors select source documents and work forward to follow the transaction through to the recording in the journal and ledger. b. Observation – Involves the auditor watching a process or procedure being performed by client personnel. Observation can be used anytime during the audit. c. Inquiry – Involves the auditor asking verbal or written questions to the client to gain an understanding of matters throughout the audit. Inquiry can be used anytime during the audit. d. Confirmation – Occurs when auditors communicate directly with a third party regarding a matter and the third party replies directly to the auditor. Auditors use confirmation as a substantive procedure. e. Recalculation – Involves the auditor checking the mathematical accuracy of client documents or records. Auditors use recalculation as a substantive procedure. f. Reperformance – Involves the auditor independently executing procedures or controls that the client previously performed. Reperformance is used as a test of controls. g. Analytical procedures – Consist of evaluating financial information by studying plausible relationships between both financial and nonfinancial information. Analytical procedures are required during risk assessment and are optional as a substantive procedure. h. Scanning – Occurs when auditors use professional judgment to review accounting data to identify certain unusual or significant items requiring further examination. Scanning is used during all phases of the audit. i. Audit data analytics (ADA) and automated tools – Using computer software and various automated tools to question and examine client data. This technique can be used during all phases of the audit.

LO 3, BT: C, Difficulty: Easy, TOT: 20 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

R5.7 Recalculation is an audit procedure used to verify mathematical calculations manually or electronically. Two simple recalculation techniques are footing and crossfooting in which the au-

For Instructor Use Only

ditor adds a set of numbers in a column and a row to determine accuracy. Other recalculation techniques include recalculating depreciation, interest, and payroll taxes by checking the accuracy of formulas and verifying numbers from source documents. Reperformance provides evidence of whether a client procedure was performed correctly. Auditors ―re-do‖ procedures performed by the client to ensure the procedure was done correctly and that it was completed. An example of reperformance is when auditors agree the total of the subsidiary accounts receivable ledgers to the general ledger accounts receivable balance. Agreeing the totals of the subsidiary and general ledger balances is an internal control procedure performed by the client. The auditor reperforms this control to ensure the client personnel followed procedures, agreed the balances, and followed up on any discrepancies.

LO 3, BT: C, Difficulty: Medium, TOT: 15 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

R5.8 When hiring a specialist, auditors take precautions to reduce the risk that the work of an auditor‘s specialist is not relevant or reliable. First, auditors determine the scope of the specialist‘s work and the type of documentation/report needed from the specialist. Next, auditors determine whether the specialist has the qualifications, experience, and objectivity to perform the work. Finally, the audit team will also assess the specialist‘s report to determine whether the findings are consistent with past years and other corroborating evidence gathered by the auditors.

LO 4, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Using the Work of Others

R5.9 The external audit team consists of a partner, manager, senior associate and staff associates. Partners have the most experience and are responsible for the entirety of the audit including the team‘s supervision and final audit report. The size of the audit team will depend on the complexity and size of the client. A client‘s internal audit function is not considered part of the external audit team, however, auditors may use the work performed by internal auditors to gather evidence and assist in the audit. With approval from management or those charged with governance, auditors can assign internal auditors specific activities for the audit and review the work performed just like any staff member on the audit team. Since internal auditors are employees of the client, external auditors must assess the objectivity and competence of the internal auditors and assess their procedures and quality of working papers before deciding to allow the internal auditors to assist with the audit.

LO 4, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Using the Work of Others

R5.10 An auditor may use the work of a component auditor when auditing a consolidated company. For example, when auditing a parent company, the auditors may rely on another accounting firm, referred to as the component auditor, to provide audit evidence regarding the parent‘s subsidiary, or component. This is especially common when the component is located in a foreign country. A component could also be a joint venture in which the client participates. A component auditor may be used to audit the joint venture because the component auditor has more

For Instructor Use Only

expertise in the business of the joint venture, or because the group engagement team does not have enough staff to also audit the joint venture in a timely manner.

LO 4, BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Using the Work of Others

R5.11 Some key elements included in all audit documentation are: 1. Client name 2. Period under audit 3. Title describing the contents of the working paper 4. File reference indicating where the working paper fits in the audit file 5. Initials of the preparer and the date prepared 6. Initials of the reviewer and date reviewed 7. Cross-referencing between working papers indicating where further work and evidence is summarized LO 5, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk assessment, Analysis and Management, Section: Documentation – Audit Working Papers

For Instructor Use Only

SOLUTIONS TO ANALYSIS PROBLEMS AP5.1 Various inventory accounts (produce and meat) are at risk of overstatement because items are missing because of theft. Therefore, the existence of inventory is impacted.

Sales revenue could be overstated (occurrence assertion) if the employees have been covering their thefts by recording fictitious sales or overstating genuine sales.

LO 1, BT: AN, Difficulty: Easy, TOT: 10 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions

AP5.2 The accuracy assertion for revenue is impacted. Revenue for the three areas of lawn and garden, plumbing, and paint supplies, could be overstated or understated depending on whether the outdated price lists had higher or lower sales prices. Management should also verify that correct costs of inventory are being used when a product is sold. The accuracy assertion for COGS could be impacted if the system is pulling costs from an outdated cost list when an inventory item is sold.

LO 1, BT: AN, Difficulty: Easy TOT: 10 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions

AP5.3 a. 3 – refers to source which impacts both relevance and reliability b. 2 c. 1 d. 2 e. 1 f. 2 LO 2, BT: C, Difficulty: Easy, TOT: 10 min, AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Characteristics of Audit Evidence

AP5.4 a. A slowdown in business might result in managers being pressured to understate expenses in order to overstate profits. Capitalizing routine maintenance and repairs in an asset account will overstate assets (existence assertion) and understate expenses (completeness assertion). The classification assertion is also violated because the expenditures are recorded in the wrong accounts. Expenditures that are capitalized in an asset account should be depreciated which impacts depreciation expense and accumulated depreciation. If expenditures are improperly recorded in an asset account, they will be improperly depreciated, thus overstating depreciation expense (occurrence assertion) and overstating accumulated depreciation (accuracy, valuation and allocation assertion). b. As risk of material misstatement increases, the need for sufficient appropriate evidence increases. Auditors will need to gather more quantity (sufficiency) of evidence. The evidence will also need to be appropriate, which means more relevant and reliable. Auditors must ensure their procedures are relevant for the assertions being tested. Also, the evidence obtained should be more reliable. For example, auditors should not rely solely on evidence generated from in-

For Instructor Use Only

quiry of client personnel or inspection of internal client documents. If possible, evidence should be obtained from independent sources or by direct knowledge by the auditor.

LO 1, 2 BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions and Characteristics of Audit Evidence

AP5.5 3 4  1 or 6 1 2 7 2 5 LO 3, BT: C, Difficulty: Easy, TOT: 15 min, AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Procedures for Gathering Audit Evidence

AP5.6 a. Jenna has used the following procedures to gather audit evidence: 1.

External confirmations – 30% of which were positive confirmations and 70% negative confirmations. Confirmations, particularly positive confirmations, provide very reliable evidence because an external source is confirming the information.

2.

Inspection of documents – invoices, cash receipts and sales returns vouchers. Auditor inspection of internally generated documents provides moderately reliable evidence because the client could falsify internally generated documents. Accuracy, completeness, and authenticity could be an issue.

3.

Inquiry – interviews with accounts receivable manager, CFO and accounts receivable department. Although auditors can gain important information by interviewing client personnel, inquiry is the least reliable type of evidence. Generally, auditors must obtain corroborating evidence to support, or contradict, information gained through inquiry. b. The external confirmations provide evidence about the existence of accounts receivable when the customers reply and confirm that they owe the client money for goods or services.

Negative confirmations provide more limited evidence about existence when the customer does not reply to state that they do not owe the client money. The confirmations also provide evidence about rights and obligations assertion because the customer confirms that they owe the client.

The inspection of documents relates to the existence and accuracy valuation and allocation assertions for accounts receivable when Jenna vouches the balances back to the underlying sales documents. It relates to the completeness assertion when Jenna traces the sales transactions to the accounts receivable balance. In addition, the vouching of accounts receivable back to sales returns and cash receipts documents provides evidence about the occurrence of these transactions, and also the completeness of the accounts receivable balance. The tracing of these transactions to accounts receivable provides evidence about the completeness of the record

For Instructor Use Only

of these transactions, and also the existence of the accounts receivable balance. The review of subsequent cash receipts also provides evidence about existence and accuracy valuation and allocation because when customers pay their account they are confirming that they owed the balance on the balance sheet date and they were in a position to make a payment.

The inquiry evidence could relate to all assertions, depending on the topic of the conversation.

The auditor is likely to ask about procedures used to identify potential bad debts (accuracy, valuation, and allocation), about credit control (accuracy, valuation, and allocation), segregation of duties (primarily existence, rights and obligations, completeness), and about control systems in general (which would relate to all assertions).

LO 1, 2, 3, BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

AP5.7 a. Appropriateness of evidence refers to its relevance and reliability, including its source. The most reliable evidence is evidence gathered directly by the auditor. The next most reliable evidence is externally generated and sent directly to the auditor followed by externally generated evidence held by the client. The least reliable evidence is that which is internally generated.

None of the documents held in James‘ files are in the most reliable category because it is all held by the client. Therefore, the more reliable evidence held by James is the externally generated evidence such as bank statements, correspondence from banks, and other bank-initiated documents. The least reliable evidence is James‘ documents, including bank reconciliations and copies of letters sent to banks and other parties. The evidence is relevant because it relates to Ajax‘s bank accounts and could support assertions such as existence, completeness, accuracy, and classification of cash accounts. b. The auditor would obtain more appropriate evidence by obtaining documents directly from the bank. For example, the auditor could ask the bank to confirm in writing (via a bank confirmation) the balances of the client‘s various accounts at specific dates, the interest rates and fees that apply to the client‘s bank accounts, and the state of any disputed transactions. This evidence would be more reliable because it has not passed through the client‘s hands and therefore could not have been altered by the client.

LO 1, 2, 3, BT: AP, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

For Instructor Use Only

AP5.8 a. The occurrence assertion for revenue refers to management‘s claim that revenue transactions that have been recorded have occurred and pertain to the entity. A procedure for the completeness assertion would be selecting documents and related customer orders and tracing them to inclusion in the sales journal. Tracing provides evidence that all transactions that should have been recorded were actually recorded. Therefore, the tracing procedure is not relevant to the occurrence assertion. To gather evidence for the occurrence assertion, auditors should select a sample of sales from the sale journal and vouch back to supporting documentation (sales invoice, authorized shipping document, and approved customer order). b. The procedure relies solely on internally generated evidence. Therefore, the evidence is not highly reliable.

LO 1, 2, 3 BT: E, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

AP5.9 a. The cutoff assertion for inventory purchases refers to management‘s claim that transactions have been recorded in the correct accounting period. The risk is that purchases and accounts payable will be understated by incorrectly recording items in the next fiscal year that were received in the current fiscal year. This can be done by forward-dating receiving reports to the first few days of the next financial year for goods received in the last few days of the current year.

The planned procedure to inspect receiving reports in the three days before and after year end to determine if the items were recorded in the inventory/accounts payable accounts will address the cut-off assertion. b. The procedure relies solely on internally generated evidence. However, if there is also a bill of lading from the carrier/delivery of the goods that could be matched with the receiving report, the reliability of the evidence would be improved because it would include externally generated evidence held by the client.

LO 1, 2, 3 BT: E, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

AP5.10 a. The accuracy, valuation, and allocation assertion for the allowance for doubtful accounts refers to management‘s claim that assets are included in the financial statements at appropriate amounts, and any resulting valuation or allocation adjustments are appropriately recorded. Confirmation of accounts receivable provides evidence that customer account balances exist and are owed to the client; however, they do not provide evidence of a customer‘s intention to pay the amount due. Therefore, the confirmation procedure is not relevant for the accuracy, valuation, and allocation assertion for the allowance for doubtful accounts. b. The confirmation procedure provides highly reliable evidence because it is externally generated evidence sent directly to the auditor.

LO 1, 2, 3 BT: E, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

For Instructor Use Only

AP5.11 a. Susan has been gathering the following types of evidence: 1. Inquiry: Susan has been holding conversations with staff. During these conversations she will be discovering how they perform their duties, whether there are staff shortages in certain areas at various times, how management is communicating their attitudes towards control systems and profit targets, whether controls are overridden at various times.

2. Inspection: Susan has inspected the physical assets of the company during her tours. She can see if assets exist, whether they are being protected, their condition, how they are used. For example, she can see if construction equipment appears to be new or well maintained. She can also observe staff performing their duties, both on the construction sites and in the offices.

3. Analytical procedures: Susan is calculating ratios and reviewing the trial balance. She is looking for indicators of problems, such as unusual fluctuations, and whether the data appear to reflect the state of the business as described by management. b. The spreadsheets are reviewed to identify unusual patterns that could indicate problem areas for further investigation, and to calculate trends and ratios, including common size statements, to quantify the fluctuations. Susan will use the results of the analytical procedures to justify increased or decreased focus on specific areas, and the nature, timing and extent of further procedures.

For this type of business, Susan will be using the data to determine if profitability is comparable to previous periods and with other similar clients. She will analyze the specific movement of physical materials used in construction and whether this is consistent with the financial data. For example, if the quantities of physical materials delivered to a site are lower because of slower construction progress, is the cost of materials also lower? Is the progress of the build consistent with the use of labor and machinery? Is revenue recognized on building in progress consistent with the progress and cost of the construction? c. Observing the assets during the tour provides a starting point for investigating the assertions of completeness (whether new items she observes are in the accounting records), accurac, valuation, and allocation (whether the items appear to be in poor condition, and thus have impaired values), and existence (whether items, especially new items, included in the accounting records actually exist). Older items or unused items are more likely to be obsolete and thus either impaired in value or scrapped from the accounting records. Newer items are more likely to be of higher value but could also not be recorded in the accounting records.

LO 1, 2, 3 BT: AN, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

AP5.12 The internal audit department focuses on efficiency and effectiveness of production (i.e. operational auditing) and compliance with government regulations (compliance auditing).

The head of the internal audit department is a CPA and the other members of the department have operational auditing and compliance relevant experience and qualifications. The internal audit department is highly regarded within the business, reports to the board of directors and the

For Instructor Use Only

CEO, and the reports appear to be acted upon. All these factors suggest that the internal audit department is well run and effective. However, they also suggest that it does not concentrate on issues directly relevant to financial reporting and auditing.

The external auditors are likely to review the internal audit department‘s work, particularly where it is relevant to operational indicators reflected in the accounts. They are likely to review the internal auditor‘s reports and their evaluations of internal control systems, particularly in production and inventory issues and general management issues. However, most of the internal audit department‘s findings on waste regulations and efficiency matters will not be directly relevant to the external auditors‘ audit of accounting transactions and balances.

LO 4, BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Using the Work of Others

AP5.13 a. Mark must consider the requirements of AU-C 620 when making his choice of specialist.

Once it has been decided that the services of a specialist are required, the main factors to consider are: a) Scope of the work: The auditor must specify the scope of the work to be carried out by the specialist. It is possible that the two specialists being considered, and any others, would not be interested in completing all the work required. Mark has to consider how to communicate the scope of the work, and whether he could use more than one specialist to complete the work required. b) Capability of the specialist: What qualifications do Manfred and Lily possess? Are they a member of a relevant professional body (e.g. Institute of Engineers), and what tertiary qualifications do they have in the relevant scientific field? What experience do they have – both appear to have been working in the industry for many years? c) Objectivity of the specialist: This appears to be the most contentious point in this case.

Fritz is not in favor of using Manfred because he believes that Manfred would have a negative attitude. However, Mark should be cautious about taking Fritz‘s advice to employ Lily because it appears that Lily could be too positive towards Fritz. A third choice of specialist might resolve the deadlock, although in such a specialized field, there would likely be personal relationships or views on the reputation of most of the leading experts.

For Instructor Use Only

b. Mark will be guided by AU-C 600 if the local auditor continues to audit the new subsidiary.

Mark would consider as part of his client continuance decision in the second year whether he can operate with a component auditor or if he should take over the work of the subsidiary himself. Mark needs to consider whether he can do or supervise the work involved in the new subsidiary and whether the local auditor can complete the audit work to the necessary standard if they are to continue with the audit of the subsidiary. It is Mark‘s responsibility to be satisfied whether the other auditor can do the work to the required standard. Mark will consider the other auditor‘s capacity and ability, reputation, membership of a professional body, and whether they will take direction from Mark.

LO 4, BT: AN, Difficulty: Hard, TOT: 25 min., AACSB: Technology, Analytic, AICPA AC: Research, Section: Using the Work of Others

AP5.14 a. AU-C 230 Audit Documentation requires that the auditor prepares the audit documentation on a timely basis that provides a sufficient appropriate record of the basis for the auditor‘s report and evidence that the audit was planned and performed in accordance with AU-Cs. The audit documentation of audit procedures must record the (a) identifying characteristics of the specific items or matters tested (b) who performed the audit work and the date such work was completed, and (c) who reviewed the audit work performed and the date and extent of such review (AU-C 230.09).

Essentially, the documentation should allow another experienced auditor to understand the work done and the results obtained and any significant matters that arose during the audit (AU-C 230.08). The conclusions reached should also be understandable given the audit work documented. b. The audit assistant has documented that there were no replies to certain accounts receivable positive confirmation letters. Jennifer‘s review has shown that the decision to take no further action after non-reply from customers is not appropriate. A response to a positive confirmation request is necessary to obtain sufficient appropriate evidence (AU-C 505.13).

According to AU-C 505.12, the auditor shall perform alternative audit procedures to obtain relevant and reliable audit evidence for each of the non-responses. Jennifer should note that further audit work is required and the specific audit work to be done. Examples of alternative audit procedures the auditor can perform are: a) examining specific subsequent cash receipts; b) shipping documents and c) sales near the period end for the non-response customers (AU-C 505.A24). Specific consideration should be given to the implication of the non-responses for audit risk for accounts receivable. These conclusions would also be documented (AU-C 230.08.12).

LO 3, 5, BT: AN, Difficulty: Medium, TOT: 45 min., AACSB: Technology, Analytic, AICPA AC: Research, Section: Procedures for Gathering Audit Evidence, Documentation

AP5.15 Note: Student answers will vary.

This link to the SEC website provides a summary of the fraud:

For Instructor Use Only

https://www.sec.gov/litigation/litreleases/2011/lr21915.htm Here is a link to the PCAOB release: https://pcaobus.org/Enforcement/Decisions/Documents/PW_India.pdf Primary audit deficiencies were that the auditors failed to maintain control over cash and accounts receivable confirmations. The auditors allowed Satyam management to send the confirmations and receive them back directly from the banks. This provided Satyam management with the opportunity to falsify the confirmations.

The auditors violated AS No. 3 (now AS 1215) by adding documentation to the audit file well after the 45-day completion requirement. The documents that were added did not include dates, who added them, or why. The auditors also lied to the PCAOB about adding the documentation past the completion deadline.

The penalties issued by the PCAOB included: (1) censuring the registered public accounting firms Price Waterhouse, Bangalore, Lovelock & Lewes, Price Waterhouse & Co., Bangalore, Price Waterhouse, Calcutta, and Price Waterhouse & Co., Calcutta (collectively, "PW India,") (2) temporarily limiting the activities, functions, and operations of PW India, including by prohibiting PW India from accepting SEC Issuer Referred Engagement Work for new clients for a period of six months (3) requiring PW India to engage an independent monitor (4) requiring PW India to adopt and implement certain policies and to undertake certain actions related to PW India's system of quality control (5) requiring PW India to provide additional professional education and training to its associated persons (6) imposing a civil money penalty jointly and severally in the amount of $1,500,000 as to Price Waterhouse, Bangalore, and Lovelock & Lewes.

LO 4, 5, BT: AN, Difficulty: Hard, TOT: 60 min., AACSB: Technology, AICPA AC: Research, AICPA PC: Professional Behavior, Section: Using the Work of Others, Documentation

For Instructor Use Only

SOLUTIONS TO AUDIT DECISION CASES C5.1 A customer, TRS, with a large, material accounts receivable balance is over 90 days late in paying the balance owed to KCI. One of KCI‘s accounting staff, Jonathan, states he has not made any adjustments or allowances related to the overdue balance. Based on the information given, it seems reasonable that some or all of the balance for TRS should be included in the estimate of bad debts and included in the allowance for doubtful accounts. If no adjustment is made, bad debt expense is at risk of being understated (completeness assertion) and the allowance for doubtful accounts is at risk of being understated (accuracy, valuation, and allocation assertion). If the allowance is understated, then net accounts receivable will be overstated (accuracy, valuation, and allocation assertion).

LO 1, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions C5.2 AU-C 230.09 Audit Documentation requires specific documentation of the procedures performed to gain an understanding of the potential bad debt. The auditor would document the inspection of the aging of the accounts receivable balance. For example, the auditor would note which accounts receivable balances were included in the analysis, the date the balances of accounts receivable were extracted; who conducted the analysis, and on which date; and who reviewed the analysis, and on which date, including the items reviewed and the conclusions drawn.

In addition, the notes (or transcript of the interview) from the inquiry with Jonathan from the accounting department, would be documented; the date of the interview and the personnel involved; who conducted the interview; and who reviewed the contents of the interviews.

AU-C 230.11 requires the auditor to discuss significant matters with management, those charged with governance, and the nature of the significant matters discussed, with whom and when the discussions took place. In this case, TRS‘s account is large, material and more than 90 days overdue, yet there is no allowance provided for the possible bad debt. The auditor would discuss with Jonathan and possibly Patricia (CFO) if there are disputes with TRS‘s account, if any attempts have been made to recover the debt, and the progress of those attempts.

Depending on the responses from Jonathan and Patricia, the auditor would inquire as to why an allowance has not been made for this account.

The working papers should include the auditor‘s plan for following up on this issue during interim work, and again at year-end if KCI has not received payment from TRS.

LO 5, BT: AP, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Documentation

For Instructor Use Only

C5.3 According to AS 2605, Leo & Lee should take the following steps when evaluating the internal audit function of MSI: 1. Gain an understanding of the internal audit function – AS 2605.05 states auditors should inquire of management and internal audit personnel the following: a.

Organization status within the entity. b.

Application of professional standards c.

Audit plan, including the nature, timing, and extent of audit work d.

Access to records and whether there are limitations on the scope of activities.

After gaining an understanding, the auditor may conclude that the internal auditor‘s activities are not relevant to the integrated audit. If so, the auditor does not need to give further consideration to the internal audit function (AS 2605.08). However, the auditor could consider the internal audit activities to be relevant to the audit. It that case, it could impact the nature, timing, and extent of the audit work, and the auditor should continue to the next step.

2. Assess the competence of internal auditors – AS 2605.09 states auditors should consider the following factors: a. Educational level and professional experience b. Professional certification and continuing education c. Audit policies, programs, and procedures d. Practices regarding the assignment of internal auditors e. Supervision and review of internal auditors‘ activities f. Quality of working paper documentation, reports, and recommendations g. Evaluation of internal auditors‘ performance 3. Assess the objectivity of internal auditors – AS 2605.10 states auditors should consider the following: a. Organizational status of the internal auditor – who does the internal auditor report to?

Who makes employment decisions about the internal auditor? Does the internal auditor have direct access to the board of directors or audit committee? b. Policies to maintain internal auditors‘ objectivity Regarding the use of MSI‘s internal auditors, information is provided in the case relevant to the competence and objectivity of the internal audit function. The head of the internal audit function, Lorenzo, created the internal audit group five years ago. Lorenzo does not have any certifications but has three to five years of experience as an external auditor prior to working at MSI. The internal auditors that work with him have certifications, however, they do not have much experience. Therefore, the competence of the internal audit function could be considered low.

The internal audit function appears to be designed appropriately so that the internal auditors can be objective in their duties. Most importantly, Lorenzo has direct communication with the audit committee. Therefore, the objectivity of the internal audit function appears reasonable.

No information is given in the case regarding the quality of the work produced by the internal auditors. The quality of the work would probably be the determining factor of whether to use the work of the internal auditors and/or have them assist with the audit.

(Student answers may vary, but they should defend whichever answer they choose.)

For Instructor Use Only

LO 4, BT: E, Difficulty: Medium, TOT: 40 min., AACSB: Technology, AICPA AC: Risk assessment, Analysis and Management, Research, Section: Using the Work of Others C5.4 (Note: Student answers may vary. Answer provided goes beyond what students are required to answer.)

The following table lists the most significant asset accounts for BPH, the two or three most relevant assertions for each account, and two or more audit procedures that would provide sufficient appropriate audit evidence related to the assertions.

Significant Account

Two relevant asser- Two audit procedures tions

Patient accounts receivable, net – This account is 51% of total current assets (7% of total assets), therefore it is significant based on its magnitude. It is also significant because of the complexity and risk involved with collecting from Medicare, Medicaid, insurance companies, and individuals.

Existence and valuation

 Existence: Confirmation of receivables with Blue Cross and a sample of other insurance providers. Sending confirmations to individual patients would not be effective because most patients would probably not respond.

Confirming with Medicare and Medicaid would also probably not be effective because of non-response. In addition to confirmation, auditors inspect documentation (vouch back to supporting documents) and correspondence with insurance companies that supports the existence of the receivable.  Valuation: Inquire of management regarding the process of determining the estimate for uncollectible accounts. Recalculate the estimate. Inspect documents and correspondence with insurance companies as needed.

Long-term investments – This Existence and valuaaccount is 51% of total assets, tion therefore it is significant based solely on its magnitude.

 Existence: For investments held with a third party investment firm, send confirmations to verify existence and valuation.  Valuation: For investments required to be measured at fair value, inquire of management about the process for determining fair value. Fair value can also be verified with a confirmation with the third party investment firm. For investments reported at cost, inspect supporting documentation and recalculate if necessary.

For Instructor Use Only

Existence, rights, valuation

 Existence: Inspect the physical buildings for existence and inspect supporting documentation, especially for any new buildings acquired.  Valuation: Inquire of management regarding the process for determining impairment. Recalculate if necessary.

Furniture and equipment – Existence, rights, valuation This account is 11% of total assets. It is significant because equipment and furniture are critical to the primary operations of the hospital. Hospitals cannot function without medical equipment (i.e. x-ray machines) and furniture (i.e. hospital beds, chairs for waiting rooms).

 Existence: Inspect a sample of the physical equipment for existence and inspect supporting documentation, especially for any new equipment acquired.  Rights: Inspect supporting documentation to verify that equipment is owned rather than rented for a term of less than one year.  Valuation: Inquire of management regarding the identification of obsolete or defective equipment and related impairments. Recalculate if necessary. Inspect actual equipment for indications of possible impairment.

Buildings – This account is 32% of total assets, therefore it is significant because of its magnitude.

LO 1, 2, 3, BT: E, Difficulty: Hard, TOT: 45 min., AACSB: Analytic, AICPA AC: Risk assessment, Analysis and Management, Section: Management Assertions, Characteristics of Audit Evidence, Procedures for Gathering Audit Evidence

For Instructor Use Only

Cloud 9 a. The procedures for engaging other auditors to perform the work on the inventory in Vietnam are covered in AS 1205. First W&S Partners must determine if it qualifies as the ―principal auditor.‖ AS 1205.02 states that to be considered the principal auditor, the firm must consider the materiality of the portion it is auditing, must have knowledge of the overall financial statements, and must consider the importance of the components it is auditing in relation to the whole. The Vietnam operations account for 25% of Cloud 9‘s inventory and 20% of Cloud 9‘s property, plant, and equipment. W&S is auditing everything else except for the Vietnamese operations.

Therefore, W&S qualifies as the principal auditor.

Next, W&S must complete the following procedures as outlined in AS 1205.10: 1.

Inquire as to the professional reputation and independence of the other auditors.

Inquiries can be of the AICPA or similar professional organization in Vietnam, other practitioners, banks and other creditors, and other appropriate sources.

2.

Obtain a representation letter from the other audit firm that it is independent from Cloud 9 under the PCAOB and SEC requirements.

3.

Communicate with the other auditor the following – i.

Other auditor is aware that the financial statements of the component will be included in the financial statements on which the principal auditor will report and the principal auditor will rely on the report of the other auditor. ii.

Other auditor has knowledge of financial reporting requirements of the SEC iii.

A review will be made of matters affecting elimination of intercompany transactions/accounts b. Engagement of the derivatives specialist is covered by AS 1210. Derivatives are specialized assets and can be difficult to value because of the risks involved. Josh must consider the choice of specialist by considering the following (AS 1210.03): 1.

Professional certifications, license, or professional accreditation of the specialist in the particular field 2.

Reputation and standing of the specialist in the particular field 3.

Years of experience in the type of work under consideration Josh must also consider the relationship of the specialist to the client, if there is one. The specialist does not have to be independent from the client but must maintain objectivity (AS 1210.05).

Josh must decide the scope of the work to be carried out by the specialist. The specialist will provide a report of the work completed and the findings. Josh must gain an understanding of the work to be performed by the specialist including (AS 1210.06): 1.

The responsibilities, including the objectives of the work to be performed 2.

The nature of the work the specialist is to perform or assist in performing 3.

The degree of the specialist‘s responsibility for evaluating the relevance and reliability of data produced by the company or from sources outside of the company.

4.

The degree of the specialist‘s responsibility for evaluating the significant assumptions used by the company or developing his or her own assumptions.

For Instructor Use Only

5.

The degree of the specialist‘s responsibility for evaluating the methods used by the company or using his or her own methods.

6.

The responsibility of the specialist to provide a report or other documentation that describes the work performed, the results of the work, and the findings or conclusions reached by the specialist.

Josh should perform appropriate tests of the data provided to the specialist, considering the assessment of control risk. He should also evaluate whether the specialist‘s findings support the related assertions in the financial statements. If Josh believes the specialist‘s findings contradict the relevant assertion or do not provide sufficient appropriate evidence, he should apply additional procedures or request the specialist to perform additional procedures as necessary to address the issue (AS 1210.12).

LO 4, BT: AP, Difficulty: Medium, TOT: 45 min., AACSB: Technology, AICPA AC: Risk assessment, Analysis and Management, Research Section: Using the Work of Others

CHAPTER 6 Gaining and Understanding of the Client’s System of Internal Control Learning Objectives 1.

2.

3.

4.

5.

6.

7.

Define internal control and explain the COSO Framework.

Explain and evaluate internal control at an entity level.

Explain and evaluate internal controls at a transaction level.

Explain and evaluate Information Technology (IT) Controls.

Identify and explain the different techniques used to document internal controls.

Explain the importance of identifying strengths and weaknesses in an entity‘s system of internal control.

Explain the auditor‘s responsibility for understanding internal control when the client‘s outsources part of its accounting and information system to an outside service organization.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

2. D LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

3. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

4. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

5. C LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

6. A

LO 2, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

7. D LO 2, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

8. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

9. B LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

10. B LO 4, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

11. B LO 4, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

12. C LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

13. D LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

14. C LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

15. A LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

For Instructor Use Only

ANSWERS TO REVIEW QUESTIONS R6.1 An auditor needs to understand an organization‘s internal controls to identify the types of misstatements that are likely to occur and make a preliminary assessment of the risk of material misstatement. The understanding, including understanding the audit trail is needed to design substantive tests. Finally, understanding internal control influences the resulting audit strategy developed at the assertion level.

LO 1, BT: C, Difficulty: Easy, TOT: 8 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.2 The three objectives of internal control are: Operations objectives. These pertain to the effectiveness and efficiency of the entity‘s operations, including operational and financial performance goals and safeguarding assets against loss. An entity‘s budgeting process is an example of an operational control.

Reporting objectives. These pertain to internal and external financial and non-financial reporting and may encompass reliability, timeliness, transparency, or other terms as set forth by regulators, recognized standard setters, or the entity‘s policies. Many IT application controls are examples of controls related to the reporting objective.

Compliance objectives. These pertain to adherence to laws and regulations to which the entity is subject. For example, a pharmaceutical company may institute controls over the manufacturing process to ensure compliance with Food and Drug Administration regulations.

LO 1, BT: C, Difficulty: Easy, TOT: 9 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.3 The control environment, the tone at the top set by management, influences all other aspects of internal control. If management and those charged with governance are clear about communicating the importance of internal control, others in the organization will be more conscious about ensuring that controls are implemented effectively.

LO 2, BT: C, Difficulty: Easy, TOT: 8 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.4 HR management must staff jobs with individuals who have the needed skills and employees who have the knowledge, skills, and training to make appropriate judgments required by their job responsibilities. For example, an employee should have sufficient knowledge of GAAP (or an applicable financial reporting framework) to apply GAAP in a variety of situations.

For Instructor Use Only

One aspect of HR risk that is closely related to financial reporting auditing is the effect of HR policies on promoting and communicating ethical values throughout the organization and ensuring that the appropriate ―tone at the top‖ trickles down through the organization. A report conducted by Ernst & Young (EY) revealed these issues have become more visible and significant, possibly as a result of adverse publicity about corporate ethics in recent years. However, although ethics is becoming more significant as a HR risk, the executives responding to the survey rated the likelihood of ethical problems arising throughout the organization as low. The survey‘s authors suggest HR executives should pay more attention to the alignment between values espoused by company management in public arenas and actual practices by employees at all levels within the organization.

Finally, HR has a significant influence on hiring competent people who understand and are prepared to carry out various accounting and control responsibilities.

LO 2, BT: C, Difficulty: Moderate, TOT: 12 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.5 The risk assessment process at a retailer might focus on business risks, such as selling produce before it goes bad. Failure to control this risk reduces profitability and affects the valuation of inventory. Many retailers are also concerned about controlling cash transactions and making sure that are transactions are recorded and the cash is received. This would affect the completeness of recorded sales and cash.

LO 2, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.6 The failure to maintain strong segregation of duties makes it possible for an individual to commit an error or fraud and then be in a position to conceal it in the normal course of his or her duties. During the process of making credit sales, credit approval should be segregated from authorizing individual sales, which should be segregated from shipping goods, which should also be segregated from billing customers.

LO 2, BT: C, Difficulty: Easy, TOT: 8 min., AACSB: v, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.7 The client has the responsibility for monitoring its own internal control system, so the client knows their internal controls are working properly. An auditor wants to know that the client reviews controls and tests of controls to ensure controls within the internal control structure are effective.

LO 2, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

R6.8 An important process used for developing an audit strategy for various assertions involves the following eight steps: 1. Understand entity level controls 2. Understand the flow of transactions 3. Identify what can go wrong (WCGW) for financial statement assertions 4. Identify relevant controls to test 5. Determine preliminary audit strategy 6. Perform tests of controls 7. Evaluate audit evidence, assess control risk, and reevaluate audit strategy (if necessary) 8. Report internal control weaknesses to those charged with governance.

The auditor obtains an understanding of internal control at the entity level by talking with individuals at all levels of the organization.

The auditor obtains an understanding of internal control at the transaction level by performing a walk-through of a transaction cycle, such as the sales process. A walkthrough involves following a transaction from initiating the transaction until it is recorded in the financial records.

The auditor identifies what can go wrong using the auditor‘s knowledge of assertions.

The auditor combines their knowledge of the client‘s internal controls with knowledge of assertions to determine if adequate controls exist to prevent, or detect and correct, misstatements on a timely basis. The auditor also looks for the most effective control, rather than relying on all controls related to an assertion.

If the auditor determines that it is appropriate to test controls (tests of controls are usually performed when the auditor wants to assess control risk below the maximum), the auditor will perform tests of control at the entity level and the transaction level. If tests of controls show that internal controls related to an assertion are strong the auditor will assess control risk as low. If tests of controls show that controls are not functioning as expected, the auditor will usually revise the audit strategy for the relevant assertion.

The audit will test controls when the auditor plans a reliance strategy.

Once the auditor performs tests of controls, the auditor will evaluate the evidence obtained and determine if tests of controls support the planned audit strategy. If necessary, the auditor will reevaluate controls to determine if compensating controls might be relied upon. If tests of controls support a low control risk assessment the auditor will follow an audit strategy of a lower assessed level of control risk approach. If internal controls are weak related to an assertion, the auditor will use a primarily substantive approach.

For Instructor Use Only

If the auditor identifies significant deficiencies or material weaknesses in internal controls, the auditor will consider wither the deficiency or material weakness in internal controls has been remediated as of the balance sheet date, when reporting these to control deficiencies to those charged with governance.

LO 3, BT: C, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.9 In order to understand a client‘s internal control in an IT environment, it is important to understand the benefits and risks of IT systems, such as: 1. IT systems may be more vulnerable to physical disaster. This is mitigated by an IT general control over systems backup. Having an appropriate backup allows the organization to use a second set of programs and files if the primary set is compromised by a physical disaster.

2. Various functions may be concentrated in IT systems, with a corresponding reduction in the traditional segregation of duties followed in manual systems. If one person is allowed to both run computer programs with live data, and change the programs, the person may be able to conceal errors or fraud. IT general controls segregating program changes from operations prevents this type of misstatement. Careful access controls and logs of access to programs and data must also be maintained.

3. Unauthorized access to data may result in the destruction of data or improper changes to data, including the recording of unauthorized or nonexistent transactions, or inaccurate recording of transactions. Unauthorized access to data allows change data and manipulates the audit trail. Appropriate access is maintained through access controls, such as password controls and logs of access to data.

4. There may errors in converting information from paper form to machine readable form. Such errors are often controlled through IT application controls such as comparing data to the data in a master file, or through controls such as limit tests or reasonableness tests.

LO 4, BT: C, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.10 The advantages and disadvantages of internal control documentation are: 1. Narratives. This is the most common form of documentation, particularly in smaller environments where accounting and internal control activities are simple or where a flow of a particular transaction is relatively simple and straightforward. It involves the auditor describing (in words) each step of the flow of a transaction from start to finish (that is, from initiation to reporting in the financial report). Advantages include the fact that narratives are simple to prepare. Disadvantages include the fact that strengths and weaknesses may or may not be transparent. However, a good narrative should explain the accounting process and related controls, and it may highlight internal control strengths and weaknesses.

For Instructor Use Only

2. Flowcharts and logic diagrams. This form of documentation is used in larger and more complex environments. It involves the auditor summarizing in flowcharts or logic diagrams each step of the flow of a transaction from start to finish or from initiation to reporting in the general ledger. Logic diagrams are more common than flowcharts. One advantage is that logic diagrams provide a visual perspective of the flow of the transaction and key controls throughout the flow that is often simpler for the reader or reviewer to understand. A disadvantage is that a firm needs to have a standard process for developing flowchart and logic diagram documentation. Good documentation makes strengths and weaknesses stand out in a visual manner.

3. Combinations of narratives and flowcharts. This form of documenting internal controls is typically a page divided into two sections: with the process flowchart on the lefthand side, and the narrative describing each step in the flow on the right-hand side.

The flowchart side highlights the key activities from initiation to reporting, while the narrative column contains the details about what happens in the flow of the transaction.

The advantage of a flowchart is the combination provides a good explanation of processes and controls, while providing a visual aid to understand the transaction flow.

Strengths and weaknesses in a client‘s system of internal control are usually transparent in good combination documentation. The disadvantage of a combined format is that it may take more time to create.

4. Checklists and preformatted questionnaires. An internal control checklist or questionnaire is another technique used to systematically identify the most common types of internal control procedures that should be present in the client‘s system. The strength is that checklists are particularly helpful in industries that the auditor may not personally be familiar with, or when less experienced auditors find it difficult to identify which are the critical controls. Questionnaires also help auditors identify controls that the client has not implemented (vs. documenting what the client is doing). A weakness involves the importance of understanding the question and the client‘s response to the question.

Checklists often identify internal control weaknesses more than they do internal control strengths.

LO 5, BT: C, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.11 Areas of internal control weakness are where the auditor typically performs additional substantive testing to quantify the (potential) material misstatement. The link between weaknesses in internal controls or observations that controls being tested did not operate as intended, and the level of substantive procedures required to address these exceptions is revealed by the auditor, who uses this information to reassess the risk of a material misstatement. The auditor is also likely to perform substantive testing on year end balances, with larger sample sizes.

When the auditor identifies internal control strengths, the auditor will consider a reliance on controls approach for assertions influenced by these strengths, perform tests of controls to ensure that controls are strong, and then limit substantive testing. If internal For Instructor Use Only

controls are strong, the auditor may also perform substantive tests with smaller sample sizes at an interim date.

LO 6, BT: C, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R6.12 A SOC 1, Type 2 report will provide the user auditor with information about the intended design of controls at the Service Organization and the results of tests of those controls. Based on the results of a SOC 1, Type 2 report the user auditor may determine that a primarily substantive approach must be followed for an assertion In this circumstance, the user auditor noted that the SOC 1, Type 2 report on tests of controls performed by the service auditor noted exceptions to the effective operation of the relevant controls. Due to those exceptions, the user auditor was not able to assess control risk as low.

LO 7, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

SOLUTIONS TO ANALYSIS PROBLEMS AP6.1Dereck‘s suggestion is not appropriate because the auditor needs to have sufficient appropriate evidence about the effectiveness of controls. The fact that IT general controls are strong is not a substitute for the control environment, risk assessment, the information and communication system, IT application controls and other control activities, or monitoring. Each year the auditor needs a complete understanding of the entire system of internal control and test the system if the auditor intends to follow a reliance strategy for an assertion.

LO 1, BT: C, Difficulty: Basic, TOT: 5 min., AACSB: Analytic Skills, Reflective Thinking Skills, Technology Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.2

Control a. Management established a code of conduct that includes rules regarding conflicts of interest for purchasing agents. b. Waterfront‘s management established a disclosure committee to review the selection of new accounting policies.

Category 1

Assertion(s) Occurrence

3.2

c. Any computer program revision must be approved by user departments after testing the entire program with test data. d. The managers of each of Waterfront‘s manufacturing departments must review and expenditures charged to their responsibility center weekly.

3.3.1

Valuation and Allocation, Presentation and Disclosure Virtually any assertion

3.2

Occurrence, Completeness, Accuracy, Cutoff, Classification

e. The CEO, CFO, and controller review the financial consequences of business risks annually to ensure that controls are in place to address significant business risks. f. Human resources focuses on ensuring that accounting personnel have adequate qualifications, experience, and training for work performed in billing and accounts receivable. g. Security software limits access to programs and data files and keeps a log of programs and files that have been accessed. The log is reviewed by the security manager daily. h. A software program prints a daily report of all shipments that have not yet been billed to customers. i. The controller reviews sales and collections bi-monthly. j. The software application compares the information on the sales invoice with underlying shipping information for the transaction. k. Customer billing complaints are directed to internal audit for follow-up and resolution. l. The documentary transaction trail for all credit sales is documented in company policy manuals. m. Waterfront uses a Microsoft Excel program to calculate depreciation expense. An accounting manager tests the calculations on a sample basis and evaluates the overall reasonableness of depreciation expense.

2

Valuation and Allocation

1

Virtually any assertion

3.3.1

Occurrence

3.3.2

Completeness

3.2 3.3.2

Valuation, Completeness Occurrence

5

Virtually any assertion

4

Virtually any assertion

3.3.3

Valuation

For Instructor Use Only

LO 2, BT: A, Difficulty: Moderate, TOT: 15 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

AP6.3 (a) The accounts show that the controls over sales, receivables and cash receipts are not effective. The accounts are not up to date and client statements have not been issued for four months. These tasks were apparently the responsibility of the bookkeeper, Sally, under the supervision of Max. Max appears to have been unaware of the problems, suggesting that he is not monitoring the processes very closely. Overall, this means that the management‘s attitudes towards internal controls in general, and the accounts in particular, are not good. The fact that the bank has asked them to meet to discuss their worsening cash position suggests that they are not adequately managing their cash flow.

Although Betty is responsible for technical issues, such as repairing computers, rather than the administration side of the business, she is also an owner of the business and should be involved in setting the tone of the organization. Max and Betty appear to have failed to establish good internal controls and communicate and enforce the importance of the systems to their staff. There is no evidence of any unethical behavior by the staff, but they do not appear to have been adequately trained and/or appropriately selected for the positions they hold.

In a small business, such as this, management involvement is a substitute for a large system of formal controls. This means that Max and Betty must be personally involved in authorizing and supervising transactions to a greater extent than if there were more staff. (b) Segregation of duties should follow the broad principle that the following duties are segregated:  Authorization or approval of transactions affecting assets,  Custody of assets,  Recording or reporting of transactions, and  Control over processing a transaction should be separated from recording or reporting a transaction.

Sally is employed to help with bookkeeping. The other staff members are a computer technician and a sales part-timer. This means Sally and Max are the only two staff members currently with administrative responsibilities. It will be difficult to segregate duties with only two staff in the area. Therefore, Max and Betty must perform additional review tasks, such as separately reviewing all transactions over a certain limit, monthly reports of debtor‘s balances and transactions, bank reconciliations etc.

In addition, if Sally retains the task of banking, she should not be involved in recording transactions, particularly cash receipts. An alternative would be for Max to do the banking and leave Sally responsible for transaction processing. Betty could take responsibility for inventory control, so the sales staff are not involved in maintaining inventory records as well as having access to the inventory for making sales.

For Instructor Use Only

LO 2, BT: A, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.4 a. The control environment factors that can affect the effectiveness of specific policies and procedures related to the other components of an internal control system are:  Integrity and ethical values,  Commitment to competence,  Board of directors and audit committee,  Management's philosophy and operating style,  Organizational structure,  Assigning of authority and responsibility, and  Human resource policies and practices. b.

The required level of understanding of several of the control environment factors, such as management's philosophy and operating style, organizational structure, and board of directors or audit committee will ordinarily be the same for each audit strategy. For some factors, however, such as human resource policies and practices, additional knowledge may be necessary when the lower assessed level of control risk approach is used.

LO 2, BT: A, Difficulty: Basic, TOT: 20 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.5 The problems at International Bank (IB) appear to begin at the most senior levels of the foreign currency department, rather than with an individual trader. The attitude at senior levels was that if the trader was able to make a profit, the official policies and procedures could be ignored, or overridden. This suggests the control environment in the department did not reinforce integrity and ethical values, and encouraged risk taking in pursuit of profit.

Questions must be asked about more senior levels in IB if senior management of one department has a poor ethical attitude, how was this viewed by higher levels of management and those charged with governance? Did senior levels in the foreign currency department hide their attitudes from their supervisors, or did those supervisors ‗turn a blind eye‘ to the issue provided the department was profitable? The press reports suggest the poor ethical attitudes are not confined to the foreign currency department, adding weight to the view that more senior management were likely to have poor attitudes toward ethical conduct. There should have been stronger communication and enforcement of integrity and ethical values throughout the organization, through measures such as codes of conduct.

For Instructor Use Only

The organization structure at IB could be deficient if there was not effective supervision of the foreign currency department. In addition, HR policies and practices were either ignored or were non-existent with respect to ethical attitudes and behavior.

Overall, the most significant problem was with communication and enforcement of integrity and ethical values throughout the organization.

LO 2, BT: A, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.6 Item

1. The software application must match information from a vendor‘s invoices with information from receiving and information from the purchase order before a check is issued.

2. Two authorized signatures are required on every check for payment of purchases over $100,000.

3. Each month the credit manager carefully reviews the computer-generated aged trial balance of accounts receivable to identify past-due balances and follows up for collection.

4. A supervisor must approve overtime work.

5. The software application assigns sequential numbers to sales invoices used in the billing system.

6. The software application verifies the mathematical accuracy of each voucher and prints an exception report for items with mathematical errors.

7. Employee payroll records are kept on an electronic file that can only be accessed by certain terminals and are password protected.

8. An accounting supervisor reviews journal entries periodically for reasonableness of account classifications.

9. Two individuals open the mail and prepare a prelisting of checks received.

Then the checks received from custom-

a. Category of Control Activities

b. Assertion

IT application controls

Occurrence

Authorization

Occurrence

Performance reviews

Valuation and allocation

Authorization

Occurrence

IT application controls

Completeness

IT application controls

Accuracy

IT general controls

Occurrence, accuracy, classification

IT dependent manual controls

Classification

Segregation of duties

Completeness

For Instructor Use Only

ers and related remittance advices are separated in the mailroom and subsequently processed by different individuals.

10. All vouchers must be stamped ―paid‖ upon payment.

11. On a quarterly basis, the controller reviews a software-generated comparison of warranty expenses and actual warranty claims.

12. Computer programmers are not allowed in the computer room.

13. The software application will not complete the processing of a batch when the accounts receivable control account does not match the total in the subsidiary ledgers.

Physical controls

Occurrence

Performance reviews, IT dependent manual controls.

IT general controls

Accuracy

IT application controls

Pervasive affect on multiple assertions Occurrence or completeness

LO 2,4 BT: A, Difficulty: Moderate, TOT: 40 min., AACSB: Analytic Skills, Reflective Thinking Skills, Technology Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.7 a) Inherent risk associated with the recording of depreciation expense and accumulated depreciation should be high or maximum. The determination of depreciation expense is highly subjective. It involves estimates of useful lives and appropriate residual values, that are influenced by external factors such as economic conditions, demand, aircraft usage, and new technology. Based on analytic procedures, the primary risk is that depreciation expenses are understated. Depreciation expenses may have decreased even though the cost of aircraft and engines has not changed. This would be justified if the aircraft are flying fewer miles each year.

Auditors should investigate the flight schedules for aircraft to determine if the distances flown are lower. b)

‗What could go wrong‘ is that depreciation expenses could be understated and pretax profits are overstated. Also, the net value of aircraft equipment could be overstated. The assertion involved is the valuation and allocation assertion associated with aircraft equipment.

c)

A common control over accounting estimates in public companies involves the review of estimates by a disclosure committee. Such a committee would be made up of key accounting and operating personnel that are knowledgeable about the factors that influence accounting estimates. In smaller organizations, one individual should make the estimate, and another knowledgeable person should review the estimate.

For Instructor Use Only

LO 2, BT: A, Difficulty: Basic, TOT: 30 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.8 a) When planning and performing the audit of internal control over financial reporting, the auditor should consider the results of his or her fraud risk assessment. As part of identifying and testing entity-level controls, the auditor should evaluate whether the company's controls sufficiently address identified risks of material misstatement due to fraud and controls intended to address the risk of management override of other controls. Controls that might address these risks include  Controls over significant transactions that are outside the normal course of business for the company or that otherwise appear to be unusual due to their timing, size, or nature ("significant unusual transactions"), particularly those that result in late or unusual journal entries;  Controls over journal entries and adjustments made in the period-end financial reporting process;  Controls over related party transactions;  Controls related to significant management estimates; and  Controls that mitigate incentives for, and pressures on, management to falsify or inappropriately manage financial results.

If the auditor identifies deficiencies in controls designed to prevent or detect fraud during the audit of internal control over financial reporting, the auditor should take into account those deficiencies when developing his or her response to risks of material misstatement during later stages of the financial statement audit. b)

Given that the industry is experiencing a decline in the number of passenger air miles, it is surprising that there is little change in earned revenues, while unearned revenues are down. It may be that Omega Airways is on the lagging end of industry trends. A challenge for the management of many companies is to achieve performance targets, including revenue growth and profit. In the case of Omega Airways, there is a risk that the amount of revenue received in advance is transferred to revenue too early because it would help management achieve their revenue and profit targets. The evidence from the financial statements suggests there is a greater fall in revenue received in advance than in usual revenue. This could occur if revenue received in advance is incorrectly treated as revenue for the period (revenue in advance would be decreased and revenue for the period would be increased). However, an alternative explanation is that the revenue in advance is lower because bookings for the next period have fallen even further than bookings for the current period.

c)

Internal controls at Omega Airways appear to be strong based on the description of the controls. The controller for Omega Airways evaluates the unearned revenue account and revenue recognition quarterly. Once a decision is made, revenue earned is reviewed by the CFO and the company‘s disclosure committee. This proFor Instructor Use Only

cess provides several layers of review of the decision originally made by the controller.

LO 3 BT: E, Difficulty: Moderate, TOT: 40 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.9 a) The transactions that would occur at Emerald Spa include:  Cash receipts from customers for services,  Reimbursement from health insurance companies for counselling and massage services,  Credit purchases of supplies, such as oils and hair products,  Electronic funds transfers to pay wages,  Check payments for rent, electricity, furniture purchases, insurances, tax remittances, advertising, and  Depreciation for furniture and equipment. b)

Examples of what can go wrong if the control system does not meet objectives include:  Incorrect pricing used for customer services.  Services provided but not charged to customers or services provided and cash payments from customer not recorded in the accounts.  Not all cash receipts are banked intact in a timely manner.  Failure to claim reimbursements from health insurance companies on behalf of clients, or claims processed for the wrong services.  Ordering wrong supplies or insufficient supplies to meet demand.  Failure to keep supplies safely locked away, as required, and potential inventory shrinkage.  Failure to record purchase of supplies; making payment for supplies not received; or recording the cost of supplies at an incorrect amount.  Branch manager approves salary payments for hours not worked by staff, or approves wages at incorrect rates, or for staff that do not work for the business.  Failure to control costs such as electricity, through inefficient use of equipment.  Equipment and furniture not accounted for, not kept secure at the premises, charging depreciation on furniture and equipment no longer used by the business; or failure to record depreciation because equipment was not recorded as asset.  Repairs to furniture and equipment recorded as new purchases of assets; or new purchases recorded as repairs.

LO 3 BT: E, Difficulty: Moderate, TOT: 30 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

AP6.10 a) Purchases Process Authorization

Purchase Order

Receiving Receiving Report

Recording

Vendor’s Invoice

Record in Purchases Journal Purchases Journal

General Ledger Cash Disbursements Process Authorization

Determination of Invoices Due Review Supporting Documentation

Check Making Payment 114 | © 2022 John Wiley and Sons, Inc.

For Instructor Use Only

Cash Disbursements Journal Recording General Ledger

(b) Generally, authorization should be separated from custody of assets which should be separated from recording. In the case of purchases, preparing and authorizing the purchase order should be separated from receiving, which should be separated from recording the purchase.

In the case of cash disbursements, authorizing the payment should be separated from making the payment, which should be separated from recording the payment.

LO 3,5 BT: E, Difficulty: Moderate, TOT: 30 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

AP6.11 To: Risk Assessment Committee Issue: Recent reports have warned of climate change impacts on the Florida coastline.

These include the possibility of a rise in sea levels, more frequent storms, similar to what we have seen in recent hurricanes that bring flooding and coastal erosion.

Our company owns a material amount of undeveloped ocean front property along the Florida Coastline, which we expect to develop over the next 15 years. If coastal hurricanes continue to be a significant issue, they may impact the value of our undeveloped waterfront property.

The risk assessment committee should consider whether there is sufficient demand to accelerate the development of this property, so that it can be sold at a value that will bring expected profit margins. If market forces allow, the Company might consider developing our Florida coastal properties ahead of other properties that are less subject to the impact of climate change.

Further, we might consider whether we offer the public homes that are designed to withstand the impact of high winds and have major living areas above rising sea levels or the levels that would be affected by a storm surge.

Ultimately, we need to consider the effect of climate change on the underlying value of our existing Florida oceanfront property.

For Instructor Use Only

LO 2,7 BT: e, Difficulty: Challenging, TOT: 20 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP6.12 Mariya should take two steps.

First, Mariya should determine if Murray and Heath Construction, LLC (MHC) has controls over the completeness and accuracy of all transactions submitted to the service organization that processes MHC‘s payroll. If there are sufficient controls at MHC for each assertion, Mariya should document those controls and then determine an appropriate audit strategy, given those controls.

Second, if MHC does not have sufficient controls over the process of payroll transactions by the outside service organization, Mariya should make inquiries about obtaining a SOC 1, Type 2 report. A SOC 1, Type 2 report can then be used to document Visse and Watne‘s understanding of internal controls over payroll transactions, as well as documenting test of controls of those transactions which were performed by the service auditor.

LO 7 BT: E, Difficulty: Moderate, TOT: 15 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

For Instructor Use Only

Audit Decision Cases C6.1 a) Small entities have limitations in their ability to implement a comprehensive control system. There are fewer employees in small entities, which means that segregation of incompatible duties is harder to organize. In addition, small entities usually do not have formal documentation of their control systems, making assessment of their design effectiveness more difficult.

However, managers of smaller entities (who are usually also the owners) are able to have a greater personal involvement in all aspects of the business and are therefore able to monitor activities directly. With direct monitoring, many departures from control systems could be detected. For example, if owners are knowledgeable about the expenditures of the business, owners might personally sign all checks or approve any ETF payments. This direct oversight by owners can mitigate many issues that arise from lack of segregation of duties. b)

Eric and Patricia may be too trusting of their employees. A tenet of a strong internal control environment is to trust but verify. There is a weak tone at the top about the importance of internal control, there is virtually no segregation of duties, and no monitoring function. First, Eric and Patricia need to be engaged in the accounting function and understand and promote good internal controls. Second, they should attend to segregation of duties, and Eric and Patricia should be involved in regular oversight in terms of authorizing key transaction and monitoring cash receipts and cash disbursements. For example, bank statements should go unopened to Eric or Patricia, and they should monitor the transactions processed by the bank. They might also actively review bank reconciliations and monitor entries to the purchases journal, cash receipts journal, cash disbursements journal, as well as any adjusting journal entries.

c)

Thornson and Danforth, LLP should consider making the following recommendations regarding control activities: Segregation of Duties and Authorization Controls. A strong system of segregation of duties should be implanted at King Companies, Inc. Segregation of duties usually involves segregating authorization of transactions from custody of assets, from the recorded accountability (accounting). To this extent, all transactions need to be authorized by someone outside of accounting. As King Companies grows in size, King might consider a centralized purchasing function. If purchasing is authorized by store managers, which might also have custody of assets, it should be regularly reviewed by Eric King.

1.

With respect to payroll, time worked by hourly employees needs to be approved by store managers, and payroll for salaried employees should be reviewed by Eric or Patricia King.

For Instructor Use Only

No transactions should be initiated in accounting.

2.

Regular Vacations. Eric and Patricia King should implement a policy of regular vacations for all employees, and other individuals should fill in and perform the responsibility of those on vacations. This will allow those people who fill in for vacationing individual to identify transactions or responsibilities that may be ill conceived or poorly performed.

3.

Performance reviews. Store managers should be responsible for not only reviewing the performance of their stores, but they should also review all transactions charged to their stores. If store managers are responsible for the transactions charged to their stores, they may review them carefully, and it makes it less likely that fictitious vendors or fictitious employees will exist. It addition, Eric or Patricia King should also review individual transactions. Periodic review by knowledgeable owner-managers will influence the control environment and strengthen other controls.

4.

IT-Dependent Manual Controls. Strong IT-Dependent Manual Controls are important. Duties should be segregated within accounting where Abby Owens is responsible for the initial recording of all transactions, and Jonathan Jung is responsible for reviewing all transactions and validating the transactions to supporting documents.

LO 2 BT: E, Difficulty: Challenging, TOT: 45 min., AACSB: Analytic Skills, Reflective Thinking Skills, Technology Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C6.2 Following is a draft management letter to Eric and Patricia King: Date: Address: To the Management and the Board of Directors of King Companies, Inc. In planning and performing our audit of the financial statements of King Companies, Inc. (KCI) as of and for the year ended December 31, 2025, in accordance with auditing standards generally accepted in the United States of America, we considered the KCI‘s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the KCI‘s internal control. Accordingly, we do not express an opinion on the effectiveness of the KCI‘s internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control For Instructor Use Only

that might be material weaknesses or significant deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. However, as discussed below, we identified certain deficiencies in internal control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity‘s financial statements will not be prevented, or detected and corrected, on a timely basis. We consider the following deficiencies in the Company‘s internal control to be material weaknesses.

Control Environment During our audit we noted a weak control environment. In other words, it is important for senior management to emphasize the importance of strong internal controls. This is often accomplished by senior management reinforcing the concept that others in the organization should be conscientious about implementing strong internal controls. Further, it is important for owners to monitor the implementation of controls by others.

While it is appropriate for management to trust employees, a good control environment establishes an environment of trust, but verify. Hence, senior management needs to monitor and verify the implementation of controls on a regular basis.

Segregation of Duties Good segregation of duties segregates the authorization of transactions from custody of assets, from the recording of transactions and developing recorded accountability. We recommend that KCI take a close look at each transaction process. In the purchasing process KCI may have grown to the size where centralized purchasing may be appropriate, or where owners are more involved in authorizing purchases. Owners should also be involved in authorizing salaried payroll and store managers should authorize payroll for hourly workers.

Regular Vacations An important aspect of internal control is requiring regular vacations. The lack of regular time off may allow an individual to initiate fraud and conceal fraud. Regular vacations make it more difficult to conceal fraud or errors. We found that several employees in key accounting positions have not taken time off for significant periods of time. We recommend that KCI implement a policy of mandatory vacations and that they have other individuals take over those responsibilities while any individual is on vacation.

For Instructor Use Only

Performance Reviews Another aspect of a strong system of internal control involves having managers responsible for business units (e.g., auto parts stores) review revenue and expense transactions associated with their business units. In our opinion, store managers should be responsible for not only reviewing the performance of their stores, but they should also review all transactions associated with their stores. If store managers are responsible for the transactions associated with their stores, they may review them carefully, and ensure strong recorded accountability. Further, it makes it less likely that fictitious vendors or fictitious employees will be processed. In our opinion, it is also important for Eric or Patricia King to review individual transactions. Periodic review by knowledgeable owner-managers will influence the control environment and strengthen other controls.

IT-Dependent Manual Controls Strong IT-Dependent Manual Controls, where individuals in accounting verify transactions reported by the computer system are verified against underlying source documents. In our opinion, duties in the accounting department should be segregated where Abby Owens is responsible for the initial recording of all transactions, and Jonathan Jung is responsible for reviewing all transactions and validating the transactions to supporting documents. This should strengthen the accuracy of accounting records.

This communication is intended solely for the information and use of management and the Board of Directors of KCI, and it is not intended to be, and should not be, used by other than these specified parties.

Thomas Danforth Thornson and Danforth, LLP LO 2 BT: E, Difficulty: Challenging, TOT: 40 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C6.3 a) In the context of evaluating the control environment with respect to implementing the new manufacturing costing system, the auditor will want to:  Pay attention to the tone at the top over the implementation of the new costing system. What messages are being sent by senior leaders about the importance of controls that are (1) embedded in the new system and (2) controls over system changes? It is very important for management to emphasize the importance of controls and that the new system is developed and tested.  Evaluate the human resource aspect of the system change to ensure that competent individuals are involved in the design, implementation, and management of the system change.  Understand and evaluate the monitoring function with respect to evaluation of IT general controls over the system change, and monitoring of the testing of IT application controls embedded in the new manufacturing costing system.

For Instructor Use Only

Auditors will evaluate these items in large part through inquiry of management and employees involved in the implementation and assessing the tone at the top through memos sent by management and by talking with employees about what they are hearing about the importance of controls in the process of developing the new system. b)

Management‘s risk assessment process focuses on management‘s evaluation of what can go wrong during the design and implementation of the new manufacturing costing system. In particular management will want to attend to the risks that:  The new system is adequately designed to accomplish both business goals and to ensure adequate accounting and control functions.  IT general controls over system changes are strong and that the new system has adequate protections over the access and security of data and information.  IT application controls are strong and that controls designed into the new system are adequate. The auditor might evaluate risk assessment controls by reviewing any documentation of the risk assessment process, as well as evaluating the processes used by management to ensure that the risks identified above are minimized. c)

With respect to IT general controls, the auditor is particularly concerned over the new cloud-based system. The auditor will want to evaluate controls over:  system software acquisition, change and maintenance,  program changes,  access security, and  application system acquisition, development, and maintenance. The auditor will evaluate these controls through inspecting documentation of these controls, observation of controls during the system change process if the audit team is onsite during the design and implementation of the new system, and inquiries of management and employees about the process of developing and implementing the new manufacturing costing system.

LO 2,3,4 BT: E, Difficulty: Challenging, TOT: 50 min., AACSB: Analytic Skills, Reflective Thinking Skills, Technology Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C6.4 a) Management of a hospital needs to be concerned about all assertions related to revenues from government sponsored programs. The auditor might ask the following questions of individuals involved in billing for government-sponsored Medicare or Medicaid programs:  What controls do you have to ensure that all revenues due from governmentsponsored patient services are recorded as revenue and receivables?  What controls do you have in place to ensure that billings to governments for Medicare and Medicaid services are for services actually performed?  What controls do you have in place to ensure that billings to governments for Medicare and Medicare services are accurate and that you are using proper billing codes associated with services actually provided?

For Instructor Use Only

 

What controls do you have in place to ensure that billings to governments for Medicare and Medicare services are properly classified with respect to billing the correct government, and with respect to appropriately classifying revenues? What controls do you have in place to ensure that billings to governments for Medicare and Medicare services are recorded in the accounting period when the services were provided?

b) The occurrence assertion is related to recording revenues for services actually provided. Hence, each billing should be supported by actually providing a service to patients. Controls over occurrence might include controls that patients actually checked in to receive services, controls that doctors actually ordered services billed to patients and insurance companies were actually ordered by doctors, and that they were actually delivered to the patients. Hence, any billing should actually be supported by a doctor‘s order, or by removing drugs from the pharmacy. The auditor might also make inquiries about how often patients complain about being billed for services not received or how often insurance companies raise questions about the adequacy of supporting documentation behind billings.

LO 2,3,4 BT: E, Difficulty: Challenging, TOT: 40 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

For Instructor Use Only

Cloud 9 Purchase Order

Credit Evaluation Sales Order Packing Slip Bill of Lading Sales Invoice

Sales Journal

General Ledger

Acct. Rec. Subsidiary Ledger Monthly Statements

For Instructor Use Only

a)

Combined Flowchart and Narrative

Authorization

To initiate an order customers log on to a Cloud 9 website supported by a program entitled ―swift.‖ Swift has a master price file, and will show customers the price for various items on hand. The swift system does not allow customers to place an order in excess of inventory levels on hand. If a customer needs more inventory, the customer completes a separate request for inventory not on hand, that gets e-mailed to the Cloud 9 production manager and the Cloud 9 marketing manager, who determine if Cloud 9 should manufacture more goods.

The swift system compares the customer‘s outstanding receivable, plus the amount of the purchase order with the customer‘s credit limit. If the customer goes over the credit limit, there are a limited number of people in the CFO‘s office who can approve an extension of credit in excess of a customer‘s credit limit.

When credit has been approved the purchase order becomes a sales order. Then the swift system assigns shipments to the warehouse location nearest to the customer‘s location that can fulfill the entire order.

Warehouse employees select inventory and put boxes of ordered shoes onto pallets. The pallets are taken to a staging area where each product is then scanned. Swift matches the quantities and products on the packing slip to the sales order. If they don‘t match, the order is set aside for follow-up to ensure that the order is accurately filled. Once they match, the approval box is activated, and the shipping supervisor can enter his passcode. This officially approves the packing slip and bill of lading, and each gets printed.

Accounting can then pull up a draft invoice that was generated when the shipping document was approved. At this point swift performs a number of checks. The system:  matches the quantities in the invoice against the packing slip and sales order (accuracy).  Prices are also matched to the sales order (accuracy).  The customer number should also match on the sales order, shipping documents, and draft invoice (accuracy and classification).  A report is run daily of any shipments that have not resulted in invoices (completeness).  A report is also run of any invoices that are not supported by shipping documents (occurrence).  At month end a report is run to compare dates on shipping documents with dates invoices are recorded in the sales journal (cutoff).  At the end of each day totals for accounts receivable are compared with the total of each customer‘s balance in the accounts receivable subsidiary ledger. If there are any discrepancies, the transaction is reported for manual follow-up. Cloud 9 has a data control group that follows up on discrepancies in a variety of systems. Discrepancies have to be cleared daily. Once the reason for the discrepancy is identified, changes to the underlying data must be approved by a manager in the data control group. The data is then corrected, and the invoice is processed.

Then the sales invoice is processed. Processing the sales invoice enters the transaction in a database from which Cloud 9 builds the sales journal and accounts receivable subsidiary ledger. The system is also used to send monthly statements of accounts receivable balances to customers.

Cloud 9 sends statements to customers with their receivable balances monthly. The sale manager and the CFO discuss past due accounts on a regular basis. The balance in the allowance for doubtful accounts is reviewed monthly by the sales manager, controller and CFO. Any adjusting journal entries are made monthly by the controller and approved by the CFO (valuation).

b) Follow-up Questions Students may have follow-up questions that focus on either (1) the controls related at the assertion level for the recording of wholesale revenue transactions, or (2) the manual follow-up related to discrepancies noted. Students might ask questions of personnel who actually work in the system, to determine what employee experience in exceptions being reported, and how exceptions are cleared. Students might also ask questions about the strength of IT general controls. This is not a black and white question and instructors should evaluate student answers in the context of the above possible questions. c)

Controls related to recording wholesale revenue transactions For Instructor Use Only

Cloud 9 has the following IT application controls related to the assertions noted below: Assertion Completeness Occurrence Accuracy Classification Cutoff

Control A report is run daily of any shipments that have not resulted in invoices.

A report is run daily of any invoices that are not supported by shipping documents.

First, the system matches the quantities in the invoice against the packing slip and sales order. Prices are also matched to the sales order.

The customer number should also match on the sales order, shipping documents, and draft invoice.

At the end of the month a report is run of discrepancies between the month the goods are shipped and the month the sales invoice is recorded.

With respect to all of the above IT application controls Cloud 9 has a data control group that follows up on discrepancies. Discrepancies have to be cleared daily. Once the reason for the discrepancy is identified, changes to the underlying data must be approved by a manager in the data control group. The data is then corrected, and the invoice is processed. d) Overall conclusion: Based on information obtained from the interview with Carla Johnson, Cloud 9‘s CFO, and follow-up questions of individuals who work in the process, the revenue system seems to have adequate controls related to all wholesale revenue transaction assertions. However, tests of controls still need to be performed to evaluate the adequate operations of the system.

LO 3,4, and 5, BT: E, Difficulty: Moderate, TOT: 20 min., AACSB: Analytic Skills, Reflective Thinking Skills, Technology Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

CHAPTER 7 Executing the Audit – Performing Tests of Controls Learning Objectives 1.

2.

3.

4.

5.

6.

Explain the different types of controls that an auditor might encounter.

Explain the types of evidence that can be used to support a test of controls.

Determine how to select and design tests of controls.

Evaluate the results of tests of controls.

Evaluate the results of a SOC 1, Type 2 Report.

Document the results of tests of controls.

For Instructor Use Only

7.

Explain how to communicate internal control weaknesses to those charged with governance.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

2. A LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

3. A LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

4. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

5. D LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

6. D LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

7. C

LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

8. D LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

9. C LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

10. B LO 3, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

11. B LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

12. D LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

13. C LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

14. B LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

15. A LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

16. C LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

ANSWERS TO REVIEW QUESTIONS R7.1 Preventive controls might include such controls as a strong control environment which encourages ethical behavior, physical controls that limit access to valuable assets, or software controls applied to each transaction during normal processing. They are intended to stop fraud or errors from occurring. Preventing errors during processing is an important objective of every accounting system.

Detective controls are those applied after transactions have been processed to identify whether fraud or errors have occurred, and to rectify the fraud or errors on a timely basis. Companies put detective controls in place to assist management in ensuring WCGWs do not occur in financial reporting and that the business is functioning as planned through the design and implementation of its business processes. Most companies design detective controls to ensure that if preventive controls are not effective, errors or fraud are detected and corrected on a timely basis.

LO 1, BT: C, Difficulty: Easy, TOT:10 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R7.2 As reconciliations, such as bank reconciliations, are prepared, unusual items are investigated, and issues are resolved and corrections made, if necessary. The performance of reconciliations without following up on reconciling or unusual items is not a control, as accounting records are not corrected based on items identified in the reconciliation process. The control is the follow-up and correcting items that require correction. Typical reconciliations are performed between the general ledger and some other form of external evidence or a subsidiary ledger. The bank reconciliation reconciles the bank statement to the cash account recorded in the general ledger, and accounting personnel make adjustments for transactions identified in the bank statement that have not been recorded (e.g., recording bank service charges).

LO 1, BT: C, Difficulty: Easy, TOT:10 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R7.3 Purely manual controls are those that do not rely on the client‘s IT environment for their operation. An example is a locked inventory cage for high dollar-value items to which only a few authorized staff have an access key. However, manual controls may use IT-produced information from third parties. For example, a client may reconcile the amount of inventory held on consignment that was manually counted during its inventory count to the amounts listed in the third party‘s computer-generated consignment inventory statement.

For Instructor Use Only

Automated controls are usually IT application controls, as discussed in the Chapter 6 section on Information Technology Controls. For example, an IT application control may recalculate the amount of gross payroll paid to hourly employees and note any discrepancies between hours worked and hours paid. It is important to identify the extent of reliance a control places on IT to determine possible exceptions. Further, if the auditor expects to rely on IT application controls, the auditor must also determine whether the client has effective ITGCs. LO 1, BT: AP, Difficulty: Moderate, TOT:10 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R7.4 Ordinarily, an entity has three types of ITGCs in place: 1. Program change controls. Only appropriately authorized, tested, and approved changes are made to applications, interfaces, databases, and operating systems.

2. Logical access controls. Only authorized personnel have access to data and applications and can perform only authorized tasks and functions. Logical access controls are particularly important for maintaining segregation of duties.

3. Other ITGCs (including IT operations). This includes controls such as ensuring regular and timely backups of data, following up on and resolving program faults and errors in a timely manner, following up on any deviations from scheduled processing on a timely basis, and planning upgrades to programs and applications on a timely basis.

ITGC are often called ―general controls‖ because they do not control particular assertions. Rather they control the IT environment. ITGCs affect many applications. In other words, they influence the effectiveness of revenue process controls as well as purchase and payroll process controls.

ITGCs are essential because they impact the effectiveness both of IT application controls and IT-dependent manual controls, as well as potentially affect the reliability of electronic audit evidence the auditor may wish to rely upon during the audit. For example, if a client relies on an application that records a sale and then automatically records and updates the accounts receivable ledger for that particular customer, the client also relies on its IT program change procedures and security to verify that the program and this specific control is not changed without appropriate approval and testing.

LO 1, BT: C, Difficulty: Moderate, TOT:15 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R7.5 Tests of controls include inquiry, observation, inspection of physical evidence, reperformance, and computer assisted audit techniques. Ordinarily, a combination of these testing procedures provides evidence that the control operated as intended throughout the period for which the auditor wishes to place reliance on the control.

For Instructor Use Only

1.

2.

3.

4.

5.

Inquiry. This technique involves the auditor using questioning skills to determine how the control is completed and whether it appears to have been carried out correctly and on a timely basis. For example, the auditor may ask the employee who prepares the bank reconciliation how reconciling items are identified, the reasons for them, and the procedures to ensure that the accounting records are corrected on a timely basis. The auditor may also ask management how it ensures the reconciliation is prepared correctly and timely. In addition, the auditor might ask questions of employees who follow up on exception reports about the types of misstatements that employees find and how exceptions are cleared. Finally, while inquiry is helpful, it does not stand on its own regarding the quality of evidence. Important information obtained through inquiry should be corroborated with other evidence.

Observation. This procedure involves the auditor observing the actual control as it is being performed. For example, the auditor may observe the preparation of the bank reconciliation. The limitation of this technique is that employees often perform procedures more diligently when they know they are being observed.

Inspection of Physical Evidence. This procedure relies on the auditor testing the physical evidence to verify that a control has been appropriately performed. For example, the auditor may inspect initials and dates on a bank reconciliation or trace certain amounts on the bank reconciliation to the accounting records or to other documents (for example, a bank statement) to gain evidence that the procedures were properly performed. Also, auditors may read some or all of the reconciliations for other periods and examine the reconciling items to determine whether the reconciliation routinely detected errors and whether those errors were appropriately dealt with. ITGCs often result in documented evidence of authorization of program changes or testing, and other reports of system access that provide important evidence associated with these controls.

Reperformance. This procedure involves the auditor reperforming the control to test its effectiveness. For example, the auditor may test the effectiveness of manual follow-up of items that IT application controls put on an exception report (e.g., bills of lading that did not result in a sales invoice). The auditor would reperform the follow-up procedures to see that items put on an exception report were appropriately cleared. In some smaller organizations the auditor might find manual controls where an independent person checks the accuracy of computer output to computer input. If the auditor wants to test this control, the auditor must find evidence that the control was performed on a timely basis, and then re-perform the control to make sure it was performed correctly.

Software-based Audit Techniques. A common Computer Assisted Audit Technique (CAAT) involves submitting test data to the computer program while the program is under the auditor‘s control. Submitting auditor test data to the client‘s program will allow the auditor to verify that the computer program is functioning as designed.

For Instructor Use Only

In addition, in various circumstances the auditor might use a form of Audit Data Analytics (ADA) to test controls. For example, let us assume that transactions are both authorized and approved electronically, and the computer electronically tracks the individuals authorizing or approving transactions. Subsequently, the auditor might use audit software to identify any transactions for which the same individual was authorizing the initiation of a transaction and approving the transaction for payment. Alternatively, let us say that the policy in a private company is that the CEO must approve all purchases over $500,000. The audit software can identify all transactions over $500,000 and extract any that do not have the CEO‘s approval.

LO2, BT: C, Difficulty: Moderate, TOT:25 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R7.6 Auditors do not need to test every client control. Rather, auditors identify key controls that might be relevant to financial statement assertions and WCGW. For example, if there is a high risk of material fraud related to an assertion, the auditor will want to test controls over that assertion. Where there are multiple controls related to one assertion, the auditor will need to determine which control is most likely to ensure that fraud or error does not occur, if other controls fail. This would then be the key control that the auditor would test.

The auditor also needs to consider whether the effectiveness of one control depends on the effectiveness of other controls. For example, if the auditor wants to rely on IT application controls, the auditor needs to test the application control and the IT general controls (to gain assurance that the computer program functioned as designed throughout the period), and manual follow-up of exceptions that are noted by the computer.

LO3, BT: C, Difficulty: Moderate, TOT:10 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

R7.7 When looking for controls that are reliable and have a high likelihood of operating as intended, the auditor considers the following factors:  the relevance of the control to the assertion being tested  the competence (and integrity) of the person who performs the control  the quality of the control environment, such as the potential for management to override the control or for the control to be bypassed  changes in the accounting system that may have occurred  unexplained changes in related account balances  the auditor‘s prior-period experiences with the engagement LO3, BT: C, Difficulty: Easy, TOT:15 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

For Instructor Use Only

R7.8 Benchmarking is an audit testing strategy that can be used to allow evidence obtained in prior audit periods to support a conclusion about IT application controls in the current audit period. It can also reduce or eliminate specific substantive procedures in the current and following audit periods. Benchmarking is based on the premise that a computer will continue to perform any given procedure in precisely the same way until such time as the program (or application) is changed. If the auditor can verify that a given program that executes an application control has not changed since last tested by the auditor, he or she may decide not to repeat direct tests of the application control in a subsequent period. This period might extend, for example, from interim through to year-end, or beyond into future audit periods.

The auditor establishes the benchmark at a point in time (for example, at an interim date) by performing a test of the application control using normal tests of controls (e.g., test data). Then, at a later point in time (for example at year-end), the auditor determines that the application has not been changed or modified since he or she performed the benchmark test of the application control. In order to verify that there have been no changes, it may be necessary for the audit team to use a team member with specialist IT assurance skills.

The primary benefit of benchmarking is that the auditor does not have to test each element of IT application controls every year. It is a matter of professional judgment as to when it is necessary to re-benchmark an application. Factors to consider in making this assessment are the effectiveness of the ITGCs, the nature and timing of other related audit tests, and the consequence of misstatements associated with benchmarked application controls. In some cases, the auditor may choose to rely on benchmarked controls from year to year and, in other instances, the auditor may choose only to rely on benchmarked controls between interim and year-end.

LO3, BT: C, Difficulty: Easy, TOT:15 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

R7.9 Factors that influence the sample size when testing controls include: 1. First, the tolerable deviation rate is the maximum rate of deviation from a prescribed control that an auditor is willing to accept and still use the planned control risk. The AICPA Audit Sampling Guide includes guidelines for quantifying an acceptable range for the tolerable deviation rate. Note the relationship between the tolerable deviation rate and the planned assessed level of control risk. If the auditor plans to assess control risk as low, for example, the tolerable rate should be between 2% and 7%. The auditor will not be able to tolerate many deviations if the planned control risk is low.

2. Next, the auditor should consider the desired level of assurance where the tolerable rate of deviation is not exceeded by the actual rate of deviation in the population. This addresses the assurance the auditor wants from the performance of the controls, or confidence that the evidence is representative of the population. There is a direct relationship between assurance and sample size. The more assurance the auditor wants, the more representative a sample should be of the population, For Instructor Use Only

3.

4.

and the more testing the auditor needs to do. That is, if the auditor intends to assess control risk at a low level, he or she performs more testing than if he or she is planning to obtain only limited assurance from tests of controls.

The expected rate of deviation in the population is the rate at which the auditor expects controls to not function as planned. This is usually based on prior experience with the entity, evidence obtained through a system walk-through, and the auditor‘s professional judgment. Auditors often perform tests of controls only when the expected deviation rate is very low (e.g., less than 1% or 2%). This may seem counter-intuitive, but consider: if you expect a high rate of deviation in the population for a certain control, then why waste time testing the control only to find out you are right, and the control fails at a high rate? In this situation, it is more efficient for the auditors to take a primarily substantive strategy and focus on auditing transactions and account balances instead of testing controls. Auditors only test controls if the expected deviation rate in the population is very low. The control test will confirm (or deny) that the control is indeed working as expected. If the testing confirms that the control can be relied upon, then the auditors can continue with a reliance on controls strategy.

Population size influences sample size for populations less than 5,000. If the population is smaller, the auditor should increase sample size as population size increases (a direct relationship between population size and sample size). Once the population size exceeds 5,000, population size has no influence on sample size.

LO3, BT: C, Difficulty: Easy, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

R7.10 Generally, if tests of controls confirm the auditor‘s preliminary evaluation of control risk as low, the auditor can proceed with a reliance on controls approach and perform substantive tests at an interim date with smaller sample sizes.

If the results of tests of controls do not confirm the auditor‘s preliminary evaluation of controls, the auditor will consider whether there is a compensating control that might detect and correct a misstatement missed by the original control being tested. For example, if tests of controls demonstrate that a detection control that screens every transaction is not as effective as originally planned, it is possible that a reconciliation control might detect and correct the same misstatement on a timely basis.

Alternatively, if the auditor tested a control that compared every sales bill of lading with each sales invoice to ensure that all sales were recorded, but exceptions were noted — the control did not function as planned. Subsequently, the auditor determined that an independent client employee reconciled total shipments with total billings on a daily basis, and this compensating control should have identified any unrecorded transactions.

In this case, the auditor might choose to perform tests of controls on the reconciliation control. If the compensating control proves effective, the evidence now supports the auditor‘s preliminary evaluation of controls, and control risk and planned substantive audit procedures need no modification.

For Instructor Use Only

If the auditor determines that an effective compensating control does not exist, or tests of controls show the compensating control is not functioning as designed, the auditor revises the overall audit risk assessment for the related account and assertion and revises the planned audit strategy. For example, the auditor is likely to move substantive testing to testing year-end balances and use larger sample sizes for substantive tests.

LO4, BT: C, Difficulty: Moderate, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

R7.11 In section 1 of a SOC, Type 2 report, The Service Auditor‘s Opinion, the user auditor wants to answer the following questions:  What is the period covered by the service auditor‘s report?  Are there any scope limitations, such as the discussion of complementary user controls, or other controls that are outside the scope of the auditor‘s report?  Based on management‘s description of the system of internal control, have there been any significant changes in the system of internal control since the last SOC 1, Type 2 report?  Has the service auditor concluded that the firm believes that the evidence they obtained was sufficient and appropriate to provide a reasonable basis for their opinion?  Has the auditor expressed an unqualified opinion? In section 2 of a SOC, Type 2 report, The Service Organization‘s Management‘s Assertion, the user auditor wants to determine:  If information included in management‘s assertion is consistent with the independent service auditor‘s opinion.  That management asserts that the information in Section 3 does not omit or distort information relevant to the service organization‘s system.  Management asserts that the control objectives were suitability designed and operated effectively throughout the period covered by the report.  Management confirms the criteria used by the service auditor when auditing management‘s assertion. In section 3 of a SOC, Type 2 report, Management Description of the System of Internal Control over Financial Reporting the user auditor wants to understand the service organization‘s system of internal control. This would include understanding the service organization‘s:  Control environment  Risk assessment activities  Monitoring activities  Description of the information system including:  The types of services provided by the service organization.  The procedures by which transactions are initiated, authorized, recorded, processed and corrected as necessary and transferred to reports and other information prepared by the service organization. For Instructor Use Only

   

How the system captures and addresses significant events and conditions other than transactions. The processes used to prepare reports, or other information, for the service organization. The control objectives and specific controls. Relevant details of changes to the service organization‘s system.

In section 4 of a SOC, Type 2 report, The Service Auditor‘s Tests of Controls, the user auditor wants to determine:  The assertions that were controlled by specific control activities tested by the auditor.  The results of the service auditor‘s tests of controls.  How the results of tests of controls will influence the nature, timing and extent of the user auditor‘s substantive procedures. LO5, BT: C, Difficulty: Moderate, TOT:30 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

R7.12 Once controls have been tested, auditors document their work in working papers. Working paper documentation should include:  the auditors‘ conclusion about control risk  the basis for their conclusion (e.g., underlying evidence) In preparing a working paper for tests of controls, the auditor would ordinarily indicate the purpose of the controls tested and related assertions. This assists in carrying out the testing by reminding the auditor of the overall purpose in testing the controls.

If the auditor identifies any exceptions or issues, the auditor should determine if there is an impact on the testing strategy by considering whether the control exception means that the control no longer meets the objective of the test. For example, assume that the control selected for testing is a bank reconciliation and the objective of the test is to verify that a review by the financial controller occurred on a timely basis.

When performing the testing, it was noted that while there was evidence of the review (a signature), there was no date, so timeliness could not be verified. Therefore, the auditor can conclude that the control operated as expected. However, the auditor cannot conclude whether it operated on a timely basis. The auditor would need to determine whether a compensating control should be tested, or whether the timeliness of the review is not critical to the auditor‘s ability to rely on the bank reconciliation as audit evidence.

The auditor also documents the test performed, the actual controls selected for testing, and the results of the testing. There needs to be enough detail regarding the controls selected to allow another auditor to review the working paper, reperform the steps (if necessary), and reach the same conclusion as the auditor who prepared the working paper. The results are often set out in a table to make it easier to review and identify quickly what (if any) exceptions were identified during the testing. Before an overall conclusion being reached for each section of work performed, the test results table also assists the person reviewing the working paper to determine if enough work had been performed and if the right conclusion regarding the controls testing had been reached. The working paper should also include a conclusion specific to whether the test

For Instructor Use Only

results support the overall purpose of the test. This is the documentation standard required by AU-C 230 Audit Documentation.

LO5, BT: C, Difficulty: Moderate, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

R7.13 The management letter discusses internal control weaknesses and other matters discovered during the course of the audit. The purpose of the management letter is to meet the auditor‘s responsibility for communicating internal control matters in writing on a timely basis to those charged with governance and to inform those charged with governance of the auditor‘s recommendations to improve its internal controls. If the auditor identifies significant deficiencies or material weaknesses in internal controls, the auditor will report these control deficiencies to those charged with governance.

AU-C 265 requires written communication of internal control deficiencies to those charged with governance of the entity. A management letter meets this requirement and avoids any ambiguity or confusion as to what observations, conclusions, and recommendations the audit firm has made. It also provides a simple way for management to document the actions it has taken in response to the issues raised and share these actions (and the progress towards the resolution of the issues) with those charged with governance.

LO 7, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Analytic Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls.

For Instructor Use Only

SOLUTIONS TO ANALYSIS PROBLEMS AP7.1 Password controls are preventive controls, which is a part of the IT general controls. Having an employee change a password on their first-time log-in, and then establishing new passwords every 30 days are strong internal controls. However, the weakness is if the password is not well protected (e.g., a post it note attached to monitor) or if the system allows for weak passwords. The result may be an ineffective control.

LO1, BT: A, Difficulty: Basic, TOT:10 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.2The type of control is based on the strength of a preventive control, associated with IT application controls. The strength of a supplier master file is that it may provide good control over fictitious vendors. However, the control is only as good as the controls over the supplier master file. If access to changing the supplier master file is not limited (password controls), and if management does not review all changes to the supplier master file (management reviews a report of all changes to the master file), then the control is likely to become ineffective. However, the IT application control is a detective control, and the strength of the detective control depends on both the IT application and manual follow-up of exceptions noted by the IT application.

LO1, BT: A, Difficulty: Basic, TOT:10 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.3 a)

A strong control would involve a key person in management who is authorized to add new customers or change credit limits, and the computer checks existing customers credit limits before selling more goods to these customers. Alabama Industries needs to give authority to someone outside the sale team to approve when to extend credit beyond a customer‘s credit limit. A person in management should also oversee and authorize changes to the customer master file.

b)

There are two reasons that no sales have been made to customers that would take the customer over the credit limit. First, it is possible that no customers applied for a purchase which would have exceeded their credit limit. Second, the control of checking credit limits may be ineffective. For example, it may be possible that an employee with sales responsibilities is able to change a customer‘s credit limit so that the customer is not flagged for exceeding their credit limit.

c)

If the auditor finds two instances where customers were allowed to exceed their credit limit, the auditor needs to determine if this was done knowingly, and by an appropriate level of management. If the transactions were not appropriately authorized, they represent a deviation from the client‘s internal control. Other evidence would be (1) was appropriate authorization by management exercised or (2) was authorization given but not authorized by an appropriate individual.

For Instructor Use Only

LO1, BT: A, Difficulty: Moderate, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP 7.4 a. Preventive; IT Application Control b. Preventive; IT General Control c.

Detective; IT Application Control d. Detective; IT Dependent Manual Control e. Detective; IT Dependent Manual Control f.

Preventive; Manual Control g. Preventive; Manual Control h. Preventive, IT Application Control i.

Detective; IT Dependent Manual Control j.

Preventive, IT Application Control LO1, BT: A, Difficulty: Moderate, TOT:10 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.5 a) There are several ways to test a bank reconciliation. First, bank reconciliations are documented, so the control can be re-preformed. Second, the auditor can make inquiries of employees that are responsible for cash receipts or disbursement about any adjustments that resulted from errors uncovered through bank reconciliation procedures. Finally, in this case there is also usually documentation regarding adjustments resulting from effective bank reconciliations. b)

It is possible that an employee may not be entirely honest with an auditor, but the more knowledgeable the auditor is, the less likely it is that employees will give incorrect answers. The likelihood of receiving correct answers also depends on the tone at the top of the organization. When interviewing an employee about a bank reconciliation, the auditor needs to be knowledgeable about bank reconciliation procedures, how the employee performs the bank reconciliation, the type of errors that are likely to be found, and what steps would normally be taken to correct errors.

c)

An auditor should normally determine if the employee responsible for bank reconciliations is sick, on vacation or otherwise cannot perform a bank reconciliation.

When this happens, who steps in to take on this responsibility? In this case there is a corporate reorganization halfway through the year where both the staff person and the supervisor have changed. The auditor needs to evaluate the skills of the individual performing and supervising the bank reconciliation both before and after the reorganization. Finally, the auditor should treat these as two separate time period for purposes of evaluating the controls.

LO1, 2, 3, BT: E, Difficulty: Moderate, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

For Instructor Use Only

AP7.6 a) The auditor will normally ask about what controls are in place regarding changes in computer programs as part of assessing IT general controls. The new system should be thoroughly tested with test data, and involve user departments, before the new program goes live. The auditor is normally concerned about changes to computer programs, because if these controls are weak, someone can change the program, run data that might otherwise be rejected, and then change the program back again. Weak controls over program changes negates the effectiveness of IT application controls. b) The auditor needs to evaluate control over inventory for Dakota Drapers in two segments, January through March, and April through December. Recall that the auditor determined that they could not rely on controls with the old system.

Transactions need to be tested more heavily during the first three months of the year. During the period of April through December, the auditor first needs to evaluate whether IT general controls have improved. If IT general controls are strong during this period, the auditor does not need to test the application during every month. c) If the auditor conducts tests of controls at an interim date, the auditor must evaluate controls during the remaining period. It is not appropriate to conclude that controls are effective throughout the year based only on interim testing. During the remaining period, the auditor will first ask about system changes and then test IT general controls over system changes. If systems have not changed after interim testing, and tests of IT general controls show that general controls are strong, then the auditor may limit the testing of individual computer applications during the remainder of the year.

LO1, 3, BT: E, Difficulty: Moderate, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.7 a) The junior auditor‘s suggestion regarding not performing work on internal controls is not appropriate, because the auditor needs to test controls every year when reliance on internal controls is planned. IT general controls are to be tested every year, regardless of any internal control work performed in the prior year. The auditor must determine what controls need to be relied on every year. If the general controls are effective, then only certain application controls need to be tested on a rotational basis every year. b) Benchmarking is an audit testing strategy that can be used to allow evidence obtained in prior audit periods to support a conclusion about IT application controls in the current audit period. Each computer application does not need to be tested each year if computer general controls are strong. Benchmarking is based on the premise that a computer will continue to perform any given procedure in exactly the same way until such time as the program (or application) is changed. If the auditor can verify that a given program that executes an application control has not changed since last period tested by the auditor, he or she may decide not to repeat direct tests of the application control in a subsequent period. This period For Instructor Use Only

might extend, for example, from interim through to year-end, or beyond into future audit periods.

LO2,3, 4, BT: A, Difficulty: Moderate, TOT:15 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.8 a) The control exception means the application control did not work 100% of the time, because a deviation was discovered. In this case, the control did not pick up paying an hourly employee the wrong amount per hour. b) Materiality does not influence the auditor‘s conclusion about the deviation. If the control failed, even once, it must be recognized as a deviation from the prescribed control. However, the materiality may influence the auditor‘s conclusion about whether a significant deficiency or a material weakness in internal controls exists. c) Since the auditor found one exception in a sample size of 45, the auditor should conclude that evidence does not support a control risk assessment of low. Materiality of the exception does not matter. The control risk should be assessed as moderate, and the audit firm should revise its audit strategy accordingly.

LO4, BT: E, Difficulty: Moderate, TOT:15 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.9 a) 2.01 The payroll information processed by the service organization is complete based on information provided by the audit client.

2.02 The payroll was accurately calculated based on underlying information. b) 2.01 The auditor needs to test complementary user controls to determine that all payroll hours worked were uploaded to the service organization. If the user organization‘s complementary controls are effective, then the auditor can follow a reliance strategy when testing the completeness of payroll.

2.02 The auditor can follow a reliance strategy when testing the accuracy of payroll transactions. c) The auditor needs to test a control at the user organization that ensures that the hours submitted to the service organization matched the hours actually worked.

For example, the information submitted to the service organization might be compared with underlying timecards in terms of hours worked. Alternatively, a control total of total hours worked, might be compared to the total hours submitted to the service organization for payroll processing.

LO5, BT: E, Difficulty: Challenging, TOT:25 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.10 Students‘ answers will vary as they research the difference between PCAOB AS 2201 and AU-C 315.

PCAOB AS 2201 is focused on performing an integrated audit, using a top-down approach to understanding and testing internal controls. AS 2201 does not go into as much detail about the COSO framework as AU-C 315, and it focuses more on issues asFor Instructor Use Only

sociated with larger companies. For example, there are a series of appendices that address issues such as scoping decisions for multiple location audits, using service organizations, and benchmarking. There is also a discussion on assessing fraud risk, as internal controls are so heavily related to the risk of fraud.

AU-C 315 focuses more on issues associated with what the auditor needs to understand about internal control in any audit and the focus is more on audit strategy rather than the needs of an integrated audit. While there is a discussion that the auditor needs to know enough about internal controls to assess the risk of material misstatement and to design substantive tests, there is not a presumption that the auditor will test controls for all material assertions. The explanatory material in AU-C 315 .A49 -.A121 is organized around the following four topics: 1. General Nature and Characteristics of Internal Control 2. Controls Relevant to the Audit 3. Nature and Extent of the Understanding of Relevant Controls 4. Components of Internal Control—Control Environment LO6, BT: E, Difficulty: Challenging, TOT:25 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

AP7.11 Students‘ answers will vary as they research evaluate the SOC 1, Type 2 report of FinSer Corporation. However, answers should be close to the following.

FinSer Corporation offers 3 major services.

Investment Portfolio Reporting Services which provide financial institutions with reports that help track and manage fixed-income investments.

2. Asset/Liability Management services which include software systems and consulting services to assist in the measurement and management of interest rate risk in financial institutions.

3. Offering specialized software for financial institutions: including software designed to facilitate tracing and management of Regulation E and software to help manage an institution‘s public fund deposits and pledges.

This information is found in Part III of the SOC 1, Type 2 report. a.

1.

b.

1.

2.

The Independent Service Auditor (Fisher, Herbst & Kemble, PC) provided an unmodified opinion that in all material respects, based on the criteria described in FinSer‘s assertion in Section II, The description fairly presents the Investment Portfolio Reporting Services was designed and implemented throughout the period of November 1, 2018 to October 31, 2019.

The controls related to the control objectives stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively through the period of November 1, 2018 to October 31, 2019, and subservice organization and user entities applied the complementary controls assumed in the design of FinSer‘s controls through the period of November 1, 2018 to October 31, 2019.

For Instructor Use Only

3.

The controls operated effectively to provide reasonable assurance that the control objectives stated in the description were achieved throughout the period of November 1, 2018 to October 31, 2019, if complementary subservice organization and user entity controls assumed in the design of FinSer‘s controls operated effectively throughout the period of November 1, 2018 to October 31, 2019.

c.

The specific control objectives outlined in Section III and tested by the service auditor in Section IV, are quite specific, and do not address all aspects of entity level controls. The entity level control objectives tested by the independent service auditor focus on FinSer‘s personnel management practices (Control Objective #1, and on Computer General Controls (Control Objectives #10, #11, #12, #13 and #14). The user auditor cannot draw a conclusion about entity level controls beyond those tested by the independent service auditor.

d.

Control objectives #2, #4, #5, #6, #7 address the accuracy of the portfolios of FinSer‘s clients. Control Objectives #3 and #8 address the fair value valuation of the portfolios of FinSer‘s clients. No deviations were found during the testing by the independent service auditor. Assuming that the user auditor has tested user entity complementary controls and those controls are effective, with respect to the accuracy, valuation and allocation assertion, the auditor can proceed with assessing control risk as low for this assertion.

LO6, BT: E, Difficulty: Challenging, TOT:35 min., AACSB: Analytic, Technology, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

For Instructor Use Only

Audit Decision Cases C7.1 a) The audit assistant is incorrectly interpreting an absence of evidence of an event as evidence of the event did not occur. Further, the staff member is relying too heavily on inquiry of management as evidence. While there is no evidence of any program changes or overrides, only limited testing has been done. The auditor needs to gather direct evidence that there were no changes or overrides. The auditors will need to conduct further tests to verify management‘s statements. b)

Other options available to the auditor include testing other controls that could perform the same function, that is, is there a compensating control to prevent or detect the WCGW? If the auditor is able to test a compensating control that operates effectively, the auditor can still assess control risk as low and proceed with a lower assessed level of control risk approach.

LO2, 3, 4, 6, BT: E, Difficulty: Challenging, TOT:15 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C7.2 a) The new system provides expenses and accruals for the accounting system, and thus any errors in its calculations can have a direct effect on the accounts. There was no testing prior to the new system going ‗live‘. The auditor cannot review evidence of the system‘s ability to operate in the same way as the old system (i.e., would the same data be generated under both systems). Limited staff training increases the risk that there will be errors in either the system and its financial data or the way it is interpreted and used by the client‘s staff. b)

Accuracy is affected by the raw data and the calculations. Application control could include controls that test the entry of data to underlying information (e.g., hours worked, approved pay rates linked to the position classification) or limit tests on total amounts calculated to prevent 10 hours being entered as 100 hours, or controls over the calculations (e.g., reasonableness tests such as overall limits on total payments).

c)

Occurrence relates to whether the payment is for hours actually worked, there would need to be a control that did not allow a payment to be made until a supervisor had authorized the hours worked; and controls to prevent duplicate payments (i.e., same worker paid twice for hours worked). If hours worked are recorded electronically, the computer can compare hours worked to hours paid.

d)

Tests of controls could include use of test data to determine if the controls prevented the payment if it was not authorized, and submitting deliberately incorrect data, such as duplicate payments. The auditor should also gather documentary evidence of approvals of hours worked; reconciling hours worked for a pay period For Instructor Use Only

with total payments made that period; seeking documentary evidence for supervisor reviews of salary payments.

LO1, 3, BT: E, Difficulty: Challenging, TOT:25 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C7.3 a) Assuming the IT general controls are strong, the auditor is likely to test the IT application control by submitting test data. The auditor should try to process a sales invoice that is not supported by shipping documents and has no bill of lading evidencing the shipment of goods. b)

The application control that checks each sales invoice to ensure that it is supported by shipping documents, packing slip and bill of lading, before a sales invoice is created, is primarily related to the occurrence assertion.

c)

In addition to knowing that the IT application control works, the auditor must also test (1) the effectiveness of IT general controls, and (2) the effectiveness of manual follow-up of exceptions that are flagged by the IT application control.

LO2, 3, BT: E, Difficulty: Challenging, TOT:20 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C7.4 a) Determine the key assertion at risk b) Describe a practical prevent internal control that would directly address the risk c) Describe a practical detect internal control that would directly address the risk. d)

Explain the test of controls you would perform to test the control in your answer to c. above, including the evidence that you would obtain. e) Describe the evidence of an exception to the internal control in your answer to c. above. f) Explain the test of controls you would perform to test the control in your answer to d. above, including the evidence that you would obtain.

Occurrence A supervisor must approve hours paid before they are submitted for processing.

Data entered into the computer should be validated against evidence of hours worked (whether electronic or manual approval of hours by a supervisor).

This is a manual control. The auditor needs to review evidence of approval of hours by supervisors and ask supervisors about how frequently they reject hours submitted that they have not approved.

Evidence of an exception would be paying hours that were not approved by the supervisor.

The audit would test the IT application control by submitting test data in an attempt to process payroll hours worked that is not supported by appropriate approvals.

For Instructor Use Only

g) Describe the evidence of an exception to the internal control in your answer to d. above

Evidence of an exception would be the computer program processing payroll associated with hours that did not have appropriate approval.

An exception could also happen if a transaction is flagged by the computer but does not receive appropriate manual follow-up on the flagged exception.

LO1,2,3, BT: E, Difficulty: Challenging, TOT:35 min., AACSB: Analytic, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

C7.5 Following is a draft management letter to Eric and Patricia King: Date: Address: To the Management and the Board of Directors of King Companies, Inc. In planning and performing our audit of the financial statements of King Companies, Inc. (KCI) as of and for the year ended December 31, 2022, in accordance with auditing standards generally accepted in the United States of America, we considered the KCI‘s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the KCI‘s internal control. Accordingly, we do not express an opinion on the effectiveness of the KCI‘s internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. However, as discussed below, we identified certain deficiencies in internal control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity‘s financial statements will not be prevented, or detected and corrected, on a timely basis. We consider the following deficiencies in the Company‘s internal control to be a material weakness.

For Instructor Use Only

Control Environment During our audit we noted a weak control environment. In other words, it is important for senior management to emphasize the importance of strong internal controls. This is often accomplished by senior management reinforcing the concept that others in the organization should be conscientious about implementing strong internal controls. Further, it is important for owners to monitor the implementation of controls by others.

While it is appropriate for management to trust employees, a good control environment establishes an environment of trust, but verify. Hence, senior management needs to monitor and verify the implementation of controls regularly.

Segregation of Duties Good segregation of duties segregates the authorization of transactions from custody of assets, from the recording of transactions and developing recorded accountability. We recommend that KCI take a close look at each transaction process. In the purchasing process KCI may have grown to the size where centralized purchasing may be appropriate, or where owners are more involved in authorizing purchases. Owners should also be involved in authorizing salaried payroll and store managers should authorize payroll or hourly workers.

Regular Vacations An important aspect of internal control is requiring regular vacations. The lack of regular time off may allow an individual to initiate fraud and conceal fraud. Regular vacations make it more difficult to conceal fraud or errors. We found that several employees in key accounting positions have not taken time off for significant periods of time. We recommend that KCI implement a policy of mandatory vacations and that they have other individuals take over those responsibilities while any individual is on vacation.

Performance Reviews Another aspect of a strong system of internal control involves having managers responsible for business units (e.g., auto parts stores) review revenue and expense transactions associated with their business units. In our opinion, store managers should be responsible for reviewing their stores performance, and they should also review all transactions associated with their stores. If store managers are responsible for the transactions associated with their stores, they may review them more carefully, and ensure strong recorded accountability. Further, it makes it less likely that fictitious vendors or fictitious employees will be processed. In our opinion, it is also important for Eric or Patricia King to review individual transactions. Periodic review by knowledgeable ownermanagers will influence the control environment and strengthen other controls.

IT-Dependent Manual Controls Strong IT-Dependent Manual Controls, where individuals in accounting verify transactions reported by the computer system are verified against underlying source documents. In our opinion, duties in the accounting department should be segregated where For Instructor Use Only

Abby Owens is responsible for the initial recording of all transactions, and Jonathan Jung is responsible for reviewing all transactions and validating the transactions to supporting documents. This should strengthen the accuracy of accounting records.

This communication is intended solely for the information and use of management and the Board of Directors of KCI, and it is not intended to be, and should not be, used by other than these specified parties.

Thomas Danforth Thornson and Danforth, LLP LO 7 BT: e, Difficulty: Challenging, TOT: 40 min., AACSB: Analytic Skills, Reflective Thinking Skills, AICPA PC: Risk Assessment, Analysis and Management, Systems Processing and Controls

For Instructor Use Only

Cloud 9 e) Controls related to recording wholesale revenue transactions Cloud 9 has the following IT application controls related to the assertions noted below.

Assertion Completeness Occurrence Accuracy Classification Cutoff

IT Application Controls Related to Wholesale Revenue Transactions A report is run daily of any shipments that have not resulted in invoices.

A report is run daily of any invoices that are not supported by shipping documents.

First, the system matches the quantities in the invoice against the packing slip and sales order. Prices are also matched to the sales order.

The customer number should also match on the sales order, shipping documents, and draft invoice.

A report is run at the end of the month of discrepancies between the month the goods are shipped and the month the sales invoice is recorded.

With respect to all of the above IT application controls Cloud 9 has a data control group that follows up on discrepancies. Discrepancies have to be cleared daily. Once the reason for the discrepancy is identified, changes to the underlying data must be approved by a manager in the data control group. The data is then corrected, and the invoice is processed. b) Tests of controls related to recording wholesale revenue transactions are suggested below.

Assertion Completeness Occurrence Accuracy Classification

Potential Tests of IT Application Controls Related to Wholesale Revenue Transactions Submit test data for a transaction that has supporting shipping documents and evidence, but a sales invoice has not been processed.

Submit test data for a transaction that has a draft sales invoice which is not supported by shipping documents (packing slip and bill of lading).

Submit test data for a transaction which has a draft sales invoice that is not supported by the information in the sales order and the packing slip.

Submit test data for a transaction that has a draft sales invoice with differing customer numbers on the draft invoice and the underlying sales order and sipping documents.

For Instructor Use Only

Cutoff

Submit test data where shipments are made in one month, and the sale invoice is recorded in the subsequent month. Also, submit test data where shipments are made in one month, and the sale invoice is recorded in the previous month.

For these assertions, the auditor also needs to perform tests of controls on the manual follow-up procedures. The auditor should select samples of daily or monthly exception reports, reperform the control, and talk with individuals in the data control group about exceptions they are finding, reasons items are flagged, and how they have been cleared. c)

With respect to the tests of controls described above, the following discussion explains the evidence that would lead the auditor to believe that there was a deviation from the prescribed control.

Assertion

Completeness Occurrence Accuracy Classification Cutoff

Evidence from Running Test Data that IT Application Controls Related to Wholesale Revenue Transactions are NOT Effective A transaction that has been shipped but not invoiced does not show up on the daily report showing shipments not billed to customers.

An invoice that is recorded but not supported by shipping documents does not show up on a daily report of any invoices that are not supported by shipping documents.

An invoice with pricing or quantity misstatements does not show up on a daily report of any invoices containing these inaccuracies.

An invoice that misidentifies customers or has classification errors does not show up on a daily report of any invoices containing misclassifications.

An invoice that is recorded in the wrong time period is not identified and reported as part of the end of the month report focused on identifying cutoff problems.

In addition, to testing IT application controls the auditor must also test manual followup procedures. Evidence of deviations from Cloud 9‘s manual follow-up procedures might include:  Exception reports are not reviewed on a timely basis.  Items reported on an exception report are not cleared on a timely basis.  Individuals clearing or approving exceptions are not authorized to do so.

Note: The details of tests of IT general controls are beyond the scope of this question.

CHAPTER 8 For Instructor Use Only

Audit Data Analytics Learning Objectives  Explain how to apply the audit decision making framework when using audit data analytics.  Apply steps associated with accessing and preparing data for audit data analytics.  Explain how audit data analytics is used as a risk assessment procedure.  Apply audit data analytics as a risk assessment procedure and evaluate the results.  Explain how audit data analytics is used as a substantive test.  Apply audit data analytics as a substantive test and evaluate the results.  Explain how artificial intelligence and machine learning may be used in an audit.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools

2. B LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools

3. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools

4. C LO 2, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools

5. D LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

6. C LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

7. C LO 4, BT: E, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

8. D LO 4, BT: E, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

9. A LO 5, BT: E, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

10. C LO 6, BT: E, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management,

For Instructor Use Only

11. C LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management,

12. D LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management,

ANSWERS TO REVIEW QUESTIONS R8.1 The following discussion provides an example of how ADA might be used as risk assessment procedures related to inventory for a manufacturer of computer electronics in the context of the Five Step Audit Decision Making Process.

Step 1: Start with company background information and data: As part of understanding the entity and its environment the auditor will want to understand the client’s inventory turnover and how it compares to industry averages.

Step 2: What is the audit problem you are trying to solve? In an industry where technological obsolescence is a significant issue, the auditor is concern about the valuation of inventory at the lower of cost or net realizable value.

Step 3: Gather information and evidence. The auditor may want to determine how fast each item in inventory is moving. First the auditor needs to determine what data is available, as well as the relevance and reliability of the data used. Companies may know the quantities on hand and quantities sold for each item, but they may not know the value on hand, and the cost of inventory sold for each item. The auditor also needs to determine the reliability of the quantity data, and whether it is subject to a strong system of internal control.

Step 4: Perform the analysis and evaluate the results. Once the auditor has good data to computer inventory turnover, the auditor can use ADA to identify the slowest moving inventory, and the materiality of that inventory. If a material amount of inventory is moving slower than expected, then the auditor needs to determine whether the inventory should be written down to net realizable value, perhaps by looking at sales of that inventory after year-end.

Step 5: Draw an audit conclusion. If there is a material difference between the cost and the net realizable value of inventory then the auditor would discuss the write down of that inventory with the client.

1.

LO 1, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Technology, AICPA AC: Technology and Tools

R8.2 Three key issues are listed below – note that other answers are possible as this list is not comprehensive.

1. What financial statement items, accounts or disclosures and related assertions are being audited?

2. What is the overall purpose of the ADA application and how will it contribute to the achieving the goals of the audit? For example, is ADA being used as a risk assessment procedure or as a substantive test?

3. What ADA tool is best suited for the audit purpose? The auditor needs to select an appropriate tool or tools from the many analytic techniques and visualizations available.

LO 1, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Technology, AICPA AC: Technology and Tools

For Instructor Use Only

R8.3 The quality of internal controls is particularly relevant when evaluating the reliability of data. If internal controls are weak, the data set may contain misstatements and inaccuracies, or be incomplete. If such data were used, ADA results would be unreliable. In contrast, data that comes from a strong system of internal controls provides some validation of the reliability of the data. Consider data about inventory quantities as an example. The auditor should be more comfortable using this data in an ADA if they know that inventory on hand is regularly tested against recorded values in the inventory system, and the control is effective. This is just one example as other tests of internal controls would also be relevant, such as checking purchases of inventory with the quantities received, and sales of inventory with shipping records.

LO 2, BT: AP, Difficulty: Moderate, TOT: 5 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.4 The following discussion explains how each item discussed influences the reliability of the data.

1. Data from external sources can be reliable or unreliable; the same is true for internal sources.

In both cases it is important to evaluate the reliability of each data set. Data obtained from external sources through proper procedures is less likely to be tampered with or altered.

2. Data obtained directly is more reliable than data obtained indirectly.

3. Data obtained from original documents is more reliable than data obtained via electronic scans.

4. Data from written sources is more reliable than records of verbal conversations.

LO 2, BT: AP, Difficulty: Moderate, TOT: 8 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.5 The Risk Analysis Decision Tree is associated with the fourth and fifth step of the audit decision making process: Perform the analysis and evaluate the results and draw an audit conclusion. As shown in Illustration 8.9, the risk analysis decision tree can assist with performing ADA as a risk assessment procedure when items that do not fit the auditor’s expectation (level 1 of the Risk Analysis Decision Tree) are uncovered. Such items should be treated as notable items and should be initially investigated according to the second level of the Risk Analysis Decision Tree to determine whether the variations from initial expectation are acceptable because they are underpinned by a valid business reason that can be substantiated. If they are unacceptable, they should be investigated further according to the final level of the Risk Analysis Decision Tree to determine whether there is a reasonable risk of aggregating to a material level of misstatement.

LO 3,4, BT: AP, Difficulty: Moderate, TOT: 10 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.6 A risk assessment ADA might uncover two unexpected matches in the address fields of the employee file and the vendor file. Further investigation might reveal that the employee address and the vendor address are the same due to the fact that an employee is married to a small business vendor working out of the home and a proactive conflict of interest disclosure has already been filed with the company. In this case, the notable item could be deemed an acceptable variation from expectations as per level 2 of the Risk Analysis Decision Tree. In the other case, the employee and vendor might turn out to be the same person, and the vendor

For Instructor Use Only

might be a fictitious vendor, which would be evidence of misappropriation of assets and should be deemed an unacceptable variation.

LO 3,4, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.7 A visualization can be used as part of an ADA to (a) assist with the analysis, (b) communicate findings effectively and efficiently or (c) both. Visualizations are important tools for auditors because they: a) Facilitate visual comparisons between data elements that can help to identify patterns, deviations from patterns, and outliers; b) Communicate a lot of information efficiently and are generally understood by a wide audience; c) Are often better remembered than raw findings.

LO 4, BT: AN, Difficulty Moderate, TOT: 5 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.8 First, there is a risk that the picture or image in the visualization is remembered, and not the findings trying to be conveyed. Thus, auditors need to focus viewers on the substance, and not the form, of the visualization. Second, there is also a risk that visualizations are used in isolation, when they should be used in combination with other tools. For example, visualizations are excellent at summarizing results, but they generally do not provide precise figures or tests of statistical significance that are often needed in ADAs. LO 4, BT: AN, Difficulty: Moderate, TOT: 5 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.9 Regression analysis is an analytical technique that can be used as part of a risk assessment ADA. The auditor can use a regression's predicted value to inform their expectations of certain auditable items. These expectations can then be compared with actual figures in search of notable items. Cluster analysis can also be used as part of a risk assessment ADA to discover groups of similar items with data sets. Notable items may be uncovered by clustering because individual items do not belong to a group, or because an entire subgroup is identified as abnormal.

LO 4, BT: AP, Difficulty: Moderate, TOT: 8 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.10 ADA is usually performed with reliable data which comes from a strong system of internal control, including strong IT controls. Consider a substantive test of details to validate the amount of accounts receivable in which an ADA showed that every receivable perfectly matches to a subsequent cash receipt. The finding of the ADA merely concludes that the data in the analysis matched. However, if the data used in the ADA was generated by a system of weak IT controls, then the data used may differ from the truth. If the data is unreliable and not true, then the findings of the ADA are essentially meaningless. Hence, such an ADA is usually performed with reliable data generated in the presence of strong IT general controls and strong IT application controls.

LO 5, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.11 The auditor should reassess the relevant internal controls at a higher risk level, and reevaluate the implications of a high control risk assessment on detection risk and the auditor’s overall audit strategy. The auditor should then evaluate whether continuing the use of ADA as For Instructor Use Only

a substantive test is appropriate. The auditor may consider using other substantive tests to supplement initial findings as part of the audit strategy. The auditor should also evaluate whether a reportable condition is present that should be included in a management letter to those charged with governance of the entity.

LO 5,6, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.12 A substantive test ADA uses electronic evidence to validate specific auditable data and detect material misstatement. The substantive test is often similar to a vouching or tracing technique, except that it is done electronically. In contrast, a risk assessment ADA is used to identify and assess the risk of material misstatement. This involves searching for notable items that are (a) indicative of a risk of material misstatement, or (b) provide information useful in designing or tailoring procedures to address risks of material misstatement (or both).

LO 6, BT: AN, Difficulty: Moderate, TOT: 5 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

R8.13 Many companies make regular adjusting journal entries at the end of every month. In a large corporation, these might add up to hundreds of journal entries every month, or more. A normal adjusting entry might include amortization of a prepaid expense. However, an anomaly might represent a decrease in an expense and an increase in an asset. For example, WorldCom managed earnings by crediting expenses, and debiting long term assets. This understates expenses and overstates assets and pretax income. The assertion that is misstated is the classification assertion. Also, as a result, assets are reported that do not exist, impacting the existence assertion.

LO 7, BT: AN, Difficulty: Moderate, TOT: 5 min., AACSB: Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

SOLUTIONS TO ANALYSIS PROBLEMS AP8.1 There are a variety of solutions to this question regarding Quick Technologies, Inc. (QTI). An auditor might use ADA as a risk assessment tool to look for slow moving inventory and inventory that might need to be written down (valuation and allocation). Alternatively, an auditor might use ADA to look for slow paying customers when evaluating the allowance for uncollectable accounts (valuation and allocation). Finally, the auditor might use ADA to validate the existence of receivables by matching the receivables to subsequent cash receipts (existence assertion). The following example illustrates the answers for a though e in the context of using ADA to look for slow-moving inventory.  ADA can be used to test inventory by looking at inventory turn days for each SKU number in inventory.  The population being tested is total inventory on hand at the date of the test.  In this case, inventory is being used as a risk assessment procedure.  The information needed to implement this application is the number of units on hand in inventory, and the number of units sold during the year. Based on the auditor’s knowledge of the industry and QTI, the auditor must then identify an appropriate cutoff point at which inventory appears to be moving slowly (e.g., inventory that has more than a 120-day supply of inventory on hand). The auditor then needs to determine if there are good business rea- For Instructor Use Only



sons for holding a larger than normal supply of inventory for particular items. The auditor may then use ADA to identify sales prices associated with slow moving inventory during the period after the cutoff date and compare sales prices to the underlying cost of inventory to determine if there is a material net realizable value problem (valuation assertion).

Business acumen is particularly helpful in identifying false positives, items that have been identified as slow moving, when there is not an underlying net realizable value problem.

The client might carry large amounts of inventory for a customer that purchases in large quantities, but not regularly. However, the auditor must evaluate the reasonableness of the business reason based on the auditor’s knowledge of the industry, and evidence of sales prices after year-end. LO 1. BT: AN Difficulty: Moderate, TOT: 25 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.2 Often data may not be ready for analysis. Dirty data refers to a situation where the same information may be recorded in different formats. For example, in some parts of the world dates are recorded as date /month/ year, whereas in the United States dates are usually recorded in the format of month/date/year. Further, in some countries, numbers are separated by decimals rather than commas. In another example, a serious problem may exist when the auditor is looking at a time series of data, and a customer number that is not longer used, is allowed to be used for a new customer. Hence, two different customers could have the same customer number. These types of problems are common when a company acquires another company, and merges two different information systems. These are all examples of data that cannot be analyzed until the data is cleaned up and repaired, so that all data is in a consistent format that can be analyzed.

LO 2, BT: AN DifficultyBasic, TOT: 25 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.3 Answer provided in ALLsales.csv. Please note the following issues had to be dealt with:  Small differences in column headings.  INVOICE_NO (NAsales) and INVOICE_NUM (EUsales) are equivalent.  There are no duplicate invoice numbers so it is likely that they are unique across all regions, but this should be checked with the business.  Differences in dates had to be handled - the solutions used mm/dd/yyyy as the consistent format, but other ways could have been chosen. The European data is in d/mm/yyyy format to start with. This can be quickly identified because the initial numbers get larger than 12.  The currencies differed. Note that while all US sales are in USD (and so there was no CURRENCY field), European sales are a mixture of USD and EUR. Thus, a CURRENCY field was added for US entries.  Average monthly exchange rates must be used so that all sales are reported in U.S. Dollars.  Region information was preserved by adding a column with that information.  No information has been provided about the customer and product numbers so we assumed they are common across the whole business, but the auditor should check before assuming that they are the same.

For Instructor Use Only



It is common for the decimal separator to be “,” and not “.” in Europe, but in this case, the company used “.” consistently so no adjustment needed to be made in the AMOUNT field.

The final solution is provided in a file labeled AP7_3 Allsales - Solutions File.

LO 2. BT: AN Difficulty, Moderate, TOT: 60 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.4  The assertion being audited is the occurrence of revenues.  An expectation regarding the percentage of completion should be based on an engineering estimate or an estimate from project managers on the extent of completion of a project.

Percentage of completion should not be established based on expenditures vs. budget. It is likely that expenditures may be incurred in advance of reaching completion milestones on a project, or they may lag behind completing milestones on a project, and as a result, expenditures are not a reliable means of determining percentage of completion. The auditor might evaluate the reasonableness of a project manager’s estimates based on prior experience with the project manager, or experience with similar clients in the industry. The auditor might also hire an independent expert to evaluate the percentage of completion on projects that are material in amount.  The auditor should rely primarily on an expert’s evaluation of percentage of completion. If the expert’s evaluation was significantly different from the client’s evaluation, the auditor should determine the reasons for the difference between the two before making a decision on the best course of action for the situation. The role of business acumen is very important in understanding the differences between two evaluations of percentage of completion. Different companies may have different business models, which leads to differences in how projects are completed. The auditor needs to understand these differences based on the auditor’s experience in the industry.  Unacceptable deviations from the client’s expectations may result when the client is determining the percentage of completion based on expenditures to date on a project vs. budget. This is not an appropriate method of determining the percentage of completion. An unacceptable variation might also result from the client’s project manager developing an ad hoc estimate of percentage of completion that is significantly different from the auditor’s expert’s evaluation of percentage of completion. The auditor’s evaluation is dependent upon the auditor’s knowledge of the business and industry in which the client operates, and the auditor’s understanding of the client’s business model.

LO 3. BT: AN Difficulty, Moderate, TOT: 30 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.5 Suggested visualizations are included in a separate file AP8_5.xls. Students may develop different visualizations. One visualization should focus on highlighting the long inventory turn days in the top two deciles. The other visualization should highlight the amount of dollars tied up in that inventory. Ultimately, the risk involved is that nearly 30% of the inventory dollars turn quite slowly.

LO 4. BT: E Difficulty, Moderate, TOT: 20 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

For Instructor Use Only

AP8.6  Suggestion 1

Advantages

Disadvantages

Likely not to generate too many false positives

False positives are possible because streets with the same name exist in different cities. 

Truly notable items will be missed if there are slight changes in spelling such as “James St”, “james street”, “James Street”, “James Street”, “Jamess Street” when they are likely the same. This could aid employees attempting to conceal stealing.

2

Small likelihood of missing truly nota- Huge number of false positives – in fact, the ble items vast majority of matches would likely be false positives.

3

Almost zero chance of a false positive Truly notable items are likely to be missed, because of the slight changes listed above, but also because city and state are separated by a comma in SHIP_CS, which is unlikely when simply appending E_CITY and E_STATE

4

The risk of missing truly notable items False positives are possible if people in the is very low. The numbers in an adsame zip codes live at the same numbered dress are more difficult to change. location.

For example, mail addressed to “Jamess Street”, when the correct spelling is “James Street” will still likely reach the same destination. However, mail with an incorrect house number or zip code is likely not to be delivered to the intended address.

Consequently, even if (potential) fraudsters wanted to change addresses so they did not match, it is likely that the numbers will stay the same so that they still receive the goods they are trying to steal.

b. b.

For Instructor Use Only

b. The risk of missing truly notable items is too high in Option 1 and Option 3. Further, the risk of too many false positives is too high in Option 2. Overall, Option 4 provides the best balance between the risk of missing truly notable items and the risk of too many false positives. While there is a low risk of missing truly notable items, there will still be some false positives – not at the impractical level of Option 2, but it is reasonably possible that people in the same zip code could live at the same number in a street. c. The issue with Option 4 is that there are still going to be the potential for multiple false positives being produced. These could be further refined by looking at the text, not just the numbers. For example, it is highly likely that the following two addresses are different: 5701 Broadway at ZIP 07093 and 5701Palisade Ave at ZIP 07093. Nevertheless, Option 4 will find them as a match. However, we want to avoid doing exact text matches because of the problems identified in Options 2 and 3. What the auditor could do is perform a probabilistic (sometimes called fuzzy) match that looks at the degree of similarity in the text part of the ADD fields. This would be recommended and can be done in audit software such as IDEA. LO 4, BT: AN Difficulty, Challenging, TOT: 40 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.7  The audit team developed expectations for monthly payroll payable based on business logic that they should be related to the number of employees. This relationship was validated with data from 2023 to 2024 and a linear regression model was estimated. The resulting linear regression was used to form expectations for the monthly amounts of 2025 being audited. Although every month is different from the regression prediction, only two notable items are Unacceptable Variations from the Auditor’s Expectation because they fall outside the 95% prediction interval from the regression. The two notable months are at risk of being understated. Thus, the valuation and cutoff assertions might be misstated and the Payroll Payable figures at the end of November and December 2025 need to be investigated further as they could represent an attempt to understate expenses. 

First, according to the third level in the Risk Analysis Decision Tree, an assessment of whether this issue could aggregate to a problem above the threshold for tolerable misstatement is needed. The level of tolerable misstatement would have been set in the planning stage of the ADA, but it is likely that this issue is material in size. Assuming that it is, further investigation is needed to search for a valid business reason supporting these notable items. This investigation might start with the fact that the number of employees changes by approximately 600 (10%) for the two months that fall outside the prediction range.

This is a large fluctuation and the auditor should understand the underlying business model and potential impacts on the business – this knowledge will help interpret this ADA’s findings. The auditor would also want to investigate whether there were any human resources policy changes in 2025 that might have contributed to this result. Overall, there are many paths than this investigation could take, but the key is that it should be guided by sound

For Instructor Use Only

business acumen and a good understanding of the client, their business model and the business environment they operate in.

LO 4, BT: AN Difficulty, Challenging, TOT: 20 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.8 When the auditor performs ADA as a risk assessment procedure, the auditor is using ADA to identify transactions or balances that are likely to be misstated. These transactions or balances are often called “notable items” which are items identified from the population being analyzed that are (a) indicative of a risk of material misstatement or (b) provide information useful in designing or tailoring procedures to address risks of material misstatement. For example, the auditor might use ADA to identify customers that are at a high risk of not paying receivables, and should be provided for in an allowance for doubtful accounts.

When the auditor performs ADA as a substantive test the auditor is often performing vouching or tracing procedures electronically. For example, if an auditor vouches a revenue transaction to underlying source documents, the auditor is comparing information on a sales invoice to information on shipping documents, the sale order, and the customer’s purchase order. If the same information is reliably available in electronic form, the auditor can use ADA to make these same comparisons electronically.

LO 4, 5, BT: AN Difficulty, Basic, TOT: 15 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.9 a.The assertion being audited is the existence and valuation of receivables at their gross amount as of December 31, 2025. b.This discussion provides an interpretation of the following table.

Accounts Receivable at Year-end Subject to ADA

$ 2,634,008

100.0 %

Cash Collection Equals Accounts Receivable

$ 2,122,858

80.6 %

Cash Collection Greater than Accounts Receivable

$

-

0.0 %

Cash Collection Less than Accounts Receivable

$ 418,025

15.9 %

No Cash Collected on Dec 31, 2025 Receivables

$

93,125

3.5 %

$ 2,634,008

100.0 %

Total c.

2.

While tolerable misstatement is not given in the problem, it is likely to be about 5% of gross receivables, or approximately $132,000. Receivables with no collections amount to 3.5% of gross receivables. Given that no cash has been collected, these may be at a high risk of being invalid For Instructor Use Only

receivables. The auditor will want to look at signed lease agreements on these contracts. The auditor also needs to do further analysis on the receivables with cash collections less than the amount of the receivable. The case does not indicate the actual amount of cash collections on these items. For example, if $408,025 was actually collected on receivables amounting to $418,025, the $10,000 difference is not likely to be material, even when aggregated with the receivables with no cash collections. However, if only $318,025 was collected on receivables amounting to $418,025, this $100,000 difference would be material when aggregated with the receivables with no cash collections. c.Two additional procedures are important. First the auditor needs to look at the signed lease agreements of the customers with no cash collections after year-end. Second, the auditor needs to determine the amount of collections when collections were less than accounts receivable at year end. If a significant amount of receivables were not collected from particular customers, the auditor will want to look at signed lease agreements when evaluating the propriety of these receivables.

LO 6, BT: AN DifficultyChallenging, TOT: 25 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

AP8.10 Technological advancement in recent times has facilitated the development of computerassisted audit tools and techniques that can be used in audit data analytics. Auditors are now able to extract and analyze large volumes of organizational data. The sources for data can range from enterprise resource planning (ERP) systems, document management or supply chain systems, or even telephone and email conversations. Such a large volume of data has resulted in a variety of data-mining techniques being used to detect fraud. These techniques include neural networks, Bayesian networks, genetic algorithms, decision trees and regression models. Despite some success, models developed using these techniques have suffered from two major limitations that this article aims to address.

The first limitation is that they result in a large number of false positives. In the fraud detection context, a false positive refers to a model detecting fraud, when in truth there is no fraud. These false positives are costly and time-consuming to investigate without a benefit at the end.

That is, they cause a waste of resources. The second limitation identified in this article is that despite ERP system data being process-oriented, these techniques do not incorporate sequential information. The authors claim that ignoring this information limits the ability to effectively detect fraud.

To overcome these two limitations, the authors propose a method that combines process mining with the use of traditional red flags to reduce the number of false positives. Red flags are defined as a set of circumstances that are unusual in nature or deviate from the normal activity signifying that something is out of the ordinary and may need further investigation. Process mining involves identifying, monitoring and improving business processes by extracting and analyzing event log data (that has accurate timestamps) from IT systems. On its own, using red flags is one of the most common approaches used by auditors and is recommended in a number of risk assessment auditing standards. The use of process mining is also not new to fraud For Instructor Use Only

detection. One of the process-mining approaches involves identifying deviations from standard business procedures. Another approach involves the analysis of the roles and responsibilities of IT system users to check for inconsistencies such as cases that do not have segregation of duties; for example, a purchase order that is created and released by the same person. According to the article, this process mining method has identified violations that were missed by traditional auditing methods. Overall, neither process mining nor red flags on their own are new to fraud detection; the novelty of the proposed method is in their combination.

The proposed method uses 142 red flags identified by analyzing existing literature. These flags are listed in Appendix 1 and categorized according to the following types of fraud: kickback fraud, bid rigging, shell company, double payment, pass through, non-accomplice vendor, redirect payment fraud, personal purchases, and purchase requisition and purchase. Their proposed method then followed these steps: i. Analytical steps: Understand the business process and identify theoretically possible frauds and use this information to determine possible red flags. It is important to note how the first step is to understand the business, which has been one of the themes in this textbook; ii. Technological steps: prepare and inspect the event logs, gather data about red flags and patterns, and then analyze the results; iii. Investigative steps: investigate and follow-up based on the results of the technological steps.

The authors developed a prototype implementation using Celonis Process Mining (www.celonis.com) that includes a visualization of the red flags within the business process.

They then evaluated their approach on a synthetically generated dataset of a purchase-to-pay business process. Real-world data was not used because of difficulties obtaining it given it contains suspected fraud. Instead, the White Collar Hacking Contest game was used to create what they call semi-realistic fraud data. Overall, the prototype successfully identified 15 out of 31 fraud cases. This is a true positive rate of 48.38% (=15/31), which is rather low with a prior study achieving a higher rate, but at the cost of 57% false positives. In contrast, the false positive rate of this prototype was only 0.37% (1,399 out of 377,113 cases), which is lower than the three previously developed models that were used as a comparison.

The search for red flags successfully reduced the number of false positives produced by the model. The other advantage of this approach is the visualization of red flags in the context of business processes and the ability to highlight processes with a high number of red flags. However, the model needs to be tested on real world data to further validate the results presented.

LO 4, 6, BT: AN Difficulty, Moderate, TOT: 25 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management, Research

AP8.11 i. The major issue here is the occurrence of revenue and the existence of receivables. If QTI is providing customers with an unconditional right of return for 90 days if they are unable to sell the merchandise, the shipment of goods is essentially shipping goods on consignment For Instructor Use Only

for 90 days, rather than making a sale. Hence, revenue cannot be recognized until either the customer sells the product to its customers, or 90 days passes. Further, if revenue cannot be recognized, inventory associated with the shipment should be recorded on the balance sheet and cost of good sold should not be recorded on the income statement. b.AI can be used to review all sales invoices and sales contracts during the year, looking for terms of sale that are out of the ordinary (e.g., sales that allow for a 90 day right of return). AI can identify a population of sales that should be investigated for possible premature revenue recognition.

LO 7, BT: AN Difficulty, Moderate, TOT: 15 min., AACSB: Analytics, Technology, AICPA AC: Technology and Tools, Risk Assessment, Analysis, and Management

SOLUTIONS TO AUDIT DECISION CASE C8.1 i. Historical data prior to the financials to be audited (2025) is used to develop a linear regression model that predicts Quarterly Revenue for 2025. These predictions represent the audit team’s expectation and are compared to the actual figures as per the Risk Analysis Decision Tree. The number of miles flown by passengers will be used as an independent variable, because revenue is highly demand-driven in the airline industry. Tolerable misstatement for this analysis could be assumed to be $15 million.

The question was clear that passenger miles should be used as the independent variable, but if that were not the case, it would have been logical from a business point of view to investigate a time-series regression model in an attempt to capture the seasonality in the airline industry, such as Thanksgiving and Christmas holidays. ii. Current and historical data for Revenue and Passenger Miles Flown have been provided in a spreadsheet. This data is already clean and in a consistent format. c.

Nature of the data

Quarterly data from the 1st quarter of 2017 to the 4th quarter of 2025 was obtained from the client regarding Revenue and Passenger Miles Flown.

Source of the data

All the data comes from the client.

Process used to produce the data

The client’s accounting database for revenue and the database of operational information for data on passenger miles.

For Instructor Use Only

Matter the auditor might consider in determining the nature, timing and extent of procedures to perform regarding whether data is sufficiently reliable

The client has a well-defined electronic process of tracking the number of passenger miles flown. This process has been tested and verified by the auditor.

The audit team have previously tested and found effective the Information Technology General Controls (ITGC) and internal controls over the accounting and operational databases.

Procedures regarding data reliabil- The audit team verified that the quarterly revenue data supplied ity an auditor may consider perreconciled with the historical data and annual data being auditforming ed.

d. i. Estimate the prediction equation using data that is not currently being audited (usually historical data, in this case from the 1st quarter of 2017 through the 4th quarter 2024); ii.Validate the prediction equation from a business logic point of view based on the auditor’s knowledge of the client, the industry and the data being analyzed. Make modifications to step 1 as needed; iii. Validate the prediction equation from a statistics point of view. Make modifications to step 1 as needed;

Intercept Quarterly Passenger Miles Flown

Coefficient

tStatistic

p-value (twosided)

-72,870,947.71

-1.92

0.0645

0.1605

16.45

Approximately 0

𝑃𝑟𝑒𝑑𝑖𝑐𝑡𝑒𝑑𝑄𝑢𝑎𝑟𝑡𝑒𝑟𝑙𝑦𝑅𝑒𝑣𝑒𝑛𝑢𝑒($) = −72,870,947.71 + 0.16 × 𝑄𝑢𝑎𝑟𝑡𝑒𝑟𝑙𝑦𝑃𝑎𝑠𝑠𝑒𝑛𝑔𝑒𝑟𝑀𝑖𝑙𝑒𝑠𝐹𝑙𝑜𝑤𝑛.

This model states that quarterly revenue increases by $0.16 for each additional passenger mile flown, which is logical from a business standpoint. Further, the intercept states that negative revenue occurs when zero miles are flown. However, negative revenue is impossible. It might be tempting to remove the intercept from the model, particularly because it also has a p-value greater than 5%, but a linear regression without an intercept does not have unbiased estimates for the coefficients. Furthermore, the minimum quarterly passenger miles flown in the data provided is approximately 2,648 million miles, which is well above the minimum miles required For Instructor Use Only

for a positive revenue prediction to occur (

70,870948 0.1605

≈454 million miles). Consequently, for any

sensible usage of this model, the quarterly revenue will be positive and so the intercept is acceptable from a business logic viewpoint.

The model above is also valid from a statistics viewpoint at any standard level of significance with a p-value for the passenger miles being approximately zero. In a linear regression with one independent variable, this p-value is the same as for the F-test for overall model usefulness (F statistic = 270.5 on 1 and 30 degrees of freedom). Finally, standard diagnostic plots do not reveal any substantial violation of linear regression assumptions and the model is deemed suitable by standard statistical tests for linear regression: i. The Durbin-Watson test does not reveal any auto-correlation that would violate the assumption of independent residuals; ii. The Goldfeld-Quandt test does not reveal any changes in variance that would violate the assumption of residuals with constant variance (homoscedasticity); iii. The Jarque Bera Test and the Shapiro-Wilk test, do not reveal a violation of the assumption of normally distributed residuals; iv. The Harvey-Collier Test and RESET tests for squared terms, do not reveal a violation of the linearity assumption.

Note: Using Passenger Services as the independent variable does give a statistically significant model. However, Passenger Services is a cost measure that, like Revenues, comes from the accounting database, whereas passenger miles flown comes from a separate operational database. From an audit perspective, using data from separate sources is more beneficial because if there were something untoward being covered up then it would be harder to do it across multiple data sources. Furthermore, the model that uses Passenger Services does not pass all the statistical tests. For example, the Goldfeld-Quandt test indicates that there is a problem with heteroscedasticity (non-constant variance).

Use the regression equation to make predictions for the data being currently audited; compare the predicted values (auditor’s expectation) with the actual values; The 95% prediction interval from the linear regression model is used to differentiate acceptable and unacceptable variations. The specific results are shown below (in millions) with a visualization shown in step (e).

95% Prediction Interval Period

Actual

Estimated/Expected

Lower Limit

Upper Limit

1Q-2025

$

700,664,000

$

668,895,392

$

589,901,628

$

747,889,155

2Q-2025

$

809,005,000

$

753,992,025

$

672,230,301

$

835,753,748

3Q-2025

$

804,814,000

$

750,995,694

$

669,353,069

$

832,638,318

For Instructor Use Only

4Q-2025

$

720,125,000

$

620,454,066

$

542,438,191

$

698,469,941

vi. Any values that are unacceptable variations should be treated as notable items and be investigated further according to the Risk Analysis Decision Tree (Illustration 8.9) to determine whether (i) their unusual characteristics are acceptable because they are underpinned by a valid business reason that can be substantiated and (ii) whether there is a risk of a material level of misstatement.

Based on the table above, Revenue for 4Q-2025 is an unacceptable variation and thus a notable item. e.

Based on the visualization below, it can be clearly seen that the fourth quarter of 2025 is outside the acceptable variation and at risk of overstatement. It is a notable item. Further, the variation from expectation is well above the materially threshold.

For Instructor Use Only

f.

Revenue for 4Q-2025 needs to be investigated further to determine whether there is a valid business reason that explains it and that can be substantiated. It appears that revenue is overstated. Additional procedures might focus on: i. Investigating unearned revenue at year-end to determine if this liability is understated, and revenue in the fourth quarter is overstated. ii. Determine if there was a change in the pricing in the fourth quarter that accounts for the increased revenues. iii. Examine any contra-revenue accounts such as sales allowance, discounts, returns, etc. to ensure the numerical accuracy and completeness of these accounts. An understatement of contra-revenues will result in an overstatement of overall revenues.

LO1,2,3,4, BT: E, Difficulty: Challenging, TOT: 1 hr. 30 min., AACSB: Analytics, AICPA AC: Technology and Tools, Risk Assessment, Risk Assessment, Analysis, and Management

For Instructor Use Only

C8.2 i. Historical data prior to the financials to be audited (2025) is used to develop a linear regression model that predicts quarterly Salaries and Wages Expense for 2025. These predictions represent the audit team’s expectation and are compared to the actual figures as per the Risk Analysis Decision Tree.

Considering the data provided and knowledge of the business gained from the chapter discussion, the number of employees makes logical business sense as a potential independent variable to predict the dependent variable Salaries and Wages. If G&J Airlines operates a large casual workforce that is heavily demanded or workload-driven, it could be argued that Available Seat Miles, Passenger Miles Flown or the Number of Flights might be suitable independent variables. b.

Current and historical data for Salaries and Wages Expense and Employees have been provided in a spreadsheet. This data is clean and in a consistent format. c.

Nature of the data

Quarterly data from the 1st quarter of 2017 to the 4th quarter of 2025 was obtained from the client regarding Salaries and Wages Expense, and Employee numbers.

Source of the data

All the data comes from the client.

Process used to produce the data

The client’s accounting database for costs contained the salary/wages expense information, while the database of operational information housed the employee numbers data.

Matters the auditor might consider in determining the nature, timing and extent of procedures to perform regarding whether data is sufficiently reliable

The client has a well-defined process of recording the number of employees. This process has been tested and verified by the auditor.

The audit team have previously tested and found effective the Information Technology General Controls (ITGC) and internal controls over the accounting and operational databases.

Procedures regarding data reliabil- The audit team verified that the quarterly salary and wage exity an auditor may consider perpense data supplied reconciled with the annual data being auforming dited.

For Instructor Use Only

d. i. Estimate the prediction equation using data that is not currently being audited (usually historical data). ii. Validate the prediction equation from a business logic point of view based on the auditor’s knowledge of the client, the industry and the data being analyzed. Make modifications to step 1 as needed. iii. Validate the prediction equation from a statistics point of view. Make modifications to step 1 as needed.

Coefficient

t-Statistic

p-value (two-sided)

Intercept

9,277,710.7

2.08

0.0462

Quarterly Employee Numbers

17,518.7

31.98

Approximately 0

This model states that salary and wage expenses increase with more employees. There is also a relatively small, fixed component to salary and wage expenses (the intercept). This finding is valid from a business logic point of view. Furthermore, the employee numbers and the intercept are both statistically significant with p-values less than 5%.

It is also noteworthy that none of Available Seat Miles, Passenger Miles Flown and the Number of Flights are statistically significant even at a 10% level in a regression to predict Salaries and Wages. Thus, the following regression equation will be used: 𝑃𝑟𝑒𝑑i𝑐𝑡𝑒𝑑𝑄𝑢𝑎𝑟𝑡𝑒𝑟𝑙𝑦W𝑎𝑔𝑒𝑠𝑎𝑛𝑑𝑆𝑎𝑙𝑎𝑟i𝑒𝑠𝐸𝑥𝑝𝑒𝑛𝑠𝑒($) = 9,277,710.7 + 17,518.7 × 𝑄𝑢𝑎𝑟𝑡𝑒𝑟𝑙𝑦𝐸𝑚𝑝𝑙𝑜𝑦𝑒𝑒𝑁𝑢𝑚𝑏𝑒𝑟𝑠.

The model above is also valid from a statistics viewpoint. Overall, the model is suitable with an F statistic of 1023 (on 1 and 30 degrees of freedom), which represents a p-value of approximately 0. Standard diagnostic plots do not reveal any substantial violation of linear regression assumptions and the model is deemed suitable by standard statistical tests for linear regression: i. The Durbin-Watson test does not reveal any auto-correlation that would violate the assumption of independent residuals; ii. The Goldfeld-Quandt test does not reveal any changes in variance that would violate the assumption of residuals with constant variance (homoscedasticity); iii. The Jarque Bera Test and the Shapiro-Wilk test, do not reveal a violation of the assumption of normally distributed residuals; For Instructor Use Only

iv. The Harvey-Collier Test, and RESET tests for squared terms do not reveal a violation of the linearity assumption. iv. Use the regression equation to make predictions for the data being currently audited; v. Compare the predicted values (auditor’s expectation) with the actual values; The 95% prediction interval from the linear regression model is used to differentiate acceptable and unacceptable variations. The specific results are shown below (in millions) with a visualization shown in step (e).

95% Prediction Interval Period

Actual

1Q-2025

$151,245,000

2Q-2025

Estimated/Expected

Lower Limit

Upper Limit

$153,176,019

$149,512,905

$156,839,133

$146,059,000

$146,764,188

$143,089,537

$150,438,839

3Q-2025

$158,714,000

$162,198,131

$158,474,273

$165,921,989

4Q-2025

$157,677,000

$157,257,868

$153,578,305

$160,937,431

vi. Any values that are unacceptable variations should be treated as notable items and be investigated further according to the Risk Analysis Decision Tree (Illustration 8.9) to determine whether (i) their unusual characteristics are acceptable because they are underpinned by a valid business reason that can be substantiated and (ii) whether there is a risk of a material level of misstatement.

Based on the table above, all quarters are within an acceptable level of variation. e.

Based on the visualization below, it can be clearly seen that all quarters of 2025 are within acceptable variation. There are no notable items. However, it can also be seen that the third quarter is nearly an unacceptable variation.

For Instructor Use Only

f. No notable items were identified as part of this ADA so no further procedures are required.

LO1,2,3,4, BT: E, Difficulty: Challenging, TOT: 1 hr. 30 min., AACSB: Analytics, AICPA AC: Technology and Tools, Risk Assessment, Risk Assessment, Analysis, and Management

Cloud 9 a. The following assertions should be tested with respect to purchase transactions: a. Completeness b. Occurrence c. Accuracy d. Cutoff e. Classification For Instructor Use Only

b. The auditor would compare the following information for the above assertions a. Completeness: The EIPP number acts as both a receiving number and a voucher number. For each receiving (EIPP_NO and REC_DATE), the auditor should determine that a liability is recorded (EIPP_NO and VOUCHER_DATE). b. Occurrence: Each recorded liability is supported by a receiving report. For each recorded liability (EIPP_NO and VOUCHER_DATE), the auditor should be able to match a unique receiving (EIPP_NO and REC_DATE). c. Accuracy: For each recorded liability the auditor should be able to perform a three way match on quantity, price, and total liability (e.g., for each EIPP_NO recorded as a liability, the following fields should match: “PO_PROD_QUANT” with “SHIP_PROD_QUANT” and “REC_PROD_QUANT” and “VCH_PROD_QUANT.” The auditor should be able to match price and total liability in a similar fashion; “PO_PROD_PRICE” with ASN “PROD_PRICE” and “VCH_PROD_PRICE.” Also “TOTAL_ORD_PRICE” with “ASN_TOTAL” and “VCH_TOTAL.” d. Cutoff: The accounting period in which the receiving occurs should be the same accounting period as the recording of the liability. For each unique EIPP number compare “REC_DATE” with “VOUCHER_DATE.” e. Classification: Account coding at recording should match account coding on purchase order. For each unique EIPP number compare “PO_ACCT” with “VCH_ACCT.” c. The electronic evidence that would represent a misstatement would be as follows: a. Completeness: recording a receipt without recording a voucher in the same time period. b. Occurrence: recording a voucher without the support of an underlying receiving report. c. Accuracy: the voucher is recorded at an incorrect amount due to inaccurate price, inaccurate quantity, or inaccurate total for the voucher. d. Cutoff: The voucher is recorded in an accounting period different from the period of receipt of goods. e. Classification: The voucher recorded the purchase in the wrong account.

CHAPTER 9 Risk Response – Performing Substantive Procedures Learning Objectives 8. Demonstrate how audit risk, management assertions, and substantive procedures are linked 9. Describe methods of risk response at the financial statement level 10. Explain and analyze factors that impact the nature of substantive procedures at the assertion level, including the use of audit data analytics

For Instructor Use Only

11. Explain and analyze factors that impact the timing of substantive procedures at the assertion level 12. Explain and analyze factors that impact the extent of substantive procedures at the assertion level 13. Explain and apply audit procedures used to audit accounting estimates 14. Describe how auditors document the results of substantive procedures

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures

2. D LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures

3. C LO 2, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Risk Response at the Financial Statement Level

4. D LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management Section: Nature of Substantive Procedures

5. C LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

6. A LO 3, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

7. B LO 3, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

8. C LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

9. A LO 4, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Timing of Substantive Procedures

10. D LO 5, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Extent of Substantive Procedures

11. A LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates

12. B LO 6, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates

13. D For Instructor Use Only

LO 7, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Documenting Results of Substantive Procedures

ANSWERS TO REVIEW QUESTIONS R9.1 The nature of substantive procedures is considered one of the most critical factors when responding to assessed risks. The nature refers to the purpose and type of the procedure. The assessed level of risk for an assertion is an important factor in determining the type of substantive procedure to use. If risk of material misstatement (RMM) is high, the acceptable detection risk will be low. When detection risk is low, more substantive procedures must be performed (thus increasing the extent of testing) to gather sufficient appropriate evidence. Also, when detection risk is low, substantive procedures will most likely be performed at year-end rather than at interim.

LO 1, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures

R9.2 Some identified risks affect the financial statements as a whole rather than a specific assertion for an account or transaction. Auditors respond to risk at the financial statement level by maintaining professional skepticism, increasing supervision of audit team members, modifying the nature, extent, and timing, of audit procedures, and adding elements of unpredictability to the audit.

Responding to risk at the assertion level requires planning specific tests of controls and substantive procedures for assertions related to accounts, transactions, and disclosures.

LO 2, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Risk Response at the Financial Statement Level

R9.3 Substantive procedures are designed to detect material misstatements at the assertion level for transactions, accounts, and disclosures, and to gather evidence to support management assertions. The two primary types of substantive procedures are substantive analytical procedures and tests of details. The types of procedures used as tests of details include inspection, observation, inquiry, confirmation, recalculation, reperformance, and scanning.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.4 When auditing the inventory balance, auditors perform several initial procedures before applying other substantive procedures. Auditors compare and agree the beginning balance of inventory to the prior year working papers. Next, they scan the inventory account for any unusual items. Auditors can also test the trial balance for mathematical accuracy and reconcile the balance to subsidiary and general ledgers.

LO 3, BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.5 Analytical procedures are evaluations of financial information through analysis of relationships among both financial and non-financial data. Analytical procedures can be used as a substantive procedure to gather evidence to support assertions related to an account balance and/or transaction. When considering whether to use analytical procedures as a substantive procedure, auditors must consider the nature of the assertion, the plausibility and predictability of the relationship, the reliability of data being used, and the precision of the expectation. For lower risk assertions, substantive analytical procedures may provide sufficient evidence. For higher risk For Instructor Use Only

assertions, substantive analytical procedures may be used in combination with tests of details to gather sufficient appropriate evidence.

LO 3, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.6 The quality of data used in analytical procedures is important because the results of analytical procedures are based on the data used in the procedures. Therefore, if there is good, quality data, the results of analytical procedures will be more meaningful and accurate. Client controls over financial data affect the quality of the data. If the data is internally generated, auditors must determine if there are effective controls over the data. If controls over the data are effective, the data is considered more reliable. For example, if an auditor uses growth in employee headcount to develop an expectation for sales growth or payroll expense, the auditor should first test controls over HR records, such as access and change controls.

LO 3, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.7 Answers will vary as students develop their own example, such as the following: During risk assessment, the auditor used audit data analytics (ADA) to analyze the average amount of sales transactions for the first half of the year. Sales that were over $10,000 are considered outliers and the auditors will follow up with substantive procedures for the outliers. Tests of details for the outlier transactions include vouching the transaction back to supporting documentation to verify that the sale occurred. For outlier transactions occurring near year-end, confirmations can be sent to customers verifying the amount owed, providing evidence that the transaction occurred.

LO 3, BT: AP, Difficulty: Hard, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.8 The use of audit data analytics does not remove the need to test the client’s internal controls. Audit data analytics relies heavily on the quality of the data. Internal controls are critically important in ensuring the accuracy, consistency, and reliability of the underlying data. Therefore, weak internal controls would severely hinder the reliability of the evidence gathered with audit data analytics.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.9 Confirmation bias is the tendency to interpret evidence in a way that supports pre-existing expectations – to seek information that confirms what we already know or believe to be true (whether or not it is true). To help minimize confirmation bias, auditors should not purely seek evidence that confirms management’s explanation or over-rely on management inquiries. Auditors must exercise professional skepticism and consider all information.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

R9.10 It is appropriate to use roll-forward procedures when substantive procedures are performed during an interim period. The auditors must update their findings from the time of interim procedures through the year-end.

LO 4, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Timing of Substantive Procedures

R9.11 The extent of testing refers to the sample size. Both quantitative and qualitative factors are considered when determining sample size. There are three different techniques for selecting a sample of items for testing. First, if there are a small number of inventory transactions, testing 100% of items may be possible, therefore sampling is not needed. Testing 100% of the items is advantageous because it is the most effective way of gathering sufficient appropriate audit eviFor Instructor Use Only

dence. Second, selecting specific items from the population can be used. This method is used most often. Auditors test high dollar transactions, key items, unusual items, or items over a certain dollar amount from the inventory account balance. A sample may be tested from the remaining balance if it is still material. This sampling method is advantageous because auditors ensure that a large portion of the inventory account balance is being tested. Third, statistical sampling can be used to test the inventory account balance. Although this method is not used very often, it is advantageous because auditors draw conclusions about an entire population based on the sample testing results. Sample testing may be cost effective for smaller organizations.

LO 5, BT: AP, Difficulty: Hard, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Extent of Substantive Procedures

R9.12 Four risk assessment procedures would be performed on the accounting estimate for the allowance for doubtful accounts. First, the auditor would gain an understanding of what is required by the client’s financial reporting framework. The financial reporting framework would specify the conditions for estimating the allowance for doubtful accounts. Second, the auditor would inquire of management regarding the process for identifying the need for the allowance for doubtful accounts estimate. Third, the auditor would inquire of management regarding how the accounting estimate for allowance for doubtful accounts is made and any internal controls over the estimation process. Finally, the auditor would inspect the outcome of the prior period allowance for doubtful accounts estimate. The auditor must be aware of management bias in this step. If management bias is detected in the prior period allowance for doubtful accounts estimate, it may represent an increased risk of material misstatement.

LO 6, BT: C, Difficulty: Medium, TOT: 20 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates

R9.13 A factual misstatement that could affect the balance of PPE is a spreadsheet that miscalculated the depreciation amount of an asset (due to an incorrect formula or a formula that was incorrectly modified after the initial creation). A judgmental misstatement that could affect the balance of PPE is a poor selection of an accounting policy. For example, a company depreciates an asset using the double-declining balance method, but straight-line is a more accurate representation of the depreciation for the asset.

LO 7, BT: AP, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Documenting Results of Substantive Procedures

SOLUTIONS TO ANALYSIS PROBLEMS AP9.1 Gaskin and Bryson have approximately the same amount of revenue, but there are substantial differences between the firms. Gaskin is a recently publicly listed manufacturing and wholesaling company. Bryson is a private company that provides marketing and other consulting services.

The auditing standards require the auditor to gain an understanding of the client and its circumstances. For example, the auditor should gain an understanding of the operating conditions in the client’s industry as well as the economy generally, and the reporting requirements that apply to the company, which would be influenced by whether it is a public or private company. The auditing standards require audit plans to be based on the auditor’s assessments of inherent and control risks at the client. The nature, timing and extent of substantive procedures should reflect these risk assessments.

For Instructor Use Only

Therefore, the main problems with using Bryson’s audit program as a basis for designing substantive procedures for Gaskin relate to the fact that by doing so the auditor may not properly work through the effects of Gaskin’s circumstances on the audit program.

Examples of specific problems: - The auditor may use the wrong type of substantive procedures, e.g. not incorporate tests of inventory balances (which would not be on Bryson’s balance sheet) and accounts receivable balances.

- The auditor may not make a thorough assessment of internal controls at Gaskin (if Gaskin is required to have an audit of ICFR) and therefore not schedule control tests in time to use the results of the control tests to determine the nature, timing or extent of substantive procedures.

- The auditor may not schedule tests of disclosures required of public companies that are not required for Bryson.

LO 1, BT: AN, Difficulty: Easy, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures

AP9.2 The occurrence assertion is tested by selecting a sample of items in the accounting records and agreeing the details to the underlying documents (vouching). The test answers the question: Did this item shown in the accounts occur? This is true because the test gathers evidence from the documents about the item in the accounts.

Procedure A addresses the occurrence assertion, therefore James is correct.

The completeness assertion is tested by selecting a sample of documents and agreeing the details to the accounting records (tracing). The test answers the question: Are the accounting records complete? That is, do they include this transaction? This is because the test gathers evidence about the completeness of the accounting records by testing if the transactions in the documents were entered into the accounting records correctly.

Procedure B addresses the completeness assertion.

LO 1, BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures

AP9.3 1. G 2. D 3. J 4. L 5. E 6. I 7. C 8. F and L 9. A 10. E LO 1, BT: E, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures

AP9.4

For Instructor Use Only

Analytical procedure #1: The government levies payroll tax at a prescribed tax rate on the total amount of payroll. If the amount of payroll is known, and the tax rate is known, the amount of payroll tax can be calculated.

Recalculation involves checking the client’s calculations for accuracy, and would be persuasive evidence.

Analytical procedure #2: Direct labor costs (salary payments, retirement contributions, etc.) have a relationship to the number of employees where an increase in the number of employees increases direct labor costs. Because each employee could be on a different pay rate, the amount of costs cannot be obtained simply by multiplying the number of employees by a constant number.

However, the test would determine a significant difference in the relationship between employee numbers and direct labor costs, which should be investigated further. As such, the evidence would not be conclusive but supportive of other tests.

LO 3, BT: E, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures

AP9.5 A. Inherent risks at the financial statement level caused by the takeover of Plastic Products Inc. include: - Taking over another company and integrating the operations and reporting is a massive change management exercise. Any time there is a wide-scale change for a company, there is an increased risk for errors. This inherent risk should lead to increased professional skepticism when approaching the audit.

- With more upper management and some of them joining North West from the plastics company, the tone at the top may change and could impact the control environment.

- Integrating the IT systems is a challenging and intricate project that could cause errors in recording and reporting of transactions. It could also cause the loss of data or issues with the integrity of existing data.

-If employees were laid off as part of the takeover, there could be disgruntled employees who could try to cause harm to the company through hacking or bad publicity.

Procedures that the auditors can take to respond to risk at the financial statement level include: -Emphasize that audit team members maintain professional skepticism -Lower materiality level will increase the extent of testing -Assign more experienced staff to areas of higher risk of material misstatement (RMM) -Provide extensive supervision of audit staff -Include more elements of unpredictability in the selection of audit procedures B. Factors increasing the reliability of data include: - Data is used for management purposes, suggesting that management has faith in its reliability - Data is generated by state and division, allowing new business segments to be removed before comparison with prior years - Well-established business, suggesting good business practices and reliable data being used - Purchasing and billing systems are fully integrated, suggesting data is used consistently throughout the business For Instructor Use Only

-

Few changes to production processes in the paper business Minimal changes to new plastics business since acquisition, allowing analysis of this division with data held for prior years (if available) The takeover was 18 months ago, suggesting that this year would be a full year of data

Factors decreasing reliability of data include: - Acquisition of new plastics business makes entire business reports not comparable with previous years.

- Any changes such as growth could distort comparisons - Could be increased pressures for growth and/or profitability, changing the incentives for accurate reporting (i.e. managers could have incentives to manipulate figures for their division) - Last year’s data was difficult to analyze because of acquisition half-way through the year, making last year’s data not as useful for comparisons LO 1, 2, 3, BT: AN, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures, Risk Response at the Financial Statement Level, Nature of Substantive Procedures

AP9.6 (a) Questions Iman could ask for each procedure include: (1) What acquisitions and disposals have occurred for each depreciable asset class? (These would affect the balance of assets at the end of the period although depreciation expense is for all assets held during the period) Are the same depreciation methods and useful lives used for each asset in the asset class?

Have the closing balances for the assets been verified? Are there any other changes in the business suggesting that asset balances should be different?

Are there any significant changes from last year?

The evidence provided by this substantive analytical procedure is not very persuasive.

PP&E for many companies is a material account on the balance sheet, therefore, substantive tests of details should be performed to provide more reliable evidence.

(2) Are sales commissions ever given at non-standard rates? If so, to which salespeople or for which products? Are all sales subject to sales commission?

Have total sales been verified? Have we identified any misstatements in our testing of sales?

Are there any significant changes from last year?

The evidence provided by this substantive analytical procedure would be persuasive assuming that sales commission rates are standard for all sales personnel and all products.

If the commission rates vary, by sales personnel or products, separate calculations should be made for different groups of salespeople and/or products.

(3) What changes in personnel numbers have there been this year (i.e. new employees or employees leaving?) Are there any changes in pay rates for some employees? Are there any other changes in the business suggesting that employee numbers or payroll expenses should be different?

Are there any significant changes from last year?

For Instructor Use Only

If very little had changed from the previous year regarding the total number of employees and pay rates, then evidence from this comparison could potentially be regarded as being persuasive. (b) Additional tests of details for each item could include the following: (1) For new assets acquired during the year, vouch back to supporting documentation to verify existence. For assets disposed of during the year, inspect supporting documentation of how the asset was disposed of and the related journal entry showing the removal from the accounting records. Inquire of management regarding depreciation methods used for different classes of fixed assets. Recalculate depreciation for a sample of assets to verify accuracy.

(2) Perform substantive tests on total sales, such as inspecting supporting documentation on a sample of sales transactions. Perform cutoff testing by inspecting supporting documentation to ensure sales are recorded in the proper period. Inquire of management regarding any changes in sales commission rates, either for different levels of salespeople or for different types of products. Recalculate sales commissions for a sample of sales transactions.

(3) Select a sample of employees and recalculate payroll to verify it is accurate on an individual employee basis. For new employees and employees who are no longer with the company, inspect supporting documentation to verify employees have been appropriately added to the payroll or properly removed from payroll calculations. (c) Audit data analytics (ADA) could be used as follows: (1) ADA could be used to compare depreciation entries for each asset class for the current year to the depreciation entries for each class of asset for the prior year. The auditor could further investigate any large or unusual differences identified by the software.

Evidence would support the accuracy assertion for depreciation expense and the valuation assertion for property, plant, and equipment.

(2) Auditors could use ADA to examine all entries for calculations of sales commissions to ensure the correct commission rate is being used and the calculation is correct. Evidence would support the accuracy assertion for commission expense.

(3) For employees who were employed in the current and prior year, ADA could be used to compare each employee’s current year payroll to prior year payroll. The auditors could further investigate significant differences. Evidence would support the accuracy and occurrence assertions for payroll expense.

LO 3, 4 BT: AP, E, Difficulty: Hard, TOT: 35 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures, Timing of Substantive Procedures

AP9.7 (a) A major risk is the overstatement of sales. Therefore, we would expect to see substantive procedures in the audit program designed to test the assertions of occurrence and cutoff for sales.

This focus drives the sample selection. Key items would be selected based on size (there are some very large transactions) and date (because those sales recorded as occurring just before year-end are potentially misstated sales that occurred just after year-end). Depending on the auditor’s assessment of the strength of controls over custom tools and standard tool sales, the auditor could sample relatively more of one type of sales transaction. Key item selection and testing For Instructor Use Only

would allow the auditor to gain reasonable assurance that sufficient evidence was obtained to substantiate the total sales balance.

The vouching procedures require Marty to inspect documents supporting the sales transactions.

Marty would start with the items selected as above, and locate the relevant documentation (sales order or contract, shipping documents, sales invoice). Marty would verify the date and amount of the sales transaction, plus the details of the items sold. He would recalculate the total price by reference to the number of units and the agreed price. In the case of custom-designed tools, Marty would inspect a contract and obtain the price details from it, but in the case of standard tools, Marty would need to obtain the record of the phone/email sales order and use standard price lists. The number of items shipped to the customer would be verified by inspecting the shipping documents that the client reconciles to the sales order and a copy of the invoice. Marty would also examine shipping terms and shipping/delivery dates to determine when the title transferred to ensure proper period cutoff. (b) ADA could be particularly useful as a substantive procedure for sales transactions of standard tools. Sales of standard tools should be charged using a standard price list. ADA could examine all sales transactions of standard tools and match the tool(s) sold to the correct price on the standard pricing sheet and calculate the total amount of the sale. The auditors could further investigate any sales transactions that do not “match” what is calculated by the software by inspecting supporting documentation for the sale. This ADA procedure provides evidence in support of the occurrence and accuracy assertions.

LO 3, 5 BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Nature of Substantive Procedures, Extent of Substantive Procedures

AP9.8 (a) Some substantive procedures could be performed at interim periods. These would be most likely in the following accounts:  Accounts that accumulate transactions that remain in the account balance at yearend (e.g. verify additions to fixed assets).  Accounts where controls are confirmed as strong (which they appear to be), and detection risk is high (tests could be done up to six months before year-end)  Accounts where controls are believed to be strong, and controls will be tested (tests could be done 2 or 3 months before year-end)  Accounts with limited materiality (E.g. small asset accounts) or low likelihood of errors (i.e. low inherent risk) (b) Roll forward procedures update the findings from the interim procedures. For example, analytical procedures could be used to test if the patterns of revenue or expense transactions are similar before and after the interim procedures. A sample of transactions from after the interim date could be taken and further tests of details performed. (c) In general, risk assessments affect the timing of substantive procedures. If inherent risk and control risk are low, allowable detection risk is high. This means that the timing of the substantive procedures is more flexible. For example, strong internal controls over inventory would allow interim inventory testing. In addition, the nature of substantive procedures affects the timing of the procedures. Some procedures are more relevant at year-end than at inFor Instructor Use Only

terim periods, for example, the auditor would test the completeness of liabilities at year-end, but details of individual liabilities could be tested before year-end.

LO 1, 3, 4, 5 BT: AP, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures, Nature of Substantive Procedures, Timing of Substantive Procedures, Extent of Substantive Procedures

AP9.9 (a) The key assertions at risk for accounts receivable (A/R) are existence (do the travel agents exist?) and accuracy, valuation and allocation (are the accounts receivable valued appropriately?). The auditor is concerned about the risk of overstatement. This means that the larger A/R balances would be of most concern. The testing has revealed that rigorous credit checks are conducted before travel agents can purchase from the client on credit, providing some assurance that the amounts are collectible. However, the constant late payments increase the risk that accounts will not be paid, either because of financial deterioration of the travel agent or a dispute between the client and the travel agent about a particular sale.

Forty-two travel agents represent 81% of the A/R balance. A sample of the 42 travel agents should be selected. Of the remaining 356 travel agents (398 total – 42 large balances), an additional sample of late-paying travel agents should be selected. Finally, a small sample of the remaining travel agents should also be selected. (b) There are strong controls over credit approval. If other controls over A/R and sales are also strong, the testing for existence could be carried out before year-end with roll-forward procedures after year-end. Testing for accuracy, valuation and allocation of the allowance for doubtful accounts should be carried out closer to year-end as evidence of the deteriorating financial position of travel agents would be more likely to be gathered closer to year-end. Testing of subsequent receipts from travel agents (post balance date) would provide strong evidence to support A/R valuation at year-end.

LO 4, 5, BT: AP, Difficulty: Hard, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Timing of Substantive Procedures, Extent of Substantive Procedures

AP9.10 a.S b. C c. E d. E e.C LO 6, BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates

AP9.11 (a) During risk assessment, the auditors would ask the following questions of the accounts receivable (A/R) manager and controller: - What is the method of measurement? Do they use a percentage of sales or percentage of receivables method, or a combination of both?

-What controls are in place regarding the estimate? There appears to be appropriate segregation of duties over the credit granting process and the determination of the bad debt expense estimate.

The sales manager approves credit and credit limits, the A/R manager determines the estimate, and the controller reviews and approves the estimate.

For Instructor Use Only

-What assumptions are used in determining bad debt expense and how were they developed?

-Has there been a change in the process of determining bad debt expense since the prior year? If so, what was the reason for the change?

-Has management considered the effect of estimation uncertainty? (b) At interim, auditors could recalculate the estimate for the first three quarters. They would inquire of management if anything had changed in the assumptions or methods used to calculate the estimate. They would also inspect the aging of the A/R report.

At year-end, the auditors would recalculate the final year-end estimate and ensure it is properly disclosed in the notes to the financial statements. Once again, they would inquire of management if anything had changed in the assumptions or methods used to calculate the estimate, and they would inspect the aging of A/R report. The auditors would inspect events occurring after year-end and up to the date of the auditor’s report. For A/R balances that were overdue at yearend, the auditors would inspect cash collections to see if any of the overdue balances had been collected. This would provide evidence relating to the appropriateness of the year-end estimate of bad debts. (c) Consideration of the inherent risk factors are as follows:  Estimation uncertainty - because the estimate of bad debt expense is a routine estimate relating to recurring business activities, the auditors would conclude it has low estimation uncertainty. However, auditors should be mindful of conditions that might impact Crescent City’s ability to collect from travel agents. For example, if the economy takes a downturn, people may cut back on vacations and entertainment. A slowdown in business could adversely impact the travel agents and their ability to pay outstanding balances owed to Crescent City. Special situations like this could increase the estimation uncertainty for the estimate of bad debt expense.  Complexity – Determining an estimate for bad debt expense is not very complex.

Again, it is a routine estimate that does not require specialized skills or complex calculations.  Subjectivity – There is some subjectivity in determining bad debt expense because a company can never predict what might happen to some of its customers. However, a company usually looks at historical bad debt rates helps to estimate for the future.

Inherent risk should be assessed as medium, primarily because complexity is low and estimation uncertainty is medium. (Student answers may vary as this is an subjective question.)

LO 6, BT: AP, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates

AP9.12 (1) This is a factual misstatement because the sale is included in the wrong accounting period (unless the date of January 1, 2026 is based on a judgment about the nature of the sales contract). The sale should be included in the next period. The client has incorrectly recorded the sale in December as: Dr. accounts receivable, Cr. sales. To correct this error, the adjusting entry would be to reverse the entry in December and record it as of January 1, 2026 ($1,250,000).

For Instructor Use Only

(2) This is a judgmental misstatement because management underestimated the liability for warranty claims for the year ended December 31, 2025. On December 31, 2024, the liability had a balance of $100,000 (credit balance). During 2025, $150,000 of warranty claims are processed as a debit to the liability account bringing the balance to $50,000 debit. Management has booked a warranty liability accrual for 2025 of $120,000. The warranty liability account would look as follows:

Liability for Warranty Claims Credit $100,000 12/31/24 During 2025 $150,000 Balance $50,000 $120,000 12/31/25 adjustment $70,000 balance 12/31/25

Debit

Correspondence evidence suggests that $200,000 more in warranty claims could be processed.

The adjusted liability of $70,000 appears to be inadequate. The entry to increase the current year provision would be Dr Warranty expense, Cr Liability for Warranty for the amount of the increase.

(3) This is a factual misstatement. The restructuring expenses were charged to the wrong expense account. An adjusting entry should be made: Dr Restructuring expenses, Cr Rental Expenses ($578,920) (4) The amount for impairment of assets to be recognized in the accounts is based on judgment and is an estimate. In this case, there is evidence that the following entry should be made: Dr Impairment expense Cr Asset, but the amount of the impairment is not given in the question.

LO 6, 7, BT: E, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates, Documenting Results of Substantive Procedures

AP9.13 Student answers will vary depending on which Spotlight publication is selected.

LO 1, 6, 7, BT: AN, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, Technology, AICPA AC: Risk Assessment, Analysis and Management, Research Section: Audit Risk and Substantive Procedures, Auditing Accounting Estimates, Documenting Results of Substantive Procedures

SOLUTIONS TO AUDIT DECISION CASES C9.1 For Instructor Use Only

a. Examples of questions the auditors would ask MSI management about the impairment loss are: -What is your process for identifying the need for an impairment loss?

-How did you measure/determine the amount of the loss?

-What controls are in place for determining if an impairment loss is needed and how it is determined?

-What assumptions did you use and how were they developed?

-Have you made any changes to how you determine if there is a loss or how you estimate the loss?

-Have you considered the effect of estimation uncertainty on the determination of the impairment loss?

-What was the discount rate used in your cash flow analysis and how was that rate determined? b. The primary inherent risk factors that impact the estimate of the impairment are estimation uncertainty and subjectivity as follows: -MSI operates in a specialized industry with a limited customer base, primarily the government and scientific institutions. Therefore, it can be difficult to determine the fair market value of the patent or the future estimated cash flows that can be generated from the patent.

-MSI is an innovator in the industry, suggesting there may not be many competitors with a comparable patent to compare to.

-The estimate of the impairment loss is not a routine, recurring estimate. Therefore, MSI management cannot look to recent past estimates for guidance. c. Management bias, whether intentional or unintentional, occurs when management is not neutral in the preparation and fair presentation of financial information. Management may be overly optimistic about the future cash flows from the Covert Recorder and underestimate the amount of the impairment loss. Alternatively, if it has been a tough year financially and management is concerned about reporting a profit, then management may intentionally underestimate the impairment loss. d. Substantive procedures used to audit the Covert Recorder patent balance include: -Inquiry about assumptions used by management when determining the impairment loss -Recalculation of the impairment loss -Inspect transactions related to the Covert Recorder after year-end and up to the date of the auditor’s report and determine if any transactions/events provide more information about the reasonableness of the impairment estimate -Inspect the journal entry that recorded the impairment loss -Recalculate amortization of the Covert Recorder balance LO 6, BT: AN, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Auditing Accounting Estimates

C9.2 a. The primary procedure to gather information about the upcoding incidence would be to inquire of management and other personnel about the situation. Auditors would ask questions such as: -How long the fraud had been occurring -Who was involved -Have all personnel involved been released, placed on administrative leave, and/or reprimanded -Have controls been put in place to prevent it from happening again, or to detect it if it happens again -Have adjusting entries been made to correct the fraud For Instructor Use Only

-Have corrected statements been sent to patients and/or insurance companies Auditors would also inspect documentation related to adjusting entries to correct the fraud and would consider testing new controls that BPH had put in place. b. Two key account balances that are affected by the fraud are revenue and receivables. The assertions most at risk for revenue are occurrence and accuracy. Since the doctors were “upcoding,” they were charging for services that were not performed or using higher reimbursement codes for low-value services performed. So the services, and the related revenue, did not occur, and therefore, the reported revenue is not accurate. The assertion most at risk for receivables is existence. If the revenue did not occur, then the related receivable should not exist. c. Because of the fraud, auditors would consider the need to change the nature, extent, and/or timing of substantive procedures over revenue and accounts receivable. They would use procedures that provide more reliable evidence. For example, they could send A/R confirmations to insurance companies, particularly those who were impacted by the fraud. The auditors would also consider increasing the extent of testing by using larger sample sizes. For revenue transactions, they could select a larger sample size and verify that the proper code was used for the provided services. If necessary, they could select specific revenue transactions to audit, such as more expensive procedures, procedures that were performed by the doctors who were fired, or procedures that are uncommon. Finally, because fraud occurred, the auditors should have a heightened sense of professional skepticism in all audit areas. d. ADA can be designed for analyzing revenue transactions. For example, ADA could analyze all revenue transactions for the year, or just for a certain period, summarize the most commonly used medical codes, and highlight uncommon codes. ADA could also highlight the revenue transactions that used the higher billing rate medical codes. ADA could select all revenue transactions that were generated by the doctors involved with the fraud and perhaps detect a trend in specific codes they used in their upcoding scheme. The audit team could further investigate any trends or unusual transactions detected by ADA. LO 1, 3, 4, 5 BT: AN, Difficulty: Hard, TOT: 40 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Risk and Substantive Procedures, Nature of Substantive Procedures, Timing of Substantive Procedures, Extent of Substantive Procedures

For Instructor Use Only

Cloud 9 – note: answers may vary by student because this involves professional judgment. Students can refer to Illustration 9.7 for guidance. a.

Account Assertion Sales - occurrence Sales – completeness Receivables - existence Receivables - completeness Cash – existence Cash - completeness

Inherent Risk

RMM

medium low medium low

Control Risk medium low medium low

medium low medium low

Detection Risk medium high medium high

medium low

low low

medium low

medium high

b. Cloud 9 accounts that require estimates or fair value measurements: 1. Allowance for doubtful accounts for A/R – since this is a routine estimate, inherent risk is low unless an unusual event occurs.

2. Inventory – management must determine if inventory needs to be written down to net realizable value if it is below cost. This is a fairly routine fair value measurement and athletic shoes have an observable market, therefore, inherent risk is low.

3. Investments (derivatives) – Determining fair value of derivatives can be complex and subjective, therefore, inherent risk is assessed as high.

4. PPE – management must determine if any PPE has been impaired. Depending on the specific item in question, inherent risk may be assessed as high to determine fair value.

5. Intangible assets – management must determine if any intangible assets have become impaired. If a readily available market does not exist for the intangible asset, then determining fair value could be complex and subjective. Therefore, inherent risk may be assessed as high.

LO 1, 6 BT: AN, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management Section: Audit Risk and Substantive Procedures, Auditing Accounting Estimates

CHAPTER 10 Risk Response – Audit Sampling for Substantive Procedures Learning Objectives 1.

2.

3.

4.

5.

6.

Evaluate when to use audit sampling versus audit data analytics.

Differentiate between sampling and nonsampling risk.

Differentiate between statistical and nonstatistical sampling and explain various sampling methods.

Determine how sample size for substantive procedures is influenced by various factors.

Explain a basic framework for selecting and evaluating an audit sample for substantive procedures.

Apply probability proportionate to size sampling for a substantive procedure and draw an audit conclusion.

7.

Apply nonstatistical sampling for a substantive procedure and draw an audit conclusion.

8*. Apply classical variables sampling for a substantive procedure and draw an audit conclusion.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. A LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Technology, AICPA AC: Technology and Tools.

2. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

3. A LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

4. D LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Technology and Tools.

5. C LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

6. B LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

7. D LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

8. D LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

9. B LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

10. C LO 7, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Technology and Tools.

11. A LO 8, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Technology and Tools.

ANSWERS TO REVIEW QUESTIONS R10.1 When testing the existence assertion, professional standards require that the inventory be physically inspected., An effective procedure is selecting a sample of inventory for observation at a client’s location.

The auditor might also consider using audit data analytics (ADA) to audit inventory valuation. If the auditor knows that the available data is reliable and comes from a strong internal control system for a large amount of inventory that turns relatively quickly, this can be an effective way to identify slow moving inventory. If a computer manufacturing company has slow moving inventory, the company may be holding onto computer parts or completed inventory that may be of little or no value within a short time frame. ADA alerts the auditor to slow moving inventory.

LO 1, BT: AP, Difficulty: Easy, TOT: 10 min., AACSB: Analytic, AICPA AC: Technology and Tools.

R10.2 The individual inventory SKU numbers, or inventory item numbers, and the quantities for each item make up the population that will be sampled.

Audit sampling is when an auditor selects less than 100% of a population (on a basis where the sample is representative of the population). Thus, this audit sample is likely to provide a reasonable basis for concluding on an entire population. In this case, an auditor might take a sample of inventory to draw a conclusion about the existence of all of the inventory recorded in the client’s accounting records.

LO 1, BT: AP, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools.

R10.3 Audit sampling is when an auditor selects less than 100% of a population (on a basis where the sample is representative of the population). Thus, it is likely to provide a reasonable basis for drawing a conclusion about an entire population. The auditor must project the $25,300 in known misstatements on the unsampled portion of the population, to draw a conclusion about the entire population. Further, errors in the auditor’s sample also provides evidence that might suggest a breakdown in internal controls. The auditor should assume the control breakdown found in the sample will happen proportionately in the unsampled portion of the population, as it did in the audit sample.

LO 2, BT: AP, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools.

R10.4 The risk of incorrect acceptance is the risk that the auditor concludes that a material misstatement does not exist when it does exist. When the auditor conducts substantive procedures on a sample and concludes there is no material misstatement, when there is a material misstatement, the auditor will conclude that an assertion is presented fairly in all material respects, when the assertion is materially misstated.

The risk of incorrect rejection is the risk that the auditor concludes that a material misstatement exists when it does not exist. The auditor conducts substantive procedures

on a sample and concludes there is a material misstatement in an assertion, when there is no material misstatement. This usually happens when the known misstatements in the sample are immaterial. However, they project to a material amount of misstatements in the population. If the auditor expands audit testing only to find there is not a material misstatement, the audit is inefficient, due to extra sampling done to reach the correct conclusion about the audit population eventually.

The risk of incorrect acceptance is the more serious risk. The risk of incorrect acceptance will lead to an incorrect conclusion, and potentially to an incorrect auditor’s report. The risk of incorrect rejection merely leads to an inefficient audit, not an ineffective audit.

LO 2, BT: AP, Difficulty: Medium, TOT: 10 min., AACSB: Analytic, AICPA AC: Technology and Tools.

R10.5 Nonsampling risk is the risk that an auditor arrives at an inappropriate conclusion for a reason unrelated to sampling issues. This can occur when an auditor uses an inappropriate audit procedure, relies too heavily on unreliable evidence or spends too little time testing the accounts most at risk of material misstatement. Drawing a conclusion based only on the sample items, without considering the implications for the unsampled portion of the population, represents nonsampling risk. Nonsampling risk may also occur when an auditor makes an inappropriate judgment in the process of selecting and evaluating a sample. The auditor controls nonsampling risk through supervision and review of the individuals performing the audit.

LO 2, BT: C, Difficulty: Medium, TOT: 5 min., AACSB: Analytic, AICPA PC: Technology and Tools.

R10.6 Nonstatistical sampling is sometimes considered easier to use than statistical sampling. It requires less staff training, and it allows an auditor to select a sample he or she believes is appropriate.

LO 3, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools.

R10.7 In statistical sampling, sample size is determined objectively, or quantitatively, using appropriate statistics. The sample should be selected randomly, which is the auditor’s best estimate of a representative sample. Finally, the sample results should be evaluated mathematically, using the appropriate statistical technique resulting in an objective evaluation of the evidence obtained. An advantage of statistical sampling is that it allows the auditor to measure sampling risk.

LO 3, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.8 The risk in using a systematic random selection is that items will be listed in such a way that by selecting every nth item the auditor is selecting items that are related in some way to the auditor’s selection process. The risk is misstatements that are seeded systematically will not be picked up in the auditor’s sample. This risk can be reduced by reviewing the items in a population for any systematic bias before selecting a sample.

LO 3, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.9 The auditor uses professional judgment in making appropriate decisions about the factors in applying both statistical and nonstatistical sampling. Professional judgment is also needed in determining the factors that influence sample size, appropriately selecting a sample, evaluating the evidence obtained by sampling, and in drawing an appropriate conclusion about the population based on sample evidence. Whether using a statistical or nonstatistical selection method, auditors need to apply professional judgment at every step in the process.

LO 3,5, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.10 The auditor’s assessment of how much misstatement can be tolerated without changing the user’s decision using the information depends on professional judgment.

This includes assessing the overall materiality and the influence of a population on a financial statement user’s decision making.

LO 4, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.11 When an auditor believes there is likely to be a material misstatement in the population of transactions or amounts making up an account balance, he or she will increase the sample size to gain a better estimate of the actual misstatement in the population. The estimate of expected misstatement will be influenced by inherent risk.

This will occur when an account is at risk of material misstatement, such as when it requires estimation (for example, the allowance for doubtful accounts), when it requires complex calculations (for example, foreign exchange translations), or when it requires complex valuation techniques (for example, fair values). The estimate of expected misstatement will also be influenced by control risk, such as when control risk is assessed as moderate, high, or maximum for an assertion. These factors are evaluated both by risk assessment procedures and the auditor’s prior experience with the client.

LO 4, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.12 At the outset, it is vital to make sure the evidence obtained is relevant to the assertion. More extensive procedures are of no audit value if the evidence is not relevant to the assertion being tested. The risk that the procedure is not appropriate means the auditor may be unable to draw an appropriate conclusion about the assertion, if the evidence does not relate to the audit question being asked. This relates to nonsampling risk and is controlled by supervision and review of the audit process.

LO 5, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.13 The advantages of PPS sampling are:

     

It is generally easier to use because the auditor can calculate sample sizes and evaluate sample results by hand or with the assistance of tables, The size of a PPS sample is not based on any measure of the estimated variation of audit values, PPS sampling automatically results in a stratified sample because items are selected in proportion to their dollar values, PPS sample selection automatically identifies any item that is individually significant if its value exceeds an upper monetary cutoff, If the auditor expects no misstatements, PPS sampling will usually result in a smaller sample size, and A PPS sample can be designed more efficiently, and sample selection may begin before the total population is available.

In contrast, PPS sampling has the following disadvantages: a.

b. c.

d. e.

It includes an assumption that the audit value of a sampling unit should not be less than zero or greater than book value. When understatements or audit values of less than zero are anticipated, special design considerations may be required.

The selection of zero balances or balances of a different sign (e.g. credit balances for asset accounts) requires special consideration.

PPS evaluation may overstate the Allowance for Sampling Risk (ASR) when misstatements are found in the sample. As a result, the auditor may be more likely to reject an acceptable book value for the population.

As the expected number of misstatements increases, the appropriate sample size increases.

PPS is appropriate for testing for overstatement, but not understatement.

When using PPS sampling for testing the existence of accounts receivable, all you need to know is book value of account receivables, which should be in the client’s records.

PPS automatically stratifies the results. When control risk is low, it usually means a lower sample size. PPS should include only the audit values greater than zero, so a credit balance or a zero balance in accounts receivable would have to be investigated with another sampling method.

A disadvantage is that when control risk is high for the existence of accounts receivable, and the auditor expects misstatements, then larger sample sizes would be needed than when using other techniques.

LO 6, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.14 The major advantages of nonstatistical sampling include:  Decreased complexity,  Lower training cost, and  It may be less time consuming. The major disadvantages of nonstatistical sampling are that the auditor: 1. Cannot quantify sampling risk, 2. Cannot measure the sufficiency of evidence, and 3. May not get the most efficient sample.

When testing the existence of accounts receivable, it may be less complex to select the sample and evaluate sample results. However, the auditor must use professional judgment, rather than statistics, in evaluating sampling risk and the sufficiency of evidence.

LO 7, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA AC: Technology and Tools

R10.15 When the auditor plans to use ratio or difference estimation, both audit and book values are needed for each sampling unit, and the auditor should expect differences between audit and book values. Therefore, a common condition for using ratio or difference estimation is that a minimum number of differences must exist between book values and audit values in the sample.

LO 8*, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: Analytic, AICPA PC: Technology and Tools

SOLUTIONS TO ANALYSIS PROBLEMS AP10.1 1. A potential for audit data analytics would include analyzing inventory turnover and potential lower of cost or market issues for inventory. The inventory is likely heterogeneous, and the auditor might evaluate produce different from canned goods and other items with a longer shelf life. ADA may make it easy to look at the inventory turnover of various categories of goods. ADA may also be relevant to auditing the accuracy, valuation and allocation assertion related to the collectability of receivables.

2. A potential application of audit sampling might be selecting inventory to observe and count, or receivables to confirm for auditing the existence assertion.

LO1, BT: AP, Difficulty: Easy, TOT:40 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.2 a) The auditor's justification for accepting the uncertainties that are inherent in the sampling process is based upon the premise that the  Cost of examining all financial data would usually outweigh the benefit of the added reliability of a complete (100%) examination,  Time required to examine all financial data would usually preclude issuance of a timely auditor's report. b) The uncertainties inherent in applying audit procedures are collectively referred to as audit risk. Audit risk, with respect to a particular account balance or class of transactions, is the risk there is a monetary misstatement greater than tolerable misstatement in the balance or class that the auditor fails to detect. Audit risk is a combination of 3 types of risks as follows:  Inherent Risk - The susceptibility of an assertion to a material misstatement assuming the client does not have any related internal controls.  Control Risk - The risk that a material misstatement that could occur in an assertion will not be prevented or detected on a timely basis by the client's internal controls.  Detection Risk – The risk that the auditor‘s procedures, both analytical procedures and tests of details, will not detect a material misstatement that exists in an assertion.  Audit risk includes both uncertainties due to sampling and uncertainties due to factors other than sampling. These aspects of audit risk are referred to as sampling risk and nonsampling risk, respectively. c) Sampling risk arises from the possibility that when performing a substantive procedure, the auditor's conclusions based on the sample may differ from the conclusions that might be reached if the procedure were applied in the same way to all items in the population.

Nonsampling risk includes all the aspects of audit risk that are not due to sampling. An auditor may apply procedures to all transactions and still fail to detect a

material misstatement. Nonsampling risk includes the possibility of using procedures that are not appropriate to achieve the specific objective, or failing to recognize errors in documents examined, which would render the procedures ineffective even if all items were examined.

The auditor is concerned with two aspects of sampling risk in performing substantive procedures:  The risk of incorrect acceptance is the risk that the auditor‘s sample leads the auditor to believe that the population is presented fairly, when the population contains a material misstatement.  The risk of incorrect rejection is the risk that the auditor‘s sample leads the auditor to believe that the population contains a material misstatement when the population is, in fact, materially correct.

LO2, BT: AP, Difficulty: Easy, TOT:40 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.3  The population consists of 2 types of contracts. One subpopulation would be contracts that have been completed during the year versus a second subpopulation of contracts representing work in progress at year-end. Given that the client uses a percentage of completion method, those contracts that are 100% complete may behave differently than those still in progress.  Sampling risk exists for contracts in different stages of completion, and these contracts may not be characteristic of the entire population. An issue that exists is that the contracts may be heterogeneous with different levels of variability. Therefore, the auditor is likely to see characteristics in a sample that may not be indicative of the variation in the population.  Nonsampling risks include not applying the appropriate audit procedure, or not appropriately evaluating the evidence. Therefore, in the recognition of revenue on a percentage of completion basis there is a greater amount of calculation, estimation, and judgment which might cause an inappropriate evaluation of the sampling results. The auditor must be knowledgeable about how the client applied the percentage of completion method, and the auditor should also understand how the client should have applied the percentage of completion method. LO2, BT: AN, Difficulty: Medium, TOT:40 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.4 a. Areas where judgment may be exercised by a CPA in planning a statistical sampling for inventory include:  Determining the objectives of the plan. The CPA must identify the assertions that are of interest for inventory, and determine if the statistical procedure should (1) estimate the total dollar amount of the population or (2) estimate the dollar amount of misstatement in the population.  Defining the population and sampling unit. The CPA must consider the appropriate population for the objectives of the plan. Is the population all items in inventory or select items or select locations? Is the inventory homogenous or heterogeneous? Once the appropriate population is identified, the CPA must determine the sampling unit for inventory and determine that it is compatible with the objective of the procedure.  Determining sample size. The CPA must use judgment in specifying the acceptable level of risk of incorrect acceptance, tolerable misstatement, and expected misstatement.  Determining the sample selection method. The CPA must decide which random sampling selection method to use: pure random selection, stratified random selection, or systematic random selection. b. The CPA must consider the qualitative aspects of the misstatements as well as the quantitative aspects. From a quantitative aspect, the CPA will perform statistical calculations to project the misstatements to the entire population. If the projected misstatement (PM) is less than tolerable misstatement (TM), the CPA may conclude that the inventory balance is presented fairly in all material respects. The CPA may choose to select an additional sample and perform more testing if the PM is reasonably close to the TM. From a qualitative aspect, the CPA should consider if results from other substantive procedures support or contradict the conclusion, and if there is any evidence of fraud or possible failure of internal controls. If fraud or failure of controls is evident, the CPA should consider how this may impact other aspects of the audit. c.

Two techniques for selecting a nonstratified sample of 80 accounts payable vouchers are: a.Random number sampling. Use a table of random numbers or a software application that generates random numbers to identify 80 four-digit numbers that can be uniquely related to items in the population. When a table of random numbers is used, the starting point in the table should be selected randomly and the path to be followed through the table should be determined in advance and followed consistently.

2. Systematic random sampling. Select every 40th voucher (3200/80) after selecting the initial voucher (from 1-40) randomly. If the CPA is concerned there may be a cyclical pattern in the population, he or she may use multiple random starts, multiplying the skip interval for a single random start (40) by the number of multiple starts.

LO1,2,3 BT: AP, Difficulty: Easy, TOT:40 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.5 i.

The factors that influence sample size for a substantive procedure are: a. The desired level of assurance that the actual misstatement does not exceed tolerable misstatement in the population, b. Tolerable misstatement, c.

The amount of expected misstatement in the population, and d. Stratification of the population when appropriate. ii.

In the case of Consumer Home Electronics Warehouse these factors would influence sample size as follows: a. The first factor is the auditor’s desired level of assurance that tolerable misstatement is not exceeded by the actual level of misstatement in the population. Inherent risk is probably high or maximum with respect to existence of inventory. However, internal controls are strong, so the auditor can use a lower assessed level of control risk approach, setting control risk and risk of material misstatement as low. This will result in smaller sample sizes. b. The second factor is the auditor‘s assessment of tolerable misstatement, which is the maximum dollar amount of misstatement that an auditor is willing to accept in a transaction class or an account balance, and still conclude the population is presented fairly. Jennifer set tolerable misstatement at $1.6 million. If she had set tolerable misstatement at a smaller amount, sample size would increase. If tolerable misstatement were set at a larger amount, sample size would decrease. However, tolerable misstatement should be set based on the amount of misstatement that a financial statement user might tolerate without changing a decision based on the information. c.

The third factor is the amount of misstatement the auditor expects to find in the population. In this case, internal controls are strong, so the auditor expects the amount or expected misstatement to be relatively low. The auditor might also check the amount of misstatement found in prior years when determining this amount. Given that the amount of expected misstatement is relatively low, compared to tolerable misstatement, this will result in a smaller sample size. d. The fourth factor is stratification of the population. In this case there is a high degree of variability in the population, so stratifying the population into more homogenous subgroups will result in more efficient sampling and reduce the sample required.

LO4, BT: AP, Difficulty: Medium, TOT: 35 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.6 The appropriate steps for executing a sampling plan are: i.

Determine the objectives of the substantive procedure ii.

Determine the substantive procedures that will meet objectives iii. Determine whether to audit a sample or the entire population iv. Define the population and sampling unit

v. vi. vii. viii. ix. x.

Choose an audit sampling technique Determine sample size Select a representative sample Apply audit procedures Evaluate results of the sample Document conclusions

LO5, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.7 i.

The advantages of PPS sampling are as follows: i.

PPS sampling is generally easy to use, ii.

Size of PPS is not based on the estimated variation of audited amounts, iii. PPS sampling automatically results in a stratified sample, iv. Individual significant items are automatically identified, v. If no misstatements are expected, PPS sampling will usually result in a smaller sample size, and vi. A PPS sample can be easily designed, and sample selection can begin before the complete population is available. ii.

Sample Size Calculations: Sample Size: n = (BV*RF)/((TM – (EM * EF)) n = ($300,000 X 3.0) / (($15,000 – (0)) n = 60

iii.

Sampling Interval: SI = BV / n SI = $300,000 / 60 SI = $5,000 The calculation of projected misstatement is as follows: Misstatement Number

Recorded Amount

Audit Amount

Tainting Percentage

Sampling Interval

Projected Misstatement

1

$ 400

$ 320

20%

$1,000

$ 200

2

$ 500

$0

100%

$1,000

$1,000

3

$3,000

$2,500

N/A

$1,000

$ 500

Total Projected Misstatement

$1,700

Author’s notes: i.

The question asks for projected misstatement, not for the upper misstatement limit. ii.

The 3rd misstatement is larger than the sampling interval, hence a tainting percentage is not used and the projected misstatement equals the actual misstatement.

LO6, BT: E, Difficulty: Hard, TOT: 25 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.8 a.

1. Projected misstatement = $4,570 (See spreadsheet AP10_8.xls for calculations) 2. Projected misstatement = $4,890 (See spreadsheet AP10_8.xls for calculations) b.

1. Basic precision = $3,800 (See spreadsheet AP10_8.xls for calculations) 2. The incremental allowance for sampling risk = $1,700 (See spreadsheet AP10_8.xls for calculations) 3. The upper misstatement limit = $10,390 (See spreadsheet AP10_8.xls for calculations)

c.

The auditor is 85% confident that the maximum overstatement in the population is $10,390. This is significantly less than tolerable misstatement of $50,000 so the auditor can conclude that the population is presented fairly in all material respects.

LO6, BT:E, Difficulty: Hard, TOT: 35 min., AACSB: Analytic, AICPA AC: Technology and Tools

AP10.9 a.

Fine Host Corporation (FHC) is a Connecticut based company that provided food and beverage concession, catering, and other services in approximately 400 facilities in 38 states. It conducted an initial public offering in June 1996. We now know that FHC engaged in a financial fraud that, when detected, resulted in the collapse of its stock price, and eventually, the end of its existence as a public company.

FHC improperly capitalized expenses as assets. In the 1995 financial statements that represented the most current annual statements that were included in the registration statement, FHC capitalized contract acquisition costs. When a contract was signed to provide food and beverages services to sports arenas, convention centers and other facilities, costs attributed to those contracts were transferred to a “contract rights‖ account and were capitalized to be amortized over the term of the contract. This practice was permissible under GAAP only to the extent that the costs are directly related to the acquisition of assets with a future economic benefit. However, FHC capitalized costs such as airfare, lodging, food, flowers, and color illustrations for proposals.

In its 1995 financial statements, FHC capitalized a total of $4.6 million in contract acquisition costs. Several years later when FHC restated its earnings it wrote off almost $4.3 million of these capitalized costs (approximately 113% of pretax income). b.During the audit of the 1995 financial statements the engagement team under the supervision of John Bacsik, the engagement partner, and Barbara Horvath, the engagement manager, sampled only nine items, totaling $9,332 of the $4.6 million in contract acquisition costs. A critical issue in this case was a sample size that was considered to be too small. Further, the basis for selecting only nine items was not documented.

The SEC found that the engagement team, under the supervision of Bacsik and Horvath, failed to collect sufficient, competent evidence to support an opinion on the financial statements. The SEC also found that Bacsik and Horvath failed to properly plan and supervise audit procedures necessary to support a reasonable basis for an audit opinion. Bacsik was denied the privilege of appearing or practicing before the SEC as an accountant and Horvath was censured by the SEC. LO3,4,5,7 BT: S, Difficulty: Hard, TOT: 45 min., AACSB: Analytic, AICPA AC: Technology and Tools

Audit Decision Cases C10.1 Part 1: a. The assertion being tested when the auditor audits the client‘s quantities of inventory on hand would be the existence assertion. The assertion being tested when the auditor audits the client‘s prices assigned to quantities of inventory on hand would be the accuracy, valuation and allocation assertion. b. The evidence needed to test the existence of inventory would involve observing and counting a portion of the inventory on hand, to match the auditor‘s counts against the client‘s counts. Gathering evidence needed to test the valuation of inventory, involves testing how the client accumulates manufacturing costs. For example, raw material prices would be validated by vendor‘s invoices, and direct labor would be validated by reference to payroll hours and wage rates. The auditor also needs to audit the process of assigning manufacturing overheads to the cost of inventory, by reference to underlying vendor invoices.

Part 2: Sample Size = 32 n = (BV*RF)/((TM – (EM * EF)) n = ($6,719,028.95 * 1.0) / (($325,000 – ($100,000 * 1.15)) n = 32 Part 3: The scenario that supports a risk of incorrect acceptance of 37% is one where the system of internal control is considered to be strong with respect to the existence of inventory and the accuracy, valuation and allocation of inventory at historical cost. Inherent risk for the existence of inventory would likely be maximum. Inherent risk would also be set at maximum for the accuracy, valuation and allocation assertion due to the complexity of determining manufacturing overhead rates. However, if internal controls are strong, then the risk of material misstatement is low, leading to a high risk of incorrect acceptance (37%).

Part 4: Each student will get a different result for part 4 as each student will select a different sample. This is an excellent opportunity to talk about sampling and sampling risk. An excel file is provided labeled C10_1 with a proposed solution.

Part 5: Again, each student will get a different result for part 5 as each student will select a different sample. An excel file is provided labeled C10_1 with a proposed solution.

Part 6: Again, each student will get a different result for part 6 as each student will select a different sample. An excel file is provided labeled C10_1 with a proposed solution.

LO6, BT: E, Difficulty: Hard, TOT:60 min., AACSB: Analytic, AICPA AC: Technology and Tools

C10.2

Stratum

N

n

Book Value of Stratum

Book Value of Sample

Audit Value of Sample

Estimated Audit Value of Stratum

> $50,000

20

20

$ 3,000,000

$ 3,000,000

$ 2,948,000

$2,948,000

$50,000 > x > $5,000

100

30

$ 3,000,000

$ 1,000,000

$ 970,000

$2,910,000*

< $5,000

300

30

$ 3,000,000

$ 300,000

$ 280,250

$2,802,500**

$ 9,000,000

$ 4,300,000

$ 4,198,250

$8,660,500

i.

The estimated audit value of the population of total receivables is $8,660,500. The estimated misstatement is $339,500 ($9,000,000 - $8,660,500). While this is less than tolerable misstatement ($350,000), the auditor has not yet considered an allowance for sampling risk. The auditor needs to evaluate the underlying causes of the misstatements and consider doing more work. The auditor should also consider whether the misstatements found are evidence of a significant deficiency in internal controls.

*Ratio method = $970,000 * $3,000,000 $1,000,000 = $2,910,000 **Ratio method = $280,250 *$3,000,000 $300,000 = $2,802,500 ii.

While the overstatement of accounts receivable is less than TM, it does not allow for a reasonable allowance for sampling risk. Before drawing an audit conclusion, the auditor should extend the sample size and/or perform additional procedures to obtain a higher level of certainty with the conclusion.

LO7, BT: E, Difficulty: Hard, TOT:30 min., AACSB: Analytic, AICPA AC: Technology and Tools

C10.3 The population for the tests of depreciation expense is the depreciable items included in PPE. This includes both new items and existing items. The auditor should ensure that disposals are removed from the asset register before the sample is taken.

Sampling PPE for the tests of depreciation expense should reflect the changed conditions and the materiality of PPE to the balance sheet. The changed conditions relate to the large investment in a new manufacturing process and the associated increases in PPE acquisitions. The sampled items should include new acquisitions of PPE (because these have not been tested before for depreciation), plus the larger items (because the depreciation expense would likely be higher for these items).

Other considerations include the location of items (does FH have different branches?), and types of equipment (are some pieces of equipment harder to value and make estimates about useful life and depreciation rates?), and history (does management made predictable types of misjudgments about useful life?).

The auditor could formally stratify the sample to select samples of new items and old items, and different value items, or select a large enough sample to be reasonably sure that the sample includes all types of items that are likely to be most at risk.

A random sample (either with or without stratification) would allow the auditor to make conclusions using probability theory. The auditor could supplement the formal conclusions based on a random sample with evidence obtained from samples of items considered ‗important‘ in the auditor‘s judgement. This judgment would relate to the consideration of which items are more likely to be depreciated inappropriately.

The assertions most at risk are the accuracy of depreciation expense and the accuracy, valuation and allocation for PPE (shown as cost less accumulated depreciation).

LO3, BT: AN, Difficulty: Hard, TOT:30 min., AACSB: Analytic, AICPA AC: Technology and Tools

C10.4 Using the ratio method, the estimated audit value of the population is calculated as follows: Estimated AV of population = $1,096,500 X $11,345,000 $1,145,000 = $10,864,448 The difference between the book value (BV) of the population and the estimated AV of the population is $480,552 ($11,345,000 - $10,864,448).

This means that PPE items with a value of $480,552 have inappropriate depreciation rates. This error equates to approximately 4% of gross PPE ($480,552/$11,345,000), which is usually not considered material. However, the auditor needs to consider how it might combine with other misstatements discovered in the audit. If there are no other misstatements, the auditor would conclude that the accuracy, valuation and allocation assertion for PPE was not violated.

Although we are not given the depreciation rate, the effect on profit before tax is likely to be less than 4% (i.e. assuming 10% depreciation, the error in the expense is $48,055, which is 2.5% of profit before tax). However, given that PPE is considered to be one of the most material balances, the auditor might consider further testing or asking management to adjust the depreciation.

LO7, BT: E, Difficulty: Hard, TOT:20 min., AACSB: Analytic, AICPA AC: Technology and Tools

C10.5 i.

Using the formula RIA = AR/ (IR x CR x OSP) where RIA= Risk of Incorrect Acceptance, IR = Inherent Risk, CR = Control Risk and OSP = Assurance from Other Substantive Procedures, the risk of incorrect acceptance for each sampling plan is: 1.

2.

3. ii.

RIA = .05/ (1.0 x .5 x .25) = .40 RIA = .05/ (1.0 x .4 x .50) = .25 RIA = .05/ (1.0 x .4 x .85) = .15

Based on R values obtained from Illustration 10A.3 and the formula A = R x TM, the planned allowance for sampling risk for each sampling plan is: a. b. c.

A = .863 x $110,000 = $94,930 (RIR is 10%, RIA is 40%, use Illus. 10A.3) A = .742 x $140,000 = $103,880. (RIR is 5%, RIA is 25%, use Illus. 10A.3) A = .612 x $170,000 = $104,040 (RIR is 10%, RIA is 15%, use Illus. 10A.3)

Use the formula n = ((N * UR * Sxj) / A)2 . Illustration 10A.2 has the UR Factor.

The sample size for each sampling plan is: 1.

2.

3.

n = ((5,000 * 1.64 * $80) / $94,930)2 = 48 n = ((6,000 * 1.96 * $105) / $103,880)2 = 141 n = ((8,000 * 1.64 * $125) / $104,040)2 = 248

Note: Since n/N is less than .05 in each case, the finite correction factor is not applied.

LO6,8, BT: E, Difficulty: Hard, TOT:30 min., AACSB: Analytic, AICPA AC: Technology and Tools

C10.6

a.

Company X sample size = 160 (See spreadsheet C10_6.xls for calculations) Company Y sample size = 144 (See spreadsheet C10_6.xls for calculations) b.

Accept the population as materially correct because the book value of $90,000 falls within the precision interval of $78,821 to $91,514. (See spreadsheet C10_6.xls for calculations) c.

Reject the population as containing material misstatements because the book value of $200,000 falls within the precision interval of $170,559 to $191,104. (See spreadsheet C10_6.xls for calculations)

LO8, BT: E, Difficulty: Hard, TOT:25 min., AACSB: Analytic, AICPA AC: Technology and Tools

CLOUD 9 Question A: 1. The risk of incorrect acceptance of 37% would be supported by qualitative assumptions as follows:  Inherent risk for the existence of accounts receivable is probably maximum given that the occurrence of revenues and the existence of receivables is a high risk assertion.  Control risk for the existence of accounts receivable is probably assessed as low, given strong internal controls. The results of tests of controls should support this.  This would allow for a detection risk of high, which is consistent with a 37% risk of incorrect acceptance.

2. Sample size give these assumptions would be 28. n = (BV*RF) / ((TM – (EM * EF)) n = ($71,622,804* 1.0) / (($3,500,000 – ($750,000 * 1.15)) n = 27.15 so round up to 28 3. The sampling interval = $2,557,957.29 SI = BV / n SI = $71,622,804 / 28 = $2,557,957.29 Question B: i.

The UML is $1,146,300. (See spreadsheet Chp 10 Cloud 9 Solution Johnson 2E.xls for solution. ii. The UML, including an allowance for sampling risk, of $1,146,300 is less than tolerable misstatement of $3,000,000. Therefore, the accounts receivable book balance of $71,622,804 is presented fairly in all material respects.

LO 6, BT: E, Difficulty: Hard, TOT: 45 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., AC: Technology and Tools PC: Decision Making

CHAPTER 11 Auditing the Revenue Process Learning Objectives 1.

2.

3.

4.

5.

Explain the nature of the revenue process.

Evaluate audit planning information and its effect on the assessment of inherent risk in the revenue process.

Evaluate control activities for credit sales transactions.

Evaluate control activities for cash receipt transactions.

Evaluate control activities in a ―paperless‖ revenue system.

6.

7.

8.

Evaluate control activities for sales adjustment transactions and revenue process disclosures.

Determine how to design and perform tests of controls in the revenue process and connect the results of control testing to audit strategy.

Determine which substantive procedures to perform in the revenue process and how to evaluate their results.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: None

2. D LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: None

3. B LO 2 BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, AICPA AC: None

4. D LO 2, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis and Management, PC: Decision Making

5. C LO 2, BT: C, Difficulty: Moderate, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, PC: Decision Making

6. C LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Systems and Process Management, PC: Decision Making

7. A

LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Systems and Process Management, PC: Decision Making

8. B LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Systems and Process Management, PC: Decision Making

9. D LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Systems and Process Management, PC: Decision Making

10. B LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Systems and Process Management, PC: Decision Making

11. A LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Systems and Process Management, PC: Decision Making

12. D LO 7, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis and Management, PC: Decision Making

13. A LO 8, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Decision Making

14. C LO 8, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA PC: Decision Making

ANSWERS TO REVIEW QUESTIONS R11.1 If cash receipts are not recorded accounts receivable will be overstated. The failure to record a cash receipt also results in a failure to reduce a receivable and an understatement of cash.

LO 1, BT: AP, Difficulty: Easy, TOT: 3 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, PC: Decision Making

R11.2 1. Revenue is recorded before goods are shipped due to a cutoff problem. For example, an invoice might be prepared before goods are actually shipped.

2. Revenue is recognized prematurely because the customer is billed for the full order, even though some items ordered are back ordered and not shipped yet.

3. Management books revenue and receivables prematurely in order to meet sales targets. This may be done though a journal entry or by sending an invoice to a customer before goods are shipped.

LO 1, BT: AP, Difficulty: Easy, TOT: 10 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, PC: Decision Making

R11.3 For oil and gas field machinery equipment, knowing that they are tied to extractive industries that are dependent on oil prices and they depend on opportunities for export and competitive pricing (worldwide), the risk of material misstatement concerns can be significantly affected by:  Terms of sales and moving inventory during a period of low oil prices,  Sales may be dependent on policies (and politics) of foreign governments and oil prices, or decisions made by foreign countries to invest in or support oil and gas extraction,  Collection risk associated with selling to foreign entities (and political disruption). For a retail grocer, sales are relatively straightforward. However, with numerous products where product differentiation is difficult, retailers are improving margins by leasing space to banks and coffee companies. Grocers also have intense competition from club stores and click and pick up or delivery services, the risk of material misstatement concerns can be significantly affected by: 1. Sales may not be recorded, or cash may be taken by employees, 2. Receivables are usually related to pharmacy receivables from insurance companies.

LO 2, BT: AN, Difficulty: Easy, TOT: 10 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, PC: Decision Making

R11.4 Two financial ratios that might be helpful in identifying revenue recognition are: 1.Comparing sales to total capacity, or sales to total assets, increasing ratios, particularly in the 4th quarter may indicate potential revenue recognition issues.

2.Accounts receivable growth to Sales growth may be useful as ratios larger than 1.0 indicate receivables are growing faster than sales. Large ratios may indicate possible revenue recognition issues.

LO 2, BT: AN, Difficulty: Easy, TOT: 5 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, PC: Decision Making

R11.5 Management often has more incentive to overstate than to understate revenues.

Factors that incentivize management to misstate the revenue process assertions and possibly engage in fraudulent financial reporting include: 1. pressures to overstate revenues to achieve revenue or profitability targets that were not achieved in reality due to such factors as global, national, or regional economic conditions; the impact of technological developments on the entity‘s competitiveness; or poor management, 2. pressures to overstate cash and gross receivables or understate the allowance for doubtful accounts in order to report a higher level of working capital in order to meet debt covenants.

LO 2, BT: AN, Difficulty: Easy, TOT: 5 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, PC: Decision Making

R11.6 Auditors usually understand the flow of transactions in a given process by performing a walkthrough, such as the sales process or the cash receipts process, by following a transaction from its initiation until it is recorded in the financial records. During a walkthrough, the auditor will often interview client personnel, understand the documents and electronic files used by the client, and understand how the entity uses information technology to support transaction-level controls. The auditor will often ask questions of the entity's personnel about their understanding of the responsibilities involving the authorization and recording of transactions in the general ledger. Through inquiry and observation, the auditor obtains an understanding of transaction-level controls as well as the adequacy of segregation of duties.

The sales process normally begins with authorizing the sale by reference to a customer master file which has information on approved customers, customer shipping and billing information, and the customer credit limit.

Once the transaction is authorized a sales order is generated. The sale order is a clientprepared prenumbered document that includes customer information, description and quantity of what was ordered, and terms of sale.

When the warehouse receives the sales order, the goods are prepared for shipment and a bill of lading and packing slip are prepared. The bill of lading is the shipping document that serves as acknowledgement of receipt of goods for delivery by a freight carrier, and the packing slip is a client-prepared document with the details of items included in a shipment.

Once goods are shipped the client usually prepares a sales invoice to record the sale and bill the customer. The sales invoice is a client-prepared document stating the particulars of a sale, including the amount owed, terms, and date of sale. It is used to bill customers, and it provides the basis for recording a sale in the sales journal (the journal of original entry where each sale is recorded). The sale is also usually recorded in the accounts receivable subsidiary ledger, which becomes the basis for sending monthly statements to customers.

LO 3, BT: AP, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, BC: Process and Resource Management Perspective

R11.7 Accepting Customer Orders. Sales orders from customers should be accepted only in accordance with management’s authorized criteria. The criteria generally provide for specific approval of the order in the sales order department, using a software application to determine that the customer exists in a customer master file with approved credit limits. If the customer is not in the master file, many companies ask for a credit card, or they ship on a collect-on-delivery basis to establish a history with a new customer. In many companies, the next step involves the client preparing a prenumbered sales order form. The prenumbered sales order form enables following each transaction from initiation to delivery of goods or services, to recording the sale, to receipt of final consideration. The sales order represents the start of the transaction trail of documentary evidence. Information on open (unfilled) and filled sales orders is usually maintained in appropriate computer files and monitored to ensure ordered goods are shipped to customers. Usually, the computer can be programmed to compare a customer’s outstanding receivable balance, plus the anticipated sale, with the customer’s credit limit in the approved customer master file. Segregating responsibility for initiating a sale and approving sales that exceed a credit limit prevents sales personnel from subjecting the company to undue credit risks to boost sales.

Approving Credit. Today, most companies ask first-time customers to pay in cash, pay on a cash-on-delivery basis, or pay with credit cards or some form of electronic funds transfer. This allows the company to make the sale and begin to establish a relationship with new customers. After some history with a new customer, a company may begin steps to approve credit in small amounts and increase credit limits based on a customer’s payment history. Controls over approving credit are designed to reduce the risk of initially recording a revenue transaction at an amount in excess of the amount of cash expected to be realized from the transaction. Thus, these controls also relate to the valuation or allocation assertion associated with the allowance for uncollectible ac-

counts. Additional controls over revenue recognition take place when the transaction is recorded.

Recording the Sale Invoice. At the stage of recording a sales invoice, the information on the invoice is compared both with the information on an authorized sales order and on shipping documents. Each invoice should be supported by a unique bill of lading, the quantities on the sales invoice are matched with the packing slip, and prices are matched with the sales order.

LO 3, BT: AP, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Process and Resource Management Perspective

R11.8 Ultimately, a key aspect of fraud risk relates to the opportunity that may or may not present itself based on the quality of the system of internal control. An auditor’s concerns are heightened when the control environment is weak, or control activities are non-existent. In not-for-profit organizations, smaller companies, or governments, segregation of duties may be weak or non-existent. In these cases, the auditor with appropriate professional skepticism should consider fraud risk to be high.

Sound internal controls should ensure that sales are recorded only when goods are shipped. Hence, an IT application control or an IT dependent manual control should be in place to ensure that each recorded sales invoice is supported by appropriate shipping documents (bill of lading and packing slip).

LO 3, BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Process and Resource Management Perspective

R11.9 A major risk in processing cash receipt transactions is the possible theft of cash before or after a record of the receipt is made. Control procedures should provide reasonable assurance that documentation establishing accountability is created at the moment cash is received and that the cash is subsequently safeguarded. Often larger companies use a lockbox where customer checks are mailed directly to the bank which establishes control over cash receipts. If a company receives checks and cash, a process should be in place to issue a receipt and control cash upon its receipt from the customer.

The auditor should also be alert to situations where an employee may have personal reasons to misappropriate assets, such as affording the costs of private schools or universities. Ultimately, a key aspect of fraud risk relates to the opportunity that may or may not present itself based on the quality of the system of internal control. An auditor’s concerns are heightened when the control environment is weak, or control activities are non-existent. In not-for-profit organizations, smaller companies, or governments, segregation of duties may be weak or non-existent. In these cases, the auditor with appropriate professional skepticism should consider fraud risk to be high.

Finally, a common scheme to conceal the misappropriation of cash receipts is called lapping, which begins when a customer pays cash toward an accounts receivable balance. Then an employee steals cash received from the customer (Customer A). Subsequently, the employee will post a cash receipt from another Customer-to-Customer A’s account so that Customer A does not complain that the cash receipt was not recorded.

Sometimes the fraudster can solve the problem of keeping this going by falsifying a sales adjustment to reduce the receivable, or by writing off part of a customer’s balance with a journal entry. The auditor should be alert to the possibility of fraud when cash is credited to the wrong customer, or there is little or no justification for a sales adjustment or a receivable write-off.

LO 4, BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Process and Resource Management Perspective

R11.10 The flow of cash receipt transactions normally begins with cash received via electronic funds transfer and lockboxes where cash is received directly by the bank.

With an EFT, cash goes from the customer’s bank account to the client’s bank account.

When the bank receives EFTs or funds by way of a lock box, the bank also prepares a remittance report listing each individual cash receipt and a deposit slip. The remittance report is used as a source document to record cash receipts and update accounts receivable. These systems expedite the depositing of funds from customers, permit the company to receive credit for the receipts sooner, and provide external evidence of the existence of the transactions. They also eliminate the risk of diversion of the receipts by company employees or the failure to record cash receipts.

LO 4, BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Measurement, Analysis and Interpretation, BC: Process and Resource Management Perspective

R11.11 Sound control over the completeness of cash receipts starts with good control over receiving cash. The best controls are when cash is received directly by the bank, and the bank prepares a remittance report. If cash is received by the company, duties should be segregated, and mail should be opened by two individuals, and they should be responsible for preparing a complete prelisting of cash received.

The clients ’software application should then compare each item in the bank remittance report (or the prelist of cash receipts if cash and/or checks are received by the client) to develop a one-for-one match with recorded cash receipts in the cash receipts journal.

An exception report is generated daily of any cash receipts that have not been recorded. Follow-up by appropriate employees or management is required to close the loop on the control.

LO 4, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Process and Resource Management Perspective

R11.12 Making sales through an evaluated receipts system typically starts with a contract that will outline how data is exchanged electronically, how long prices are good for, the process for verifying quantities shipped and received, the process fo verifying other transactions costs such as freight or taxes, and the terms of payments.

An individual revenue transaction starts when the seller receives a purchase order from the customer. The cosmetic company then initiates an advance shipping notice (ASN) which is essentially the company’s sales order.

Cosmetics are then shipped based on the ASN. Normal packing slips and bills of lading are created (often electronically).

Upon shipment a sales invoice is created based on the ASN and the packing slip.

Cash is normally received through an electronic invoice presentment and payment system (EIPP), where an electronic payment is made by the purchaser through an independent third-party payment processor, to the cosmetic company’s bank account. The cosmetic company will book cash receipts based on an electronic remittance report received from the cosmetic company’s bank.

LO 5, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Process and Resource Management Perspective

R11.13 Good internal controls over the write-off of uncollectible accounts are important to prevent write-offs from being used to conceal fraud in processing cash receipts. For example, an employee might misappropriate cash received from a customer and cover up the fraud by writing the customer’s account off against the allowance for uncollectible accounts. Good internal controls include:  All write-offs of uncollectible accounts should be authorized by appropriate management and supported by documentation, such as correspondence with the customer or collection agencies.  Journal entries for write-offs should be reviewed by management to ensure the appropriateness of the transaction. In addition, management should establish controls over accounting estimates such as the provision for bad debt expense using hindsight to evaluate the adequacy of prior provisions for bad debt expense compared with subsequent receivables that went uncollectable. Further, in a public company the process of estimating the allowance for doubtful accounts, and related economic conditions, should be reviewed by a disclosure committee.

LO 6, BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Process and Resource Management Perspective

R11.14 Most public companies will control the occurrence of revenue with an IT application control that ensures that a sales invoice is supported by a bill of lading and quan-

tities on a packing slip that match quantities on the sales invoice. An appropriate test of control will usually include:  Test the effectiveness of IT general controls,  Use computer assisted audit techniques (CAATs) to evaluate effectiveness of IT application controls and  Test the effectiveness of manual procedures to follow up on exceptions identified

by IT application controls. The auditor will usually test the effectiveness of IT general controls as part of testing entity-level controls, such as when testing the control environment. The auditor might pay particular attention to making inquiries and collecting supporting evidence regarding employee awareness of IT security issues. If the auditor is testing issues regarding controls over program changes, the auditor might determine how program access is controlled and monitored, look at logs of program access or incident reports and talk to users about their involvement in program changes and their responsibilities. The auditor will want to pay attention to segregation of duties regarding access to programs and access to data, the effectiveness of password controls, and follow-up of any incident reports regarding unauthorized access. The auditor will also want to understand controls over back-up and recovery of programs and data and test the effectiveness of these controls. These tests are often performed by a computer audit specialist.

A computer specialist will usually test the IT application control with test data, to ensure that the software appropriately approves and processes transactions and rejects transactions that should be rejected.

Finally, the auditor will make inquiries about, and inspect documentation of, manual follow-up procedures. The auditor might also reperform the manual follow-up procedures to ensure that they were performed correctly.

LO 7, BT: AP, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management.

R11.15 The following discuses performing initial procedures when auditing revenues.

Usually, the auditor will obtain an understanding of the business and industry and determine: a. the significance of revenues and accounts receivable to the entity, b. key economic drivers that influence the entity’s sales, margins, and collections, c. standard trade terms in the industry, including seasonal dating, collections period, etc. and d. the extent of concentration of activity with customers.

The purpose of these initial procedures is to set the business context for further analysis. Each business is different, and understanding the business and industry provides a context for evaluating evidence that is obtained in subsequent stages of the audit.

Additional initial procedures are usually performed on the accounts receivable balance as follows. a. Trace beginning balance for accounts receivable to prior year’s working papers.

b.

Scan the activity in general ledger account for accounts receivable and investigate entries that appear unusual in amount or source. c.

Obtain accounts receivable trial balance and determine that it accurately represents the underlying accounting records by: i. footing the trial balance and determining agreement with (1) the total of the subsidiary ledger or accounts receivable master file, and (2) the general ledger balance and ii. verifying agreement of customer balances listed on the trial balance with those included in the subsidiary ledger or master file.

These procedures ensure that the data subjected to detail testing actually is supported by the prior audit’s beginning balance and the client’s general ledger and supporting documents.

LO 8, BT: AP, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making

R11.16 Effective cutoff test for sales and sales returns normally include:  Selecting a sample of recorded sales transactions from several days before and after year-end and examine supporting sales invoices and shipping documents to determine sales were recorded in the proper period, and  Selecting a sample of credit memos issued after year-end and examine supporting documentation such as dated receiving reports to determine that returns were recorded in the proper period.  The auditor might also consider whether the volume of sales returns after yearend suggests the possibility of unauthorized shipments before year-end. LO 8, BT: AP, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making

R11.17 The right audit data analytics (ADA) may be a very effective substantive test.

Data analytics might be particularly effective in auditing the allowance for doubtful accounts. Here the auditor might be able to review all customer sales and cash receipts, to identify customers for which sales have not been collected for long periods of time.

The auditor, however, must use professional judgment to distinguish between customers who reliably pay receivables after long periods (90+ days) from customers with deteriorating payment history.

The auditor might also use ADA to test revenue recognition against subsequent cash receipts. For example, many public utilities have a very high percentage of customers who pay the amount billed each month. Matching subsequent cash receipts with billings may be a very effective way of testing the occurrence of revenue and the existence of receivables for consumers who may not respond to confirmations. The auditor may also learn a great deal by following up on customers with no payments.

LO 8, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making

R11.18 Auditing the allowance for doubtful accounts may be a good place to use generalized audit software for audit data analytics approach to evaluate the adequacy of the allowance for doubtful accounts.

The auditor can use generalized audit software to generate an aging of the client’s master file. The auditor can then use the same aging to identify customers that do not fit the norm for the client’s normal collection history (e.g., over 90 days past due). Within this population of customers taking over 90 days to pay, the auditor might identify customers that normally take 90 to 120 days to pay but they pay regularly. This would be an acceptable variation from the norm.

Alternatively, the auditor wants to pay close attention to customers that demonstrate a deteriorating payment history as the year progresses. For this final grouping, auditors might also examine correspondence with customers or correspondence with outside collection agencies, review customers ’credit reports and financial statements, and discuss the collectability of specific accounts with appropriate management personnel. Ultimately, the auditor must determine if the potential misstatement of the allowance for doubtful accounts could aggregate to an amount greater than or equal to tolerable misstatement.

Finally, the auditor may want to use as much hindsight as possible to evaluate whether outstanding receivables are subsequently collected.

LO 8, BT: AP, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making

SOLUTIONS TO ANALYSIS PROBLEMS AP11.1 Revenues for the 27 owned properties represent direct revenues of the motel chain.

The auditor might consider evaluating the summer season separate from the balance of the year as the auditor will expect occupancy to be higher during that time of year and the auditor will also expect that revenues should reflect higher rates. The auditor would also expect that for the balance of the year occupancy should be lower and revenues per night will be reduced due to significant price competition. Knowledge of the industry will be particularly helpful in gauging the reasonableness of occupancy rates and revenues per unit.

Revenues for the 40 managed hotels will likely reflect management fees based on revenues earned for absentee owners. The auditor needs to consider the same issues as above, but also needs to determine the appropriateness of the management fee based on the contract with absentee owners.

LO 1,2, BT: AN, Difficulty: Basic, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making; BC; Strategic Perspective

AP11.2 1. The following table provides solutions to the quantitative requirements in parts a through g:

Units sold in 20X9 is derived as follows: ($28,000 + $450,000) - $32,000 = $446,000 2.



 

Receivables are growing faster than sales. In addition, sales price per unit has gone up and the ratio of sales to total assets has increased. This might be evidence of problems with revenue recognition. In addition, during this period of accounts receivable growth, accounts receivable turnover days increased during the last year, and the uncollectable account expense to account receivable write-off has gone down. The auditor should also consider whether the allowance for doubtful accounts is adequate.

The assertions that are likely to be misstated are: (1) the occurrence of revenues and the existence of receivables, (2) and the valuation of receivables and their net realizable value.

The auditor is most likely to test the existence of receivables and the occurrence of related revenues with confirmations to customers. The auditor is most likely to use audit data analytics to test the valuation of receivables at net realizable value, along with using hindsight to evaluate the collection of receivables.

LO 2, BT: AN, Difficulty: Moderate, TOT: 35 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making; BC; Strategic Perspective

AP11.3 a. 6 b. 2 c. 9 d. 5 e. 1 f.

3 g. 10 h. 8 i.

7 j.

4 LO 3,4, BT: AN, Difficulty: Moderate, TOT: 35 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making; BC.

AP11.4 Weaknesses

Recommended Improvement

The financial secretary exercises too much To the extent possible, the financial secrecontrol over collections. tary's responsibilities should be confined to record-keeping.

The finance committee is not exercising its The finance committee should assume a assigned responsibility for collections. more active supervisory role.

The auditing function has been assigned to the finance committee, which also has responsibility for administration of the cash function. Moreover, the finance committee has not performed the auditing function.

An audit committee member should be appointed to perform periodic auditing procedures or engage outside auditors to perform the procedures.

The head usher has sole access to cash during the period of the count. One person should not be left alone with the cash until the amount has been recorded or control established in some other way.

The number of counters should be increased to at least two people, and cash should remain under joint surveillance until counted and recorded so that any discrepancy will be brought to the attention of management.

The collection is vulnerable to robbery while it is being counted and from the church safe prior to its deposit in the bank.

The collection should be deposited in the bank's night depository immediately after it is counted. Physical safeguards, such as locking and bolting the door during the period of the count, should be instituted. Vulnerability to robbery will also be reduced by increasing the number of counters.

The head usher's count lacks usefulness from a control standpoint because he surrenders custody of both the cash and the record of the count.

The financial secretary should receive a copy of the collection report for posting to the financial records. The head usher should maintain a copy of the report for use by the audit committee.

Contributions are not deposited intact.

Contributions should be deposited intact. If There is no assurance that amounts with- it is considered necessary for the financial held by the financial secretary for expendi- secretary to make cash expenditures, she tures will be properly accounted for. should be provided with a cash working fund. The fund should be replenished by check based upon a properly approved reimbursement request and satisfactory support.

Members are asked to make checks payable to "cash", thus making the checks completely negotiable and vulnerable to misappropriation.

Members should be asked to make checks payable to the church. At the time of the count, ushers should stamp the church's restrictive endorsement (For Deposit Only) on the back of a check.

No mention is made of bonding.

Key employees and members involved in receiving and disbursing cash should be bonded.

Written instructions for handling cash collections apparently have not been prepared.

Because much of the work in cash collections is performed by unpaid and untrained church members, often on a short-term basis, detailed written instructions should be prepared.

LO 5, BT: AN, Difficulty: Moderate, TOT: 35 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making

AP11.5 a Substantive Procedure

b. Financial Statement Assertion

1.

Vouch aged trial balance to supporting documentation.

Valuation or allocation

2.

Apply analytical procedures.

Existence of receivables, occurrence of revenues, valuation of receivables.

3.

Vouch recorded sales to supporting shipping documentation.

Occurrence of revenues

4.

Perform sales cutoff test.

Cutoff, occurrence, or completeness of revenues

5.

Confirm accounts receivable

Classification of revenues

6.

Use audit data analytics to evaluate the collectability of receivables and the adequacy of the allowance for doubtful accounts

Valuation of receivables.

7.

Confirm accounts receivable

Valuation of receivables.

8.

Verify accuracy of accounts receivable trial balance and agreement with general ledger control account.

Valuation or allocation.

9.

Trace shipping documents to the recording of sales, vouch subsequent collections to recorded sales

Completeness of sales and receivables

10.

Confirm accounts receivable.

Occurrence of revenues and existence of receivables

11.

Compare statement presentation with GAAP using a disclosure checklist.

Knowledge of the pledging of receivables was probably obtained by confirmation with the factoring agent.

Presentation and disclosure

12.

Perform cash receipts cutoff test.

Cutoff, occurrence or completeness of cash receipts.

LO 8, BT: E, Difficulty: Moderate, TOT: 45 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management. PC: Decision Making

AP11.6 Accounting and Auditing Enforcement Release (AAER) findings against Homestore, Inc. revolved around the issue of what are often called Round Trip Transactions. In this case Homestore paid inflated sums to various vendors for services or products. The vendors then used these funds to buy advertising from two media companies, and subsequently the media companies bought advertising from Homestore. The result was that Homestore improperly recorded revenues from the money it received from the sale of the advertising as revenue in its financial statements. The SEC viewed these transactions as a circular flow of money where Homestore recognized its own cash as revenue.

LO 3,8, BT: E, Difficulty: Challenging, TOT: 45 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., AC: Research, PC: Ethical Conduct, PC: Decision Making

Audit Decision Cases C11.1 i.

Jonathan does many activities himself; including opening mail, cash receipts and vendor payments, depositing funds received, performing reconciliations, posting journals, and performing the payroll function. As a result, he has the ability to potentially divert cash receipts from customers. However, these would likely be payment on receivables, so Jonathan would have to reduce the customer‘s receivable. This would need to involve some type of lapping scheme or writing a journal entry to write down the amount owed by a customer. Eric or Patricia might identify the problem if they note a receivable being posted to the wrong customers account, or a write-off of an accounts receivable that should not have been written off. ii. The risk of fraudulent financial reporting is primarily related to Eric‘s desire to show an increase in revenues to support a bank loan. Given that internal controls are weak at King Companies, Inc., the auditor is already following a primarily substantive approach, auditing revenues and receivables at year-end, and using larger sample sizes.

The auditor might pay particular attention to any journal entries increasing revenues at year end. The auditor should also pay particular attention to year-end cutoff procedures to ensure a proper cutoff on revenue transactions.

LO 3, BT: E, Difficulty: Challenging, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., PC: Ethical Conduct, PC: Decision Making

C11.2 First, an auditor would normally use audit data analytics (ADA) when internal controls are strong, which is not the case for King Companies, Inc. due to segregation of duties issues. Hence, the auditor would potentially use ADA as a risk assessment procedure to identify transactions that are out of the ordinary. The auditor might also treat revenues from store sales supported by daily cash or credit card receipts separate from sales to customers made on account. With respect to daily cash sales, it would be easy to use ADA to match cash sales to bank deposits. There would be no acceptable variation from cash sales not matching cash deposits. Further, the auditor might consider whether it is feasible to match sales to subsequent cash receipts from customers. With respect to acceptable variations, it might be that a customer does not make a payment in full, but just payment on account. Failure to make a full payment would cause the auditor to investigate the customer’s account in more detail.

LO 8, BT: E, Difficulty: Challenging, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., AC: Technology and Tools PC: Decision Making

C11.3 Analysis of individual transactions a.

No misstatement of the financial statements b.

No misstatement of the financial statements

c.

No misstatement of the financial statements

d.

Revenue for the year ended June 30, 2026 is overstated by $40,000 & Cost of Sales is overstated by $24,000.

e.

Revenue for the year ended June 30, 2026 is overstated by $100,000 & Cost of Sales is overstated by $56,000 as revenue should not be booked upon shipment to the consignee.

f.

No misstatement of the financial statements

g.

No misstatement of the financial statements

h.

Revenue for the year ended June 30, 2026 is understated by $80,000 & Cost of Sales is understated by $55,000.

The journal entries to correct Sales Revenue and Costs of Goods Sold for the year ended June 30, 2026 are as follows.

Revenues Inventory

$60,000* Accounts Receivable Cost of Good Sold

$ 25,000**

$60,000 $ 25,000

*$40,000 + $100,000 - $80,000 **$24,000 + $56,000 - $55,000 LO 8, BT: E, Difficulty: Challenging, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., AC: Measurement, Analysis and Interpretation, PC: Decision Making

C11.4 Goodfellow and Perkins, LLP should probably segregate receivables into two groups; patients who arrive with insurance coverage, and patients who do not arrive with insurance coverage.

For patients who have insurance coverage, it is normal for the insurance company to make some sort of adjustment to the initial billing based on the hospital‘s agreement with the insurance company. If the auditor can get a table of procedures and standard adjustment, the auditor can use audit data analytics (ADA) to reconcile billings, with adjustments and subsequent cash receipts from the insurance company. Further, there

are often co-pays required by the patient, and once the auditor has determined the amount owed by the patient, the auditor can reconcile this amount to subsequent payments from patients.

For patients who do not have insurance coverage, the auditor can directly validate revenue with subsequent cash receipts.

LO 8, BT: E, Difficulty: Challenging, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., AC: Technology and Tools PC: Decision Making

Cloud 9 Question 1: 2.The following table summarizes the issues raised by confirmations and audit conclusions:

Issues Raised Customer No. 00030 disputed the price on stock number 11205, which was priced at $75 per item and should have been priced at $60 per item on 1200 items. Cloud 9 issued a credit memo for $18,000 on January 7, 2026. The book value of the receivable for Customer No. 00030 at December 31, 2022 was $130,500.

Audit Conclusion Due to the accuracy problem, accounts receivable and revenues were overstated by $18,000 as of the confirmation date. Even though a credit memo was issued to the customer, the balance was incorrect as of the confirmation date and this should be treated as a misstatement.

Misstatement (if Relevant) $18,000 overstatement of revenues and receivables.

Customer No. 00158 with a receivable As the goods were shipped FOB None. balance of $730,225 on December 31, shipping point and they were disputed receivables in the amount of shipped on December 31, booking $30,500, as a shipment of shoes was the revenue is appropriate and not received until January 2, 2026. there is no misstatement.

Further investigation showed that the customer ordered the goods on December 31, 2025, and they were not counted in inventory when the inventory was taken on that date. The freight carrier came by late in the day and picked up the goods, even though the warehouse was normally shut down for inventory on December 31, 2025. The goods were shipped FOB shipping point. The receivable was paid in full on January 29, 2026.

Customer No. 00651 disputed receivables in the amount of $250,750, as it had been paid on December 31, 2025. The check from Customer No. 00651 was received and deposited by Cloud 9 on January 3, 2026. The book value of the receivable for Customer No. 00651 at December 31, 2025 was $250,750.

This is a normal cutoff issue asso- None. ciated with the time between the customer issuing a check and the client receiving the check. There is no misstatement.

Customer No. 00850 disputed the balance on the confirmation of $35,700 in its entirety. Further investigation showed that the balance was charged to the wrong customer.

Goods were shipped to Customer No. 00580. On January 3, 2026 the error was discovered. A credit memo was issued to Customer No. 00850 and an invoice was sent Customer No. 00850, which was paid in full on January 27, 2026.

This is a classification error. However, total revenues and receivables are not misstated as a result of billing the wrong customer.

None.

No response was received from Customer No. 10141. Goods in the amount of $944,232 were shipped on November 1, 2025. Additional goods in the amount of $131,824 were shipped on December 12, 2025. The receivable balance was $1,076,056 at December 31, 2025. A review of the cash receipts journal showed that a check for $944,232 was deposited on January 24, 2026. Another check for $131,824 was received on February 1, 2026.

Subsequent cash receipt from the customer validated the existence of accounts receivable as of the end of November.

None.

Customer No. 21287 disputed receivables in the amount of $755 claiming that they did not receive a promised 1% discount associated with the first shipment to a new customer. The book value of the receivables for Customer No. 21287 at December 31, 2025 was $75,500. The customer subsequently paid $74,745 on January 29, 2026 and Cloud 9 subsequently issued a credit memo in the amount of $755.

The amount of accounts receivable at November 30, 2022 was overstated by $755 associated with a discount not given to the customer.

$755 overstatement of revenues and receivables.

LO 8, BT: E, Difficulty: Challenging, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management., AC: Technology and Tools PC: Decision Making

CHAPTER 12 Auditing the Purchasing and Payroll Processes Learning Objectives 1.

2.

3.

4.

5.

6.

7.

8.

Explain the nature of purchasing transactions and balances.

Evaluate audit planning information and its effect on the assessment of inherent risk in the purchasing process.

Evaluate control activities for purchase transactions.

Evaluate control activities for cash disbursement transactions.

Evaluate control activities in an electronic receipt settlement system.

Evaluate control activities for purchase adjustment transactions and purchasing process disclosures.

Determine how to design and perform tests of controls in the purchasing process and connect the results of control testing to audit strategy.

Determine which substantive procedures to perform in the purchasing process and how to evaluate their results.

Appendix 1.

2.

3.

4.

Explain the nature of payroll transactions and balances.

Evaluate audit planning information and its effect on the assessment of inherent risk in the payroll process.

Determine inherent risk for various assertions in the payroll process.

Determine how to design and perform tests of controls in the payroll process and connect the results of control testing to audit strategy.

5.

Determine which substantive procedures to perform in the payroll process and how to evaluate their results.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. C LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

2. B LO 2, BT: AN, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

3. A

LO 2, BT: AP, Difficulty Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

4. C

LO 2, BT: AN, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

5. D LO 3, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

6. B LO 3, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

7. D LO 3, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

8. D LO 4, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

9. A LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

10. A LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

11. A LO 7, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

12. D LO 8, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

13. A LO 8, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

14. A LO 9*, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

15. B LO 10*, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

16. C LO 10*, BT: C, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

17. B LO 11*, BT: AN, Difficulty: Medium, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

18. D LO 12*, BT: AN, Difficulty: Medium, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

19. B LO 13*, BT: AN, Difficulty: Easy, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, PC; Decision Making

ANSWERS TO REVIEW QUESTIONS R12.1 An entity’s purchasing process consists of activities related to the acquisition of, and payment for, goods and services. The core purchases transactions are a. purchasing goods and services (purchase transactions), purchases and accounts payable should be recorded up receipt of goods, b. making payments (cash disbursement transactions) such that if discounts are taken for early payment, purchase discounts are recorded when recording the cash disbursement, and c. making purchase adjustments when defective goods are returned to the vendor by debiting accounts payable and crediting purchase returns and allowances.

LO 1, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

R12.2 Hotels make purchases of food for restaurants, as well as linens and other supplies. Purchases of products are less material in the hotel industry, and purchases of supplies may be even less significant to their operations and moderately material to the entity.

The oil and gas field machinery equipment manufacturing industry produces products such as drill bits, drilling pipes and motors, derricks, valves, portable rigs, wellmonitoring instruments, tubing, wellheads, blowout preventers, and oil and gas separators. The purchase of raw materials is material and critical to these companies. Manufacturers may have a wide range and large number of suppliers of various raw materials and parts, which heightens the attention to internal controls over vendors.

LO 2, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management; BC: Strategic Perspective

R12.3 The auditor should consider pervasive factors influencing the understatement or overstatement of payables and expenses in assessing inherent risks in the purchasing process. These include:  the pressure to understate expenses and liabilities in order to report achieving announced profitability targets or industry norms that were not achieved in reality, and  the pressure to understate payables in order to report a higher level of working capital when the entity is experiencing liquidity problems or going-concern doubts. Both of these factors lead to a greater risk of understatement of expenditures and payables.

LO 2, BT: AN, Difficulty: Easy, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.4 The transaction flow in a typical process for a client purchasing goods includes approving purchases, receiving goods, and recording purchases and accounts payable and finally cash disbursement to vendor.

In the authorization process, the company initiates a purchase order, checking the vendor master file for an approved vendor.

When goods arrive, a receiving report is prepared. An independent stores or warehouse function should be responsible for safeguarding inventory until it is used in production.

When a vendor’s invoice is received, it should be matched to the purchase order and receiving report. A voucher should then be prepared to record the transaction in the purchases journal, and the accounts payable subsidiary ledger. The purchases journal should then be posted to the general ledger.

When the payment is due, a cash disbursement is requested and sent (after amounts and payment terms are compared) and recorded in the cash disbursements journal, and accounts payable subsidiary ledger. The cash disbursements journal should then be posted to the general ledger.

LO 3, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.5 Reliance should be on IT application controls to flag potential misstatements.

When identifying the occurrence of cash disbursements, the software compares the check (EFT) information with a purchase order, receiving, and voucher information.

Once the voucher (and related vendor’s invoice) is paid, it is cancelled to ensure that it cannot be paid twice.

LO 4, BT: C, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.6 The key to good internal controls overpaying fictitious vendors is good controls over the vendor master file. Only limited individuals should be able to update the vendor master file, and management should review all changes to the master vendor file.

The voucher, an internal document indicating the vendor, the amount due, and payment terms for the purchases should be checked against the vendor master file to ensure only vendors receive authorization for payment for goods. This control also relies on strong manual follow-up procedures of exceptions noted.

LO 4, BT: C, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.7 In an ERS system, the purchaser and supplier agree to exchange data about a transaction electronically and use an ERS process for paying purchases. Once the contract is agreed upon, the purchasing company initiates a purchase order, which is sent electronically to the vendor. The supplier normally acknowledges the transactions by sending an advance shipping order (ASN) indicating the goods to be shipped, prices, and other information. Upon shipment, the vendor will create normal shipping documents (bill of lading and packing slip).

Upon the receipt of goods, the purchaser should create a prenumbered, electronic receiving report. The goods received per the receiving report should then be matched electronically to the purchase order. Once the quantity received of each item is known, the purchaser has sufficient information to book a liability, and then an entry should be made to the purchases journal to record the purchase and accounts payable. When a vendor’s invoice is presented electronically, it is matched to determine that the purchase order, receiving report, and vendor’s invoice agree. A liability is created when goods are received, and the purchase is paid based on contractual terms.

LO 5, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.8 On occasion, goods received from vendors are defective and must be returned.

Each of these transactions results in reducing payables and expenses, improving reported liquidity and earnings. All purchase returns should be authorized by the vendor and returned only with a proper purchase return authorization. An independent count of goods returned should be recorded on shipping documents and the software should match the debit memo information with the authorization for the purchase return and shipping documents, and the computer should generate a report of any discrepancies, which is followed-up upon manually on a timely basis.

LO 6, BT: C, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.9 A strong internal control that would help prevent payments to fictitious vendors would be having strong controls over changes to the master vendor file and having an independent and knowledgeable individual review all additions to the master vendor file, LO 7, BT: C, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.10 An important audit test is a search for unrecorded liabilities. If a liability is not recorded at year-end, it is usually paid shortly after year-end. Hence, the auditor will examine a sample of cash disbursements after year-end (or after an interim cutoff date) to determine if they were recorded as liabilities at year-end, if the company received the good or service prior to year-end (or an interim cutoff date). This test is often effective at finding disbursements for transactions that were not recorded as liabilities at year-end.

LO 8, BT: C, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.11 In many companies, payroll is recorded when paid, and payroll taxes are accrued at the same time. If the pay period does not coincide with the end of month, end of the quarter, or end of the fiscal year, accruals should be made for payroll payable.

When payroll payments are to be made on Friday, the debits are normally to payroll expense, and credits are posted for the amount of withholdings payable, and cash paid to the employee. The company may have an imprest payroll bank account (transactions go through a separate bank account) and the exact amount necessary to clear net payroll transactions is transferred into the account. Payroll disbursements are made and the book balance in the account is zero. (Note: the bank balance may be positive in the amount of any outstanding checks).

LO 9*, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.12 The payroll process for a manufacturer of gas and oil field equipment personnel will likely be an important part of the manufacturing process, and payroll expenses will be capitalized as part of the cost of inventory through direct and indirect labor costs. There may be a moderate turnover of employees so controls over changes to the master payroll file are important. The risk of material misstatement is related to both the amount of transactions and the frequency of changing payroll information.

Payroll is extremely material to a university, as it is often 70% - 85% of expenses. The inherent risk is related to the volume of the transactions, before considering internal controls. There is less turnover of employees at a university than there is for a manufacturer of gas and oil field equipment. The primary turnover is related to part time faculty, and some hourly employees. In addition, because of the stability of employee expenses, payroll expenses at a university may be relatively predictable.

LO 10*, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.13 Payroll expenses are more likely to be overstated than understated as employee are likely to complain if they are not paid, or paid the wrong amount. Overstatements may result from using incorrect amounts, or incorrect hours for hourly employees (both relate to the accuracy assertion).

In addition, payroll fraud (occurrence of payroll expense) is a major concern for an auditor. Fraud may occur at two levels.

1. First, employees involved in preparing and paying the payroll may process data for fictitious employees and then divert the payroll payments for their own use. When there is frequent turnover of personnel in a company, there is the risk that a terminated employee might remain on the payroll.

2. Second, there is a risk that management may overtly misclassify or ―pad‖ labor costs in government contract work to defraud the agency.

Finally, if pay periods do not align well with month-end, quarter-end, or year-end, then there is a risk of cutoff problems associated with failure to accurately accrue unpaid payroll (cutoff, completeness and accuracy assertions).

LO 10*, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.14 The transaction flow ina typical payroll process focuses on approving payroll, employee working hours, and paying payroll. Common documents and files found in the payroll process include: Hiring Employees.  Hiring of employees is usually done in the human resources (HR) department. All hiring should be documented on an HR authorization form. The HR form should list the job classification, starting wage rate, and authorized payroll deductions.  Authorized individuals in the personnel department can gain access to the personnel data master file by entering a password before entering data on new hires.  A regular computer-generated log of all changes to the master file should be printed and independently checked by a HR manager not involved in entering data into the computer.  Controls over adding new hires to the HR data master file reduce the risk of payroll payments to fictitious employees. Thus, they relate to the occurrence assertion for payroll transactions.  Payroll authorization —  Approved payroll master file — This computer file contains pertinent information on employees that have been approved for payroll payments.  The output of the payroll program should consist of valid payroll transactions and an exceptions and control report that is sent to data control.  Data control compares the control totals and batch totals, informs the payroll department of exceptions discovered by the edit routine and follows up to see that corrected data is processed.  These controls over the payroll processing relate to the occurrence, completeness, accuracy, and classification assertions. The data associated with valid payroll transactions and the employee master file are used to calculate payroll and prepare the payroll register and payroll disbursements  Recording Document  Most large companies use an imprest payroll bank account as an important control overpaying payroll.  As the gross pay, deductions, and net pay are calculated for each employee, the payroll program updates the employee earnings master file for year-to-date payroll transactions and accumulates totals for entries in the payroll journal.  Payroll disbursement, EFT, or paycheck — An internal document indicating the employee, gross payroll, payroll deductions, and net payroll paid.  Payroll journal — This is the journal of original entry where each payroll paid is recorded and then posted to the General Ledger.



Additional controls include controls over month-end journal entries to accrue payroll.

LO 11*, BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.15 The primary control over preventing or detecting and correcting payments to fictitious employees is sound controls over the payroll master file. Only a limited number of individuals can change the payroll master file. All file changes are reviewed by appropriate levels of management. The payroll master file is also reviewed to remove employees no longer working for the organization. Each payroll transaction is then matched with the payroll master file. The IT control should match payroll disbursement to electronic evidence of hours worked.

LO 11*, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.16 An IT control should compare the wage rate being paid to the master payroll file, and any discrepancies should be set aside for manual follow-up.

An auditor would test the IT control with test data and attempt to process a transaction with the incorrect wage rate. The auditor would test manual follow-up procedures by reviewing documentation of exceptions notes and follow-up performed, and then reperform the manual follow-up procedures on a sample basis.

LO11*,12*, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R12.17 The use of ADA as a substantive procedure depends on the quality of the client’s data. The amount of gross payroll expense and the classification of payroll expense may be easily validated to a master payroll file (assuming strong controls over the master payroll file). The ability to use ADA to test the payroll for hourly employees depends on how information about hours worked is captured in electronic form. If reliable information about hours worked is captured in electronic form, the auditor can have the computer validate hours paid for the entire population of hourly workers. ADA could also be used to test completeness by ensuring that all hours worked resulted in payments to employees. Further gross payroll and payroll deductions can be validated with information obtained from the master payroll file. In essence, with sound electronic information, the computer can compare information the same way as an auditor would substantively vouch transactions to underlying documents. The primary assertions involved would be the completeness, occurrence, accuracy, and classification of payroll transactions.

In these examples, ADA is used as a substantive procedure. Any discrepancies noted should be investigated, the same way an auditor would investigate discrepancies noted when performing a substantive procedure.

LO 13*, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

SOLUTIONS TO ANALYSIS PROBLEMS AP 12.1  6  3  8  1  2  5  7  4 LO 1,3, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.2 Purchases and accounts payable are material transactions for an independent grocer. An independent grocer probably does not purchase directly from manufacturers but does buy from wholesalers, and therefore will likely not have a significant investment in the supply chain the way a major grocery chain will, but an independent grocer will have a network of vendors that supply goods. The auditor will need to understand these vendor relations and how goods are ordered and priced. Significant inherent risks associated with an independent grocer include:  Concerns about accounting for advertising allowances and other price concessions to stock merchandise on grocery shelves,  Concerns about purchases cutoff at month-end and  Concerns about potential unrecorded liabilities.  Knowledge of these issues helps the auditor assess inherent risk, determine if controls are present for material inherent risk, assess the risk of material misstatement, and develop audit strategy. LO 2, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.3  The following table provides the solutions to the quantitative requirements of AP 12.2. Formula

Year 5

Year 4

Year 3

Year 2

Unaudited

Audited

Audited

Audited

$ 935,000

Purchases

Cost of Goods Sold + Ending Inv. – Beginning Inv.

$1,715,00 $1,295,00 $1,105,00 0 0 0

Accounts Payable Turnover in days

(Avg. Acct. Pay) ÷ Cost of Goods Sold x 365

24.3 days

29.7 days

Cost of Goods Sold to Accounts Payable

Cost of Goods Sold ÷ Avg. Accounts Payable

14.5

11.6

11.2

11.0

Current Ratio

Current Assets ÷ Current Liabilities

2.48

2.20

2.16

1.97

30.1 days 30.3 days

Calculations can be found in an MS Excel Spreadsheet AP12_2.xls  The decrease in Account Payable turnover in days and the increases in the ratio of Costs of Goods Sold to Accounts Payable and the Current Ratio indicate a potential for unrecorded liabilities and the understatement of Accounts Payable. As a result, the audit team needs to pay significant attention to the completeness assertion for Accounts Payable. Given the results of analytical procedures, the audit team should consider a primarily substantive approach emphasizing tests of details when performing a search for unrecorded liabilities. LO 2, BT: E, Difficulty: Moderate, TOT: 25 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.4 Consistent / Inconsistent

Strengthens or Weakeness

1. Consistent

This strengthens internal control, as the stores department should be responsible for initiating and authorizing purchases.

2. Consistent

Purchase orders should be prenumbered and accounted for, and IT application controls can accomplish this task.

3. Inconsistent

Receiving should only know the items ordered, and not quantities ordered. This weakens controls as the receiving department might over rely on quantities ordered and not make an independent count of items received.

4. Inconsistent

This weakens controls as receiving does not indicate the items received or the quantity received.

5. Consistent

These are strong IT application controls over the recording of accounts payable.

6. Consistent

Again, this is an IT application controls over the accuracy of the vendor‘s invoice, which supports the recording of accounts payable.

7. Inconsistent

This weakens controls as a voucher should be prepared to record the accounts payable, long before a disbursement is requested.

8. Inconsistent

Accounts payable can keep supporting documentation. However, the weakness is that the voucher should be used to record an accounts payable, not a disbursement.

9. Inconsistent

This weakens controls as the disbursement process should be independent of accounts payable. Accounts payable should not be responsible for the cash disbursement process.

LO 4, BT: E, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.5 a.2 b.6 c.5 d.1 e.3 f.4 g.8 h.7 LO 3, BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.6 a. The accounts payable audit procedures should be directed toward searching for proper inclusion of all Accounts Payable and ascertaining that recorded amounts are reasonably stated because the primary audit purpose is to reveal any possible material understatements.

The principal assertions for Accounts Payable are: i.

Accounts Payable includes all amounts owed by the entity to suppliers of goods and services at the balance sheet date (the completeness assertion). ii. Recorded Accounts Payable represent amounts owed by the entity at the balance sheet date (the existence assertion). iii. Accounts Payable are obligations of the entity at the balance sheet date (the rights and obligations assertion). iv. Accounts Payable are stated at the correct amount owed (the valuation or allocation assertions). b.

i. ii. iii. iv. c.

Mincin is not required to use Accounts Payable confirmation procedures. For Accounts Payable, the auditor can examine external evidence such as vendor invoices and vendor statements, which substantiate the accounts payable balance. Although not required, the Accounts Payable confirmation is sometimes used. The auditor might consider such use when: Internal controls are weak (detection risk is low).

The company is in a "tight" cash position and bill paying is slow, Vendor accounts include unusual transactions.

The company has incentives to understate accounts payable (e.g., concerns over current ratio levels and working capital levels).

The auditor must consider confirming accounts with small or zero balances in order to adequately test for understatements. A selection technique using the large dollar balances of accounts is generally used when the primary audit objective is to test for overstatements (e.g., Accounts Receivable). Accounts with zero balances or relatively small balances would not be subjected to selection under such an approach. When auditing Accounts Payable, the auditor is primarily concerned with the possibility of unrecorded payables or understatement of recorded payables.

Selection of vendor accounts with relatively small or no balances for confirmation is the more efficient testing since understatements are more likely to be detected when examining such accounts.

When selecting accounts payable for confirmation, the following procedures could be followed:

i.

Use a sampling technique that selects items based on criteria other than the dollar amount of the item (e.g., select based on terminal digits, select every nth item based on a predetermined interval, etc.),

ii. iii. iv. v. vi.

Design a statistical sampling plan that will place more emphasis on selecting accounts with zero balances or relatively small balances, particularly when the client has had substantial transactions with such vendors during the year, Select prior-year vendors who are no longer used, Select new vendors used in the subsequent period, Select vendors that do not provide periodic statements, and Select accounts reflecting unusual transactions during the year.

LO 8, BT: AN, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.7 i.

The fact that the client made a journal entry to record vendors' invoices which were received late should simplify the CPA's test for unrecorded liabilities and reduce the possibility of a need for a further adjustment, but the CPA's test is nevertheless required. A client with a good system of internal control would normally be expected to make necessary adjustments to their books, so the CPA may examine financial statements the client believes are complete and correct. If the client has not journalized late invoices, the CPA should extend testing for unrecorded liabilities. In this situation, the CPA should test entries in the 2026 voucher register to ascertain that all items according to the date of receiving reports or vendors' invoices that were applicable to 2025 have been included in the journal entry recorded by the client. ii.

No. The CPA should obtain a letter in which responsible executives of the client's organization represent that to the best of their knowledge that all liabilities have been recognized. However, such a representation letter (see Chapter 14) does not relieve the CPA of the responsibility for making his or her own tests. iii.

Whenever a CPA is justified in relying on work done by an internal auditor, he would normally curtail (but not eliminate) his own audit work. In this case, the CPA should have ascertained early in his examination whether Ozine's internal auditor is qualified by being both technically competent and reasonably independent. Once satisfied as to these points, the CPA should discuss the nature and scope of the internal audit program with the internal auditor and review his working papers in order to properly coordinate his own program with that of the internal auditor. If the Ozine internal auditor is qualified and has made tests for unrecorded liabilities, the CPA may limit his work to reviewing the work of the internal auditor and making limited tests in this audit area.

iv.

Work done by an auditor for a federal agency will normally have no effect on the scope of the CPA's audit, since the concern of government auditors is usually limited to matters that are unrelated to the financial statements. Nevertheless, the CPA might discuss the government auditor's work program with the auditor, as there are isolated situations where specific procedures followed to a satisfactory conclusion by a government auditor will furnish the CPA with added assurance and therefore permit him to curtail certain work in a particular area. However, government auditors are usually interested in substantiating as valid and allowable those costs that a company has allocated against specific government contracts or sales to the government, and consequently there is little likelihood that the auditor for a federal agency at Ozine would check for unrecorded liabilities. v.

In addition to the 2026 voucher register, the CPA should consider the following sources for possible unrecorded liabilities: a. Unentered vendors' invoice file, b. Status of tax returns for prior years still open, c. Discussions with employees, d. Representations from management, e. Examination of individual accounts during the audit, f.

Existing contracts and agreements, g. Minutes of board of directors or audit committee meetings, h. Attorney's bills and letter of representation, i.

Status of renegotiable business, j.

Correspondence with principal suppliers and k. Audit testing of cutoff date for reciprocal accounts, e.g., inventory and fixed assets.

LO 8, BT: AN, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.8 Taylor should perform the following additional substantive procedures:

i. ii.

Foot the client-prepared schedule, Tie the general ledger Accounts Payable control account to the client-prepared Accounts Payable schedule, iii. Examine vendors' statements in support of items on the client-prepared schedule, iv. Examine other documents (such as approved vouchers) in support of items on the client prepared schedule, v. Review the general ledger control account for noncash debits or unusual items and investigate them, vi. Confirm, with positive confirmation requests, account balances from vendors with account balances and vendors with zero account balances, vii. Examine unpaid invoices on hand (to ascertain whether any were erroneously omitted from the client-prepared schedule of Accounts Payable), viii. Examine documents in support of invoices paid subsequent to the year-end (to ascertain whether the payable was recorded in the appropriate year),

ix. x. xi. xii. xiii. xiv. xv.

Inspect receiving reports (to test the accuracy of the year-end cutoff), Review correspondence files with respect to disputed items, Review open purchase orders for unusual or old items that may have been received but not recorded, Examine unmatched receiving reports, Determine if there are any payables with debit balances and reclassify such balances as accounts receivable, Make certain that the client representation letter includes the proper assertions concerning Accounts Payable, and Investigate and resolve confirmation exceptions and other matters requiring follow-up.

LO 8, BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.9 TruServ is a hardware store buying cooperative. On March 31, 2000, TruServ reported a loss of more than $131 million for the fiscal year 1999, which included expenses it failed to report during fiscal years 1997 and 1998. The misstatements in TruServ’s financial statements came to light when the entity’s accounting staff was closing its books for fiscal year 1999. The largest component of the previously unreported loss represented increases in cost of sales and accounts payable in the amount of $74.5 million.

A significant component of the problem represented a year-end accrual for unbilled merchandise. TruServ routinely made an accrual for merchandise it had received but for which it had not yet been billed. TruServ estimated the amount of the accrual for merchandise payable by using a report called the ‘open receiver file.‖ However, the “open receiver file‖ was not accurate. Distribution center and warehouse employees were not keeping accurate records of the merchandise that was received. As a result, accounts payable was understated by approximately $36.9 million. Further, because inventory was based on a physical count, cost of goods sold was also understated, resulting in an overstatement of net income.

In addition, TruServ claimed approximately $20 million in reductions in accounts payable related to claims for returned merchandise and allowances. If merchandise returned from a member could not be resold due to damage, or some other reason, the merchandise should have been removed from inventory and charged to cost of goods sold by way of journal entry. Instead, TruServ removed the merchandise from inventory and reduced the amount of its merchandise payable by the same amount. However, it never received authorization to return merchandise to its vendors. As a result, accounts payable and cost of goods sold were understated, overstating net income.

Finally, in 1999 TruServ wrote off approximately $16.6 million in inventory adjustments for lost inventory, damaged goods, and the closing of distribution centers. TruServ should have reduced inventory and increased cost of goods sold. However, warehouse

personnel did not correctly use inventory adjustment codes. As a result, TruServ wrote off the inventory and reduced its accounts payable by the same amount.

Two key procedures might have uncovered the problem with accounts payable. First, a search for unrecorded liabilities by looking payments to vendors after year end should have surfaced that accounts payable was understated. Second, the understatement in accounts payable could also have been found by reconciling vendor statements with the accounts payable subsidiary ledger.

LO 8, BT: E, Difficulty: Challenging, TOT: 40 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, Research

AP12.10 Young Computers, Inc. Internal Control Questionnaire – Payroll Question    o o o o o      o o o o         

Are payroll changes (hires, separations, salary changes, overtime, bonuses, promotions, etc.) properly authorized and approved?

Are discretionary payroll deductions and withholdings authorized in writing by employees the company hires?

Are the employees who perform each of the following payroll functions independent of the other functions?

Personnel and approval of payroll changes, Recording and approval of time worked Preparation of payroll data, Approval of payroll disbursements, Reconciliation of the payroll account.

Are changes in standard data on which payroll is based (hires, separations, salary changes, promotions, deduction and withholding changes, etc.) promptly input to the system to process the payroll?

Is access to personnel and payroll records, checks, completed forms, etc., limited and properly authorized?

Is gross pay determined by using authorized salary rates and time and work records?

Is there a suitable chart of accounts and/or established guidelines for determining salary account distribution and for recording payroll withholding liabilities?

Are there adequate IT application controls over: The completeness of payroll transactions?

The occurrence of payroll transactions?

The accuracy of payroll transactions?

The proper classification of payroll transactions?

Is there independent follow-up of transactions flagged by IT application controls?

Are there adequate controls over the proper cutoff of payroll at period end?

Are payrolls approved by a responsible official before payroll is disbursed?

Are payrolls disbursed through an imprest account?

Is the payroll bank account reconciled monthly to the general ledger?

Are payroll bank reconciliations properly approved and differences promptly followed-up in a timely manner?

Is the custody and follow-up of unclaimed salary checks assigned to a responsible official (if applicable)?

Are differences reported by employees followed up on a timely basis by persons not involved in payroll preparation?

Are there procedures to assure proper and timely payment of withholdings

Yes No

to appropriate bodies and to file required information returns?

LO 9,11*, BT: AN, Difficulty: Moderate, TOT: 25 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.11 a. Significant deficiency or material weakness

b. Recommended improvement

It is possible that the bookkeeper might write an unauthorized check and it might not be caught by the cursory scan of checks when the owner signs the checks on Fridays.

Beach Land Construction should consider implementing various IT application controls. The owner should be responsible for updating a payroll master file, and payroll checks could not be written to any employee who is not on the payroll master file.

It is possible that the bookkeeper could write a check for more hours than are actually worked and this would not be picked up by the cursory scan of checks when the owner signs the checks on Fridays.

Beach Land Construction should consider implementing various IT application controls. The owner can enter hours worked and evaluate the reasonableness of hours worked when information is obtained from the job foreman. Alternatively, electronic timecard devices can be set up on each job site and each employee must log in and log out to capture hours worked. Any differences between hours captured electronically and hours paid are reported to the owner.

It is possible that the bookkeeper could write a check for incorrect amounts as there is not checks on the hours worked, wage rates, or mathematical accuracy of checks written.

Beach Land Construction should consider implementing various IT application controls. The owner should be responsible for updating a payroll master file including wage rates and employee deductions. The mathematical accuracy of payroll should be checked by the computer with exceptions reported to the owner.

There is no control over the classification of expenses to various jobs. Employees could work on multiple jobs in one week, and there is no control over the classification of wages expense to various construction projects.

When time is captured, it should contain job classifications. Each week, the owner should perform a performance review to analyze charges to each job for appropriateness of wages charged to each job.

There are no controls over month end cutoff, if the end of the month is on a day other than Friday.

At month-end, the bookkeeper should write an adjusting journal entry to accrue wages payable, which is then reviewed by the owner. The journal entry can be reversed at the beginning of the next month.

LO 9,11*, BT: E, Difficulty: Moderate, TOT: 40 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP12.12 a. Possible Misstatement

b. Possible Test of Controls

1.

Fictitious payroll transactions may be recorded.

Examine authorizations and reperform the control on a sample basis.

2.

Fictitious payroll transactions may be recorded.

Examine evidence of supporting documentation and reperform the control on a sample basis.

3.

Actual payroll transactions may not be authorized.

Examine supervisor authorizations and approvals and reperform the control on a sample basis.

4.

Payroll may be distributed to unauthorized recipients.

Examine authorizations and approvals and reperform the control on a sample basis.

5.

Payroll checks may be incorrect or incorrectly recorded.

Test IT application controls with test data, examine evidence of manual follow-up and reperform manual follow-up on a sample basis.

6.

Unauthorized changes may be made to Test access controls to master payroll files. master files.

Select a sample of reports of master file changes and reperform review of changes to master file.

7.

Actual payroll transactions may not be authorized.

Examine authorizations and approvals and reperform the control on a sample basis.

8.

Payroll tax returns may not be filed or filed inaccurately.

Examine review and approvals of payroll tax returns and reperform the control on a sample basis.

LO 12*, BT: AN, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

SOLUTIONS TO AUDIT DECISION CASES C12.1 This case allows the professor to explore the challenges of auditing privately held companies. While privately held companies do not receive the same attention of public companies, they represent a significant portion of audits performed by CPAs. This case allows students to explore the control environment issues associated with ownermanager companies, typical challenges associated with segregation of duties, and the challenges associated with the implementation of electronic data interchange (EDI) in the owner-managed company environment. Finally, this case also explores issues associated with the potential for misappropriation of assets that is increasingly common in owner-managed companies.

C12.1a: Control Environment Issues The control environment at CIRI is representative of the control environment in a number of owner-managed businesses. The following issues all represent control environment weaknesses. i.

Les Browning owns a majority of the business and is focused on growing sales and profits. Les has focused attention on customer relations and on growing revenues in the lumber brokerage business. His emphasis on marketing and operations has resulted in neglecting accountability and financial reporting. ii. Les Browning has delegated oversight of accounting issues and internal controls to his controller, who is not a CPA, and Les is price-conscious about salaries and costs of overhead such as accounting. iii. Tangible evidence of the lack of attention paid to the accounting system is that Les is satisfied with having a balance sheet and income statement on a monthly basis with a lag time of 15-20 days after month-end (Note that management uses neither cash flow projections nor a statement of cash flows on a regular basis). iv. Further evidence of the lack of a strong control environment is the fact that the company has not developed budgets and accountability at the store level for financial results is informal. Senior management’s philosophy and operating style has focused on the top line and had not attended to the details of day-to-day expenditures. v. Les Browning has delegated responsibility for the accounting system to Craig Ferris, but there is no significant accountability for results in place. Craig Ferris has delegated the implementation of the EDI system to Dennis Brewer, again with no formal accountability for implementation.

This is also a good time to discuss the implications of a weak control environment on audit strategy. Even if control activities were present, there is a reduced likelihood that controls will be operating effectively. Hence, the auditor will follow a substantive approach for all significant assertions in material account balances and transaction classes.

C12.1b.1: Risk Assessment Fraud Risk Factors Assertion

Incentives / Pressures

Opportunity

Attitude & Rationalization

Control Activities

Possible Misstatements

occurrence of purchases and existence of payables

Dennis Brewer is seeking advancement, status, and the increased compensation that would come with promotion. In addition, he has some financial pressures from having children in private schools.

Dennis Brewer has full access to the system; he can initiate purchases, direct drop shipments to delivery locations, record payables, and initiate payments.

Dennis Brewer is frustrated with the failure to receive a pay increase or promotion based on his efforts. He further believes that he is not earning what he deserves, and he feels that management has no been forthcoming with rewards.

Control activities do not exist due to poor segregation of duties and Dennis Brewer‘s system access.

There is a high risk of inventory shrinkage, particularly with respect to dropshipments. Dennis Brewer controls the ability to order goods, direct drop shipments to delivery locations, record receipt of goods, and initiate payments.

C12.1b.2 A number of reportable conditions exist. i.

First, there is inadequate segregation of duties. In addition to the obvious problem with Dennis Brewer being in a position to initiate a drop shipment, create a receiving, and record the transaction, there is only one warehouse clerk at each store responsible for receiving and shipping. This creates an additional problem where there is no significant owner-manager oversight. ii. Second, there are no budgets. Les Browning and Craig Ferris only informally review the performance of store managers. This creates a situation with little accountability for managers at each store, or for the organization as a whole. If there is little accountability, there is no significant incentive to expect accurate accounting numbers, as they are not used in any significant way in managing the company. iii. Third, the normal controls over IT implementation did not exist. Normally new system design should include user involvement in the design, system testing, and user sign off at the end. The case makes no discussion of any systems testing, and it implies that responsibility for implementing the new EDI system has been delegated to Dennis Brewer with virtually no oversight. iv. Fourth, the problem associated with the poor segregation of duties in the new system is made worse by the prior year comments and continuing problems associat-

v.

ed with adding new customers (or new delivery locations) to the master customer file. As noted above, Dennis Brewer is in a position to have shipments directed to himself.

Fifth, it is worth emphasizing the importance of discussion of the control weaknesses and communication among the audit team. It is entirely possible that similar risks exist in other cycles. Also, the entire audit team needs to be alert to comments heard in the field, such as some of the comments made by Dennis Brewer that provide insights into incentives, motivations, and an attitude that would rationalize behavior. The entire audit team needs to be alert for all aspects of the audit, not just the particular areas assigned to a team member.

C12.1.c Internal Control Recommendations Date To the Board of Directors Construction Industry Resources, Inc. In planning and performing our audit of the financial statements of Construction Industry Resources, Inc. (the Company) as of and for the year ended December 31, 2025, in accordance with auditing standards generally accepted in the United States of America, we considered the Company’s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the Company’s internal control.

Accordingly, we do not express an opinion on the effectiveness of the Company’s internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. However, as discussed below, we identified certain deficiencies in internal control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected, on a timely basis. We consider the following deficiencies in the Company’s internal control to be a material weakness.

Segregation of Duties in the Purchasing Function Dennis Brewer currently has electronic access to all phases of purchasing transactions in the EDI purchasing system with Contractors Wholesale Supply. Hence, Mr. Brewer is in a position to initiate a transaction, authorize receipt of the transaction, and record a payable that eventually will result in the payment of invoices to Contractors Wholesale Supply. This presents a risk that Mr. Brewer could possibly initiate a purchase, have it drop shipped to almost any location, record the receipt of goods, and process payment for the goods. Sound segregation of duties segregates the three major functions: (1) authorizing transactions, (2) having custody and responsibility for receipt of goods, and (3) having responsibility for recording transactions. Mr. Brewer’s access to the EDI purchasing system with Contractors Wholesale Supply should be limited to functions necessary to accurately record purchases.

Controls over IT implementation Dennis Brewer had complete responsibility for implementing the new EDI purchases system with Contractors Wholesale Supply. In order to minimize risks associated with unauthorized alteration of programs or data; system design and system testing should be carried out by individuals who have no day-to-day responsibilities in the system. Further, new systems implementation should involve a variety of individuals from each function that are affected by the program. In addition to Mr. Brewer, it would be normal to involve individuals who initiate purchases and individuals responsible for receiving goods in the testing phase of new systems implementation. Someone with senior IT responsibilities should be responsibility for reviewing and testing Mr. Brewer’s work. Only after representatives of each user function have approved the system should it be placed in operation. The involvement of user departments in system design greatly reduces the risk of programs not meeting the needs of user department and it provides checks and balances over the system design process.

Budgetary controls and accountability Currently Construction Industry Resources, Inc. does not have a budgetary process where budgets are developed for each operating unit and actual results reported by the accounting system are compared with actual. Construction Industry Resources, Inc. has grown to a sufficient size where budgets are cost effective. Developing a system where managers are accountable for reported results encourages a higher level of attention to the accuracy of results reported by the accounting system. We would recommend that Construction Industry Resources, Inc. establish budgets for each store and for the lumber brokerage business. Managers of each responsibility center should then be held accountable for the reasonableness of variations from planned performance. This will likely improve the operating efficiency of each business unit and it will have a secondary benefit of having management review the accuracy of output from the accounting system.

This communication is intended solely for the information and use of management and the Board of Directors of Construction Industry Resources, Incorporated, and it is not intended to be, and should not be, used by other than these specified parties.

We thank you for the opportunity to continue to be of service to you.

Signature.

LO1,2,3,5,6 BT: E, Difficulty: Challenging, TOT: 1 Hr., 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, Research

C12.2 C12.2.a: Analyzing the Results of Tests of Transactions. A number of issues are raised above.

The following notes address issues associated with internal controls and then issues raised by substantive procedures.

Internal Control Issues: 1. Exception reports are an important part of the audit trail. They are generated daily, and various transactions may appear on the exception reports. In this case they may have provided evidence of drop shipments that had billings from CWS with no matching receiving reports. Dennis could clear these exceptions and throw away the evidence. If all reports were maintained, and not just Wednesday’s and Thursday’s reports, then a true audit trail is available for the auditor.

Exceptions noted in substantive procedures: 2.

3.

4.

The first exception represents a potential valuation problem associated with a transposition error. CIRI ordered merchandise at one price ($167 per unit), yet it paid another price ($176 per unit). The difference for the transaction was $900 (100 units at $9 per unit). If the auditor assumes that other items in the strata contain a proportionate number of misstatements relative to the misstatements found in the sample, this results in projected misstatements in the strata of $50,694. The auditor then needs to determine if the $50,694 is sufficiently material to come forward to a possible adjustment summary to be aggregated with other possible misstatements. The auditor might consider whether to take an additional sample to ascertain the degree to which such misstatements appear in other transactions and then evaluate the results of a larger sample.

The second issue forces students to confront some of the realities of inventory counts in small businesses. In this case, goods are received during the inventory count. Eventually they are included in inventory, and they are also included in purchases. The purchases are recorded in the same period in which the goods were received so that the financial statements are presented fairly with respect to this transaction.

The issue associated with the one drop shipment that was not billed to a customer is very significant. The failure to bill customers is possibly evidence of inventory shrinkage, which could be a serious problem – particularly given the results of

analytical procedures. This may be a good place to discuss how students would look at an item that is individually immaterial. Auditors need to consider both quantitative and qualitative issues when they evaluate known audit problems.

Quantitatively, if this failure to bill a customer for the drop shipment is projected on the balance of the strata, the auditor’s estimate is that $308,997 of goods at cost have not been billed to customers. Assuming a prior year’s gross margin of 19.1%, this represents approximately $368,000 of lost revenues. Qualitatively this audit evidence is the tip of the iceberg and students need to recognize that this is sufficient evidence to ask the auditor to look at more drop shipments for similar problems. When the auditor considers this problem together with the risks associated with Dennis Brewer having unlimited access to the EDI system and the fact that he has incentives and the opportunity to order goods and have them shipped to himself, the qualitative aspects of this evidence demands that the auditor bring these issues to management and discuss the need to extend the scope of the audit. The auditor might want to consider using audit data analytics to match EDI shipments with customer billings in order to determine the scope of the problem.

Purchases

# of Trx.

n

BVn

AVn

Est. AV

$ 76,207

Proj. Misstatement

Drop Shipments

$ 5,756,077

35%

1,391

11

$ 80.530

30%

$5,447,080

$308,997

Shipments to Stores

$10,615,018

65%

1,737

19

$188,455

70% $263,762 $10,564,324

$ 50,694

Total EDI Purchases

$16,371,095 100%

3,128

30

$268,985

100%

$359,691

$16,011,404

C12.2.b Client Discussions.

An important part of auditing is discussing difficult issues with management. In this case, management has not fostered a strong control environment. The weak control environment has led to further problems associated with the possible misappropriation of assets. At this point, the auditor has two suspect transactions. The audit team may do further sampling to identify additional suspect transactions, but one of the issues that needs to be raised with management is the beginning of a fraud audit, which is substantially larger in scope than an audit in accordance with generally accepted auditing standards.

The auditor should raise issues with the owner, Les Browning and the controller, Craig Ferris. The auditor should also make it clear that these issues need to be discussed with other absentee owners, even though Les Browning owns 70% of the business. The auditor should come prepared with evidence from the audit and an estimate of the implications of that evidence. The auditor should also take the opportunity to make the point that implementing better controls might have prevented the potential losses experienced by the company (for example, controls monitoring inventory shrinkage). The cost of the control is likely less than the loss incurred by the company. Finally, the auditor should refer to issues raised in prior (and current) management letters that address the risks that allowed a trusted employee to steal a material amount of inventory by order-

ing goods through the EDI system, that are shipped to him at any possible location, and then have the Company pay for the goods.

Note to Instructor: Before beginning the discussion of Phase II, that addresses substantive tests of transactions, it might be useful to review the level of documentary evidence that is available to support audit procedures. In this case, virtually all evidence is in electronic form. In circumstances where internal controls are good, an audit team might include an EDP specialist to test controls. However, due to the lack of segregation of duties, the auditor might consider the use audit data analytics as a risk assessment procedure. Would the auditor want to compare electronic purchase orders with electronic invoices from CWS? For example, the auditor might want to determine who authorized transactions and develop an electronic file of transactions authorized by each individual with access to the system for further analysis. Also, how the auditor needs to consider how to validate the receipt of goods at stores or at drop shipment locations when the only record is in machine-readable form? For example, the auditor could use audit data analytics to match purchases, customer billings, and cash receipts for drop shipments.

LO1,2,3,5,6; BT: E, Difficulty: Challenging, TOT: 40min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, Research

C12.3 a. An evaluation of internal controls follows for purchases transaction assertions: Assertion

Internal Control Evaluation

Completeness

Weak: It is not clear that IT application controls ensure that every receiving report results in a voucher.

Occurrence

Strong: Details of the payable are matched with the underlying receiving report.

Accuracy

Strong: Details of the payable are matched both with the underlying receiving report and purchase order.

Classification

Weak: It is not clear that the IT application control compares account classification to information on the underlying purchase order.

Cutoff

Weak: It is not clear that IT application controls compare the date of receipt of goods with the accounting period in which the payable is recorded.

b. Tests of controls for internal control strengths are as follows: Assertion

Test of Controls

Occurrence

Submit test data to test the IT application control by submitting a voucher that is not supported by a receiving report.

Accuracy

Submit test data to test the IT application control by submitting a voucher in which quantities and prices on the voucher do not match the receiving report or the purchase order.

In each case, the auditor should test the manual follow-up procedures of the data control group by reviewing exception reports received by data control and reperforming the manual follow-up procedures. c. Recommended improvements for control weaknesses are as follows: Assertion

Recommended Improvements

Completeness

Develop an IT application control that compares every receiving report with a voucher and flags any receiving reports without a voucher.

Classification

Develop an IT application control that compares every account classification with the account classification on the purchase order and flags any discrepancies.

Cutoff

Develop an IT application control that compares the date on the voucher with the date on the receiving report and flag any transactions that are in different accounting periods.

LO 8, BT: E, Difficulty: Challenging, TOT: 40min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, Research

C12.4 Control Weaknesses

Recommendations

The change controls to the master file are not effective. One worker‘s wage rate was entered incorrectly ($21.75 per hour vs. $12.75 per hour). Another person was not paid because someone entered the bank account number incorrectly.

Changes in the master file need to be more carefully reviewed and compared to underlying source documents. Each time the master file is changed, a report should be run, and an independent individual should compare the changes to the underlying source documents. Further, an IT application control should flag payroll rate changes in excess of $3.55.

The final review by the controller also did not pick up one someone being paid too much. The auditor determined that a worker‘s gross wages should not exceed $1,300 per week but an individual was paid $1,531.80 one week.

The payroll program might also include some reasonableness tests. For example, payroll should not be processed for any amount of gross payroll in excess of $1,300 per week, or if an employee is about to be paid for more than 20 hours of overtime.

LO 11*, BT: E, Difficulty: Challenging, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, Research

Cloud 9 a.

Ratio

10/31/25

1/31/25

1/31/24

Accounts Payable Turn Days**

24.23

38.82

***

Cost of Goods Sold to AP**

15.07

10.79

9.94

Payables as a % of Total Assets

6.2%

9.2%

9.3

Current Ratio

2.46

2.21

1.84

Cost of Goods Sold Growth**

1.48%

7.05%

***

Inventory Growth

.60%

(1.51%)

***

(17.60%)

(1.43%)

***

10.70%

8.11%

10.36%

AP Growth Accrued Liabilities as a % of Total Assets

** For the 9 months ended 10/31/25 cost of goods sold, and purchases has been annualized for purposes of calculating the ratio *** Data not available to perform calculations Calculations are available in an MS Excel spreadsheet labeled Chapter_12_Cloud_9.xls b. Analysis and identification of alternatives i.

With the significant decrease in accounts payable, it is possible accounts payable may be understated. Normally the completeness assertion for accounts payable may be a significant inherent risk. In this case, the drop in AP turn days and the increase in the current ratio indicate a risk associated with the completeness of accounts payable. Inherent risk should be evaluated as high or maximum for the completeness of accounts payable. Given the increase in accrued liabilities, it is also possible that there is a classification misstatement between accounts payable and accrued liabilities. ii.

Inherent risk should be evaluated as high or maximum for the completeness of accounts payable. Inherent risk should also be evaluated as high or maximum associated with the classification assertion for both accounts payable and accrued liabilities.

c. i.   i.   d. i. ii.

iii.

iv.

Control risk Strong internal controls over the completeness of accounts payable would include: IT application controls print a report of all receiving reports that have not been recorded in the purchases journal. At month-end, a report is run of all receiving reports that have not been recorded as accounts payable. Tests of controls would include: Review reports generated on a daily basis and test manual follow-up by reperforming the control. Review reports generated at month-end and test manual follow-up by reperforming the control. Detection risk Detection risk for the completeness of accounts payable can be evaluated as high if tests of control show that internal controls are strong.

The auditor should perform a search for unrecorded liabilities by taking a sample of cash disbursements after year-end to ensure that they were properly recorded as accounts payable, if goods and services were received before year-end. The auditor might also consider confirming accounts payable, but the auditor should equally weight payables with small or zero balances and those vendors with large balances. Finally, the auditor might investigate the appropriate classification of accrued liabilities to make sure none are reported as accounts payable.

If tests of controls show that internal controls are strong and detection risk is high, the auditor can perform the tests described in ii above as of an interim date (November 30, 2025 or December 31, 2025), and then perform a roll-forward test to year-end.

The auditor can perform the tests described in ii above with smaller sample sizes given strong internal controls and a high detection risk.

CHAPTER 13 Auditing Cash and Inventory (And Related Income Statement Accounts) Learning Objectives 1.

2.

Evaluate how an auditor determines and executes an audit strategy for cash and cash equivalents.

Evaluate how an auditor determines and executes an audit strategy, including the use of ADA, for inventory and cost of goods sold.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. C LO 1, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

2. C LO 1, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

3. A LO 1, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

4. B LO 2, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

5. D LO 2, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

6. B LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management,

7. C LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management,

8. A

LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management,

ANSWERS TO REVIEW QUESTIONS

R13.1 During the control risk assessment phase, the auditor will test controls over cash receipts as part of testing the revenue process and internal controls over cash disbursements as a part of testing the purchases process. In addition, it is important for the auditor to understand and test the client‘s bank reconciliation procedures, which is an important internal control over cash.

If the internal controls are strong, an auditor can limit the substantive procedures for cash balances by focusing on confirming bank balances and reviewing year end bank reconciliations.

LO 1, BT: AN, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

R13.2 The processes impacting cash focus on transactions, cash receipts (part of the revenue process) and cash disbursement (part of the purchasing process). The auditor should perform both tests of transactions and tests of the cash balance during the audit.

If internal controls are strong over transactions, the auditor will limit tests of transactions. If the internal controls are weak, the auditor will need to perform more extensive substantive procedures on both cash transactions and cash balances.

LO 1, BT: AN, Difficulty: Moderate, TOT: 5 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R13.3 The standard bank confirmation normally confirms the following information:  the client‘s permission for the bank to respond to the auditor,  requests for all bank balances (per the client‘s bank reconciliation) including details of any accounts closed during the year,  requests of details of interest charges,  requests for details of any loans or lending facilities or bank overdrafts, together with the limits and if applicable dates of repayments and any collateral pledged as security for the loan,  requests for details of any assets held by the bank on the customer‘s behalf, and  requests for details of any contingent liability of which the bank may be aware.

The bank confirmation is particularly important to the auditor‘s testing the existence, completeness, and accuracy assertions. In addition, it provides information in support of disclosure assertions. LO 1, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R13.4 Understanding an entity‘s inventory is critical to determining audit procedures in an audit of the client‘s inventory. The auditor needs to be attuned to changes in an audit client and tailor the audit to the circumstances that the auditor finds.

Inventory may be immaterial for service industries and the audit of inventory is unlikely to be a significant part of the audit strategy of entities in service industries. However, inventory is a material asset for the manufacture of industry specific machinery and equipment which may be less subject to significant obsolescence risk, but in some economic environments when prices are down due to lower demand, growing inventories may be a concern. Some industries are subject to technological obsolescence (e.g., computer technology firms), and some are facing significant competition (e.g., laptops competition from phones and tablets).

Grocery stores are subject to perishable inventory that must be sold quickly and an environment where one product may be substituted easily for another product. The grocery industry is extremely competitive, margins are low and supply chain management is critical to a retailer‘s success.

LO 2, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, BC: Strategic Perspective.

R13.5

When client inventories are stored in public warehouses or with other outside custodians, the auditor should obtain evidence as to the existence of the inventory by direct communication or written confirmation with the independent custodian.

LO 2, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

R13.6 Using perpetual inventory, the quantity of inventory on hand is cycle counted, if the records are accurate. Using the periodic inventory method, the quantity of inventory is counted at period end.

For cycle counts, the client will frequently identify a small portion of items in the perpetual inventory, go to the inventory location, count the inventory and investigate and correct any discrepancies that are found.

The key condition is the client should rotate cycle counts through the entire inventory on a regular basis, that is to say, the same inventory should not be cycle counted each time. If there are discrepancies, the client should investigate the reasons for the underlying discrepancies to correct any discrepancies that are found.

LO 2, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

SOLUTIONS TO ANALYSIS PROBLEMS AP13.1 a. Internal controls related to cash balances should include:  Separate bank deposit books and checkbooks for each cash account,  Bank reconciliations for each bank account,  Segregation of duties – employees performing the bank reconciliation should be separate from employees with responsibility for authorizing cash transactions, having responsibility for custody of cash, or having responsibility for recording cash receipts or disbursements.  Accountability/reconciliation of numerical sequence of all forms (checks, deposits, vouchers),  Mail opening procedures (for any amounts received by mail) by two people, listing, reconciliation with bank deposits,  Supervision of customer ledger postings and  Specific procedures for dealing with trust accounts with additional authorization procedures.  Imprest bank accounts for payroll bank accounts b. Cash is a significant account balance for a property management company. Substantive procedures should include:  Sending bank confirmations of all bank accounts,  Testing bank reconciliations,  Confirm signatures on checks for correct authorization,

         

Testing cut-off for checks remitted to customers (reconcile with customer accounts), Compare transfers between cash accounts (especially, to ensure that withdrawals and deposits for account transfers are recognized in the client‘s accounting records on the same day), Correlate cash receipts and checks to movements in customer accounts, Compare paid checks and supporting documents with the cash payment ledger by confirming dates, payees, amounts, account classifications and cancelling of supporting documents, Compare entries in the cash payment ledger with paid checks and supporting documents to confirm dates, payees, amounts, account classifications and cancelling of supporting documents, Compare entries in the cash receipts ledger and supporting documents to tenant‘s accounts, Test calculations of commission before remittance of rental payments to landlord customer, Investigate for any unusual delays in remitting rental payments to landlord customers, Test mathematical accuracy of cash receipts, cash payments ledger, Test supervision reports for evidence of timely review, authorization and evidence of follow-up of differences.

LO 1. BT: AP Difficulty: Basic, TOT: 15 min., ., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP13.2 a.

Patricia Company Computation of Amount Stolen by Cashier November 30, 2025

Cash balance, per books November 30, 2025 Add: Credit by bank Adjusted cash balance (Cash plus bank credit) Less adjusted bank balance: Bank balance, November 30, 2025 Less outstanding checks: #62 $116.25 #182 150.00 #284 253.25 #8621 190.71 #8623 206.80 #8632 145.28 Cash which should be on hand Cash reported

$18,901.62 100.00 $19,001.62 $15,550.00

1,062.29

14,487.71 $ 4,513.91 3,794.41

Amount of theft b.

The cashier removed $719.50. The cashier attempted to conceal his theft by:

c.

Two controls lacking are:

  

 

$ 719.50

Not listing all outstanding checks, Under footing outstanding checks shown on the reconciliation and Subtracting an item from the bank balance that should be added to book balance.

Someone other than the cashier should trace cash receipts to deposits in the bank, Someone other than the cashier should be responsible for preparing the bank reconciliation.

LO 1. BT: E, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP13.3 The following table explains the auditing procedures that should be performed associated with the legend in the table below identified as a) through i): Legend Audit Procedure a) Agreed bank cutoff statement received directly from the bank. b) These items should be vouched to bank cutoff statement. Cash receipts journal shows deposit in December of 2025 and bank cutoff statements should show deposit per bank in January 2026. c) These items should be vouched to bank cutoff statement. The check should be dated prior to December 31, 2025 and the check cleared the bank in January 2026. d) Checks deposited without sufficient funds in the customer‘s account should be vouched to bank documentation accompanying the return of the customers check on December 29, 2025. e) Bank charges for December 2025 should be vouched to bank statement received in January 2026. f) Check number was recorded in error. This should be vouched to actual check that cleared the bank, bank statement, and cash disbursements journal. g) This should be vouched to remittance advice received from the bank regarding notification of collection of note payment plus interest from customer. h) Traced to general ledger at December 31, 2025.

LO 1. BT: AP, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP13.4 a. The purposes of auditing bank transfers are to (1) determine that bank balances are correctly stated at the balance sheet date and (2) to detect kiting. b. Bank Transfer Schedule

Ck No.

Bank Accounts From To

Amount

2476 2890 3140 A1006 A1245 3402

Regular Regular Regular Special Special Regular

$100,000 200,000 100,000 50,000 25,000 125,000

Payroll Payroll Special Payroll Regular Special

Disbursement Date Per Per Books Bank 6/23 6/30 6/25 7/2 6/28 7/5 6/29 7/6 6/30 7/7 7/1 7/5

Receipt Date Per Per Books Bank 6/25 6/25 6/27 6/27 6/30 6/30 7/1 7/1 7/2 7/2 6/30 6/30

c.

City Bank - Payroll Account

50,000

Bank Clearing (Due to Metro Bank - Special Account) 50,000

City Bank - Regular Account

25,000

Bank Clearing (Due from Metro Bank – Special Account)

125,000

Bank Clearing (Due to Metro Bank - Special Account)

25,000

City Bank – Regular Account 125,000

d.

(1) Outstanding checks: 2890, 3140, 3402, A1006, A1245, (2) Deposits in transit: 3402 e.

Check 3402 may be indicative of kiting because the check was received, recorded, and deposited on June 30 from the Regular Account to the Special Account, but was not recorded in the Special Account until July 1 (the next accounting period).

LO 1. BT: E, Difficulty: Moderate, TOT: 35 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP13.5 There are a number of YouTube videos related to proof of cash procedures. For example, https://www.youtube.com/watch?v=3b1APLeXGnY https://www.youtube.com/watch?v=w8EzMs50ikU 1.

2.

3.

A proof of cash differs from a bank reconciliation in that the bank reconciliation only reconciles the ending bank balance in the general ledger with the bank balance per the bank statement. The proof of cash also reconciles the total cash receipt transactions per the general ledger to the cash receipt transactions recorded by the bank. It also reconciles the total cash disbursement transactions per the general ledger to the cash disbursement transactions recorded by the bank.

Hence, it reconciles all the transactions recorded in the accounting records with the transactions processed by the bank.

When internal controls are weak, or segregation of duties do not exist, the benefits of a proof of cash is that the process substantiates the recording of cash receipt and cash disbursement transactions in the cash receipts and cash disbursements journal. For example, if a check is written and clears the bank, but is not recorded in the cash disbursements journal, it will be picked up by performing a proof of cash. However, if cash is skimmed before a bank deposit is made, a proof of cash will not detect this.

While a proof of cash reconciles cash receipts and cash disbursements recorded in the accounting records to the transactions processed by the bank, it does not substantiate individual transactions. Hence, the auditor still needs to perform tests of cash receipts to validate these transactions to remittance advices and tests of cash

disbursement to underlying vendor‘s invoices and other source documents to validate the appropriateness of these transactions.

LO1. BT: AN, Difficulty: Moderate, TOT:30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, AC: Research

AP13.6 a. 6 b. 3 c.

2 d. 8 e. 3 f.

7 g. 4 h. 3 i.

4 LO1,2. BT: AN, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Analysis, AC: Research

AP13.7 a) An auditor tests for NRV (net realizable value) because the generally accepted accounting standards require inventory items to be measured and disclosed at the lower of cost or NRV, b) A ‗key item‘ in this context is inventory items that have a major effect on the total inventory balance. The ‗switches‘ are a key item because there are 2000 in stock, with a total stock value of $10,000,000. The other items selected for testing are also listed. The auditor has selected a representative sample of items in inventory to determine if they are fairly priced. The auditor tests the selling price less distribution costs against the unit price (cost). For example, for ‗covers‘ the unit price is $15,000, the selling price is $45,000 less distribution costs of $1,000. This means that the item‘s cost is below NRV, c) One item has an NRV below cost. Routers have a unit cost of $540,000, and there are 25 items in stock, giving a total value at cost of $13,500,000. In this case, the selling price is only $420,000. The total variance (difference) is $121,000, including the cost of distribution shown in the column ‗Distribution costs.‖ Therefore, the routers have a NRV below cost. The total inventory should be written down by $3,025,000. Note ‗A‘ in the comments shows the amount for the obsolescence or write-down of the routers is included with other stock items, and the amount was correctly provided for by the client.

LO 2. BT: E, Difficulty: Moderate, TOT: 20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, AC Measurement, Analysis and Interpretation

AP13.8

Deficiency 1. Issuance of Raw Materials Raw materials may be removed from the storeroom upon oral authorization from one of the production foremen.

Recommended Improvements Raw materials should be removed from the storeroom only upon written authorization from an authorized production foreman.

Further, a written record should be kept of items moved from stores and moved to production, and this information should also be entered into the perpetual inventory records.

2. Lack of Perpetual Inventory Records There are no records maintained of items received.

Alden's practice of monthly physical inventory count does not compensate for the lack of perpetual inventory system. Quantities on hand at the end of one month may not be sufficient to last until the next month's count. If the company has taken this into account in establishing reorder levels, then it is carrying too large an investment in raw-materials inventory.

3. Purchasing Raw materials are purchased at a predetermined reorder level and in predetermined quantities. Since production levels may vary during the year, quantities ordered may be either too small or too great for the current production demands.

The accounts payable clerk handles both the purchasing function and payment of invoices. This is not a satisfactory separation of duties.

Personnel in this department should count or weigh all goods received and prepare a prenumbered receiving report. These reports should be signed, dated, and controlled. A copy should be sent to the accounting department, and the purchasing department A perpetual inventory system should be established under the control of someone other than the storekeepers. Physical counts should be compared to the perpetual records. Where differences occur, they should be investigated, and if the perpetual records are in error, they should be adjusted. Also, controls should be established over obsolescence of stored materials.

Requests for purchases of raw materials should come from the production department management and be based on production schedules and quantities on hand per the perpetual records.

The purchasing function should be centralized in a separate department. Prenumbered purchase orders should originate from and be controlled by this department. A copy of the purchase order should be sent to the accounting and receiving departments. Consideration should be given to whether the receiving copy

Raw materials are always purchased from the same vendor.

4. Receiving The receiving department does not get a copy of the purchase order (without quantities).

A vendor‘s bill of lading is not equivalent to a receiving report.

should have quantities obliterated.

The purchasing department should be required to obtain competitive bids on all purchases over a certain amount.

Goods should only be received associated with an authorized purchase order.

Receiving should prepare a prenumbered receiving report identifying the vendor, a description of the items received, and an independent count of the items received. This data should also be entered into the perpetual inventory records.

LO 2. BT: E, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP13.9 (LO13) a.

Controls at the local store level include:  Locked doors to any storage areas and to any warehouse area,  Receiving report verified to goods when they are received from the supplier,  Any discrepancies in deliveries are reported to the central office,  Electronic cash registers record inventory items and update store inventory records,  Cyclical inventory counts reconciled to store inventory records and any discrepancies are investigated  Obsolete, damaged and impaired inventory is identified promptly.

Controls at the central office include:  Purchase orders are compared with approved suppliers,  Invoices from suppliers are not paid until local store receiving reports are reconciled with purchase order and supplier invoice, quantities and prices for each unit and overall accuracy of the invoices is verified (quantities and prices total correctly) and vouchers are prepared before payment,  Invoice payment is authorized by a senior staff member who does not participate in placing purchase orders and  Inventory records are reconciled to the store level inventory records.

b. Brompton conducts cyclical inventory counts during the year at each store location.

Therefore, the auditor would substantiate a sample of these inventory counts.

The auditor would observe the inventory count to establish: a) the client‘s personnel are complying with the instructions for taking the inventory counts, b) items belonging to the client and those the client is responsible for are accurately counted and appropriately recorded, c) items to be excluded from the inventory count (such as those with no value or belonging to others) are subject to satisfactory control and excluded and d) count tags, sheets, or cards are properly controlled.

The auditor would also perform test counts of the client‘s counts (from tags to items and from items to tags) and trace tags to the inventory records (including treatment of unused, voided etc. tags).

The auditor would inspect documents for receiving and any transfer between stores, to establish the numbers of the last documents used, and other information required for cut-off of inventory movements in the accounting records.

The auditor would also perform procedures to verify inventory valuation. This would include identification of obsolete, slow-moving and damaged items. Inventory records would be inspected for evidence of correct pricing and recording of cost of goods sold.

Analytical procedures would compare physical item numbers and pricing, compared with previous periods and comparisons across stores (by month and product line).

LO 2. BT: AN, Difficulty: Moderate, TOT: 30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP13.10 Inventory Substantive Procedures Observe the physical count, making and recording test counts where applicable.

Test the mathematical accuracy of the inventory compilation (summary).

Identify Slow Moving Inventory

Test the pricing of the inventory by obtaining a list of costs per item from buyers, vendors, or other sources.

Ascertain the propriety of items of inventory located in public warehouses.

How Audit Software and Audit Data Analytics Might Be Helpful for Substantive Procedures Determining which items are to be test counted by making a random sample of a representative number of items from the inventory file as of the data of the physical count.

Mathematically computing the dollar value of each inventory item counted by multiplying the quantity on hand by the cost per unit and verifying the addition of the extended dollar values.

Use the computer to identify slow moving inventory based on (a) the date of the last sale and (b) items where there is a high amount of inventory on hand compared to the inventory sold during the year.

Preparing a file in a format identical to the inventory file and matching the pricing in the two files.

Prepare a listing items located in public warehouses based on electronic files and prepare confirmations of inventory on hand in public warehouses.

LO 2. BT: AN, Difficulty: Moderate, TOT: 25 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

SOLUTIONS TO AUDIT DECISION CASE C13-1 a. Inventory would include three basic types of inventory; (1) raw materials, (2) work in progress, and (3) finished goods. The cost of raw materials, including various aviation parts, would be based on underlying invoices and prices paid to vendors.

The cost of work in progress should include raw materials taken from stores and put into production, labor (probably at standard cost including appropriate variances from standard cost), and manufacturing overheads (again at standard cost including appropriate variances from standard cost). Finished goods would be valued similar to work in progress, including raw materials taken from stores and put into production, labor (probably at standard cost including appropriate variances from standard cost), and manufacturing overheads (again at standard cost including appropriate variances from standard cost). b.

Substantive procedures should include the following tests. Inventory observation procedures could be performed at an interim date.

Inventory observation  Observe care taken in the client‘s counts and make test counts (existence and completeness).  Look for indications of slow moving, damaged, or obsolete inventory(valuation).  Account for all inventory electronic count media, tags, or count sheets used in physical count (existence and completeness). Testing the clerical accuracy of the compilation of inventory values  Recalculate totals and extensions of quantities times unit prices and foot the inventory compilation (valuation).  Trace test counts taken during the inventory observation to the compilation of inventory values (existence and completeness).  Vouch items on the compilation of inventory values to inventory electronic count media, tags, count sheets (existence and completeness).  Reconcile physical counts to perpetual records, the compilation of inventory values and general ledger balances and review adjusting entries (existence and completeness, valuation). Testing inventory values  Examine paid vendor invoices for purchased inventories.  Examine propriety of direct labor and overhead rates, standard costs, and accounting for variances pertaining to manufactured inventory.  Based on the tests of beginning inventory, production costs, and ending inventory, determine the appropriateness of cost of sales.

Testing net realizable values  Examine sales invoices after year end and perform lower of cost or net realizable value test.  Compare inventories with client‘s current sales catalog and sales reports.  Inquire about slow moving, excess, or obsolete inventories and determine need for write-down.  Evaluate management‘s process for estimating the net realizable value of inventory using hindsight.  Evaluate the net realizable value of inventory given information about: o Industry trends. o Inventory turnover trends. o Specific slow-moving inventory. c.

The primary implications of using information out of the new inventory costing system for audit data analytics revolve around the reliability of the data. In this case there appear to be good IT general controls over developing the new system and placing it in operation. If internal controls are strong, the auditor might use audit data analytics (ADA) to validate the cost of raw materials and parts, as well as to test variances from the standard costing system. The auditor can also use ADA to identify slow moving inventory (parts and components), and to compare underlying costs to subsequent sales prices (testing net realizable value).

LO2. BT: AN, Difficulty: Challenging, TOT:30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

C13.2 Phase I: This case allows the instructor to explore the challenges of auditing privately held companies. While privately held companies do not receive the attention of public companies, they represent a significant portion of audits performed by CPAs. This case allows students to explore the control environment issues associated with an owner-managed company with a domineering owner manager. Further, the bank wants an audit to support lending decisions, and has put various debt covenants tied to the financial statement in the lending agreement. This case was developed based on an actual case that led to fraudulent financial reporting in a privately held company.

Question a: Control Environment Issues The control environment at CTI is representative of that in a number of ownermanaged businesses. The following issues all represent control environment weaknesses:  Jessica, the owner-manager was increasing her intrusion into the company‘s financial reporting process,  Jessica paid particular attention to accounting results, particularly in the last two quarters of the year,

    

Jessica regularly discussed accounting for particular transactions. Jessica was monitoring the year-end close on a daily basis, to discuss closing entries and their impact on earnings, Jessica would override policies and tell someone in accounting to change a sales invoice to offer a particular price discount to a customer, Jessica would not accept explanations for draft financial statements that showed performance falling below her expectations, Accounting and financial reporting controls were not a high priority in the company and Accounting was understaffed (not allowing for adequate segregation of duties) and everyone in this area worked long hours.

Question b: Financial Statement Level Risks 1. Many of the financial statement level risks that have a pervasive effect on the financial statements also involve control environment issues. In particular:  Jessica, the owner-manager, was increasing her intrusion into the company‘s financial reporting process,  Jessica paid particular attention to accounting results, particularly in the last two quarters of the year,  Jessica regularly discussed accounting for particular transactions. Jessica was monitoring the year-end close on a daily basis, to discuss closing entries and their impact on earnings.  Jessica had a history of overriding accounting decisions,  Jessica would not accept explanations for draft financial statements that showed performance falling below her expectations  Accounting and financial reporting controls were not a high priority in the company and  Accounting was understaffed (not allowing for adequate segregation of duties) and everyone worked long hours.

2. When it comes to incentives and pressures, Jessica put considerable pressure on the accounting staff to achieve accounting results. In addition, the company had to meet particular debt covenants, and Jessica wanted particular year-end results to support distribution of earnings to the shareholders in a Subchapter S Corporation.

The person who had the opportunity to influence the outcome of the accounting system was the CFO, Rob Kaiser. There were no controls over Rob‘s activities in the financial reporting process.

Rob was under considerable pressure from Jessica to deliver expected results.

Jessica‘s intrusion into the financial reporting process lessened only when reported results matched the owner-manager‘s expectations.

Question c: Management Performance Reviews Management performance reviews can be effective at identifying misstatements when senior management encourages representational faithfulness in financial reporting. In these situations, management might review inventory levels or inventory pricing and identify accounting results that are not consistent with actual experience. These controls do not work well, however, when certain management members are under considerable pressure to deliver the CEO‘s desired results. Hence, management performance reviews performed by Jessica and Rob would likely not be effective at identifying financial statement misstatements related to either (1) the existence of inventory or (2) the valuation of inventory or cost of sales.

Question d: Internal Control Recommendations A number of recommendations can be discussed in this letter, most of which will deal with the control environment. Students could focus on any of the issues raised in question 1. Following is an example letter that might be used: Date To the Board of Directors Circuits Technology, Inc. In planning and performing our audit of the financial statements of Circuits Technology, Inc. (CTI) for the year ended December 31, 2025, in accordance with auditing standards generally accepted in the United States of America, we considered the Company‘s internal control over financial reporting (internal control) as a basis for designing audit procedures that are appropriate in the circumstances for the purpose of expressing our opinion on the financial statements, but not for the purpose of expressing an opinion on the effectiveness of the Company‘s internal control. Accordingly, we do not express an opinion on the effectiveness of the Company‘s internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and therefore, material weaknesses or significant deficiencies may exist that were not identified. However, as discussed below, we identified certain deficiencies in internal control that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity‘s financial statements will not be prevented, or detected and corrected, on a timely basis. We consider the following deficiencies in the Company‘s internal control to be a material weakness.

Control Environment The control environment represents the tone set by management of an organization that influences the control consciousness of its people. It is important because it represents the foundation for all other components of internal control, providing discipline and structure. A weak control environment will lessen the effectiveness of other control activities that may prevent or detect misstatements on a timely basis.

An important aspect of the control environment involves a commitment to competence and investment in human resource policies that support a sound financial reporting system. In the past we have noted financial statement misstatements that have resulted from the fact that the account staff is stretched too thin. This lack of investment in account personnel has also led to a situation where a good system of checks and balances and segregation of duties cannot be achieved. We recommend that CTI consider the addition of an additional staff person in accounting during peak periods to encourage better control activities.

A strong control environment also involves a management philosophy and operating style that reinforces representational faithfulness in financial reporting. During our audit we noticed several situations that are considered significant risk indicators including the daily involvement of the owner-manager in accounting issues associated with the closing process. A sound control environment delegates a higher degree of responsibility for financial reporting to the accounting staff and it places a premium on financial reporting that fairly presents underlying results of operations.

This communication is intended solely for the information and use of management and the Board of Directors, and it is not intended to be, and should not be, used by other than these specified parties.

This communication is intended solely for the information and use of management and the Board of Directors of Circuits Technology, Inc., and it is not intended to be, and should not be, used by other than these specified parties.

We thank you for the opportunity to continue to be of service to you.

Signature.

LO2. BT: E, Difficulty: Challenging, TOT:60 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

C13.3 Part II. Question a. Results of Substantive Procedures 1. If the results of the sample of 35 are representative of the population, the sample projects and estimated audit value of $ 839,179 based on the calculation below, using ratio estimation.

216,295 ÷ 264,705 x 1,027,000 = 839,179.

This represents a potential overstatement of inventory of $187,821 (1,027,000 – 839,179). In each instance, the errors resulted not from errors in counting the quantity of inventory, but they resulted from errors in pricing inventory.

In addition, payroll costs in the amount of $21,060 were capitalized as part of work in process inventory when the project was complete and billed to the customer. In total inventory was overstated, cost of goods sold was understated, and gross margin was overstated by $208,881. This represents 20% of the book value of inventory and is material.

2.

At a minimum, the auditor should extend the sample for price testing inventory to determine if the known misstatements are representative of the inventory as a whole. The pricing errors are extensive and all in the same direction. Given the fraud risk indicators, it is likely that misstatements are intentional with the intent of overstating inventory to achieve budgeted results.

The auditor might want to approach the accounting personnel, and the CFO, with the results and determine the extent of their involvement with the pricing of inventory. If these pricing errors and inappropriate capitalization of payroll costs rest solely with the CFO, the auditor needs to question Rob Kaiser to determine the extent of misstatements in inventory and other areas. Once presented with the audit evidence, the CFO might admit to his involvement in financial statement misstatements. If the CFO does not admit to involvement in the misstatements, the audit needs to be extended to determine the full extent of the misstatements.

Finally, the auditor should consider the implication for other aspects of the audit. If evidence suggests that prices and inventory values were changed to achieve earnings targets, the scope of other audit work should also be increased throughout the audit. The auditor might want to suggest that management hire a forensic auditor to perform a fraud audit to determine the extent of misstatements in the financial statements.

Question b. Draft Management Letter Comments Following is a draft of a management letter comment that should be discussed with the board of directors. This comment is drafted based on the audit evidence alone.

During the audit we found evidence of overstatements of inventory by the Chief Financial Officer in order to overstate gross margins with the purpose of achieving desired financial results. In a sample of 35 items, we found 17 items with pricing errors, all of which resulted in the overpricing of the value of inventory. In addition, we found evidence of inappropriate capitalization of payroll costs as part of work in process inventory. In total, we estimate that inventory values presented for audit were overstated by almost $210,000 (or 20% of the value of inventory). Due to the extensiveness of the misstatements, 17 out of 35 items sampled, we recommend retesting the entire inventory for pricing errors.

If Rob Kaiser admits to his involvement in overstating inventory, this should also be discussed with the board of directors. The auditor needs to recommend (1) changes in the control environment that led to the fraudulent financial reporting and (2) replacement of the CFO. Question c. Discussion with First State Bank The auditor cannot have any conversations with the bank about the potential fraud or financial statement misstatements due to ethical rules on confidential client information.

If CTI corrects the financial statements, the First State Bank will get financial statements that present fairly in all material respects.

If the corrected financial statements disclose violations of debt covenants, the client should approach First State Bank about the potential violations of debt covenants and ask the Bank to waive the violations. If the bank is unwilling to waive the debt covenant violations, the auditor needs to consider whether long-term debt to the bank should be reclassified as current, and the client and the accounting firm should evaluate a potential issue, before issuing an opinion on the financial statements.

LO2. BT: E, Difficulty: Challenging, TOT:60 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

Cloud 9 a.

b.

c.

d. e.

Opening a retail store creates new risks for Cloud 9. With respect to inventory there may be an increased risk of theft. Opening a retail store also requires exposure to risk associated with leasing premises and equipment. Store sales require management to manage the risk associated with cash transactions, depositing cash daily, and cash held in the premises. The company may also lose business to customers that retail Cloud 9 shoes, by opening a retail location that might compete with other customers.

As noted above, opening a new store creates new inherent risks. More importantly, the client needs to put new controls in place to manage these risks. The auditor will have to develop an evaluation of internal control associated with retail operations, which will differ from wholesale operations. Given that Cloud 9 is a public company the auditor will continue with an integrated audit. Also, these risks may not be material to Cloud 9‘s overall operations. Nevertheless, the auditor should evaluate the controls management has put in place to control the new risks.

Inventory will be affected by the need to hold inventory in the store to meet daily sales. There will be a larger volume of smaller sales made (consumer sales would be smaller than wholesale sales). There will be movements of inventory from the warehouse to the store. There could be issues with sales returns as customers return items that do not fit and with risk of damage to inventory held in the store.

Assertions that are likely affected by the opening of the store include: occurrence of sales, existence of inventory (theft issues), valuation of inventory (risk of obsolescence, damage of goods in store).

The population would include:  inventory items held in the store and warehouse – sample for inventory observation.  sales made at the store – sample sales for testing occurrence of sales.  cash receipts made by the store – testing for completeness of cash.

The sampling approach would likely be to select key items for testing – large sales transactions, inventory items that make up the largest part of the inventory balance (e.g., high value items), and take representative samples of the other items. The auditor would be concerned with completeness of cash receipts and would test controls over cash at the store. Control testing of inventory would also focus on movements of inventory, either from the warehouse to wholesale customers or to the store, and goods in transit controls.

CHAPTER 14 Auditing Investing and Financing Activities

Learning Objectives 1.

2.

Evaluate how an auditor determines and executes an audit strategy, including the use of ADA, for property, plant and equipment and depreciation expense.

Evaluate how an auditor determines and executes an audit strategy for long-term debt and interest expense, and shareholders‘ equity.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. B LO 1, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

2. D LO 1, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

3. B LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management,

4. C LO 1, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

5. A LO 2, BT: AN, Difficulty: Moderate, TOT: 2 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management,

6. D LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management,

ANSWERS TO REVIEW QUESTIONS R14.1 The issue at hand is whether an item was capitalized when it should have been expensed, or whether the item was expensed when it should have been capitalized, which is a classification assertion issue.

While analytical procedures may provide some assurance about the fair presentation of PPE in the financial statements, the auditor should exhibit an appropriate level of professional skepticism when evaluating the appropriateness of whether costs should be capitalized or directly expensed. The appropriate classification of transactions may be an issue when companies decide whether a transaction should be directly expensed versus capitalized as an asset.

The purpose of the auditor‘s testing debits to these accounts is to determine the propriety and consistency of these charges. Propriety involves considering whether the client has made appropriate distinctions between items that should be capitalized or expensed. The auditor should also consider other expenses that an entity might have capitalized incorrectly.

LO 1, BT: C, Difficulty: Moderate, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

R14.2 During a tour of plant assets, an auditor should be alert to evidence relevant to plant assets. For example, an astute auditor will look for indications of additions or retirements not listed on the schedules that relate to the completeness and existence assertions, and evidence regarding the general condition of other plant assets and whether they are currently being used which relates to the accuracy, valuation and allocation assertion.

Events may occur between acquiring and retiring an asset that affect the accuracy, valuation and allocation assertion and require immediate write-down of the asset, as addressed in ASC 360. An impairment exists when the cost of a long-lived asset, or group of assets exceeds its fair value and is not recoverable. Auditors should be alert to a significant decrease in the market price of a long-lived asset, a change in how the company uses an asset, or a change in the business climate that could affect an asset's value.

LO 1, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R14.3 The auditor usually is concerned about the understatement of liabilities. The auditor will often use his or her understanding of the business to assess the entity‘s need for financing. The use of financing is typically expected when the client is engaging in capital expansion or is unable to generate strong cash flows from operations.

A key procedure to test the completeness assertion is to send a confirmation to lenders, even prior lenders where there may currently be a small or zero balance. The auditor will also scan the cash receipts journal for large, unusual cash receipts.

LO 2, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

R14.4 Confirmations, including bank confirmations (whether received by mail or electronically), are an important method of obtaining evidence about: a. The existence of loans payable, b. Interest expense, c. Information about assets pledged as security for loans.

In addition, the auditor should send confirmations to lenders with small or zero balances as part of testing the completeness assertion.

LO 2, BT: C, Difficulty: Moderate, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

R14.5 Auditors often test interest expense in two ways. First, the auditor will use a substantive analytic procedure and test the reasonableness of interest expense by comparing interest expense with the average principal balance outstanding for interestbearing debt. Second, the auditor will often confirm the amount of interest expense when sending confirmations to lenders.

LO 2, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Risk Assessment, Analysis, and Management

R14.6 When evaluating inherent risk, the auditor should exercise care in determining the extent to which the client engaged in the conversion of stock warrants, the exercise of stock appreciation rights, or the conversion of debt to equity, as the accounting for these transactions may be complex. Further, the auditor should evaluate the appropriateness of the client‘s classification and disclosure of shareholders‘ equity, and the auditor should be alert for some equity instruments used by companies that behave more like debt than equity (e.g., preferred stock with a mandatory redemption date), which therefore should not be classified as shareholder.equit'y s When evaluating control risk the auditor should evaluate the client‘s risk assessment procedures at the entity level, and specific assertion level controls over transactions, balances, and disclosures. Often a public company will use a transfer agent to handle equity transactions.

Finally, the auditor will also consider the results of analytical procedures, indicating the entity‘s need to issue equity or its ability to repurchase equity.

Each of these issues will influence the decisions about the nature, timing, and extent of substantive tests of details.

LO 2, BT: AN, Difficulty: Moderate, TOT: 10 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

SOLUTIONS TO ANALYSIS PROBLEMS

AP14.1  Additions and disposals are directly linked to the property, plant and equipment (PPE) asset account, so evidence for the assertions for additions and disposals is also relevant to the asset account. For assertions relating to additions to PPE: 1. Occurrence (additions which are recorded during the period are PPE acquired during the period), 2. Completeness (additions that occurred during the period have been included or recorded) 3. Accuracy (additions are correctly journalized or posted ) 4. Cut-off (additions are recorded in the correct period) 5. Classification (additions are recorded in the correct asset (PPE) account).

For assertions relating to disposals to PPE: 1. Occurrence (disposals recorded during the period are for PPE disposed during the period) 2.Completeness (disposals during the period have been included or recorded) 3. Accuracy (disposals are correctly journalized or posted) 4. Cut-off (disposals are recorded in the correct period) 5. Classification (disposals are recorded in the correct PPE account)  The additions relate to the purchase of a new delivery van and work on an asset under construction. The asset under construction will not be depreciated until it is ready for use; however, the depreciation of the new delivery van commences from its purchase date.  The disposal relates to a delivery van. It had a gross book value of $350,000 and an accumulated depreciation of $280,000 which left a net book value equal to $70,000. If the selling price was $75,000, the gain on disposal amounted to $5,000. The auditor has made a note that the gain on disposal of the van is not material. As the note suggests, this is relevant because it provides evidence the company is using a reasonable depreciation rate. Therefore, the auditor is confident that the depreciation expense is not understated nor overstated for the period.

LO1. BT: AN, Difficulty: Basic, TOT: 25 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP14.2 a) An increase in property, plant and equipment (PPE) acquisitions suggests the risk would be related to an overstatement of PPE (existence, accuracy, valuation and allocation assertions). The analytical procedures have detected a fluctuation which could be explained by the significant investment in a new manufacturing process.

The auditor needs to consider if the increase is consistent with this investment. It is possible, for example, that old equipment is being disposed of and the overall balance of PPE is not excessive. The acquisitions need to be assessed for their appropriate valuation in the accounts. Are the acquisition costs treated as capital, or are there costs associated with the acquisitions that should be expensed?

Another assertion that is at risk is when there are increased PPE acquisitions is rights and obligations. Are the new acquisitions being purchased, or are they being acquired under lease or other forms of financing? Are there additional disclosures required to recognize these financing arrangements? b)

Substantive tests of details that would be appropriate include:  Inspect assets (Existence) and vouch entries for additions in the fixed asset register to underlying documents (Occurrence)  Recalculation of new depreciation charges, consideration of underlying assumptions of useful life, residual value etc. (Accuracy, valuation and allocation),  Compare actual costs with authorized costs (Occurrence and accuracy, valuation and allocation)  Test mathematical accuracy of fixed asset register (Accuracy, valuation and allocation)  Review documents relating to finance for fixed asset acquisitions (Rights and obligations), evidence of ownership (rights and obligations)  Consider the likelihood of continued production using new assets (Accuracy, valuation and allocation)

c)

If the PPE additions have been manufactured in-house, the auditor should focus on the process of assigning costs to the assets. Therefore, instead of reviewing documents relating to evidence of ownership of the asset or its purchase, the auditor would focus on testing the data and assumptions supporting the manufacturing cost allocations. The auditor would still be concerned with gathering evidence to support the existence and accuracy, valuation and allocation assertions.

LO1. BT: AN, Difficulty: Moderate, TOT: 25 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP14.3 a. Substantive Test

b. Financial Statement Assertion

c. Type of Evidence

1.

Vouch entries to retained earnings to the board of directors minutes

Occurrence, rights and obligations Documentary and accuracy

2.

Vouch long-term debt account entries to the board of directors‘ minutes

All except presentation and disclosure

Documentary

3.

Vouch to cash disbursements journal & recalculate bond interest

Occurrence, accuracy

Mathematical and documentary

4.

Vouch entries to brokers advice

Occurrence, accuracy

Documentary

5.

Inspect entries in the cash disbursements journal

Occurrence, accuracy

Documentary

6.

Vouch to the board of directors‘ authorization and consider confirming with the transfer agent

Occurrence, accuracy

Documentary, confirmation

7.

Recalculate interest expense

Accuracy

Mathematical

8.

Inspect cash disbursements journal entry, supporting documentation and consider confirming with the bond trustee

All except presentation and disclosure assertions

Documentary, confirmation

9.

Vouch to the board of directors‘ minutes

Presentation and disclosure asser- Documentary tions

10.

Vouch to the board of directors‘ minutes and review authorizations and terms of stock issues

Occurrence, completeness, accuracy, cutoff, and classification

Documentary

LO2. BT: AN, Difficulty: Challenging, TOT:30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP14.4  3  6  5  1  8  2  4  7 LO1,2. BT: AN, Difficulty: Moderate, TOT: 15 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP14.5 a. The substantive tests that Andrews should employ in examining the loans are as follows:  Obtain an understanding of the business purpose of the loans made by the president,  Confirm the loans, including terms, by direct communication (confirmation),  Confirm interest expense and interest payable or re-compute these items,  Re-compute the long-term and short-term portions of the debt,  Review minutes of meetings of the board of directors for proper authorization,  Verify payments made during the year and transactions after the year-end,  Read (notes to) the financial statements and the loan agreements and evaluate the adequacy of disclosure and compliance with restrictions and  Obtain a management representation letter regarding loan balances and disclosures. b.

Broadwall's financial statements should disclose the following information concerning the loans from its president:  The nature of the related-party relationship,  The dollar amounts of the loans and  Amounts due to the president and, if not otherwise apparent, the terms and manner of settlement.

LO2. BT: AN, Difficulty: Moderate, TOT:20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

AP14.6 The stated facts do not justify the proposal for limiting other audit procedure. Although the transfer agent and the registrar know the number of shares issued, they do not necessarily know the number of outstanding shares. Furthermore, the audit of capital stock includes more than determining the number of shares outstanding. For example, the auditor must determine what authorizations exist for the issuance of shares, what assets were received in payment of shares, how the transactions were recorded, and what subscription contracts have been entered into. Confirmation from the registrar could not help in determining these things. In addition to a confirmation from the registrar, the audit of capital stock might include the following procedures for which the purposes are briefly indicated:  Examine the corporation charter to determine the number of shares authorized and the special provisions relating to each class of stock if more than one class is authorized,  Examine minutes of stockholders' and directors' meetings to determine authorization for appointments of the registrar and the transfer agent, and to determine authorization for the issuance or reacquisition of shares,  Examine provisions relating to capital stock in the corporation law of the state of incorporation to determine any special provisions such as, for example, those relating to the issuance of no-par stock,  Analyze the capital stock accounts to obtain a record of stock transactions for use as a guide to other auditing procedures and as a permanent record,  Trace the consideration received for capital stock into the records to determine what consideration has been received and how it has been recorded,  Make a schedule of treasury stock and review entries for treasury stock to determine the existence of treasury stock, as authorized and to determine a proper record has been made,  Compare dividends with stock outstanding at dividend dates to determine that dividends have been properly paid and also to substantiate the stock outstanding and  Review subscription and option contracts, etc., to determine the facts concerning subscriptions and options and to determine that these facts have been properly recorded and that they are adequately disclosed.

LO2. BT: AN, Difficulty: Challenging, TOT:20 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

SOLUTIONS TO AUDIT DECISION CASE C14.1 a.

Item Number 1 2 3 4

Relevant Assertion Classification Occurrence, Classification Classification Classification

Principle Substantive Procedure Pertaining to the Evidence Found Vouch a sample of larger entries to repair and maintenance expense, and other expenses.

Vouch a sample of plant asset additions to supporting documentation.

Vouch a sample of entries to other income.

Vouch a sample of plant asset additions to supporting documentation.

b.

Is Audit Adjustment or Reclassification Required?

Yes or No

Reasons Why Audit Adjustment or Reclassification is Required or Not Required

1.

Yes

Commissions paid to real estate agents are costs directly related to the acquisition of the property and should be included in the land cost. Costs of removing, relocating, or reconstructing property of others to acquire possession are costs that are directly attributable to conditioning the property for use and should be included in land costs. An adjustment is required for these items so that total land costs can properly be included in Property, Plant & Equipment.

2.

No

No adjustment is required because clearing costs are directly attributable to conditioning the property for use and should be included in land costs which are part of Property, Plant & Equipment.

3.

Yes

Because clearing costs are costs of the land, amounts realized from the sale of materials recovered, such as timber and gravel, should reduce the cost of the land and should not be recorded as other income.

Item No.

4.

Yes

All costs relating to the purchase of machinery and equipment should be capitalized. For purchased items, such costs would include invoice price, freight costs, and unloading charges. Royalty payments, however, should not be included in the cost of the machinery. Such payments should be charged to expenses as they accrue.

The machinery costs, other than royalty payments, should be included in Property, Plant & Equipment.

LO1. BT: E, Difficulty: Challenging, TOT:25 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management, AC Measurement, Analysis and Interpretation

C14.2 i.

The economic substance of the patent is the right to produce and sell a particular drug if the drug becomes marketable. The primary issues associated with the recording of the patent is the fair market value of the redeemable preferred stock. If 9% is the market interest rate and no discount or premium is appropriate, then the book value of the patent is appropriately recognized at $10 million. The auditor also will need to consider the appropriate amortization period. At this point in time, the appropriate amortization period might be 16 years. In the future, the auditor needs to be sensitive to impairment in the value of the patent. ii.

Audit procedures performed in 2025 to audit the patent would include: Procedure(s)

Assertion(s)

Obtain an understanding of the business and industry and determine: 1. The significance of plant assets, and changes in plant assets, to the entity.

2. Key economic drivers that influence the entity‘s acquisition of plant assets.

3. Industry standards for the extent to which the entity is capital intensive and the impact of plant assets on earnings.

All assertions

Vouch the acquisition of the patent to supporting documentation and contracts supporting the transaction and title.

Occurrence, Accuracy, Cutoff, Classification

Evaluate the fair presentation of amortization expense by evaluating the appropriateness of useful life.

Accuracy, valuation, and allocation

Determine the appropriateness of disclosures related to the cost, book value, amortization methods, and the patent‘s useful life.

Presentation regarding transactions and related account balances.

iii.

d.

The economic substance of the redeemable preferred stock is debt. The security has a fixed rate of return stated as a percentage of the par value of the security and it has a fixed redemption date. Corporate holders of the redeemable preferred stock will enjoy a dividend received deduction for tax purposes. The company has not appropriately classified the security as the redeemable preferred stock is debt in economic substance and should be reported as the last item in debt, prior to shareholder‘s equity.

Audit procedures performed in 2025 to audit preferred stock would include: Procedure(s)

Assertion(s)

Obtain an understanding of the business and industry and determine:  The significance of sources of financing to the entity.  Key economic drivers that influence the entity‘s need for financing and choice of financing.  Industry standards regarding the type of financing commonly used within the industry.

All assertions

Review authorization by the board of directors and contracts support the transaction.

Existence, Rights, and obligations

Confirm terms of the contract with the holder of the redeemable pre- Existence, Comferred stock. pleteness, Accuracy, valuation and allocation, Rights, and obligations Recalculate interest expense

Accuracy

Compare statement presentation with GAAP.  Determine that long-term debt balances are properly identified and classified in the financial statements.  Determine the appropriateness of disclosures concerning all terms, covenants, and retirement provisions pertaining to long term debt.  Evaluate the completeness of presentation and disclosures for receivables in drafts of financial statements to determine conformity to GAAP by reference to disclosure checklist.  Read disclosures and independently evaluate their understandability.

Presentation regarding transactions and related account balances

LO2. BT: E, Difficulty: Challenging, TOT:30 min., AACSB: Analytics, AICPA AC: Risk Assessment, Analysis, and Management

Cloud 9

a. i. ii. iii.

b.

The auditor would audit the occurrence of acquisitions by selecting a sample of additions to property, plant and equipment and vouching the transactions to the underlying voucher, vendor‘s invoice, and receiving reports.

The auditor would audit the accuracy of recording acquisitions by taking a sample of additions to property, plant, and equipment, and vouching the transactions to the underlying voucher, and vendor‘s invoice.

The auditor would test the completeness of acquisitions by reference to the board of director‘s minutes and other documents authorizing capital expenditures. The auditor should also take a tour of the company‘s facilities when observing inventory, being alert to the acquisition of new assets.

i.

c.

d.

The auditor would audit the occurrence of disposals by selecting a sample of disposals of property, plant, and equipment, then vouching the transactions to the underlying bill of sale, documentation of trade-in of equipment, and evidence of cash received. ii.

The auditor would audit the accuracy of disposals while the auditor tests the occurrence assertion, by taking a sample of disposals of property, plant and equipment and vouching the transactions to the underlying bill of sale, documentation of trade-in of equipment, and evidence of cash received. iii. The auditor would test the completeness of acquisitions by referencing the board of director‘s minutes and other documents authorizing the sale of capital equipment. The auditor should also take a tour of the company‘s facilities when observing inventory, being alert to the assets that have been sold.

The auditor gains information about the appropriateness of depreciation policies when assets are sold. If there is a substantial loss on the sale of an assets, useful lives or salvage values are likely incorrect and the asset has been under depreciated. If there is a substantial gain on the sale of an assets, useful lives or salvage values are likely incorrect and the asset has been over depreciated.

No misstatements were found in strata 2 or strata 3. The only misstatement was found in the strata of acquisitions in excess of $750,000. This strata was audited 100%, so the misstatement is known with certainty. There was an understatement of $465,197, which is considerably less than performance materiality (tolerable misstatement) of $1 million. The evidence shows that either a construction project was understated by this amount or that an asset was received and not recorded until the subsequent period.

CHAPTER 15 Completing the Audit Learning Objectives

1.

2.

3.

4.

5.

Apply the audit procedures used to search for loss contingencies.

Distinguish between the two types of material subsequent events and evaluate what effect they have on the financial statements, if any.

Describe the engagement wrap-up procedures performed at the conclusion of the audit.

Evaluate the going concern assumption for a client.

Discuss what reporting is required to management and those charged with governance.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. A LO 1, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Audit Procedures for Loss Contingencies

2. C LO 2, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

3. A LO 2, BT: AN, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

4. B LO 2, BT: AN, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

5. D LO 3, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Engagement Wrap-Up

6. B LO 3, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Engagement Wrap-Up

7. D LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Engagement Wrap-Up

8. A LO 3, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Engagement Wrap-Up

9. B LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Measurement Analysis and Interpretation, Section: Going Concern

10. A LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Measurement Analysis and Interpretation, Section: Going Concern

11. C LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Management Representation and Communication with Those Charged with Governance

12. B LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Communications, AICPA AC: Reporting, AICPA PC: Communication, Section: Management Representation and Communication with Those Charged with Governance

13. A LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Measurement Analysis and Interpretation, Section: Management Representation and Communication with Those Charged with Governance

ANSWERS TO REVIEW QUESTIONS R15.1 Auditors must send legal letters directly to all attorneys that the client paid for legal services during the accounting period audited. All auditors will follow the same basic format of the letter as dictated by auditing standards. The letter is sent about mid-way through the completion of the year-end fieldwork, and the response to the letter should coincide with the end of fieldwork or very close to that date. If the attorney‘s refuse to respond appropriately to the legal letter, then it is considered a limitation on the scope of the audit, which may impact the opinion in the auditor‘s report.

LO 1, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Procedures for Loss Contingencies

R15.2 There are two types of subsequent events that may occur between the date of the financial statements and the date of the auditor‘s report. The first type is Type I subsequent events.

This type of event provides evidence of conditions that existed at the date of the financial statements and require adjustments to the financial statements. Type II subsequent events provide evidence of conditions that arose after the date of the financial statements and may only require disclosure in the notes. Specific audit procedures used to identify subsequent events include obtaining an understanding of how management identifies subsequent events, inquiring with management about whether subsequent events have occurred, reading the minutes of manager and/or board of directors‘ meetings that have been held after the date of the financial statements, reading the client‘s subsequent interim financial statements, scanning records relating to transactions that occurred after the date of the financial statements, and inquiring of the client‘s legal counsel regarding litigation, claims, and assessments.

LO 2, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA PC: Decision making, Section: Subsequent Events

R15.3 The objective of the auditors is to obtain sufficient appropriate audit evidence about whether events occurring after the balance sheet date but before the end of fieldwork have been identified and properly accounted for, if necessary. If the auditors identify subsequent events that require adjustment to or disclosure in the financial statements, they must determine if each event has been properly reflected in the financial statements as required by the financial reporting framework. If management refuses to make the adjustments or disclosures that are required for the financial statements to be presented fairly, the auditors would not be able to issue an unmodified audit report.

LO 2, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

R15.4 The engagement wrap-up is important because it is the auditor‘s last chance to evaluate audit evidence before forming an opinion on the financial statements and determining the appropriate report to issue. The wrap-up includes conducting final analytical procedures and evaluations of audit findings, completing working paper reviews, engagement quality review, and completing documentation.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Engagement Wrap-Up

R15.5 Throughout the audit, auditors consider whether additional factors or risks are present and whether they need to revise their assessments of control risk and fraud risk. Auditors reconsider their assessment of control risk at the entity level when they become aware of significant changes to the client‘s system of internal controls and after they perform tests of controls.

For example, if auditors uncover frequent unintentional misstatements in the financial statements, the auditor must reevaluate the control risk and determine if there is a material weakness or a significant deficiency in internal controls. If fraud is uncovered, it does not matter if the misstatement is material or immaterial because any amount of fraud is considered significant.

The auditor should consider the employees‘ responsibilities and determine if fraud has occurred due to lack of segregation of duties. For example, an employee who receives checks may also be in charge of recording checks, which could lead to fraud. If any amount of fraud is discovered, the auditor must reevaluate fraud risk during the audit.

LO 3, BT: AP, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Engagement Wrap-Up

R15.6 During the final evaluation, auditors will evaluate the effect of the uncorrected misstatements on the financial statement by considering both quantitative and qualitative factors. Auditors obtain an understanding of management‘s reasons for not making the corrections, and these reasons should be taken into consideration when evaluating the overall effect of uncorrected misstatements on the financial statements as a whole. Uncorrected immaterial misstatements should be aggregated to determine if, in total, they exceed the materiality level for the financial statements as a whole or the materiality level for a class of transactions, account balances, or disclosures. Uncorrected misstatements from prior years should also be aggregated with current year uncorrected misstatements to determine if they exceed materiality. Auditors should thoroughly document the basis for their conclusions about whether the uncorrected misstatements are material individually or in total.

LO 3, BT: AP, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA PC: Decision Making, Section: Engagement Wrap-Up

R15.7 An engagement quality control review is a review of selected areas of the working papers that is conducted prior to the issuance of the auditor‘s report. It is performed to ensure the audit team has conducted the audit in accordance with appropriate standards and has gathered sufficient appropriate evidence to support the audit conclusions. The engagement quality control reviewer is typically an independent partner of the accounting firm who is not part of the engagement team. The reviewer reads the financial statements and the proposed audit report as well as the related working papers to evaluate if the conclusions reached are appropriate. The engagement quality control reviewer focuses on selected audit areas that required a great deal of judgment.

LO 3, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: None, AICPA PC: Professional Behavior, Section: Engagement Wrap-Up

R15.8 The audit file assembly completion deadline is 45 days after the audit report release date for a public company audit and 60 days after the audit report release date for a private company audit. The audit file retention is 7 years from the audit report release date for a public company audit and 5 years from the release date or as specified by State Boards of Accountancy for a private company audit. Public company audits have more stringent guidelines than private company audits because there is more at stake if public companies have problems or delays in having the audit completed (for example, stock market implications).

LO 3, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA PC: Professional Behavior, Section: Engagement Wrap-Up

R15.9 The going concern assumption refers to the viability of an entity to remain in business for the foreseeable future. The auditor has a responsibility to evaluate whether there is substantial doubt about the entity‘s ability to continue as a going concern for a reasonable period of time and evaluate the adequacy of any disclosure related to the entity‘s circumstances, if applicable.

Since the auditor‘s main objective in conducting an audit is to determine if the financial statements are presented fairly, auditors do not need to design specific audit procedures to identify a going concern issue. Instead, auditors evaluate going concern by using evidence obtained to form an opinion on the fair presentation of the financial statements. Therefore, audit procedures conducted during the normal course of the audit are sufficient in determining going concern related issues. If the auditor does conclude that there is substantial doubt about the entity‘s ability to continue as a going concern, auditing standards dictate modifications to the audit report that may be required.

LO 4, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Going Concern

R15.10 The management letter is obtained at the end of the audit because it should capture the inquiries the auditor has had with management during the entire audit. If management refuses to sign a management representation letter, that would cause the auditors to question management‘s integrity, competence, and ethical values and could have serious ramifications for the audit. It may cause the auditor to question whether the evidence provided by management was sufficient and appropriate. The refusal by management to sign the representation letter would be considered a scope limitation and could affect the auditor‘s opinion on the financial statements.

LO 5, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Management Representation and Communication with Those Charged with Governance

R15.11 Those charged with governance refers to those in an organization who are responsible for overseeing the strategic direction of the entity and the obligations related to the accountability of the organization. ―Those charged with governance‖ include groups such as the board of directors, audit committee, owners, and partners. These people are ultimately responsible for the preparation of the organization‘s financial statements. Therefore, it is important for auditors to communicate with them, and not others, to ensure that the appropriate financial framework was followed and that the financial statements are presented fairly, and to ensure confidentiality.

LO 5, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, Communication, AICPA AC: Reporting, AICPA PC: Communication, Section: Management Representation and Communication with Those Charged with Governance

R15.12 Towards the end of the audit and before the audit report is issued, auditors will communicate significant findings or issues from the audit to those charged with governance. The communication can be oral or written, but it must be documented in the working papers. The matters to be communicated to those charged with governance include:  Appropriateness of significant account policies  Process used by management in developing sensitive accounting estimates  Significant unusual transactions  Difficulties encountered during the audit  Disagreements with managements  Circumstances that affect the forma and content of the auditor‘s report  Difficult matters for which the auditor consulted outside of the engagement team  Other significant findings or issues  Uncorrected misstatements  Material corrected misstatements  Business conditions affecting the entity  Consultations with other accountants  Written representation the auditors are requesting

Communicating these matters is important because it provides those charged with governance with timely observations arising from the audit that are relevant to their responsibilities in overseeing the financial reporting process.

LO 5, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: Communication, AICPA AC: Reporting, AICPA PC: Communication, Section: Management Representation and Communication with Those Charged with Governance

SOLUTIONS TO ANALYSIS PROBLEMS AP15.1 a. A legal letter, signed by the client, is sent by the auditor to the client‘s lawyers asking them to respond with the required information and send it directly to the auditor. In this case, the auditor would send legal letters to three law firms. In the letter, the client asks each law firm to advise if there are any legal matters involving the client, the lawyer‘s opinion on the client‘s description of any outstanding legal matters and whether the client‘s evaluation of those matters appears reasonable, and for any details of any legal matters that the lawyer is in disagreement with the client. Angelo would expect that each firm would respond in detail about the type of work being done by that firm for the client. b. Angelo should perform procedures to determine if any other law firms have performed work for Acme during the financial period because there could be additional matters relating to claims against the client. Angelo should: Inspect the minutes of the board of directors, specifically seeking references to any claims against the client or complex legal matters, such as new bargaining agreements, property purchases, proposed mergers, major new contracts, new regulations on which they may be seeking legal advice, etc.

Inquire of senior staff, audit committee members, board members, about new developments at the client Inspect trial balance for major transactions which could be linked to legal matters (property purchases, new loans etc.)

Review press coverage of the client Inspect cash payments for large payments to law firms LO 1, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: Communication, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Procedures for Loss Contingencies

AP15.2 The board is planning to issue shares in a private offering on February 15. This is a Type 2 event, evidence of conditions that arose after the date of the financial statements, because the private offering is to occur after December 31. The appropriate treatment is to make a note disclosure of the details of the private offering.

The share issue is to fund the purchase of a 60% stake in another company. This is a Type 2 event, evidence of conditions that arose after the date of the financial statements, because the purchase is to occur after December 31. The appropriate treatment is to make a note disclosure of the details of the purchase.  A lawsuit was filed in the week after year-end claiming damages for illness allegedly caused by chemicals used at a subsidiary company‘s manufacturing plant in the 2000s. This is a Type 1 event, evidence of conditions that existed at the date of the financial statements, because the events that gave rise to the lawsuit occurred prior to December 31 and is a further case of a continuing series of lawsuits being filed for the same reason. The appropriate treatment is to disclose the lawsuit and the reasons the company is defending the lawsuit and believes it will win the case. Normally, Type 1 events give rise to an adjusting entry, and it could be argued that the company should recognize the cost of the claim as a loss and a liability. If the company determines it is probable that the outcome will be a loss and an amount can be reasonably estimated, the company should make an adjusting entry in addition to the note disclosure.

 The review of subsequent cash receipts has revealed that several receivables that were considered doubtful have now been paid. This refers to a Type 1 event, evidence of conditions that existed at the date of the financial statements. In this case, some doubtful accounts have been paid which could impact the prior estimate of bad debts and the allowance for doubtful accounts. The appropriate treatment is for management to review the year end estimate of bad debts and determine if it needs to be adjusted.  LO 1, 2 BT: AN, Difficulty: Medium TOT: 20 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

AP15.3 The cash receipts in January provide evidence of the account balance of customers at December 31. Subsequent payments from customers show that the balance is not doubtful and should not be written off at December 31. Therefore, the auditor would agree to their valuation at the full amount to be reflected in the financial statements.

The information received about the customer with a large balance who declared bankruptcy on January 10 is the basis for making an adjustment to the financial statements. It is not a new event post December 31; rather it is an event that provides additional information about a circumstance existing at December 31. The event is a Type 1 subsequent event. The remaining account balance of the bankrupt customer will unlikely be collected. The appropriate treatment is to include in the December 31 estimate for doubtful accounts, the amount which is unlikely to be collected (amount approximately to be written off) by the bankrupt customer.

LO 2 BT: AN, Difficulty: Easy, TOT: 15 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

AP15.4 a. Audit procedures to gather evidence about this subsequent event include inquiry of management and other relevant client personnel, inspection of payments to and other correspondence with the oversees supplier, inspection of minutes of board of directors‘ meetings or other relevant meetings, inspection of work performed, or the report written by the international trade consultant, and review of news coverage of the political unrest in the foreign country.

b. The deposit was paid in October, the supplier closed in late October, and the order remained unfilled at year-end. The information about the likely non-recovery of the deposit was an opinion obtained in January (after year-end). This means that the opinion obtained in January was providing additional information about a condition that existed at year-end. This is a Type 1 subsequent event. The client should consider an adjustment to the accounts for the year ended December 31 to reflect the non-recoverability of the deposit. The client is likely to provide additional information in the notes to explain the loss and quantify the impact of the problem on the business.

LO 2, BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

AP15.5 a. Open matters are those matters that are not yet finalized to the auditor‘s satisfaction. These require audit attention because they have not been resolved. The auditor may be waiting for evidence to be received (e.g., waiting for receipt of a lawyer letter), a procedure to be completed (e.g., an audit staff has not completed testing the sample of documents), or the auditor has not yet made a decision on whether further evidence is required. The open matters could need attention such as a follow-up letter to be written to an external party, additional staff assigned to complete a procedure, or a decision to be made to complete additional procedures. In some cases, the auditor decides that no further action is required and closes the matter. b. AU-C 230.5 and .7 Audit Documentation requires auditors to prepare audit documentation on a timely basis that provides a sufficient appropriate record of the basis for the auditor‘s opinion and evidence that the audit was planned and performed in accordance with audit standards. It also requires the auditor to adopt procedures to maintain the confidentiality and safe custody of audit documentation (AU-C 230.19).

AU-C 230.16-17 requires the auditor to assemble the audit documentation, and to not delete or discard audit documentation of any nature before the end of its retention period. However, the auditor is not required to include superseded drafts of working papers and financial statements, notes that reflect incomplete or preliminary thinking, previous copies of documents corrected for typographical or other errors, and duplicates of documents (AU-C230.A6). Assembling the final audit file could involve making administrative changes to the documentation, such as discarding or deleting superseded documentation, sorting, collating and cross-referencing working papers, signing off on completion checklists relating to the file assembly process, documenting audit evidence that the auditor has obtained, discussed and agreed with the relevant members of the engagement team before the date of the auditor‘s report. (AU-C 230.A26) Therefore, it is clear that some papers are not required to be kept. Unnecessary documents include superseded drafts, notes from early stages of work, corrected documents and duplicates.

LO 3, BT: AP, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, AICPA PC: Decision Making, Section: Engagement Wrap-Up

AP15.6 Events or conditions that may cast substantial doubt on CC‘s ability to continue as a going concern are: 1.

Paying suppliers late- This suggests cash flow problems and/or poor management of debt 2.

Demands from suppliers for cash on delivery- This creates additional cash flow problems because CC does not have the ability to receive and sell goods before paying suppliers.

The additional cash flow problems will require CC to raise or source cash (probably at a cost) from a bank or by delaying payments to other parties and/or accelerating cash receipts by discounting goods. These actions are likely to increase costs and reduce profits.

3.

4.

Correspondence between CC and the bank- The cash flow problems appear to be ongoing since 2024. CC‘s cash position appears to be deteriorating, with no positive action taken by CC‘s management.

Change of auditor- A change in auditor is not by itself a sign that there are going concern problems. However, one possible reason for the change in auditor is difficulties between the client and the previous auditor about the appropriate treatment of certain items. The change in auditor might be late in the year, hampering the audit firm‘s ability to conduct appropriate procedures for client acceptance (such as conversations with CC‘s bank and previous auditor).

LO 4 BT: E, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, AICPA PC: Decision Making, Section: Going Concern

AP15.7 a. Factors indicating a substantial going concern issue include:  Drop in demand for products based on general economic conditions and increased competition  Highly leveraged (extensive borrowing) with little capacity for further borrowing  Recent borrowings due for renewal 3 months after year-end, but no agreement reached with the bank  Potential difficulties borrowing from other banks because of economic conditions and fall in demand for entity‘s products Mitigating factors include:  High expertise within the company suggesting ability to make new sales contracts despite economic conditions and competition  Borrowings were used to purchase assets which have potential resale value  On-going negotiations with another bank to refinance debt  Possible cost-cutting (e.g., employee layoffs/downsizing could be explored) b. If there is a substantial going concern issue, CMF must include the following details in the note disclosure to the financial statements (from AU-C570.A42):  Principal conditions or events that raise substantial doubt about the entity‘s ability to continue as a going concern for a reasonable period of time.  Management‘s evaluation of the significance of those conditions or events in relation to the entity‘s ability to meet its obligations.  Management‘s plans that are intended to mitigate, or have alleviated, the conditions or events that raise substantial doubt about the entity‘s ability to continue as a going concern for a reasonable period of time.

LO 4 BT: E, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, Technology, AICPA PC: Decision Making, AICPA AC: Research Section: Going Concern

AP15.8 a.

8 b.

12 and 13 c.

11 d.

5 e.

4 f.

9 g.

2 h.

6

LO 1,2,3,4,5 BT: C, Difficulty: Easy, TOT: 15 min., AACSB: Communication AICPA AC: Measurement, Analysis and Interpretation, Section: Audit Procedures for Loss Contingencies, Subsequent Events, Engagement Wrap-Up, Going Concern, Management Representation and Communication with Those Charged with Governance

AP15.9 a. Note: Student answers will vary regarding the format and content of the report. Some content items that should be considered for inclusion in the report are:  Appropriateness of significant accounting policies – Since most of Champion‘s assets and liabilities are financial in nature, the proper valuation of these items is critical to the fair presentation of the financial statements. Katrina should discuss the proper accounting treatment with the audit committee and discuss the findings of the two experts that were hired to assist with the valuation.  Disagreements with management – The CEO disagrees with Katrina‘s proposed adjustments to the assets and liabilities. He is refusing to even consider the adjustments and is also putting pressure (undue influence) on Katrina to see his point of view. He even has threatened to find another accounting firm.  Uncorrected misstatements – Since the CEO is not making Katrina‘s proposed adjustments, the difference between what is recorded and what Katrina thinks should be recorded is considered a misstatement. Katrina should report the total of the uncorrected misstatements to the audit committee.  Business conditions affecting Champion Securities – The audit committee should be updated on the current business environment affecting Champion. The investment markets have dropped in value which materially impacts the valuation of Champion‘s assets and liabilities.  Written representation requested by the auditors – Katrina should provide the audit committee with a draft of the management representation letter that she plans to ask the CEO and CFO to sign. b. If the CEO refuses to sign the management representation letter, Katrina will consider that a serious scope limitation for the audit. The management representation letter is an important piece of audit evidence that is needed to support the auditor‘s opinion. If the CEO refuses to sign, then Katrina will question the CEO‘s integrity, competence, and ethical values which calls into question the reliability of evidence gathered during the entire audit. Without reliable evidence, Katrina cannot form an opinion on the fair presentation of the financial statements.

LO 5 BT: E, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, Communication AICPA AC: Reporting, AICPA PC: Communication, Section: Management Representation and Communication with Those Charged with Governance

AP15.10 The management representation letter is a required piece of audit evidence provided to the auditor at the conclusion of the audit. It complements other audit procedures that were performed throughout the entire audit engagement. The letter reiterates management‘s responsibility for the preparation and fair presentation of the financial statements. Auditors often write the letter on behalf of the company, and it is signed by the CEO and CFO of the company. The certification statement requires the CEO and CFO to certify that they have reviewed the financial statements and they are not aware of any untrue statement or material omission. They must also certify they have evaluated internal controls and disclosed any significant deficiencies and material weaknesses. Although the two documents are similar, there are some key differences.

The management representation letter is more detailed than the certification statement.

In the letter, the CEO and CFO must verify that the financial statements are presented fairly and in conformity with GAAP. They affirm that all relevant information, such as meeting minutes, have been disclosed to the audit team. They also confirm that all uncorrected misstatements are immaterial, responsibility has been established for fraud prevention, and related party transac-

tions, guarantees, and significant estimates are properly reported and disclosed. Finally, the CEO and CFO must confirm that no events have occurred through the date of the letter that would require an adjustment to the financial statements. The management representation letter can be tailored to the circumstances of every client because each client may have unique circumstances that need to be included in the letter. It is part of the audit evidence and is included in the working papers. It is not made available to the public as this is for internal use only.

The certification statement is more narrow in scope and is not tailored to different companies. It is a standard document that all CEOs and CFOs of public companies must sign. It focuses on the overall financial statements and evaluation of internal control. The certification is made public because it is included in the company‘s 10-K filing which is for public utilization and external users.

LO 5 BT: AN, Difficulty: Easy, TOT: 30 min., AACSB: Analytic, Technology, AICPA AC: Research, Section: Management Representation and Communication with Those Charged with Governance

SOLUTIONS TO AUDIT DECISION CASES

C15.1 The situation may put KCI at risk for a loss contingency. Events may unfold as follows:  KCI will have to refund customers who purchased the affected parts or replace the affected parts at no cost to the customer. Most likely, the manufacturer will work with KCI to replace the affected parts and reimburse KCI as necessary, however, this process will take time and KCI‘s cash flow could be impacted in the short term if there is a delay in receiving a refund or replacement parts from the manufacturer. Removing the affected items from inventory will require an adjusting entry.  There could be possible litigation or claims that arise from the situation. If any KCI customers are injured as a result of the faulty parts, KCI could be named in a lawsuit along with the manufacturer. KCI should keep good documentation of its processes to contact customers who purchased the faulty parts. If litigation does arise, the bad publicity could affect future sales and lead to loss of customers to competitors. To gather evidence about the situation, the auditors should perform the following procedures:  Inquiry of management regarding the magnitude of the situation – How many faulty parts are currently in inventory and must be removed? How many faulty parts were sold? Are these amounts material?  Inquiry of management regarding the process to contact customers and document refund and replacement activities.  Inspect correspondence with the manufacturer – The manufacturer should provide something in writing (letter or email) regarding how the situation will be handled.  Inspect board of directors‘ minutes, if applicable, to see what actions the board is taking in regard to the situation.  Confirm with KCI‘s attorney (legal letter) to gather more information about the situation.

The attorney could provide insight regarding the possibility of future claims and litigation caused by the situation. LO 1, BT: AN, Difficulty: Hard, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Audit Procedures for Loss Contingencies

C15.2 Assuming the recall event is material, it does qualify as a subsequent event. It has characteristics of both a Type I and Type II subsequent event as follows:  Type I – Even though the recall notice was received after year end (mid-February), balances that existed at December 31 could be impacted. KCI must remove faulty parts from its inventory immediately. If those parts have been included in the December 31 inventory



balance, the adjusting entry should be dated to remove them from the December 31 inventory balance. Inventory would be overstated if the faulty parts were allowed to remain in the December 31 inventory balance knowing that they will never be sold. Once replacement parts are received from the manufacturer, which could take some time to happen, inventory can be increased again. Accounts receivable balances at December 31 could also be affected. Since 60% of KCI‘s business is from regular customers who are billed on account (mostly car repair/maintenance establishments), some balances could include amounts owed for the faulty parts. Some customers may demand a refund rather than waiting for a replacement part. Management should consider if the allowance for doubtful accounts at December 31 needs to be increased because of this situation. A note disclosure related to these adjustments would also be included in the 2025 financial statements.

Type II – Since news of the recall emerged after December 31, any litigation related to the recall will not begin until well after year end and most likely after the 2025 audit is com- pleted. Attorneys for KCI can provide information on the likelihood of claims being filed against KCI. If the attorneys believe it is reasonably possible or probable that claims will be filed against KCI, and they would be material, then KCI should include a note disclosure about the situation in the 2025 financial statements. Since no claims have been filed, an estimate of a possible loss contingency would not be appropriate for the disclosure.

LO 2, BT: E, Difficulty: Hard, TOT: 25 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

C15.3 a. During interim work, the audit team discovered an error with calculations in the inventory costing system that was impacting MSI‘s competitive bidding process. The auditors should gather evidence regarding the error to determine how it happened and if it was a true error or perhaps there was intent to commit fraud. If the auditors suspect fraud, they should gather evidence about the situation and report to an appropriate level of management or to the audit committee. This discovery would cause control risk to increase and detection risk to decrease.

The auditors would adjust the nature, extent, and/or timing of planned substantive procedures for year-end work. For example, if more errors are anticipated, then the auditors may increase their extent of testing in MSI‘s bidding activities.

At year end, there was a problem with inventory cutoff. If the auditors had determined that controls over the tracking and recording of purchases were effective, the discovery of cutoff errors would cause the auditors to reconsider their previous assessment and re-evaluate the internal controls over purchases. If they suspect fraud, they should gather evidence about the situation and report to an appropriate level of management or the audit committee. The auditors would also consider the need to adjust the nature or extent of substantive procedures used to test the cutoff assertion for inventory.

Materiality is a consideration when evaluating these issues. If the costing errors and inventory cutoff errors were immaterial, then the auditors may decide that no further work is needed and no adjustment to planned substantive tests is required. However, if it is determined that fraud was involved with these situations, it would not matter if the misstatements were material or immaterial. The discovery of any fraud, no matter how small, would cause the auditors to reevaluate their assessment of risk, materiality level, and the nature and extent of audit procedures that have been performed. They would also question their previous assessment of management and employee integrity. b. If planning materiality was calculated using 5% of pre-tax income, then planning materiality from C3.4 was $550,600. Now that the results from all four quarters are available, planning materiality using 5% of pre-tax income would be:

First quarter Second quarter Third quarter Fourth quarter Updated estimate of materiality

$3,200,000 $2,790,000 $2,240,000 $1,570,000

0.05 0.05 0.05 0.05

$160,000 $139,500 $112,000 $78,500 $490,000

The updated materiality is lower than the planning materiality. The difference is $60,600, or about a 12% difference. It is preferable for the updated materiality to be slightly larger than the planning materiality because that would mean no changes would need to be made to the planned substantive procedures. In this case, the updated materiality is slightly lower. The auditors should use their professional judgment in determining if they should decrease their materiality level to this lower amount and increase the amount of substantive procedures planned for year-end fieldwork. They may consider only increasing substantive procedures for the assertions identified as the highest risk.

LO 3, BT: E, Difficulty: Hard, TOT: 40 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Engagement Wrap-Up

C15.4 The engagement quality reviewer (reviewer) must be an associated person of a registered public accounting firm. It must be a partner or another individual in an equivalent position.

The reviewer may also be an individual from outside the firm (AS1220.03). The reviewer must possess the level of knowledge and competence related to accounting, auditing, and financial reporting required to serve as the engagement partner on the engagement under review (AS1220.05). The reviewer must be independent of the company, perform the quality review with integrity, and maintain objectivity in performing the review (AS1220.06). To maintain objectivity, the reviewer should not make decisions on behalf of the engagement team or assume responsibilities of the engagement team. The engagement partner remains responsible for the engagement and its performance (AS1220.07). The person who served as the engagement partner during either of the two audits preceding the audit subject to the engagement quality review may NOT be the engagement quality reviewer (AS1220.08).

The engagement quality review takes place near the end of the audit. The audit firm may only grant permission for the client to use the audit report after the reviewer provides concurring approval of issuance (AS1220.13). The reviewer‘s task is to evaluate significant judgments made by the engagement team and the related conclusions reached in forming the overall conclusion on the engagement and in preparing the audit report. To evaluate these judgments and conclusions, the reviewer should hold discussions with the engagement partner and other members of the audit team and review audit documentation (AS1220.09). Some examples of procedures the reviewer performs are (AS1220.10-11):  Evaluate judgments related to planning.  Evaluate assessments and audit responses to fraud risks.  Evaluate judgments about materiality and disposition of corrected and uncorrected identified misstatements.  Evaluate judgments about the severity and disposition of identified control deficiencies.  Review the team‘s evaluation of the firm‘s independence from the client.  Confirm with the engagement partner that there are no significant unresolved matters.  Review the financial statements, management‘s report on internal control, and the related engagement report.  Read other information included with the financial statements to be filed with the SEC.  Evaluate whether consultations have taken place regarding difficult or contentious matters.  Determine whether appropriate matters have been communicated to the audit committee, including critical audit matters.



Evaluate whether audit documentation indicates that the team responded appropriately to significant risks and supports the conclusions reached by the team.

LO 3, BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, Technology, AICPA AC: Research, Section: Engagement Wrap-Up

C15.5 a. The kitchen fire occurred after year-end but before the audit report is issued. Therefore, the event qualifies as a subsequent event. The auditor‘s responsibility is to obtain sufficient appropriate evidence about the event and ensure the client accounts for it properly. The auditors would inquire of management about the fire, specifically asking how it happened, how much insurance will cover, plans for repairs, a timeframe for when the kitchen will be open again, and interim plans to provide food to patients and employees. The auditors should inspect any correspondence/documents from the insurance company, contractors, and food service providers. b. Assuming the event is material, it qualifies as a Type II subsequent event. The situation happened after year end and does not require an adjustment to any account balances at June 30, 2026. The client should include a note disclosure about the event. The note must include the details of the event, BPH‘s plans for interim food service, insurance shortfall, and a timeframe of when the kitchen will be running again.

LO 2, BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Subsequent Events

C15.6 Student answers may vary. Items to be communicated to the audit committee include:  Significant accounting policies – Auditors should discuss BPH‘s revenue recognition policies and comment on their appropriateness. Discussion would include implementation of new accounting standards, if applicable.  Management‘s process in developing sensitive accounting estimates – The allowance for doubtful accounts is a significant accounting estimate for BPH because of the complexity of dealing with insurance companies and government sponsored healthcare programs. Also, accounting for certain investments at fair market value could involve subjectivity.  Difficulties encountered during the audit or disagreements with BPH management, if applicable  Other significant findings or issues – The kitchen fire is a significant issue that will be very costly for BPH. The audit committee should be well informed of the costs involved and the potential effect of the bad publicity on future hospital revenues.  Uncorrected and corrected misstatements – Auditors will provide a summary of all the misstatements and reasons why management left some uncorrected.  Business conditions affecting the entity – The downturn in the economy and decreased earnings from investments could adversely affect BPH‘s ability to cover the costs of charity care. A weak market could also result in fewer donations to BPH. Currently, there does not appear to be a going concern issue for the coming year. However, poor market conditions coupled with the bad publicity from the kitchen fire could mean trouble if management is not vigilant and proactive. The audit committee, along with the rest of the board, should request that management have a detailed plan for weathering the next 12-24 months.  Consultations with other accountants, if applicable  Management representation letter – The auditors provide the audit committee with a copy of the management representation letter. LO 4, 5, BT: AN, E Difficulty: Hard, TOT: 30 min., AACSB: Analytic, Communication AICPA AC: Measurement Analysis and Interpretation, AICPA PC: Communication, Section: Going Concern, Management Representation and Communication with Those Charged with Governance

Cloud 9 a. Below is a summary of findings and conclusions from the Cloud 9 problems from chapters 11, 12, 13, and 14: Chapter 11 – Our testing of accounts receivable using confirmations revealed two errors in our sample, that while corrected by the client, were not corrected on a timely basis. Both errors resulted in overcharging the customers. Auditors conclude this is not a significant deficiency.

Chapter 12 – The testing of accounts payable at 10/31/25 revealed a classification error in writing a month end accrual where items that should have been accrued to accounts payable were classified as accrued liabilities. This classification error amounted to $725,153.43. Accounts payable was understated by 4.84% and accrued liabilities was overstated by 2.81%.

Auditors conclude this is a significant deficiency as it is very close to a misstatement of accounts payable by 5%. However, there is no P&L impact.

Chapter 13 – Cloud 9 opened its first retail store which brings new inherent risks, such as risk of theft of inventory, increased sales returns, and exposure to risk associated with leasing premises and equipment. Cloud 9 must design internal controls for a retail location which are different from its wholesale operations. These risks are not material to Cloud 9‘s overall operations at this time, but if retail locations expand then the risk will increase. Therefore, it‘s important that the first retail location be a learning ground for management regarding proper internal controls over retail inventory.

Chapter 14 – The testing of fixed assets for the year ended 1/31/26 revealed an understatement of fixed assets and accounts payable as of 1/31/26. Fixed assets and accounts payable are understated by $463,197. Performance materiality (tolerable misstatement) for the fixed asset testing was $1 million.

Auditors conclude this is not a significant deficiency. There is no P&L impact, and the amount is considerably less than overall materiality. Also, there is no projected misstatement in this amount. Errors were found in a population tested 100%.

Items to be communicated to Cloud 9‘s audit committee include:  Critical accounting policies and practices – Policies over revenue recognition are critical to the fair presentation of Cloud 9‘s financial statements. Auditors should discuss Cloud 9‘s revenue recognition practices with the board and how the opening of the retail store impacts revenue recognition. Accounting for sales returns and purchase returns (to suppliers) is also critical. If any accounting standards over revenue recognition have changed since the prior audit, these changes should be discussed with the audit committee.  Critical accounting estimates - Some critical accounting estimates for Cloud 9 include estimates related to inventory valuation, warranties, allowance for doubtful accounts, and fair value estimates for derivatives. Auditors should discuss management‘s process for determining these estimates and the degree of subjectivity involved with the estimates. The derivatives fair value estimates have high estimation uncertainty; therefore, the auditors used a specialist to assist in the audit of this estimate.  Difficulties encountered during the audit, disagreements with management, consultations with other accountants – there are no issues to report in this area.  Other significant findings or issues – Cloud 9 is reporting a decline in earnings for the year. This was expected and is primarily caused by the increased expenses related to the opening of the new retail store. Auditors should discuss the signing of a 5-year purchase commitment with the Columbian supplier which qualifies as a Type II subsequent event and must be disclosed in the notes.  Corrected/uncorrected misstatements – Auditors provide the audit committee with a summary of proposed adjusting entries, some of which management has probably already corrected. If management has stated that some will not be corrected, the auditors should discuss the reasons why management will not correct with the audit committee. If the uncorrected misstatements are immaterial, then there is no issue with issuing an unqualified opinion.  Business conditions affecting the entity – The athletic shoes and apparel industry is very competitive, which the audit committee should already know. For the current year under audit, there are no unusual conditions that are impacting Cloud 9.  Internal control – no material weaknesses were noted; however, a significant deficiency was noted related to a month end accrual for accounts payable that resulted in a classification error. In addition, the opening of the retail store means designing internal controls over retail operations, which will differ from wholesale operations. Internal controls at the retail store will not be material to Cloud 9‘s overall operations, but if Cloud 9 intends to open more retail locations in the future, it is critical to have sound internal controls at retail locations to prevent/detect theft and accounting errors. LO 4, BT: AP, Difficulty: Medium, TOT: 45 min., AACSB: Analytic, Technology, AICPA FC: Decision Modeling, Research Section: Using the Work of Others

CHAPTER 16

Reporting on the Audit Learning Objectives 1.

Explain the components of the standard unqualified/unmodified audit report for public and private companies.

2.

3.

4.

5.

6.

7.

Evaluate situations requiring additional wording in the unmodified audit report on the financial statements.

Discuss modifications required to the auditor‘s report on the financial statements when the opinion is based in part on the report of another auditor.

Evaluate situations requiring a departure from an unmodified opinion on the financial statements.

Analyze how subsequently discovered facts may affect the auditor‘s report on the financial statements.

Explain the components of the standard unqualified opinion on the effectiveness of ICFR for public companies and evaluate situations that cause modifications to the unqualified opinion.

Explain preparation, compilation and review engagements performed on unaudited financial statements of a private company.

ANSWERS TO MULTIPLE-CHOICE QUESTIONS 1. A LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Communication, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report

2. D LO 1, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: Communication, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report

3. B LO 1, BT: C, Difficulty: Easy, TOT: 2 minutes, AACSB: Communication, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report

4. C LO 2, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: Analytic, AICPA AC: Reporting, Section: Additional Wording for the Standard Unmodified Report

5. B LO 2, BT: AN, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Additional Wording for the Standard Unmodified Report

6. A LO 2, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Reporting, Section: Additional Wording for the Standard Unmodified Report

7. D LO 3, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Reporting, Section: Opinion Based in Part on the Report of Another Auditor

8. A

LO 4, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Modifying the Audit Opinion

9. C LO 4, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Modifying the Audit Opinion

10. B LO 5, BT: AP, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Subsequently Discovered Facts

11. C LO 5, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Subsequently Discovered Facts

12. D LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

13. B LO 6, BT: C, Difficulty: Easy, TOT: 2 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

14. A LO 7, BT: AP, Difficulty: Medium, TOT: 2 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Preparation, Compilation and Review Engagements

ANSWERS TO REVIEW QUESTIONS R16.1 The standard unmodified report on the financial statements of a private company contains a paragraph outlining management and auditor responsibility for the financial statements so that there is no confusion as to who is responsible for the required reporting. Management is responsible for the preparation and fair presentation of financial statements and the design, maintenance, and implementation of internal controls. The auditor is responsible for conducting the audit in accordance with appropriate standards and providing reasonable assurance about the fair presentation of the financial statements. There is also a discussion that risk of not detecting material misstatements caused by fraud is higher than those caused by error. Because this report is for a private company, the paragraph also states that the auditors did not evaluate internal controls for the purpose of expressing an opinion on internal controls.

LO 1, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report

R16.2 The date on the auditor‘s report is the end of fieldwork date which signifies the date that sufficient appropriate evidence was gathered to support the audit opinion.

LO 1, BT: C, Difficulty: Easy, TOT: 5 min., AACSB: None, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report

R16.3 An emphasis of matter paragraph is used in the audit report to draw attention to important information that is already presented or disclosed in the financial statements. The auditor is required to include an emphasis of matter paragraph for changes in consistency. The auditor is allowed to include an emphasis of matter paragraph for any other matter that the auditor wishes to draw attention to, such as referencing a note about related party transactions.

LO 2, BT: AP, Difficulty: Medium, TOT: 10 min., AACSB: Analytic, AICPA AC: Reporting, Section: Additional Wording for the Standard Unmodified Report

R16.4 One of the core concepts in accounting is the consistency of accounting principles from one accounting period to the next. Therefore, auditors are responsible for evaluating the consistency of a client‘s financial statements. Examples of changes in consistency are changing from one acceptable accounting principle to another, changing the method of applying the accounting principle, and changing from one acceptable accounting principle to a newly adopted accounting principle.

LO 2, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Measurement Analysis and Interpretation, Section: Additional Wording for the Standard Unmodified Report

R16.5 If reference is made to a component auditor, the Opinion section is expanded to include the portion of the group financial statements that was audited by the component auditor. Also, the opinion statement is modified to note that the opinion is based on the report of the other auditors.

LO 3, BT: C, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Reporting, Section: Opinion Based in Part on the Report of Another Auditor

R16.6 A limitation of scope occurs when auditors cannot perform the planned audit procedures to gather sufficient appropriate evidence. An example of a scope limitation is management not giving the auditor access to specific files needed to perform an audit procedure. A departure from the financial reporting framework causes a material misstatement to occur, such as when a client is applying an accounting policy incorrectly.

LO 4, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Reporting, Section: Modifying the Audit Opinion

R16.7 A scope limitation caused by the client is worse than a situation-imposed scope limitation. An example of a client-imposed limitation is management preventing the auditors from performing certain procedures. Auditors would have to question the motives and integrity of management. An example of a situation-imposed scope limitation is a natural disaster destroying a client‘s accounting records and the resulting inability of the auditor to perform an audit.

LO 4, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Reporting, Section: Modifying the Audit Opinion

R16.8 A subsequent event is an event that occurs between the date of the financial statements and the auditor‘s report (end of fieldwork). The auditor is required to either adjust the financial statements or make a disclosure of the subsequent event. A subsequently discovered fact is a fact that the auditor discovers after the date of the auditor‘s report that if it was discovered before, may have caused the auditor to revise the report. The auditor is required to discuss the subsequently discovered fact with management and those charged with governance and management can revise financial statements if necessary. If the financial statements are revised, the auditor must reissue the audit report with an updated date. If the opinion on the updated audit report is different from the original opinion, the auditor must add an emphasis of matter paragraph that states the date of the previous report, the type of opinion previously issued, the key reasons for the difference of opinion, and a statement that the opinion on the revised financial statements is different from the previous opinion.

LO 5, BT: AN, Difficulty: Medium, TOT: 20 min., AACSB: Analytic, AICPA AC: Reporting, Section: Subsequently Discovered Facts

R16.9 Auditors must decide if they want to accept responsibility for an extended period of fieldwork or keep the original fieldwork date and only accept responsibility for the date of the subsequent event. In either case, the auditor must obtain an updated management representation letter that has the same date as the audit report. All procedures for the acceptance of the initial management representation letter must be followed when an updated letter is issued.

LO 5, BT: AP, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Reporting, Section: Subsequently Discovered Facts

R16.10 The components of an unqualified report of the effectiveness of ICFR:  Title- the title includes the terms ―registered‖ and ―independent.‖  Address- The address is to the board of directors and shareholders of the company.  Opinion section- This paragraph states that an audit of ICFR was conducted and states the auditor‘s opinion.  Paragraph referencing audit of financial statements- This references the auditor‘s report on financial statements.  Basis for Opinion section – States responsibilities and references registration with the PCAOB and adherence to independence requirements of the SEC  Scope paragraph- This paragraph explains the process of conducting an audit of the effectiveness of ICFR and states that the PCAOB standards were followed.  Definition and inherent limitations section- This paragraph defines ICFR and states inherent limitation of ICFR  Signature- States the firm name and location.  Date- Marks the end of fieldwork.

LO 6, BT: C, Difficulty: Easy, TOT: 15 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

R16.11 The auditors assess the likelihood of a control failing to prevent and detect a misstatement and the magnitude of the potential misstatement to the financial statements when determining if a control deficiency is a significant deficiency or a material weakness. A material weakness is a control deficiency such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is less severe than a material weakness. Ultimately, auditors must use their professional judgment when assessing the severity of a control deficiency.

LO 6, BT: AP, Difficulty: Easy, TOT: 10 min., AACSB: None, AICPA AC: Risk Assessment, Analysis and Management, Section: Reports on the Audit of ICFR

R16.12 The standard unqualified report on the effectiveness of ICFR would be modified for an adverse opinion if one or more material weaknesses exist. In the Opinion section, the auditor would state the company did not maintain effective ICFR for the reporting period. In the Basis for Opinion section, the auditor would include the definition of a material weakness and briefly explain the material weakness(es) found.

LO 6, BT: C, Difficulty: Medium, TOT: 10 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

R16.13 There are several differences between a preparation engagement, a compilation engagement, and a review engagement. A preparation engagement is not an assurance or attest service; therefore, the practitioner does not have to be independent. Also, there is no report issued in a preparation service. Compilation and review engagements are both considered attest engagements because the practitioner issues a report at the conclusion of the engagement. A compilation does not provide any assurance and a review provides limited assurance. The practitioner must be independent to perform a review but does not have to be independent to perform a compilation. In a compilation, a practitioner does not perform any procedures to verify or corroborate the client‘s accounting records. In a review engagement, a practitioner is required to perform analytical procedures and inquiry of management. The three services are similar in that they are provided to private companies only, and practitioners must follow standards issued by the AICPA‘s Accounting and Review Services Committee, which are the Statements on Standards for Accounting and Review Services, or SSARS. LO 7, BT: AN, Difficulty: Medium, TOT: 15 min., AACSB: Analytic, AICPA AC: Reporting, Section: Preparation, Compilation and Review Engagements

SOLUTIONS TO ANALYSIS PROBLEMS AP16.1

a.

For each CAM that is included in the auditor‘s report the auditor must  Identify the CAM,  Describe why the auditor considers the item a CAM,  Describe how the CAM was addressed during the audit, and  Refer to the relevant account or disclosures that relate to the CAM. The CAM has been identified (the issue of useful lives and residual values of aircraft), and the auditor describes why the audit firm considered it a CAM (due to the level of judgment required in determining the useful lives and residual values of the aircraft fleet).

However, aircraft are only part of fixed assets so the footnote where the values of aircraft is identified should be part of the description. Finally, the auditor must describe how the CAM was addressed during the audit.

b.

Following is a draft revision for the discussion of the CAM in the auditor‘s report.

Gazelle Airways has aircraft and related assets totaling $2,432 million and $1,932 million at December 31, 2026 and 2025 respectively as discussed in note X to the financial statements. The useful lives and residual values of aircraft may be influenced by new technology, economic conditions, and demand. Gazelle considers these changes when reassessing the useful lives and residual values of aircraft to determine the appropriate depreciation rates. This is a critical audit matter due to the level of judgment required by Gazelle in determining the useful lives and residual values of the aircraft fleet, which affects both carrying values of aircraft and depreciation charges.

We evaluated the controls in place over the calculation of depreciation around the initial input of, or changes to, residual values and useful life information. We audited Gazelle‘s assumption underpinning the calculation of residual values by assessing the historical accuracy of assumptions around residual values when aircraft are disposed. We also compared residual value to industry data and external information such as third-party sales prices. We then used analytical procedures to test the depreciation calculation.

LO1 BT: AN, Difficulty: Moderate, TOT: 20 minutes, AACSB: Communication, AICPA: Reporting, Section: Standard Unmodified/Unqualified Audit Report

AP16.2 The audit report for CC would be unmodified with a going concern section added as follows: Independent Auditor's Report To the owners of Central Companies

Opinion We have audited the financial statements of Central Companies (CC), which comprise the balance sheet as of December 31, 2025, and the related statements of income, changes in stockholders‘ equity, and cash flows for the year then ended, and the related notes to the financial statements.

In our opinion, the accompanying financial statements present fairly, in all material respects, the financial position of CC as of December 31, 2025, and the results of its operations and its cash flows for the year then ended in accordance with accounting principles generally accepted in the United States of America.

Basis for Opinion We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of CC and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Substantial Doubt About the Company’s Ability to Continue as a Going Concern The accompanying financial statements have been prepared assuming that CC will continue as a going concern. As discussed in Note X to the financial statements, CC has suffered recurring losses from operations, has a net capital deficiency, and has stated substantial doubt exists about CC's ability to continue as a going concern. Management's evaluation of the events and conditions and management's plans regarding these matters are also described in Note X. The financial statements do not include any adjustments that might result from the outcome of this uncertainty. Our opinion is not modified with respect to this matter.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about CC‘s ability to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit.

Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements.

Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of CC‘s internal control. Accordingly, no such opinion is expressed.

Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about CC‘s ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Accounting Firm Signature City, State

End of fieldwork date LO 1, 2 BT: AP, Difficulty: Easy, TOT: 15 min., AACSB: Communication, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report, Additional Wording for the Standard Unmodified Audit Report

AP16.3 a. AU-C 800.10 discusses items for the auditor to consider when accepting the engagement.

The auditor should obtain an understanding of (1) the purpose for which the financial statements are prepared, (2) the intended users, and (3) the steps taken by management to determine that the applicable financial reporting framework is acceptable in the circumstances. AU-C 800.11 explains the preconditions for the audit. The auditor should obtain the agreement of management that it acknowledges and understands its responsibility to include all informative disclosures that are appropriate for the special purpose framework used to prepare the financial statements. If these preconditions are satisfied, the auditor may accept the engagement. b. Example report from AU-C 800.A41 Illustration 2 Independent Auditor's Report [Appropriate Addressee]

Report on the Audit of the Financial Statements Opinion We have audited the financial statements of ABC Partnership, which comprise the statements of assets, liabilities, and capital—income tax basis as of December 31, 20X1, and the related statements of revenue and expenses—income tax basis and of changes in partners' capital accounts—income tax basis for the year then ended, and the related notes to the financial statements.

In our opinion, the accompanying financial statements present fairly, in all material respects, the assets, liabilities, and capital of ABC Partnership as of December 31, 20X1, and its revenue and expenses and changes in partners' capital accounts for the year then ended in accordance with the basis of accounting ABC Partnership uses for income tax purposes described in Note X.

Basis for Opinion We conducted our audit in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor's Responsibilities for the Audit of the Financial Statements section of our report. We are required to be independent of ABC Partnership, and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audit. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Emphasis of Matter — Basis of Accounting We draw attention to Note X of the financial statements, which describes the basis of accounting. The financial statements are prepared on the basis of accounting ABC Partnership uses for

income tax purposes, which is a basis of accounting other than accounting principles generally accepted in the United States of America. Our opinion is not modified with respect to this matter.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with the basis of accounting ABC Partnership uses for income tax purposes and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor's report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit.

Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements.

Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of ABC Partnership's internal control. Accordingly, no such opinion is expressed.

Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about ABC Partnership's ability to continue as a going concern for a rea-sonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Report on Other Legal and Regulatory Requirements

[The form and content of this section of the auditor's report would vary depending on the nature of the auditor's other reporting responsibilities.]

[Signature of the auditor's firm] [City and state where the auditor's report is issued] [Date of the auditor's report The similarities and differences of this report with the report in Illustration 16.1 are as follows:  Title and addressee are the same  The name of the financial statements will be different under a tax basis of accounting  In the management responsibility paragraph, the tax basis of accounting is referenced instead of GAAP  The auditor‘s responsibility paragraphs are the same  In the opinion paragraph, the name of the financial statements is different, and the tax basis of accounting is referenced instead of GAAP  There is an emphasis-of-matter paragraph added that directs attention to the note that describes the basis of accounting LO 1, 2 BT: AP, Difficulty: Moderate, TOT: 30 min., AACSB: Technology, AICPA AC: Reporting, Research Section: Standard Unmodified/Unqualified Audit Report, Additional Wording for the Standard Unmodified Audit Report

AP16.4 a. Marco should first consider if the subsidiary is a material portion of the consolidated financial statements. Since the subsidiary represents 13% of total assets on the consolidated financial statements, it would most likely be considered material. Next, Marco must decide if he wants to make reference to the component auditor in the audit report. Making reference to the component auditor means that Marco is not assuming responsibility for the work performed by the component auditor. Since the component auditor is auditing a material subsidiary, Marco will most likely reference the component auditor in the audit report. b. If Marco does not assume responsibility for the work of the component auditor, the audit report would be drafted as follows: Independent Auditor's Report To the owners of Sun Products: Opinion We have audited the financial statements of Sun Products, which comprise the balance sheets as of December 31, 2025 and 2024, and the related statements of income, changes in stockholders‘ equity, and cash flows for the years then ended, and the related notes to the financial statements.

In our opinion, based on our audits and the report of the other auditors, the accompanying financial statements present fairly, in all material respects, the financial position of Sun Products as of December 31, 2025 and 2024, and the results of its operations and its cash flows for the years then ended in accordance with accounting principles generally accepted in the United States of America.

We did not audit the financial statements of Al Aire Libre, a wholly owned subsidiary, which statements reflect total assets constituting 13 percent, respectively, of consolidated total assets at December 31, 2025. Those statements were audited by other auditors, whose report has been furnished to us, and our opinion, insofar as it relates to the amounts included for Al Aire Libre, is based solely on the report of other auditors.

Basis for Opinion We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of Sun Products and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about Sun Product‘s ability to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  

Exercise professional judgment and maintain professional skepticism throughout the audit.

Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements.



 

Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of Sun Products‘ internal control. Accordingly, no such opinion is expressed.

Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about Sun Products‘ ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Audit firm signature City, State End of fieldwork date LO 3, BT: AP, Difficulty: Moderate TOT: 20 min., AACSB: Communication, AICPA AC: Reporting, Section: Opinion Based in Part on the Report of Another Auditor

AP16.5 1.

C 2.

B 3.

D 4.

A 5.

A 6.

C 7.

A 8.

B LO 1,4, BT: AP, Difficulty: Easy, TOT: 20 min., AACSB: Analytic, AICPA AC: Reporting, Section: Standard Unmodified/Unqualified Audit Report, Modifying the Audit Opinion

AP16.6 At the end of the previous year, Waveland was attempting to refinance a material amount of debt but was unable to find alternate financing before the auditor‘s report was issued. The situation with the debt refinancing was not disclosed in the notes, which is a violation of the financial reporting framework. The previous auditor issued an unmodified report, but it should have been modified because of the material departure from the financial reporting framework. A qualified opinion would have been the appropriate report to issue, assuming there were no other material or pervasively material departures from the financial reporting framework. If the previous auditor also felt there was a going concern issue, since Waveland could not secure alternate financing, a going concern section would be appropriate. The going concern section can be added after the Basis for Qualified Opinion section.

LO 2, 4 BT: AN, Difficulty: Basic, TOT: 15 min., AACSB: None, AICPA AC: Reporting, Section: Additional Wording for the Standard Unmodified Report, Modifying the Audit Opinion

AP16.7 a.

Independent Auditor’s Report

To the owners of Billy’s Burger House Opinion We have audited the financial statements of Billy‘s Burger House, which comprise the balance sheet as of December 31, 2025, and the related statements of income, changes in stockholders‘ equity, and cash flows for the year then ended, and the related notes to the financial statements.

In our opinion, the accompanying financial statements present fairly, in all material respects, the financial position of Billy‘s Burger House as of December 31, 2025, and the results of its operations and its cash flows for the year then ended in accordance with accounting principles generally accepted in the United States of America.

Basis for Opinion We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of Billy‘s Burger House and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Emphasis of Matter As disclosed in Note X to the financial statements, Billy‘s Burger House conducts business with related parties. Our opinion is not modified with respect to this matter.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about Billy‘s Burger House‘s ability to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit.

Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements.

Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of Billy‘s Burger House‘s internal control. Accordingly, no such opinion is expressed.

Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about Billy‘s Burger House‘s ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Accounting Firm LLP Baton Rouge, Louisiana End of fieldwork date b. If management of Billy‘s Burger House did not disclose the related party transactions, it would be considered a departure from the financial reporting framework. Assuming the situation is material, the next step would be to discuss the issue with those charged with governance, which is typically the audit committee of the board of directors. If the audit committee agrees with management and refuses to make the adjustment, the next step for the auditor is to modify the audit opinion. If the misstatement is material, but not pervasive, a qualified opinion is issued. By doing this, the auditors are stating that the financial statements are fairly presented, except for a material departure from the applicable financial reporting framework. If a misstatement is material and pervasive, an adverse opinion is issued. In an adverse opinion, auditors are stating the financial statements are not presented fairly due to one or more pervasively material departures from the applicable financial reporting framework. Ultimately, it is up to the auditor‘s professional judgment whether the misstatement is material or pervasively material.

LO 2, 4, BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Communication, AICPA AC: Reporting, Section: Additional Wording for the Standard Unmodified Report, Modifying the Audit Opinion

AP16.8 a. The missing files create a limitation on the scope of the audit. There is the possibility that the auditor is not able to gather sufficient appropriate evidence on which to base his audit opinion. It appears that the circumstances were beyond the control of the client and mainly affect sales revenue and accounts receivable.

The reporting possibilities in these circumstances are: Unqualified report if the lack of evidence affecting sales revenue and accounts receivable is not material Qualified report if the loss of sales records and accounts receivable records prevent the auditor from obtaining sufficient appropriate evidence and the effect is material but not pervasive Disclaimer of opinion report if the loss of sales records and accounts receivable records prevent the auditor from obtaining sufficient appropriate evidence and the effect is material and pervasive.

Critical issues considered for the audit opinion decision include: Evidence that the problem was confined to a defined period- The information is that the problem began four months into the year and appears to be corrected.

Ability to perform alternative procedures, such as using subsequent cash receipts to verify sales for the period.

Confidence in the collection and valuation of accounts receivable at the end of the fiscal period Given the circumstances of Kingston Catering, the most likely audit opinion is qualified because of the above reasons. The audit report would be as follows: Independent Auditor's Report To the owners of Kingston Catering Qualified Opinion We have audited the financial statements of Kingston Catering, which comprise the balance sheet as of December 31, 202X, and the related statements of income, changes in stockholders‘ equity, and cash flows for the year then ended, and the related notes to the financial statements.

In our opinion, except for the effects of the matter described in the Basis for Qualified Opinion section of our report, the accompanying financial statements present fairly, in all material respects, the financial position of Kingston Catering as of December 31, 202X, and the results of its operations and its cash flows for the year then ended in accordance with accounting principles generally accepted in the United States of America.

Basis for Qualified Opinion In the second quarter, Kingston Catering experienced an IT system issue in which critical accounting data related to sales and accounts receivable was corrupted. The company was not able to recover some of the data, therefore, we were not able to obtain sufficient appropriate audit evidence to substantiate sales and accounts receivable from the first four months of the year. Consequently, we were unable to determine whether any adjustments to these amounts were necessary.

We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of Kingston Catering and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about Kingston Catering‘s ability to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit.

Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements.

Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of Kingston Catering‘s internal control. Accordingly, no such opinion is expressed.

Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about Kingston Catering‘s ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Audit firm signature City, State End of field work date b. The auditor is required to communicate in writing with those charged with governance regarding significant findings from the audit. The communication should contain a full description of the matter giving rise to the audit qualification and explain reasons for the modification of the audit opinion.

The auditor also communicates significant deficiencies and material weaknesses in internal control to those charged with governance and makes a recommendation for improvements to internal control. Deficiencies in efficient and effective back up of the IT system and consequently loosing important accounting records is a significant matter which needs to be communicated to those charged with governance.

LO 4, BT: AP, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Reporting, Section: Modifying the Audit Opinion

AP16.9 a. In general, auditors are not required to perform audit procedures after the date of the auditor‘s report. However, if new information comes to light after the date of the auditor‘s report, and the information could impact the audited financial statements and/or the auditor‘s opinion, then the auditors must gather information about the situation and possibly perform additional audit procedures. b. The audit team should take the following steps regarding the subsequently discovered facts: 1.

Discuss the matter with the appropriate level of management and, if appropriate, those charged with governance – since this situation involves fraud, the auditors will meet with the CFO and probably the CEO and audit committee (if Hexagon has an audit committee and board of directors).

2.

Determine if the information is reliable, material, and if it existed at the date of the auditor‘s report – The CFO stated the fraud has been going on for several years, therefore, it did exist at the date of the auditor‘s report and at the financial statement date. Since it is fraud, it is qualitatively material, no matter what the amount. But also, it involves members of management (Controller and Human Resources Director), one of whom has a key financial reporting role with the client.)

3.

Determine if the financial statements need to be revised – Hexagon management should take action by firing the individuals committing fraud and launching an investigation to determine the impact on the financial statements. If the financial statements need to be revised, management must make the appropriate adjustment and/or note disclosure. The auditors can perform procedures to ensure the amount of the adjustment is reasonable and made to the proper accounts.

4.

Determine effect on the audit report – Since the audit report had not yet been issued, the auditors can make changes to the report. If the financial statements are revised, the auditors must determine if the original opinion on the fair presentation of the financial statements is still valid. They must also consider the dating of the audit report.

They can choose to dual date (February 28, 2026 and March 5, 2026) or extend the end of fieldwork to March 5, 2026. If the end of fieldwork date is extended, the auditors are assuming responsibility for events occurring through March 5, 2026. c. Because fraud was occurring, that means there was some type of failure in internal control.

Either controls were not designed appropriately, or they were not being implemented correctly or both. Since two members of management were involved, it could be the result of collusion and/or override of controls. Since Hexagon is a private company, the auditors were not required to issue an opinion on internal controls, but the auditors were required to gain an understanding of internal controls and test any controls that they planned to rely on as part of the audit plan and strategy. The auditors should inquire about which controls failed that allowed the fraud to occur. If the auditors had relied on those controls and performed less substantive testing, they should perform some additional substantive tests to ensure they have gathered sufficient appropriate evidence on which to base their audit opinion.

LO 5 BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Reporting, Section: Subsequently Discovered Facts

AP16.10 The example of a combined report on the financial statements and effectiveness of internal control is found in AS2201.87: (1) Report of Independent Registered Public Accounting Firm (2) To the shareholders and the board of directors of W Company

(3) Opinions on the Financial Statements and Internal Control over Financial Reporting We have audited the accompanying balance sheets of W Company (the "Company") as of December 31, 20X8 and 20X7, and the related statements of [titles of the financial statements, e.g., income, comprehensive income, stockholders' equity, and cash flows] for each of the years in the three-year period ended December 31, 20X8, and the related notes [and schedules] (collectively referred to as the "financial statements"). We also have audited the Company's internal control over financial reporting as of December 31, 20X8, based on [Identify control criteria, for example, "criteria established in Internal Control - Integrated Framework: (20XX) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)."].

In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 20X8 and 20X7, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 20X8 in conformity with accounting principles generally accepted in the United States of America. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 20X8, based on [Identify control criteria, for example, "criteria established in Internal Control Integrated Framework: (20XX) issued by COSO."].

(5) Basis for Opinion The Company's management is responsible for these financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying [title of management's report]. Our responsibility is to express an opinion on the Company's financial statements and an opinion on the Company's internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) ("PCAOB") and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. (6) We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the financial statements included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a

material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

(7) Definition and Limitations of Internal Control Over Financial Reporting A company's internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company's internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company's assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Critical Audit Matters [Include critical audit matters] (8) [Signature] (9) We have served as the Company's auditor since [year].

[City and State or Country] (10) [Date] The combined report has all of the required components: 1.

Title 2.

Address 3.

Opinion paragraph 4.

The reference to the other audit is not necessary because the opinions for both audits are in the same report.

5.

Basis for opinion paragraph 6.

Scope paragraph 7.

Definition and inherent limitations paragraph for ICFR report 8.

Signature 9.

Statement about auditor tenure 10. Date – end of fieldwork LO 6 BT: C, Difficulty: Easy, TOT: 20 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

AP16.11 Phillips & Craig should issue a disclaimer of opinion on the effectiveness of ICFR. First, it is unrealistic to expect the completion of an integrated audit when the auditors are hired after yearend. There must have been a special situation that caused that to happen. (Note that Phillips & Craig should have inquired of the predecessor auditor about the reason for the change.) Second, because of the time constraints, Phillips & Craig was not able to complete a full audit of ICFR. If the auditors cannot complete all of their planned work, and the situation is material, then they must issue a disclaimer report. Third, even though Phillips & Craig are issuing an unqualified report on the fair presentation of the financial statements, that does not imply that internal controls are effective. A client could have poor controls but still follow the financial reporting framework and fairly present its financial statements.

In the disclaimer report, Phillips & Craig need to include a separate paragraph that describes the situation causing the scope limitation. The auditors would also remove the paragraph that explains the process of conducting an audit of ICFR. LO 6 BT: AP, Difficulty: Medium, TOT: 20 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

AP16.12 a. The auditors would issue an unqualified opinion on the effectiveness of ICFR:

REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM To the Shareholders and Board of Directors of Industrial Holdings Inc. Opinion on Internal Control over Financial Reporting We have audited the internal control over financial reporting of Industrial Holdings Incorporated and subsidiaries (the ―Company‖) as of December 31, 2025, based on criteria established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control—Integrated Framework (2013) issued by COSO. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, 2025, of the Company and our report dated February 12, 2026, expressed an unqualified opinion on those financial statements.

Basis for Opinion The Company‘s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management‘s Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company‘s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control over Financial Reporting A company‘s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

A company‘s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company‘s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. /s/ Walker LLP Baton Rouge, LA February 12, 2026 b. The auditors would issue an adverse report because one material weakness was identified and the client had not remediated the material weakness. A draft of the report would be as follows: REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM To the Shareholders and Board of Directors of Industrial Holdings Incorporated

Opinion on Internal Control over Financial Reporting We have audited the internal control over financial reporting of Industrial Holdings Incorporated and subsidiaries (the ―Company‖) as of December 31, 2025, based on criteria established in Internal Control—Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, because of the effect of the material weakness identified below on the achievement of the objectives of the control criteria, the Company has not maintained, in all material respects, effective internal control over financial reporting as of December 31, 2025, based on criteria established in Internal Control—Integrated Framework (2013) issued by COSO. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended December 31, 2025, of the Company and our report dated February 12, 2026, expressed an unqualified opinion on those financial statements.

Basis for Opinion The Company‘s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management‘s Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company‘s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company‘s annual financial statements will not be prevented or detected on a timely basis. A material weakness related to ineffective access controls over the inventory management system has been identified and included in management‘s assessment. This material weakness was considered in determining the nature, timing, and extent of audit tests applied in our audit of the consolidated balance sheet of Industrial Holdings Incorporated of December 31, 2025 and the related consolidated statements of operations, cash flows, and equity for the period ended December 31, 2025. This report does not affect our report on such financial statements.

Definition and Limitations of Internal Control over Financial Reporting A company‘s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

A company‘s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company‘s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. /s/ Walker LLP Baton Rouge, LA February 12, 2026 c. Students may provide one of two different answers for this question.

1.

2.

Auditors detect a material weakness during controls testing in October 2025 for an integrated audit for the year ended December 31, 2025. Even though management corrected the weakness, and the auditors determined the weakness has been remediated by early November, an adverse opinion on the effectiveness of ICFR should still be issued. Because nine months of the year passed with the material weakness undetected (February – October), an adverse opinion would be reasonable. In addition, the material weakness relates to the number of employees who have access to edit transactions in the inventory management system. Therefore, this type of material weakness is indicative of higher risk of material misstatement and higher risk of fraud stemming from the excessive amount of employees who have authorization to edit financial data. Due to these circumstances and increased risk factors, an adverse opinion should be reported for ICFR. Auditors detect a material weakness during controls testing in October 2025 for an integrated audit for the year ended December 31, 2025. Management corrected the material weakness in early November. Since it was corrected and the auditors had time to test the control and confirmed it is working effectively for the rest of the year, the auditors may issue an unqualified opinion on ICFR. Other factors may impact this decision, such as the number of employees that had access to edit the data before the control was remediated.

LO 6 BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: None, AICPA AC: Reporting, Section: Reports on the Audit of ICFR

AP16.13 Both the ASB and the PCAOB have a standard related to other information in documents containing audited financial statements. The standards are as follows: PCAOB- AS 2710 Other Information in Documents Containing Audited Financial Statements The auditor‘s responsibility with respect to information in a document does not extend beyond the financial information identified in the audit report, and the auditor has no obligation to perform any procedures to corroborate other information contained in a document. However, the auditor should read the other information and consider whether the information is materially inconsistent with information appearing in the financial statements. If there is a material incon-

sistency, the auditor should determine whether the financial statements, the audit report, or both require revision. If the financial statements and audit report do not require revision, the auditor should request the client revise the other information that is inconsistent with the financial statements and audit report.

ASB- AU-C 720 Other Information in Documents Containing Audited Financial Statements The auditor‘s opinion on the financial statements does not cover other information, and the auditor has no responsibility for determining whether such information is properly stated. The auditor is required to read and consider the other information because other information that is materially inconsistent with the financial statements or the auditor‘s knowledge obtained in the audit may indicate a material misstatement of the financial statements or that a material misstatement of other information exists, either of which may undermine the credibility of the financial statements and the auditor‘s report. The auditor should arrange with management to obtain the other information prior to the report release date, if possible. If reading the other information, the auditor finds a material inconsistency, the auditor should determine whether the audited financial statements or other information needs to be revised.

Both the PCAOB and ASB state that the auditor has no responsibility over other information, but the auditor should read this other information because it can undermine information the auditor is responsible for in the financial statements.

LO 6, BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, Technology, AICPA AC: Research, Section: Reports on the Audit of ICFR

AP16.14 a. Some similarities of a review engagement and audit engagement are as follows:  Practitioner must be independent.  Both provide some level of assurance.  Engagement letter is required.  Management representation letter is required.  Procedures are performed to gather evidence that the financial statements are prepared according to the financial reporting framework.  Written report provided at the end of the engagement.

Some differences between a review engagement and audit engagement are as follows:  A review engagement is performed for private companies only, but an audit can be performed on private and public companies.  An audit provides reasonable assurance (higher level of assurance), and a review provides limited assurance.  Only two types of procedures are required for a review, analytical procedures and inquiry. In an audit, more procedures are required (such as confirmation, recalculation, etc.) for the auditor to provide reasonable assurance.  A review engagement follows SSARS, which an audit is performed in accordance with the AICPA‘s professional auditing standards for private companies (and with PCAOB standards for public companies) b. Example of a review report modified for a departure from the applicable financial reporting framework (AR-C 90.A216 Illustration 5): Independent Accountant's Review Report [Appropriate Addressee] I (We) have reviewed the accompanying financial statements of XYZ Company, which comprise the balance sheets as of December 31, 20X2 and 20X1, and the related statements of income, changes in stockholders' equity, and cash flows for the years then ended, and the related notes to the financial statements. A review includes primarily applying analytical procedures to management's (owners') financial data and making inquiries of company management (owners). A review is substantially less in scope than an audit, the objective of which is the expression of an opinion regarding the financial statements as a whole. Accordingly, I (we) do not express such an opinion.

Management’s Responsibility for the Financial Statements Management (Owners) is (are) responsible for the preparation and fair presentation of these financial statements in accordance with accounting principles generally accepted in the United States of America; this includes the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement whether due to fraud or error.

Accountant’s Responsibility My (Our) responsibility is to conduct the review engagements in accordance with Statements on Standards for Accounting and Review Services promulgated by the Accounting and Review

Services Committee of the AICPA. Those standards require me (us) to perform procedures to obtain limited assurance as a basis for reporting whether I am (we are) aware of any material modifications that should be made to the financial statements for them to be in accordance with accounting principles generally accepted in the United States of America. I (We) believe that the results of my (our) procedures provide a reasonable basis for my (our) conclusion.

We are required to be independent of XYZ Company and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements related to our reviews.

Basis for Qualified Conclusion As disclosed in Note X to these financial statements, accounting principles generally accepted in the United States of America require that inventory cost consist of material, labor, and overhead. Management has informed me (us) that the inventory of finished goods and work in process is stated in the accompanying financial statements at material and labor cost only, and that the effects of this departure from accounting principles generally accepted in the United States of America on financial position, results of operations, and cash flows have not been determined.

Qualified Conclusion Based on my (our) reviews, except for the effect of the matter described in the Basis for Qualified Conclusion paragraph, I am (we are) not aware of any material modifications that should be made to the accompanying financial statements in order for them to be in accordance with accounting principles generally accepted in the United States of America.

[Signature of accounting firm or accountant, as appropriate] [Accountant's city and state] [Date of the accountant's review report] LO 7, BT: AP, Difficulty: Medium, TOT: 25 min., AACSB: Analytic, Technology, AICPA AC: Reporting, Research Section: Preparation, Compilation and Review Engagements

SOLUTIONS TO AUDIT DECISION CASES C16.1 a. It appears that KCI has a justified change in accounting principle. KCI is moving to an inventory valuation method that is more consistent with the industry, and the new method is acceptable under the financial reporting framework. KCI management must properly account for the change in the financial statements and prepare a note disclosure describing the change. b. Assuming KCI has accounted for the change properly, the auditors can issue an unmodified report with an emphasis-of-matter paragraph for the consistency reference: Independent Auditor’s Report To the owners of King Companies, Inc. Opinion We have audited the financial statements of King Companies, Inc. (KCI), which comprise the balance sheets as of December 31, 2025, and the related statements of income, changes in stockholders‘ equity, and cash flows for the years then ended, and the related notes to the financial statements.

In our opinion, the accompanying financial statements present fairly, in all material respects, the financial position of KCI as of December 31, 2025, and the results of its operations and its cash flows for the year then ended in accordance with accounting principles generally accepted in the United States of America.

Basis for Opinion We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of KCI and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Emphasis of Matter As disclosed in Note X to the financial statements, KCI elected to change its method of valuing inventory from an average cost method to FIFO. Our opinion is not modified with respect to this matter.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about KCI‘s abil-

ity to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit. Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks.

Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of KCI‘s internal control. Accordingly, no such opinion is expressed. Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements. Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about KCI‘s ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Thornson & Danforth LLP Los Angeles, California March 1, 2026 LO 1, 2, BT: E, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Standard Unmodified/Unqualified Audit Report, Additional Wording for the Standard Unmodified Report

C16.2 If KCI management refuses to make the entries to correct the material misstatements and does not disclose the change in accounting principle, the situation is referred to as a departure from the applicable financial reporting framework. The auditors would choose between issuing a

qualified opinion or an adverse opinion. When considering which modified opinion to use, the auditors must determine if the issues are material or pervasively material. Factors to consider when determining if the issues are pervasively material include:  The misstatements are not confined to specific elements, accounts, or items in the financial statements.  If the misstatements are confined, they represent or could represent a substantial portion of the financial statements.  In the context of disclosures, it is fundamental to users‘ understanding of the financial statements.

Example of a qualified opinion for KCI: Independent Auditor's Report To the owners of King Companies, Inc

Qualified Opinion We have audited the financial statements of King Companies, Inc. (KCI), which comprise the balance sheets as of December 31, 2025, and the related statements of income, changes in stockholders‘ equity, and cash flows for the year then ended, and the related notes to the financial statements.

In our opinion, except for the effects of the matter described in the Basis for Qualified Opinion section of our report, the accompanying financial statements present fairly, in all material respects, the financial position of KCI as of December 31, 2025, and the results of its operations and its cash flows for the years then ended in accordance with accounting principles generally accepted in the United States of America.

Basis for Qualified Opinion The company changed methods of valuing inventory and has not properly accounted for the change or disclosed the change in accounting principle. Accounting principles generally accepted in the United States of America require changes in accounting principle to be properly accounted for and disclosed in the financial statements. In addition, material misstatements caused by error and weak internal controls were discovered during the audit. KCI management did not make the necessary adjustments to correct the material misstatements so that the financial statements would be fairly presented.

We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of KCI and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about KCI‘s ability to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud

may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit.

Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks. Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements.

Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of KCI‘s internal control. Accordingly, no such opinion is expressed.

Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements.

Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about KCI‘s ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Thornson & Danforth, LLP Los Angeles, California March 1, 2026

Example of an adverse opinion for KCI: Independent Auditor's Report To the owners of King Companies, Inc: Adverse Opinion We have audited the financial statements of King Companies, Inc. (KCI), which comprise the balance sheets as of December 31, 2025, and the related statements of income, changes in stockholders‘ equity, and cash flows for the year then ended, and the related notes to the financial statements.

In our opinion, because of the significance of the matter discussed in the Basis for Adverse Opinion section of our report, the accompanying financial statements do not present fairly, in all material respects, the financial position of KCI as of December 31, 2025, and the results of its operations and its cash flows for the years then ended in accordance with accounting principles generally accepted in the United States of America.

Basis for Adverse Opinion The company changed methods of valuing inventory and has not properly accounted for the change or disclosed the change in accounting principle. Accounting principles generally accepted in the United States of America require changes in accounting principle to be properly accounted for and disclosed in the financial statements. In addition, material misstatements caused by error and weak internal controls were discovered during the audit. KCI management did not make the necessary adjustments to correct the material misstatements so that the financial statements would be fairly presented.

We conducted our audits in accordance with auditing standards generally accepted in the United States of America (GAAS). Our responsibilities under those standards are further described in the Auditor‘s Responsibilities for the Audit of the Financial Statements section of our report.

We are required to be independent of KCI and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audits. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinion.

Responsibilities of Management for the Financial Statements Management is responsible for the preparation and fair presentation of the financial statements in accordance with accounting principles generally accepted in the United States of America, and for the design, implementation, and maintenance of internal control relevant to the preparation and fair presentation of financial statements that are free from material misstatement, whether due to fraud or error.

In preparing the financial statements, management is required to evaluate whether there are conditions or events, considered in the aggregate, that raise substantial doubt about KCI‘s ability to continue as a going concern for one year from the issuance date of the financial statements.

Auditor’s Responsibilities for the Audit of the Financial Statements

Our objectives are to obtain reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and to issue an auditor‘s report that includes our opinion. Reasonable assurance is a high level of assurance but is not absolute assurance and therefore is not a guarantee that an audit conducted in accordance with GAAS will always detect a material misstatement when it exists. The risk of not detecting a material misstatement resulting from fraud is higher than for one resulting from error, as fraud may involve collusion, forgery, intentional omissions, misrepresentations, or the override of internal control. Misstatements are considered material if there is a substantial likelihood that, individually or in the aggregate, they would influence the judgment made by a reasonable user based on the financial statements.

In performing an audit in accordance with GAAS, we:  



 

Exercise professional judgment and maintain professional skepticism throughout the audit. Identify and assess the risks of material misstatement of the financial statements, whether due to fraud or error, and design and perform audit procedures responsive to those risks.

Such procedures include examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Obtain an understanding of internal control relevant to the audit in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of KCI‘s internal control. Accordingly, no such opinion is expressed. Evaluate the appropriateness of accounting policies used and the reasonableness of significant accounting estimates made by management, as well as evaluate the overall presentation of the financial statements. Conclude whether, in our judgment, there are conditions or events, considered in the aggregate, that raise substantial doubt about KCI‘s ability to continue as a going concern for a reasonable period of time.

We are required to communicate with those charged with governance regarding, among other matters, the planned scope and timing of the audit, significant audit findings, and certain internal control–related matters that we identified during the audit.

Thornson & Danforth, LLP Los Angeles, California March 1, 2026 LO 4, BT: AP, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Reporting, Section: Modifying the Audit Opinion

C16.3 a. Leo & Lee should consider the following factors when deciding whether to use the Brazilian accounting firm:  To be the principal auditor, Leo & Lee must audit the majority of MSI‘s consolidated financial statements, which it will since Jungle Max represents only 15% of MSI‘s total consolidated assets.  Leo & Lee must be knowledgeable about Jungle Max‘s financial statements even if they are being audited by another firm.  Leo & Lee must consider the reputation of the Brazilian firm by researching if the firm is a member of a professional organization and also if the firm has been in trouble with any regulatory agencies.  Leo & Lee must determine if the Brazilian firm has the capacity (staff) and the time (availability) to complete the audit of Jungle Max. b. The responsibilities of the Leo & Lee partner as they relate to the Brazilian accounting firm are:  Direct and supervise the Brazilian firm.  Review the main conclusions drawn by the Brazilian firm.  Review the working papers of the Brazilian firm.  Determine whether to reference the work of the Brazilian firm in the audit report or take full responsibility for the work performed by the Brazilian firm and not reference the firm. c. An example of an unqualified opinion based in part on the work of another auditor (AS 1205.09): Report of Independent Registered Public Accounting Firm To the shareholders and the board of directors of Mobile Security, Inc Opinion on the Financial Statements We have audited the accompanying consolidated balance sheets of Mobile Security, Inc. (the "Company") and subsidiaries as of June 30, 2026 and 2025, and the related consolidated statements of income, comprehensive income, stockholders' equity, and cash flows for the years then ended, and the related notes. In our opinion, based on our audit and the report of the other auditors, the consolidated financial statements present fairly, in all material respects, the financial position of the Company as of June 30, 2026 and 2025, and the results of its operations and its cash flows for the year then ended in conformity with accounting principles generally accepted in the United States of America.

We did not audit the financial statements of Jungle Max, a wholly-owned subsidiary, which statements reflect total assets constituting 15 percent of the related consolidated totals. Those statements were audited by other auditors whose report has been furnished to us, and our opinion, insofar as it relates to the amounts included for Jungle Max, is based solely on the report of the other auditors.

Basis for Opinion These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on these financial statements based on our audit. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) ("PCAOB") and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audit included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audit also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audit and the report of the other auditors provide a reasonable basis for our opinion.

Critical Audit Matters [if applicable] [Include critical audit matters] [Signature] We have served as the Company's auditor since [year].

[City and State or Country] [Date] LO 4, BT: AP, Difficulty: Medium, TOT: 40 min., AACSB: Technology, AICPA AC: Reporting, Research, Section: Opinion Based in Part on the Report of Another Auditor

C16.4 (Student answers may vary.) a. Some questions to inquire of management would include the following:  What percentage of your patients use Infinity Health Insurance? Is it a material amount that could impact your ability to generate revenues in the future? Does this situation present a going concern issue?  How much of your accounts receivable (A/R) balance is outstanding with Infinity Health Insurance? Is it still planning to pay the amount owed?  Was this a surprise announcement from Infinity or had the insurance provider been hinting that this might happen?  Have you or are you planning to discuss further with Infinity in hopes of the insurance provider giving BPH a second chance? Are there some incentives or concessions that

BPH can offer to Infinity insurance holders? Perhaps instead of dropping BPH there can be a probationary period to give BPH time to improve? b. Assuming the loss of Infinity Health Insurance patients is material, the auditors would take the following steps:  Discuss with an appropriate level of management and those charged with governance.  Gather evidence to support that the information is reliable and material.  Determine if the information impacts the financial statements and auditor‘s report.

The financial statements could be impacted depending on the answers to questions asked of management. If Infinity is refusing to pay outstanding receivables that existed at June 30, 2026, and the amount is material, then it is a Type I event that requires adjustment and disclosure in the financial statements. If Infinity agrees to pay all outstanding receivables, then it is a Type II event and only needs to be disclosed in the notes. In either case, management would need to make the changes and the auditors would audit the changes that were made. If losing Infinity patients poses a going concern issue for BPH, then management must disclose that in the notes and the auditors would review the note disclosure. Management would also be expected to contact the users of the financial statements, in this case BPH‘s lenders, and tell them not to rely on the financial statements because they are being revised and new ones will be issued. c. If management does not cooperate by revising the financial statements and notes and contacting known users of the financial statements, the auditors should notify management and those charged with governance that they will take action to prevent further reliance on the original auditor‘s report. The auditors can withdraw their original report and also contact known third parties, the lenders, and tell them not to rely on the financial statements.

LO 5, BT: AN, Difficulty: Hard, TOT: 40 min., AACSB: Analytic, AICPA AC: Risk Assessment, Analysis and Management, Section: Subsequently Discovered Facts

C16.5 a. The auditors have a choice for dating the updated audit report. It can be dual dated with August 21 and 25, 2026, or it can have one date of August 25, 2026. If only one date is used, the auditors are extending their period of responsibility and may need to do additional audit procedures other than those related to the subsequently discovered fact.

If management revised the financial statements appropriately, the auditors can still issue an unmodified report. If the loss of Infinity Health Insurance patients poses a going concern situation for BPH, the auditors may consider adding a going concern section to the report. b. If management does not make the necessary adjustment and/or disclosures, the auditors would modify their opinion and issue an updated report. The updated report would be qualified for a departure from the financial reporting framework. There would be an emphasis-of-matter paragraph added after the Basis for Qualified Opinion section, and it would include the date of the auditor‘s previous report, the type of opinion previously expressed, the key reasons for the different opinion, and a statement that the opinion on the revised financial statements is different from the previous one. If the loss of Infinity Health Insurance patients poses a going concern situation for BPH, the auditors may consider adding a going concern section to the updated report. The updated report would be dual dated or dated August 25, 2026.

LO 1, 2, 4, 5, BT: E, Difficulty: Hard, TOT: 30 min., AACSB: Analytic, AICPA AC: Reporting, Section: Standard Unmodified Audit Report, Additional Wording for the Standard Unmodified Report, Modifying the Audit Opinion, Subsequently Discovered Facts

Cloud 9 Cloud 9 should receive an unqualified opinion on the financial statements and the effectiveness of ICFR. The unqualified report on the financial statements will include a reference to the other auditors that audited the Vietnamese location. The reports are as follows: Report of Independent Registered Public Accounting Firm To the shareholders and the Board of Directors of Cloud 9, Inc. Opinion on the Financial Statements We have audited the accompanying consolidated balance sheets of Cloud 9, Inc. (the "Company") and subsidiaries as of January 31, 2026, and the related consolidated statements of income, comprehensive income, stockholders' equity, and cash flows for the year then ended, and the related notes. In our opinion, based on our audit and the report of the other auditors, the consolidated financial statements present fairly, in all material respects, the financial position of the Company as of January 31, 2026, and the results of its operations and its cash flows for the year then ended in conformity with accounting principles generally accepted in the United States of America.

We did not audit the financial statements of a wholly-owned subsidiary, which statements reflect total assets constituting approximately 20 percent of the related consolidated totals. Those statements were audited by other auditors whose report has been furnished to us, and our opinion, insofar as it relates to the amounts included for the subsidiary, is based solely on the report of the other auditors.

We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the Company‘s internal control over financial reporting as of January 31, 2026, based on the criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission and our report dated March 15, 2026, expressed an unqualified opinion on the Company‘s internal control over financial reporting.

Basis for Opinion These financial statements are the responsibility of the Company's management. Our responsibility is to express an opinion on these financial statements based on our audit. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) ("PCAOB") and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud. Our audit included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts

and disclosures in the financial statements. Our audit also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. We believe that our audit and the report of the other auditors provide a reasonable basis for our opinion.

Critical Audit Matters [Include critical audit matters] W&S Partners We have served as the Company's auditor since 2025.

Sacramento, California March 15, 2026 REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM To the Shareholders and Board of Directors of Cloud 9 Inc. Opinion on Internal Control over Financial Reporting We have audited the internal control over financial reporting of Cloud 9, Inc. and subsidiaries (the ―Company‖) as of January 31, 2026, based on criteria established in Internal Control— Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of January 31, 2026, based on criteria established in Internal Control—Integrated Framework (2013) issued by COSO. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) (PCAOB), the consolidated financial statements as of and for the year ended January 31, 2026, of the Company and our report dated March 15, 2026, expressed an unqualified opinion on those financial statements.

Basis for Opinion The Company‘s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management‘s Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company‘s internal control over financial reporting based on our audit. We are a public accounting firm registered with the PCAOB and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB. We conducted our audit in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.

Definition and Limitations of Internal Control over Financial Reporting A company‘s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

A company‘s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company‘s assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. /s/ Thornson & Danforth LLP

Sacramento, California March 15, 2026 LO 1, 3, 6, BT: AP, Difficulty: Medium, TOT: 30 min., AACSB: Analytic, AICPA AC: Reporting, Section: Standard Unmodified Audit Report, Opinion Based in Part on the Report of Another Auditor, Reports on the Audit of ICFR