You are on page 1of 17


Auditing I
Chapter 7 (Auditing Internal Control Over Financial Reporting) Mr. Freddy Loing

Group 4 (Telolet) Accounting Class 4 (Monday 07.30 – 10.00):

Amellia Samantha / 008201500036
Fajar Widya Kusumah / 008201400035
Ginsi Trianesti / 008201500117
Lyra Raisa / 008201500122
Muhammad Ihsan / 008201500124
Exercise 7-2

Discuss how the terms likelihood and magnitude play a role in evaluating the
significance of a control deficiency.

‘Likelihood’ refers to the probability that a misstatement will not be

prevented or detected. For a significant deficiency or a material weakness to
exist, the likelihood of such an occurrence must be more than remote (e.g.
either ‘reasonably possible’ or ‘probable’).
‘Magnitude’ refers to the significance that the control deficiency could
have on the financial statements according to the judgment of a reasonable
person who considers the possibility of further undetected misstatements.
If likelihood is more than remote and if the magnitude of the
deficiency is more than inconsequential, then either a significant
deficiency or material weakness exists depending on the magnitude
of the potential effects of the deficiency on the entity’s financial
Exercise 7-4

Describe how management and the auditor decide on which locations or

business units to test.

The auditor should take into account all of the following items when deciding
which locations or business units to test:
• The relative financial significance of each location or business unit.
• The risk of material misstatement arising from each location or business unit.
• The similarity of business operations and internal control over financial
reporting at the various locations or business units.
• The degree of centralization of processes and financial reporting applications.
• The effectiveness of the control environment, particularly
management’s direct control over the exercise of authority delegated to
others and its ability to effectively supervise activities at the various
locations or business units. An ineffective control environment over the
locations or business units might constitute a material weakness.
• The nature and amount of transactions executed and related assets at
the various locations or business units.
• The potential for material unrecognized obligations to exist at a location
or business unit and the degree to which the location or business unit
could create an obligation on the part of the company.
• Management’s risk assessment process and analysis for excluding a
location or business unit from its assessment of internal control over
financial reporting. (AS2, ¶ B10)
Exercise 7-7

How does the auditor evaluate the competence and objectivity of others who perform
work for management?

When evaluating the competence and objectivity of others, the auditor should consider the
following factors:
• Their educational level and professional experience.
• Their professional certification and continuing education.
• Practices regarding the assignment of individuals to work areas.
• Supervision and review of their activities.
• Quality of the documentation of their work, including any reports or recommendations
• Evaluation of their performance.
• The organizational status of the individuals responsible for the work of others in
testing controls, including—
a. Whether the testing authority reports to an officer of sufficient status to ensure
sufficient testing coverage and adequate consideration of, and action on, the findings
and recommendations of the individuals performing the testing.
b. Whether the testing authority has direct access and reports regularly to the board of
directors or the audit committee.
c. Whether the board of directors or the audit committee oversees employment decisions
related to the testing authority.
• Policies to maintain the individuals’ objectivity about the areas being tested,
a. Policies prohibiting individuals from testing controls in areas in which relatives are
employed in important or internal control sensitive positions.
b. Policies prohibiting individuals from testing controls in areas to which they were recently
assigned or are scheduled to be assigned upon completion of their controls testing
responsibilities. (AS2, ¶119-120)
Exercise 7-10

A walk-through involves tracing a transaction through the

information system. What types of evidence does a walk-
through provide to the auditor?

Walkthroughs help the auditor to confirm his or her understanding of

control design and transaction process flow, to determine whether all points
at which misstatements could occur have been identified, to evaluate the
effectiveness of the design of controls, and to confirm whether controls have
been placed in operation (AS2, ¶79).
Exercise 7-14
What are the types of reports that an auditor can issue for an audit of ICFR?
Briefly identify the circumstances justifying each type of report.
The auditor’s report contains opinions on two separate items:
(1) Management’s assessment of the effectiveness of internal control over financial
(2) The effectiveness of internal control over financial reporting based on the
auditor’s independent audit work.
Similar to reports relating to the financial statement audit, the basic options
for the opinions are unqualified, qualified, and adverse. The auditor’s opinion
relating to management’s assessment simply depends on whether the auditor agrees
with management’s conclusion regarding the effectiveness of internal control over
financial reporting. If the auditor agrees, the opinion on management’s assessment
will be unqualified. If the auditor disagrees, the opinion will be adverse.
With respect to the auditor’s opinion on the effectiveness of a
client’s internal control, an unqualified opinion signifies that the client’s
internal control is designed and operating effectively in all material
respects. Significant deficiencies relate to possible financial statement
errors that are less than material, and therefore do not require a
departure from an unqualified opinion.
A qualified opinion is issued under certain circumstances involving
limitations on the scope of the auditor’s work; however, serious scope
limitations require the auditor to disclaim an opinion. An adverse opinion
is required if a material weakness is identified. Figure 7-4 illustrates the
types of auditor’s reports and the circumstances leading to each.
Figure 7-4
Exercise 7-15

Under what circumstances would and auditor give an

adverse opinion on the effectiveness of a client’s ICFR?

The auditor will issue an adverse opinion on the

effectiveness of a client’s ICFR (Internal Control Over Financial
Reporting) if a material weakness is identified.
Exercise 7-16

Under what circumstances would an auditor disclaim an

opinion on the effectiveness of client’s ICFR?

An auditor would issue a disclaimer of opinion because of

an inability to obtain sufficient appropriate evidence (serious
scope limitations).
Exercise 7-17
What should the auditor do when a significant period of time has elapsed
between the service organization auditor’s report and the date of
management’s assessment?
When a significant period of time has elapsed between the time period covered
by the tests of controls in the service auditor’s report and the date of management’s
assessment, additional procedures should be performed. The auditor should consider
the results of relevant procedures performed by management or the auditor, how much
time has passed since the service auditor’s report, the significance of the activities of
the service organization, whether errors have been identified in the service
organization’s processing, and the nature and significance of any changes in the service
organization’s controls. As these factors increase in significance, the need for the
auditor to obtain additional evidence increases.
Problem 7-21

For each of the following independent situations. Indicate the type of

report on ICFR you would issue. Justify your report choice.
a. Johnson Company’s management does not have an adequate antifraud program or
b. Tap, Tap, & Associates completed the integrated audit of Maxim Corporation. It did not
identify any control deficiencies during its audit.
c. During the audit of Fritz, Inc., Boyd & Company discovered a material misstatement that
was not discovered by Fritz’s internal control system.
d. Scoles Manufacturing Company does not have adequate controls over non-routine sales
e. Lee, Leis, & Monk (LL&M) performs the audit of Freedom Insurance Company. LL&M has
determined that Freedom has an ineffective regulatory compliance function.
a. If the lack of an adequate antifraud program is considered a material deficiency
by the auditor because of increased risk, then the auditor should issue an
adverse opinion. However, if it is only considered to be a significant deficiency,
then an unqualified report can be issued.
b. An unqualified report should be issued as no control deficiencies were
c. Because the auditor identified a material misstatement in the financial
statements, an adverse report on Fritz’s internal control over financial reporting
must be issued.
d. The auditor must determine the magnitude of the possible misstatement of non-
routine sales. If it is determined to be material then an adverse opinion should
be issued. However, if materiality is not a concern, an unqualified opinion may
be given.
e. Most likely an adverse opinion would be issued, unless the risk of compliance
violations was not material.