During the audit of a publicly-traded biotechnology firm, the engagement team identifies a significant uncertainty related to the outcome of a pending FDA approval for a new flagship drug. Management has included extensive and appropriate disclosures regarding this uncertainty in the footnotes. The auditor has concluded that the financial statements are not materially misstated and the disclosure is adequate. What is the most appropriate course of action for the auditor's report?
Answer and explanation
Correct answer: B
When a material uncertainty exists and management has provided adequate disclosure, the auditor's opinion is not modified. Instead, the auditor should include an emphasis-of-matter paragraph in the report to draw users' attention to the matter, as it is fundamental to their understanding of the financial statements. A qualified opinion is inappropriate because the financial statements are not materially misstated. An adverse opinion is for pervasively misstated financials. A disclaimer is for a lack of sufficient evidence.
Question 2
An auditor is performing a test of controls over a client's automated cash disbursement process. Using attribute sampling, the auditor sets a tolerable deviation rate of 6%, an expected population deviation rate of 2%, and a risk of assessing control risk too low of 5%. The resulting sample size is 100 transactions. Upon testing, the auditor discovers 4 deviations. What is the auditor's most appropriate conclusion?
Answer and explanation
Correct answer: C
The sample deviation rate is 4% (4 deviations / 100 samples). The auditor must also consider the allowance for sampling risk. The computed upper deviation rate is the sample deviation rate plus the allowance for sampling risk. Given the parameters, finding 4 deviations will result in an upper deviation rate that exceeds the tolerable rate of 6%. Therefore, the auditor would conclude that the control is not effective and cannot be relied upon to the extent planned, necessitating an increase in the assessed level of control risk and an expansion of substantive testing.
Question 3
A CPA firm is auditing a non-issuer that has outsourced its complex payroll and benefits administration to a third-party service organization. The CPA firm has determined that the services provided by the third party are relevant to the audit of the user entity's financial statements. Which of the following reports from the service auditor would provide the user auditor with assurance regarding the operating effectiveness of the service organization's controls over a period of time?
Answer and explanation
Correct answer: C
A SOC 1 report focuses on internal controls over financial reporting. A Type 1 report only opines on the suitability of the design of controls at a specific point in time. A Type 2 report opines on both the design and the operating effectiveness of the controls throughout a specified period. Therefore, only a SOC 1, Type 2 report provides assurance on operating effectiveness over time. SOC 2 reports relate to Trust Services Criteria (security, availability, etc.), which may be relevant but are not the primary report for controls over financial reporting.
Question 4
Multiple answers
An auditor is using an audit data analytic (ADA) tool to analyze a client's entire journal entry population for indicators of management override of controls. Which of the following actions using the ADA tool would be most effective for this purpose? (Select TWO)
Answer and explanation
Correct answers: A, C
Entries made by unusual users or at unusual times are classic indicators of management override or attempts to circumvent normal control processes. Filtering for round-dollar amounts or amounts just below an approval threshold are also effective. Ensuring debits equal credits is a basic system function and not an indicator of override.
Question 5
True or False: When an auditor identifies a material weakness in internal control over financial reporting for a non-issuer, the auditor must issue an adverse opinion on the financial statements.
Answer and explanation
Correct answer: B
A material weakness in internal control relates to the control system, not necessarily the financial statements themselves. If the auditor can perform sufficient substantive procedures to confirm that the financial statements are not materially misstated despite the control weakness, an unmodified opinion on the financial statements can still be issued. The material weakness must be communicated in writing to management and those charged with governance.
Question 6
Case Study
Nova Solutions Inc., a rapidly growing software-as-a-service (SaaS) company, is undergoing its first audit for the year ended December 31, Year 1. The company recognizes revenue based on complex, multi-year subscription contracts that include setup fees, variable usage fees, and technical support. Nova's accounting team is small, and the CFO, who has significant equity in the company, personally approves all large revenue accruals at year-end.
During risk assessment, the engagement partner noted significant pressure on management to meet aggressive revenue targets to secure a new round of venture capital funding. The audit team decides to perform substantive analytical procedures on revenue. They develop an expectation for subscription revenue based on the number of active subscribers, average contract value, and historical churn rates. The recorded revenue is 25% higher than the auditor's expectation, a difference that is significantly above performance materiality.
Upon inquiry, the CFO attributes the difference to a new, highly successful sales incentive program launched in the fourth quarter. The CFO provides a spreadsheet summarizing the new contracts but is hesitant to provide the underlying contract documents, citing confidentiality concerns. The audit team notes that many of the large, year-end contracts were with new, unknown customers and involved unusually long payment terms.
Given the high risk of material misstatement due to fraud, the significant variance in analytical procedures, and management's reluctance to provide evidence, what is the auditor's most appropriate immediate course of action?
Answer and explanation
Correct answer: C
The significant, unexplained variance from substantive analytics, combined with identified fraud risk factors (pressure, CFO override) and management's resistance, is a strong indicator of potential misstatement. The auditor must abandon reliance on analytics for this assertion and gather more persuasive evidence. The most appropriate response is to perform detailed tests of transactions, which includes inspecting the actual contracts to verify terms and confirming the existence and terms of the arrangements directly with the customers. This shift from less to more rigorous testing is a critical application of professional skepticism.
Question 7
An auditor is required to maintain independence in fact and in appearance. Which of the following best describes 'independence in fact'?
Answer and explanation
Correct answer: B
Independence in fact relates to the auditor's actual state of mind—an internal, unbiased mental attitude that allows for objectivity and integrity. It is about acting with professional judgment that is not subordinated to other interests. In contrast, independence in appearance is how the auditor's independence is perceived by third parties.
Question 8
A first-year auditor is tasked with performing a walkthrough of the client's revenue cycle. The primary purpose of this procedure is to:
Answer and explanation
Correct answer: B
A walkthrough involves tracing a transaction from its initiation to its recording in the financial statements. Its primary purpose is to confirm the auditor's understanding of the process and to verify that the controls the auditor plans to rely on have been designed and implemented. It is not, by itself, sufficient to test the operating effectiveness of the controls, which requires a more extensive test of controls.
Question 9
While auditing a client's accounts receivable, the auditor decides to use negative confirmations for a large number of small, homogeneous balances. This decision is appropriate only if:
Answer and explanation
Correct answer: C
Negative confirmations provide less persuasive evidence than positive confirmations because no reply is assumed to mean agreement. They are only appropriate when all of the following conditions are met: the risk of material misstatement is low, relevant controls are effective, the population consists of many small, similar balances, and the auditor does not expect recipients to ignore the requests. High risk would necessitate the use of more persuasive positive confirmations.
Question 10
The audit engagement partner is reviewing the documentation for the audit of accounting estimates related to a client's warranty liability. Which of the following documented procedures would be LEAST likely to be considered a valid approach for auditing this estimate?
Answer and explanation
Correct answer: D
Auditing standards require auditors to take one or a combination of three approaches to audit estimates: (1) test management's process, (2) develop an independent expectation, or (3) review subsequent events. A management representation is required but is not a substitute for performing these substantive audit procedures. Relying solely on the representation would be a failure to obtain sufficient appropriate audit evidence.
