All questions
Question 1
In an audit of an issuer under PCAOB standards, the auditor identifies that management's control for reviewing monthly account reconciliations is performed, but documentation of the review is inconsistent and often added weeks later. The reconciliations cover several significant accounts, including accrued expenses and prepaid assets, and there were multiple post-close adjustments in prior periods. The auditor is considering whether to rely on the control to reduce substantive testing. How should the auditor respond to the control deficiency identified?
- Rely on the control because the reconciliations exist, and documentation timing does not affect operating effectiveness under PCAOB standards.
- Perform substantive tests only and skip any control evaluation because integrated audits do not require testing controls when substantive procedures are planned.
- Test the control by inspecting a sample of reconciliations for evidence of timely, independent review (including dates and reviewer sign-off), corroborate through inquiry and observation where needed, and if review is not timely/documented, increase substantive procedures on the affected accounts and evaluate the severity of the deficiency for ICFR reporting. (correct answer)
- Apply AICPA nonissuer guidance and communicate the issue only to management, because issuer ICFR communications are not required if the audit opinion is unmodified.
Explanation: This question tests evaluation of control deficiencies in account reconciliation processes during a PCAOB integrated audit. The scenario identifies untimely and inconsistently documented review of reconciliations covering significant accounts, with a history of post-close adjustments indicating the control's importance. AS 2201 requires controls to operate effectively throughout the period, and untimely review undermines control effectiveness. Option C correctly prescribes testing for timely, independent review with proper documentation, increasing substantive procedures if deficient, and evaluating the deficiency for ICFR reporting. Option A incorrectly dismisses timing as irrelevant to effectiveness; Option B misunderstands integrated audit requirements; Option D misapplies standards regarding ICFR communication requirements. The transferable principle is that control effectiveness requires both performance and timely review—delayed documentation suggests either untimely review or backdating, both of which prevent control reliance and require expanded substantive procedures with deficiency evaluation.
Question 2
In an integrated audit of an issuer under PCAOB standards, the auditor plans to use data analytics to test revenue occurrence. The auditor obtains a complete population of sales invoices and identifies a cluster of invoices recorded on the last two days of the year with shipping dates after year-end and with manual changes to shipping terms. Revenue is material, and prior-year cut-off errors were identified. Which substantive procedure would be most effective given the assessed risk?
- Select invoices from the identified cluster and vouch to underlying shipping documents (e.g., bills of lading) and customer acknowledgments to verify shipment occurred before year-end and terms support revenue recognition; expand testing if exceptions are found. (correct answer)
- Test the design of controls over shipping terms changes and, if designed well, eliminate detailed cut-off testing.
- Perform the cut-off test only at interim because year-end testing is unnecessary when analytics have been performed on the full population.
- Use a materiality threshold equal to total revenue times 5% and test only invoices above that threshold because smaller invoices cannot cause a material misstatement.
Explanation: This question evaluates the auditor's use of data analytics to identify and respond to revenue cutoff risks in a PCAOB integrated audit. The scenario presents data analytics findings showing year-end invoices with post-year-end shipping and manual term changes, combined with prior cutoff errors, indicating high risk of premature revenue recognition. AS 2301 requires substantive procedures for significant risks, and data analytics findings must be investigated through detailed testing. Option A correctly prescribes vouching the identified population to shipping documents and customer acknowledgments to verify proper cutoff and revenue recognition criteria. Option B inappropriately substitutes control testing for required substantive procedures; Option C misunderstands the relationship between interim and year-end testing; Option D misapplies materiality to population testing. The key principle is that data analytics identifies risk populations requiring targeted substantive procedures, not elimination of detailed testing, especially for cutoff where timing is critical.
Question 3
In an audit of a nonissuer under AICPA auditing standards, the auditor assesses a high risk of material misstatement for inventory valuation due to volatile commodity prices and a history of slow-moving items. The client's perpetual records are unreliable, and management performed a year-end reserve calculation using a new spreadsheet model that lacks documented review. Overall materiality is $900,000, and inventory is $6.5 million. Which substantive procedure would be most effective given the assessed risk?
- Perform tests of controls over the spreadsheet model's change management and rely on those controls to reduce substantive testing.
- Obtain management representations that the reserve is adequate and reduce further audit work because the reserve is an estimate.
- Select a sample of inventory items and recalculate lower of cost or net realizable value using recent sales prices/subsequent sales, aged inventory reports, and current replacement costs; also develop an independent expectation of the reserve and compare to management's estimate. (correct answer)
- Limit testing to items with recorded value above $900,000 because amounts below overall materiality are not subject to substantive testing.
Explanation: This question assesses the auditor's substantive response to high risk of material misstatement in inventory valuation under AICPA auditing standards. The scenario presents multiple risk factors: volatile commodity prices, history of slow-moving items, unreliable perpetual records, and a new unreviewed spreadsheet model for reserve calculations, with inventory at $6.5 million against $900,000 materiality. AU-C 330 requires the auditor to design substantive procedures responsive to assessed risks, and for significant risks, substantive procedures alone must be performed. Option C correctly prescribes recalculating lower of cost or net realizable value using external evidence (recent sales prices, subsequent sales, replacement costs) and developing an independent expectation of the reserve. Option A inappropriately attempts to rely on controls over a new, unreviewed model; Option B improperly relies solely on management representations for a significant estimate; Option D misapplies materiality by limiting testing to individual items above overall materiality. The transferable principle is that high-risk estimates require independent recalculation using external evidence, not reliance on management's models or representations alone.
Question 4
In an integrated audit of a public company issuer (PCAOB), the auditor is testing controls over journal entries. The company uses a manual spreadsheet to upload consolidation entries, and there is no independent review of the spreadsheet logic or the upload file before posting. Several large, top-side entries were posted late on the last day of the year to increase earnings, and the CFO has significant influence over the close process. Which testing procedure should the auditor implement?
- Perform a test of controls by selecting a sample of consolidation uploads and inspecting evidence of independent review and approval prior to posting; additionally, test IT access and change controls over the upload process and increase substantive journal entry testing focused on late, unusual entries. (correct answer)
- Perform only substantive analytics on the income statement because journal entry testing is required only when fraud has been confirmed.
- Apply AICPA nonissuer standards and limit testing to inquiry and observation because PCAOB integrated audit requirements do not apply to issuers.
- Test the control only in the following year because late-year entries occur at year-end and cannot be tested until after the audit report is issued.
Explanation: This question addresses testing controls over financial reporting period-end processes in a PCAOB integrated audit, specifically focusing on journal entry controls. The scenario presents manual consolidation entries via spreadsheet without independent review, late earnings-increasing entries, and CFO influence over the close process, indicating significant fraud risk. AS 2201 and AS 2401 require specific procedures for journal entry testing, especially for manual, period-end entries affecting earnings. Option A correctly prescribes testing both the review control and IT access/change controls, plus expanded substantive journal entry testing focused on unusual entries. Option B incorrectly limits procedures to analytics; Option C misapplies standards (PCAOB standards do apply to issuers); Option D misunderstands timing requirements for year-end entry testing. The critical framework is that manual period-end processes with fraud indicators require both control and substantive testing, with particular focus on IT controls preventing unauthorized changes and detailed testing of unusual entries.
Question 5
In an audit of a nonissuer, the auditor learns that the controller both sets up new vendors and approves electronic payments in the banking portal due to staffing shortages. The entity has experienced rapid growth, and there were several round-dollar payments to new vendors near year-end that management described as "expedited." Materiality is low because the entity is close to a debt covenant. How should the auditor respond to the control deficiency identified?
- Increase substantive procedures over cash disbursements by testing a sample of new vendors for existence and inspecting supporting invoices and receiving documentation, and communicate the significant deficiency to those charged with governance. (correct answer)
- Rely on the compensating control that the controller is experienced and conclude the deficiency is inconsequential without additional work.
- Perform a walkthrough only and, if the process appears reasonable, reduce detailed testing because the control deficiency relates to operations rather than financial reporting.
- Apply PCAOB integrated-audit requirements and issue an adverse opinion on internal control over financial reporting based solely on the segregation-of-duties issue.
Explanation: This question evaluates the auditor's response to control deficiencies in a nonissuer audit under AICPA AU-C standards, emphasizing segregation of duties and communication. The scenario highlights the controller's dual roles in vendor setup and payment approval, rapid growth with round-dollar payments, and low materiality due to debt covenants. Increasing substantive procedures over disbursements and communicating the significant deficiency follows AU-C 265, requiring evaluation and reporting of deficiencies, and AU-C 330 for expanded testing when controls are weak. Option B is wrong as relying on the controller's experience does not compensate for segregation issues per AU-C 315, potentially understating risks. Option C incorrectly limits to a walkthrough, ignoring AU-C 265's distinction between operational and financial reporting deficiencies, while Option D misapplies PCAOB standards to a nonissuer and overstates the deficiency's impact without full evaluation. A transferable framework involves classifying deficiencies by severity and linking them to adjusted substantive procedures. Auditors can use a decision tree to assess if deficiencies are significant or material, guiding communication and testing extent.
Question 6
During an integrated audit of a public company issuer under PCAOB standards, the auditor notes that the company implemented a new revenue system midyear and, for the first two months after implementation, sales managers could manually override the system's price and discount fields without documented approval. Revenue is quantitatively material and management's incentives are tied to quarterly revenue targets, and the auditor has identified several large quarter-end sales with unusually high discounts. How should the auditor respond to the control deficiency identified?
- Rely on substantive analytical procedures over revenue trends because the control exception is limited to two months and does not affect year-end balances.
- Test the operating effectiveness of the override-approval control by selecting a sample of override transactions from the affected period, inspecting evidence of independent approval, and reperformance of the system's approval workflow; if failures are found, expand substantive tests of revenue (especially quarter-end) and evaluate whether the deficiency is a material weakness. (correct answer)
- Treat the issue as a significant deficiency only and communicate it to management in a management letter after the audit report is issued, without modifying planned procedures.
- Apply AICPA guidance for nonissuers and perform only inquiry of management about whether overrides were appropriate, because PCAOB testing is not required when IT is involved.
Explanation: This question tests the auditor's response to control deficiencies in an integrated audit under PCAOB standards, specifically AS 2201. The scenario presents a revenue system implementation with a two-month period where manual overrides lacked documented approval, combined with material revenue, management incentives tied to revenue targets, and evidence of unusual quarter-end discounts. Under PCAOB standards, when a control deficiency is identified in a material account with fraud risk indicators, the auditor must test the operating effectiveness of compensating controls and expand substantive procedures if the deficiency is not mitigated. Option B correctly requires testing the override-approval control through inspection and reperformance, expanding substantive tests if failures are found, and evaluating whether the deficiency constitutes a material weakness. Option A incorrectly relies solely on analytical procedures without addressing the control deficiency; Option C improperly defers communication and fails to modify procedures; Option D incorrectly applies nonissuer standards to an issuer audit. The key framework is that control deficiencies in areas with fraud risk require both control testing of compensating controls and expanded substantive procedures, with immediate evaluation of the deficiency's severity for ICFR reporting.
Question 7
During planning for an audit of a public company issuer (PCAOB), the auditor identifies an unusual transaction: near year-end, the company sold a portfolio of customer receivables to a related party with an agreement to repurchase any accounts that become more than 60 days past due. Management recorded the transaction as a true sale and recognized a gain that is material to net income. There is also pressure to meet analyst earnings expectations. Based on the provided information, which audit procedure is most suitable?
- Perform a test of controls over the revenue cycle because receivables originate from sales, and conclude the gain is reasonable if revenue controls are effective.
- Inspect the transfer and repurchase agreements, evaluate whether control is surrendered under the applicable accounting framework, confirm key terms with the related party, and test subsequent collections/repurchases to assess whether sale accounting and the recorded gain are appropriate. (correct answer)
- Rely primarily on management's memo supporting sale accounting because the transaction is nonrecurring and management is responsible for GAAP conclusions.
- Apply AICPA guidance for nonissuers and treat the related-party nature as immaterial if the gain is less than 5% of total assets.
Explanation: This question addresses auditing complex related-party transactions with revenue recognition implications under PCAOB standards. The scenario presents a year-end receivables sale to a related party with repurchase obligations for past-due accounts, recorded as a true sale with material gain recognition, under earnings pressure. AS 2410 (Related Parties) and AS 2401 (Fraud Considerations) require heightened scrutiny of related-party transactions near period-end that affect earnings. Option B correctly requires inspecting agreements, evaluating control surrender under the applicable framework (likely ASC 860), confirming terms with the related party, and testing subsequent activity to assess sale accounting appropriateness. Option A incorrectly focuses on general revenue controls rather than the specific transaction; Option C improperly relies on management's accounting conclusions; Option D misapplies materiality to related-party transactions. The transferable framework is that related-party transactions with earnings impact require detailed substantive testing of legal form, economic substance, and subsequent activity to validate accounting treatment.
Question 8
During an issuer audit, the auditor finds that management's key control over revenue includes a quarterly reconciliation between the billing system and the general ledger. However, the reconciliation is performed only at quarter-end, and the fourth-quarter reconciliation was not completed before year-end close due to system downtime. Revenue is material and subject to fraud risk. How should the auditor respond to the control deficiency identified?
- Perform additional substantive procedures for revenue (including detailed testing of billing-to-GL completeness and cut-off) for the fourth quarter and evaluate whether the failure to perform the control affects the ICFR opinion. (correct answer)
- Rely on the control based on prior quarters' performance and reduce fourth-quarter substantive testing.
- Apply AICPA nonissuer standards and treat the missed reconciliation as a minor operational issue not affecting financial reporting.
- Wait until after issuing the audit report to test whether the reconciliation was eventually completed and then decide if revenue was fairly stated.
Explanation: This question evaluates control failures in an issuer audit under PCAOB AS 2201, impacting revenue. Missed Q4 reconciliation, system downtime, material revenue with fraud risk are key. Increasing Q4 substantives and evaluating ICFR follows AS 2201's deviation response. Option B relies improperly, per AS 2201. Option C misapplies AICPA, while Option D delays retrospectively. Framework: Adjust for period-specific failures. Strategy: Enhance cut-off tests on control gaps.
Question 9
During an integrated audit of an issuer, the auditor identifies that the company's control over management review of monthly financial results consists of a meeting with no documented follow-up on unusual fluctuations. This year, "other income" increased significantly due to one-time vendor rebates that were booked based on emails rather than executed agreements. Other income is material to earnings. Which testing procedure should the auditor implement?
- Test the management review control by inspecting evidence of the review and follow-up on significant variances and, due to weak documentation, perform substantive testing of the vendor rebates by inspecting executed agreements, recalculating amounts, and confirming key terms with vendors if necessary. (correct answer)
- Rely on the existence of meetings as sufficient evidence that the control operated effectively and reduce substantive testing.
- Apply AICPA nonissuer standards and treat the control as effective if management can explain the fluctuations during inquiry.
- Test the management review control only at interim because monthly controls do not require year-end coverage.
Explanation: This question evaluates management review controls in an integrated audit under PCAOB AS 2201, with weak documentation. No follow-up, rebate increases via emails, material income are key. Testing review evidence and substantively confirming rebates follows AS 2201's operating effectiveness. Option B relies on meetings insufficiently, per AS 2201. Option C misapplies AICPA, while Option D limits timing. Framework: Require variance resolution documentation. Strategy: Combine control tests with agreement inspections.
Question 10
During an issuer audit, management asserts that a decline in deferred revenue is due to a shift toward monthly subscriptions. The auditor notes, however, that several large annual contracts were signed in the last month of the year and cash was collected upfront, but deferred revenue did not increase. Materiality is moderate, and revenue is a presumed fraud risk. Which substantive procedure would be most effective given the assessed risk?
- Select a sample of late-year customer contracts and vouch cash receipts and contract terms to the recorded revenue and deferred revenue balances, including testing whether performance obligations were satisfied and whether amounts collected upfront were deferred appropriately. (correct answer)
- Confirm only the year-end cash balance because cash was collected upfront and therefore revenue recognition is not at risk.
- Test only the design of controls over subscription billing and omit substantive testing because the company is an issuer.
- Increase tolerable misstatement for deferred revenue because it is a liability and less likely to be misstated intentionally.
Explanation: This question tests deferred revenue in an issuer audit under PCAOB AS 2301, with recognition risks. Decline despite upfront cash, large late contracts, moderate materiality, fraud presumption are key. Vouching contracts and terms follows AS 2810's cut-off emphasis. Option B focuses on cash mistakenly, per AS 2301. Option C limits to design, ignoring substantives, while Option D misadjusts misstatement. Framework: Verify performance obligations in subscriptions. Strategy: Sample late-period deals for deferral accuracy.
Question 11
In a nonissuer audit, the auditor notes that the client has significant credit memos issued after year-end related to disputed billings, and the allowance for doubtful accounts was reduced this year despite worsening aging. The AR clerk can both post cash receipts and write off balances without independent review. Receivables are material and materiality is low due to lender scrutiny. Which testing procedure should the auditor implement?
- Confirm a targeted sample of receivables (including past-due accounts), test subsequent cash receipts and post–year-end credit memos, and evaluate the allowance methodology and write-off authorization due to the segregation-of-duties weakness. (correct answer)
- Rely on the client's aging report without testing because it is generated from the accounting system.
- Perform only tests of controls over write-offs and omit substantive procedures because confirmations are optional for nonissuers.
- Increase performance materiality for receivables because the allowance estimate is subjective.
Explanation: This question examines receivables procedures in a nonissuer audit under AU-C 330, with control weaknesses. Credit memos, reduced allowance, segregation issues, material receivables, low materiality are critical. Confirmations, receipts testing, allowance evaluation follows AU-C 330's risk response. Option B relies untested, per AU-C 500. Option C omits substantives improperly, while Option D misadjusts materiality. Framework: Address valuation via aging and subsequent events. Strategy: Combine confirmations with allowance analytics for collectibility.
Question 12
During an issuer audit, the auditor finds that the company's control requiring dual approval for wire transfers was overridden twice by the CFO, citing "time-sensitive acquisitions." The wires were large and sent to newly added bank accounts. Cash is material, and the company is actively pursuing acquisitions, creating opportunities for fraud. How should the auditor respond to the control deficiency identified?
- Treat the overrides as a significant risk indicator, test the authorization and support for the wire transfers, confirm recipient bank details where feasible, expand testing of cash disbursements, and evaluate whether the control failure indicates a material weakness in ICFR. (correct answer)
- Accept the CFO's explanation because executive management has authority to override controls and no further procedures are needed.
- Apply AICPA nonissuer guidance and communicate the matter only to management rather than to the audit committee.
- Perform testing only at interim because year-end testing would be redundant once the acquisition closes.
Explanation: This question assesses control overrides in an issuer audit under PCAOB AS 2201 and AS 2401, with fraud implications. CFO overrides, large wires to new accounts, acquisition activity, material cash are key. Treating as risk, testing, and evaluating weakness complies with AS 2401's override scrutiny. Option B accepts without testing, violating skepticism. Option C misapplies AICPA communication, while Option D limits timing. Framework: Escalate overrides to ICFR assessments. Strategy: Confirm details in high-risk disbursements.
Question 13
During an integrated audit of an issuer, the auditor identifies that management uses a spreadsheet to calculate stock-based compensation expense. The spreadsheet has complex formulas, is updated by one individual, and there is no documented review; several inputs are manually keyed from grant agreements. Stock-based compensation is material, and the company issued an unusually large number of grants near year-end. Which testing procedure should the auditor implement?
- Test the spreadsheet-based control by evaluating access and change controls and inspecting evidence of review; additionally, perform substantive recalculation of stock-based compensation for a sample of grants by agreeing key inputs to grant documentation and reperforming the calculation. (correct answer)
- Rely on the spreadsheet because it is a common tool and reduce substantive testing to inquiry.
- Apply AICPA nonissuer guidance and treat the spreadsheet as outside ICFR scope for an issuer.
- Perform the recalculation only at interim and assume no changes occurred for the year-end grants because they were late in the year.
Explanation: This question evaluates the auditor's approach in an integrated audit under PCAOB AS 2201 and AS 2501 for testing controls and substantive procedures over complex estimates like stock-based compensation in an issuer's financial statements. Critical scenario elements include the use of a spreadsheet with complex formulas, single-user updates without documented review, manual inputs from grant agreements, materiality of the account, and a surge in year-end grants, heightening risks of error or manipulation. Option A is justified as it requires testing IT-dependent manual controls (e.g., access and change controls) per AS 2201, inspecting review evidence, and performing substantive recalculation by agreeing inputs to source documents and reperforming calculations, consistent with AS 2501's emphasis on substantive testing for significant estimates. Option B is incorrect because relying on the spreadsheet's commonality and reducing testing to inquiry ignores PCAOB requirements for dual testing in integrated audits and fails to address control deficiencies. Option C misapplies AICPA nonissuer guidance to an issuer, where spreadsheets integral to financial reporting are within ICFR scope under AS 2201, and option D is flawed as it limits testing to interim, contravening AS 2501's need for year-end substantive procedures on material transactions. Auditors should adopt a dual-purpose testing strategy, integrating control and substantive tests to cover both ICFR effectiveness and assertion accuracy. This method enhances efficiency while ensuring comprehensive coverage of risks in estimate calculations.
Question 14
In a nonissuer audit of a retailer, the auditor identifies a fraud risk factor: significant cash sales and high employee turnover. The client's point-of-sale system allows voids and refunds without manager approval during certain hours due to "customer service" settings. Cash and revenue are material. What is the best approach to address the identified risk?
- Perform tests of controls over voids/refunds (including system settings and approval logs) and perform substantive procedures using data analytics to identify unusual void/refund patterns by cashier and time, followed by targeted vouching to supporting documentation. (correct answer)
- Rely on overall gross margin analytics and avoid detailed testing because cash sales are too numerous to audit.
- Perform the void/refund testing only after the audit report is issued to avoid disrupting store operations.
- Apply PCAOB standards and require management to provide an ICFR report for the nonissuer.
Explanation: This question assesses cash sales risks in a nonissuer audit under AU-C 330 and AU-C 240, with fraud factors. High turnover, unrestricted voids, material cash/revenue are pivotal. Testing controls and analytics with vouching complies with AU-C 240's fraud procedures. Option B relies on margins inadequately, per AU-C 520. Option C delays improperly, while Option D misapplies PCAOB. Framework: Use data tools for anomaly detection. Strategy: Target testing to system vulnerabilities.
Question 15
An auditor is designing an audit plan for a new client. The auditor's risk assessment procedures indicate a high inherent risk for the valuation of inventory due to complex costing methods and a high control risk due to the absence of perpetual inventory records. The auditor has determined that an acceptably low level of detection risk is required.
To achieve an acceptably low level of detection risk for the valuation of inventory, the auditor's planned substantive procedures would most likely include an increase in the:
- Reliance on the work of the client's internal auditors.
- Use of negative confirmations for accounts receivable.
- Extent of tests of details, such as increasing sample sizes for price testing. (correct answer)
- Level of performance materiality for the inventory account.
Explanation: There is an inverse relationship between the assessed risk of material misstatement (inherent risk x control risk) and detection risk. Since the risk of material misstatement is high, the auditor must plan procedures to achieve a low level of detection risk. This is accomplished by modifying the nature, timing, and/or extent of substantive procedures. Increasing the extent of testing, such as selecting larger sample sizes for tests of details (e.g., price testing of inventory), directly reduces detection risk.
Question 16
The auditor of a public company has assessed a pervasive risk of management override of internal controls. This assessment is based on a highly dominant CEO, aggressive earnings targets, and significant performance-based executive compensation. The auditor is designing the overall audit response.
In response to the assessed risk of management override, which of the following is the most appropriate overall audit response?
- Relying exclusively on management's written representations as sufficient audit evidence.
- Communicating the risk to the audit committee and withdrawing from the engagement.
- Incorporating an element of unpredictability in the selection and timing of audit procedures. (correct answer)
- Focusing tests of controls solely on automated controls to reduce human intervention.
Explanation: Auditing standards require specific responses to the risk of management override. One key overall response is to incorporate an element of unpredictability in the audit plan. This could involve performing procedures at unexpected locations, using different sampling methods, or varying the timing of tests from year to year. This approach reduces the ability of management to anticipate the audit procedures and conceal fraudulent activity.
Question 17
An auditor plans to perform testing on a sample of the client's cash disbursement transactions. The auditor's objectives are to determine whether the disbursements were properly authorized by a department head (a control objective) and to verify that the amount was recorded correctly in the general ledger (a substantive objective).
Which type of audit test is the auditor designing to meet both objectives simultaneously?
- A test of details of balances.
- A substantive analytical procedure.
- A dual-purpose test. (correct answer)
- A risk assessment procedure.
Explanation: A dual-purpose test is an audit procedure that is designed to provide evidence for two different purposes: testing the operating effectiveness of an internal control and detecting material misstatements in financial statement account balances (substantive testing). In this scenario, examining the disbursement for authorization tests the control, and verifying the amount tests the substantive detail, making it a dual-purpose test.
Question 18
An auditor is evaluating the information technology (IT) environment of a client that heavily relies on automated controls for processing sales transactions. The auditor's testing reveals pervasive weaknesses in IT general controls (ITGCs), specifically in program change controls and access security.
How should these identified weaknesses in IT general controls affect the auditor's planned testing of the automated sales application controls?
- The auditor should increase the testing of the IT general controls to compensate for the weaknesses.
- The auditor cannot rely on the automated application controls and must increase the extent of substantive testing. (correct answer)
- The auditor can still rely on the automated application controls if they operated effectively in the prior year.
- The auditor should test the automated application controls more extensively to compensate for the weak ITGCs.
Explanation: IT general controls provide the foundation for the effective operation of automated application controls. If ITGCs are weak (e.g., programmers can access live data and make unauthorized changes), then the integrity of the automated controls and the data they process cannot be trusted. Therefore, the auditor cannot rely on the automated controls and must adopt a substantive approach, which involves increasing the nature and extent of substantive procedures.
Question 19
An auditor is auditing a client's investment in a privately held company, which was acquired through a complex, non-routine business combination during the year. The valuation of this investment is highly subjective and based on a series of management assumptions about future cash flows.
Which planned audit approach is most appropriate for testing the valuation of this investment?
- Substantive analytical procedures comparing the investment balance to industry averages.
- Tests of details involving an evaluation of management's assumptions and the underlying data. (correct answer)
- Observing the physical location of the privately held company's headquarters.
- Testing the operating effectiveness of the client's controls over monitoring investments.
Explanation: For account balances determined by complex, subjective estimates and non-routine transactions, substantive analytical procedures are generally not effective because a predictable relationship is unlikely to exist. The most appropriate approach is to perform tests of details. This would involve scrutinizing the valuation method, evaluating the reasonableness of management's significant assumptions, and testing the underlying data used in the cash flow projections.
Question 20
An auditor for a manufacturing company is designing substantive procedures related to the inventory balance. The primary risk identified by the auditor is that the inventory quantities recorded in the general ledger may not physically exist due to theft or damage.
To obtain the most persuasive evidence regarding the existence assertion for inventory, the auditor should plan to:
- Review the client's analysis of inventory turnover and obsolescence.
- Perform test counts and observe the client's physical inventory count. (correct answer)
- Inquire of management about the procedures used to control inventory movements.
- Trace a sample of inventory purchases from the receiving reports to the perpetual inventory records.
Explanation: The existence assertion for an asset like inventory means that the asset physically exists at a given date. The most direct and persuasive audit procedure to test existence is physical observation and examination. By observing the client's physical inventory count and performing their own test counts, the auditor obtains direct evidence of the existence of the inventory.