Bootcamp

Overview

Identify planning considerations for an audit of internal control over financial reporting, including likely sources of misstatement and testing design effectiveness. Identify testing operating effectiveness and concluding on effectiveness of controls. Recognize how IT affects flows of transactions, identify relevant technology elements, assess risks arising fromUnderstand, identify and test relevant GITCs and evaluate deficiencies in GITCs and assess the impact of GITC deficiencies on the audit.

What you will learn

  • The law that establishes the requirements for management to assess the Effectiveness of ICFR and to have an independent audit of its ICFR are set forth in Section 404 of the Sarbanes-Oxley. PCAOB AS 2201 establishes the requirements For an audit of ICFR. An integrated audit accomplishes the objectives of both an Audit of ICFR and audit of financial statements.
  • The “measuring stick” for assessing effective ICFR is the framework selected by Management (generally, COSO).
  • Identification of the risks of material misstatement includes the consideration of the Risk of fraud.
  • PCAOB AS 2201.34 requires us to identify the controls implemented to address Potential misstatements.
  • For relevant controls, we evaluate design effectiveness; and, we test the operating Effectiveness of these controls
  • Use Higher or Not Higher classifications when concluding on the risk associated with The control. Document the conclusion and the basis for the classification of the risk Associated with the control.
  • Plan the nature, timing and extent of tests of operating effectiveness based on the Risk associated with the control.
  • Document nature of tests of operating effectiveness as inquiry, observation, Inspection of documentation, and/or performance.
  • The understanding of IT (along with understanding of other areas of internal control) Helps identify if we are placing reliance upon automated controls, system generated Reports, data, & substantive procedures not enough, that is an input into the scoping Process for GITCs.
  • General IT controls are the policies and procedures that serve to support the Effective functioning of applications, including the effective operation of automated Controls embedded in the applications, the integrity of reports generated from the Applications, and the security of data housed within the applications. Areas of GITC Are evaluated across technology layers.
  • We typically consider the following elements when testing IPE - Source Data, Report Logic, Report Parameters. Testing GITCs alone is not enough to address IPE.
  • When considering the design of a control, determine whether there is information Used in the control (IUC). We must test controls over accuracy and completeness of IUC.
  • When using the work of others, consider whether such work is sufficient to meet our needs
  • Align with the audit team on relevant automated controls and obtain a clear understanding to appropriately test the control
  • If IT monitoring/review controls are relevant to the audit, obtain a clear understanding through walkthroughs and determine if the control is designed appropriately including consideration of segregation of duties and completeness and accuracy of logs.
  • Segregation of duties divides functions and reduces chance that someone could commit and conceal fraud.
  • If the user auditor plans to use an SSAE18 SOC1 report as audit evidence, the auditor should evaluate the report period, the sufficiency of audit evidence, and assess the complementary user entity controls and identified deficiencies.
  • If a tool is used within an entity’s GITCs, perform relevant procedures over that tool
  • If your client experiences a cyber breach , consult!
  • Document the nature and cause of identified deviations. Evaluate whether identified deviations are control deficiencies. Recognize that it is rare for deviations to not result in a control deficiency. Use decision trees from the Internal Control Guide while evaluating deficiencies

There are key differences between an AICPA/ISA audit and a PCAOB audit.

Domains (Syllabus)

  • Domain: Planning considerations related to an audit of ICFR
  • Domain: Identify and understand entity-level controls
  • Domain: Identify the relevant flows of transactions (processes) and the relevant IT environments.
  • Domain: Internal control planning considerations in an integrated group audit
  • Domain: Understand likely sources of misstatement
  • Domain: Select Controls using a Top-Down Approach
  • Domain: Test and conclude on design effectiveness
  • Domain: Assess the risk associated with the control
  • Domain: Plan the nature, timing, and extent, and perform tests of operating effectiveness
  • Domain: Assess findings and conclude on the effectiveness of the control
  • Domain: Role of IT Specialists & Process Flow for General IT Controls
  • Domain: Understand How IT Affects the Flow of Transactions and Identify Relevant Technology Elements
  • Domain: Identify and Assess Risks Arising from IT
  • Domain: Identify and understand entity-level controls
  • Domain: Understand, Identify and Test Relevant General IT Controls
  • Domain: Conclude on Risks Arising from IT and Determine Audit Response & Evaluate Deficiencies in General IT Controls
  • Domain: Considerations for audits in accordance with AICPA/ISA standards
  • Domain: Documentation Considerations and Key Resources for General IT Controls Review and wrap up
  • Domain: Question and answer session