Exam 12: Assessing Control Risk and Reporting on Internal Controls

A five-step approach can be used to identify deficiencies,significant deficiencies,and material weaknesses.The first step in this approach is

When documenting their understanding of a client's internal controls,auditors are required to use narratives.

When using the test data approach,

The embedded audit module approach requires the auditor to insert an audit module in the client's application system to to identify specific types of transactions.

A narrative should describe the disposition of every document and record in the system.

A significant internal control deficiency is always considered a material weakness.

Which of the following is an accurate statement relating to the extent of procedures?

You are the audit manager for a new audit client.Your staff auditors are unsure of what constitutes a control deficiency.Discuss the terms control deficiency,design deficiency,and operating deficiency.

The auditor will issue an unqualified opinion on internal control over financial reporting when

A company's size should have no impact on the nature of internal control and the controls that are implemented.

Describe three computer auditing techniques available to the auditor.

If,when obtaining an understanding of control activities of a relatively small client,the auditor identified no control activities,the auditor would probably set a high assessment of control risk.

If the results of tests of controls support the design and operations of controls as expected,the auditor uses ________ control risk as the preliminary assessment.

When testing manual or automated controls,

Parallel simulation is used primarily to test internal controls over the client's IT systems,whereas the test data approach is used primarily for substantive testing.

Before making the final assessment of internal control at the end of an audit,the auditor must

The objective of the test data approach is to determine whether the client's computer programs can correctly process valid and invalid transactions.

In an audit of a nonpublic company,the less control risk there is,the smaller the amount of planned substantive evidence that is required.

A(n)________ control is a control elsewhere in the system that offsets the absence of a key control.

When using the test data approach,