Risk Assessment and Internal Control - Test 5: answer key

Question 1 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s Sharma & Associates is conducting the statutory audit of Alpha Infotech Ltd, a listed software services company. During preliminary risk assessment, the engagement partner discovers that the CFO exercises considerable influence over financial reporting, the internal audit department has remained inactive for eight months and several important bank reconciliations are outstanding. Accounting personnel have changed frequently, while the audit committee receives financial reports only after substantial delays. Management has also refused to provide certain supporting vouchers relating to year-end revenue adjustments. The company has recently reported an unexpected increase in revenue despite a decline in the number of active customers. The sales director receives performance-linked remuneration based on quarterly revenue targets. The engagement team suspects premature recognition of revenue and overstatement of trade receivables. Inventory records also indicate substantial quantities of outdated software equipment, but management has not recognised any corresponding valuation adjustment. The partner concludes that weaknesses in the overall control environment could affect several financial statement areas. He proposes assigning experienced audit personnel, increasing supervision, maintaining heightened professional skepticism and performing additional procedures at unpredictable locations. For revenue, the team plans to examine contracts, delivery evidence, customer confirmations and transactions immediately before and after year-end. For inventory, it proposes reviewing ageing reports, subsequent sales and relevant valuation assumptions. The team also identifies the absence of independent review of bank reconciliations as a potentially significant control deficiency. Management argues that no financial loss has yet occurred and therefore refuses to acknowledge any reporting obligation. The engagement partner must determine the appropriate overall and assertion-level audit responses and the communication obligations arising from the identified deficiency.

Considering Alpha Infotech Ltd's dominant CFO, inactive internal audit department and pervasive reconciliation failures, which combination of actions most appropriately represents the auditor's overall response to assessed risks at the financial statement level?

1. Concentrate exclusively on receivable confirmations and maintain the existing audit team and supervision arrangements.
2. Assign experienced personnel, reinforce professional skepticism, increase supervision and introduce unpredictable audit procedures. (correct answer)
3. Increase the number of inventory observations but retain the original audit strategy and existing reliance on management.
4. Restrict the audit to additional substantive analytical procedures and avoid changing the overall engagement approach.

Answer: B — Assign experienced personnel, reinforce professional skepticism, increase supervision and introduce unpredictable audit procedures.

Explanation. SA 330, paragraphs 5 and A1-A3, requires overall responses to assessed risks at the financial statement level. These may include emphasising professional skepticism, assigning experienced personnel, increasing supervision, introducing unpredictability and modifying the overall nature, timing and extent of procedures. Alpha's weaknesses are pervasive and may affect several assertions simultaneously. Merely increasing receivable confirmations addresses a specific area, not the wider engagement-level risks.

Where it goes wrong. Confusing broad financial-statement-level responses with additional procedures directed at one particular account balance.

Authority. SA 330

Question 2 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Alpha's revenue has increased despite declining active customers, and management may have recognised sales prematurely. Which audit approach most directly responds to the identified assertion-level risk?

1. Assign additional senior personnel to the entire engagement without modifying the procedures performed on revenue transactions.
2. Increase supervision over all audit sections without specifically examining the occurrence and cut-off of revenue.
3. Examine customer contracts, delivery evidence, confirmations and transactions immediately before and after the reporting date. (correct answer)
4. Restrict audit procedures to reviewing the board's annual budget and management's explanation for revenue growth.

Answer: C — Examine customer contracts, delivery evidence, confirmations and transactions immediately before and after the reporting date.

Explanation. SA 330, paragraphs 6-7, requires further audit procedures whose nature, timing and extent respond to risks assessed at the assertion level. Premature recognition may cause revenue occurrence and cut-off misstatements. Examining contracts, delivery evidence, external confirmations and year-end transactions directly addresses these risks. Assigning experienced staff is an overall response under paragraph 5, but does not replace assertion-specific substantive procedures.

Where it goes wrong. Selecting an appropriate overall engagement response when the question requires a procedure addressing a specific financial statement assertion.

Authority. SA 330

Question 3 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The audit team identifies outdated software equipment whose carrying amount may exceed its recoverable or net realisable value, as applicable. Which combination of substantive procedures is most appropriate?

1. Inspect ageing records, verify selected inventory items, examine subsequent sales and independently evaluate relevant valuation adjustments. (correct answer)
2. Obtain management representations regarding obsolescence and accept the recorded inventory values without further verification.
3. Compare total inventory balances with the previous year and conclude that similar balances establish appropriate valuation.
4. Examine purchase authorisations and conclude that authorised inventory purchases automatically establish their year-end valuation.

Answer: A — Inspect ageing records, verify selected inventory items, examine subsequent sales and independently evaluate relevant valuation adjustments.

Explanation. SA 330, paragraphs 6-7 and 18, requires procedures responsive to assessed risks and substantive procedures for each material class of transactions, balance and disclosure. Inventory obsolescence principally creates a valuation risk. Ageing records, subsequent sales, inspection and evaluation of valuation adjustments provide evidence relevant to that assertion. Management representations and historical balance comparisons alone cannot establish that obsolete inventory is appropriately valued.

Where it goes wrong. Confusing evidence of purchase authorisation or historical cost with evidence that inventory is appropriately valued at the reporting date.

Authority. SA 330

Question 4 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The absence of independent review of bank reconciliations is assessed as a significant deficiency. Management argues that no actual loss has been established. What communication is required under SA 265?

1. Communicate the deficiency orally to the finance manager only, because no actual financial loss has occurred.
2. Report the matter to those charged with governance only when a material misstatement is detected.
3. Wait until management completes its internal investigation before considering whether any written communication is necessary.
4. Communicate the significant deficiency in writing to those charged with governance on a timely basis. (correct answer)

Answer: D — Communicate the significant deficiency in writing to those charged with governance on a timely basis.

Explanation. SA 265, paragraphs 6(b) and 9, defines a significant deficiency by reference to its importance in the auditor's professional judgment and requires written communication to those charged with governance on a timely basis. An actual material misstatement or financial loss is not a prerequisite. The auditor considers the likelihood and potential magnitude of misstatement. Consequently, management's argument that no loss has occurred does not remove the communication requirement.

Where it goes wrong. Assuming that a significant deficiency becomes reportable to governance only after an actual material misstatement or financial loss occurs.

Authority. SA 265

Question 5 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s V. Raman & LLP has been appointed statutory auditor of Zenith Manufacturing Pvt Ltd, an automobile-component manufacturer. The company recently obtained substantial working-capital facilities from a consortium of banks. Its loan agreements contain financial covenants based on current ratios and debt-service coverage. During the year, the company experienced cash-flow difficulties, delayed payments to suppliers and a significant reduction in production capacity. Nevertheless, the draft financial statements show a substantial increase in gross profit and inventory balances. The engagement team identifies deficiencies in inventory reconciliation procedures. Physical stock records are not regularly reconciled with the general ledger, and several goods-received notes relating to high-value purchases are missing. Management explains that the documents were misplaced during a warehouse relocation. A bank confirmation received directly by the auditors also reveals a guarantee arrangement omitted from the finance department's schedule. The auditor initially intended to rely on management's monthly inventory review control. However, testing reveals that the review was not performed consistently, particularly during the final quarter. The engagement partner consequently reassesses the relevant control risk. The team considers examining purchase invoices, goods-received records, dispatch documents, subsequent sales and physical inventory evidence. It also proposes analysing the relationship between production volumes, raw-material consumption and manufacturing costs over several periods. Management insists that additional substantive work is unnecessary because the accounting system generates monthly inventory reports. The CFO also argues that testing internal controls should replace substantive procedures wherever the auditor has identified an existing control. The engagement partner must determine an appropriate response under SA 330, including the nature, timing and extent of procedures necessary to address the identified risks and obtain sufficient appropriate audit evidence.

Zenith's purchase vouchers are missing, and the auditor needs to verify whether recorded machinery purchases actually occurred. Which procedure most directly constitutes a test of details of transactions?

1. Compare total annual machinery expenditure with the previous year and investigate only significant movements.
2. Calculate expected depreciation on machinery and compare the result with management's recorded expense.
3. Examine purchase invoices, goods-received records, inward gate entries and relevant supplier documentation. (correct answer)
4. Review management's capital expenditure budget and obtain written approval of the machinery acquisition programme.

Answer: C — Examine purchase invoices, goods-received records, inward gate entries and relevant supplier documentation.

Explanation. SA 330, paragraph 4(a)(i), and ICAI Study Material Chapter 3, §8.6, classify tests of details as substantive procedures. Tests of transactions involve vouching, such as examining purchase invoices, goods-received notes and inward gate-entry records. These documents help establish the authenticity of recorded purchases. Analytical comparisons and depreciation recalculations may provide other audit evidence, but do not directly establish the occurrence of individual machinery purchases.

Where it goes wrong. Confusing substantive analytical procedures or recalculation of expenses with vouching of individual recorded transactions.

Authority. SA 330

Question 6 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The auditor wishes to evaluate whether Zenith's production costs are reasonable by comparing production volumes, raw-material consumption and manufacturing costs over several periods. Which audit procedure is being used?

1. A test of controls designed exclusively to establish whether all purchase orders received independent approval.
2. A substantive analytical procedure evaluating plausible relationships between financial and non-financial information. (correct answer)
3. A test of details involving physical verification of each individual item of raw material consumed during production.
4. A management representation procedure relying on explanations of production cost variations without independent evaluation.

Answer: B — A substantive analytical procedure evaluating plausible relationships between financial and non-financial information.

Explanation. SA 330, paragraph 4(a)(ii), and ICAI Study Material Chapter 3, §8.7, recognise substantive analytical procedures as evaluations of financial information through plausible relationships among financial and non-financial data. Comparing production volumes, material consumption and manufacturing costs is an appropriate analytical approach. A test of controls evaluates control effectiveness, while physical inspection and vouching constitute tests of details. Management explanations alone cannot replace the auditor's independent analytical evaluation.

Where it goes wrong. Confusing an analytical relationship between operational and financial information with a test of an individual transaction or control.

Authority. SA 330

Question 7 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The CFO argues that successful testing of Zenith's monthly inventory review control eliminates the need for substantive verification of inventory and purchases. Which statement correctly reflects SA 330?

1. Substantive procedures are unnecessary whenever the auditor has obtained sufficient evidence about operating effectiveness of controls.
2. Substantive procedures are necessary only where the auditor has separately identified a significant risk of fraud.
3. Substantive procedures may be omitted for material inventory balances when management has completed physical verification.
4. Substantive procedures must be designed and performed for each material class of transactions, account balance and disclosure irrespective of assessed risk. (correct answer)

Answer: D — Substantive procedures must be designed and performed for each material class of transactions, account balance and disclosure irrespective of assessed risk.

Explanation. SA 330, paragraph 18, expressly requires substantive procedures for each material class of transactions, account balance and disclosure, irrespective of assessed risks of material misstatement. Tests of controls may influence the nature, timing and extent of substantive procedures, but they do not eliminate this requirement. Management's physical verification may provide relevant evidence, but the auditor must still design and perform appropriate substantive procedures to obtain sufficient appropriate audit evidence.

Where it goes wrong. Believing that successful tests of controls automatically eliminate the substantive testing requirement for material financial statement areas.

Authority. SA 330

Question 8 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The auditor finds that Zenith's inventory review control was not consistently performed during the final quarter. What is the most appropriate consequence for the planned audit approach?

1. Investigate the deviations, reassess control risk where necessary and modify the nature, timing and extent of substantive procedures. (correct answer)
2. Retain the original risk assessment because deviations in a monthly review control cannot affect the substantive audit programme.
3. Accept management's verbal explanation and maintain the original substantive procedures without considering additional evidence.
4. Issue a modified audit opinion immediately because any control deviation establishes that the financial statements are materially misstated.

Answer: A — Investigate the deviations, reassess control risk where necessary and modify the nature, timing and extent of substantive procedures.

Explanation. SA 330, paragraph 17, requires specific inquiries when deviations from controls intended for reliance are detected. The auditor determines whether existing tests support reliance, further tests are necessary or substantive procedures should address the potential misstatement. ICAI Study Material Chapter 3, §7, also explains that an unsupported control risk assessment must be revised, with corresponding changes to substantive procedures. A deviation does not automatically establish a material misstatement or require a modified opinion.

Where it goes wrong. Confusing an ineffective control with an automatic financial statement misstatement or ignoring its effect on the audit response.

Authority. SA 330

Question 9 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. M/s K. Mehta & Co is conducting the statutory audit of Suryodaya Retail Ltd, a nationwide retail chain with 120 stores and a centralised accounting system. During the audit, the engagement team identifies several deficiencies. Store-level cash collections are not independently reconciled at certain locations, inventory adjustments can be authorised by the same employees who maintain stock records, and significant manual journal entries are processed without independent review. In addition, user access rights in the accounting system are not periodically reviewed. The deficiencies have different potential consequences. Some relate to individual low-value transactions, while others expose substantial cash balances, inventory and revenue records to possible misstatement. The auditor has not identified an actual material misstatement arising from every deficiency. However, the combination of weaknesses, their frequency and the potential exposure of financial statement balances concern the engagement partner. During discussions, the finance manager accepts certain observations but refuses to acknowledge the deficiencies involving journal-entry authorisation. The engagement team discovers that these entries were specifically authorised by the CFO, who is also a member of the company's senior management. The partner considers direct discussion of those particular findings with the CFO inappropriate because the findings concern his own actions. The audit committee requests a written explanation of the deficiencies, their possible financial consequences and the purpose of the auditor's communication. Management additionally argues that the deficiencies are already known internally and that implementing remedial controls would be expensive. The engagement partner must apply professional judgment to determine which deficiencies are significant, whether individual or combined weaknesses merit governance attention, the appropriate recipients and timing of communication, and the information that must be included in the written communication under SA 265.

Suryodaya's deficiencies involve cash reconciliation, inventory adjustment authorisation and journal-entry review. No individual deficiency has yet resulted in a detected material misstatement. How should the auditor determine whether significant deficiencies exist?

1. Treat only the largest individual deficiency as significant because multiple deficiencies cannot be assessed collectively.
2. Classify deficiencies as significant only when each one has already caused a material misstatement in the financial statements.
3. Consider whether management has acknowledged the deficiencies before assessing their significance to governance.
4. Evaluate deficiencies individually and in combination, considering their potential consequences and importance to those charged with governance. (correct answer)

Answer: D — Evaluate deficiencies individually and in combination, considering their potential consequences and importance to those charged with governance.

Explanation. SA 265, paragraphs 6(b) and 8, requires determining whether identified deficiencies individually or in combination constitute significant deficiencies. Application paragraphs A5-A11 explain that significance depends on professional judgment, including likelihood and potential magnitude of misstatement, susceptibility to fraud and the financial statement amounts exposed. Actual misstatements are not essential. Several individually smaller weaknesses may collectively merit the attention of those charged with governance.

Where it goes wrong. Assuming that significant deficiencies must individually cause material misstatements or must be evaluated separately without considering their combined effect.

Authority. SA 265

Question 10 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The auditor identifies an ordinary internal control deficiency that is not considered significant, but which has not previously been communicated to management and merits management's attention. What should the auditor do?

1. Ignore the deficiency because SA 265 requires communication only of matters classified as significant deficiencies.
2. Communicate the deficiency on a timely basis to management at an appropriate level of responsibility. (correct answer)
3. Communicate the deficiency only to shareholders because all identified control weaknesses are governance matters.
4. Include the deficiency in the audit opinion because every control weakness automatically modifies the auditor's reporting conclusion.

Answer: B — Communicate the deficiency on a timely basis to management at an appropriate level of responsibility.

Explanation. SA 265, paragraph 10(b), requires the auditor to communicate to management at an appropriate level of responsibility, on a timely basis, other deficiencies identified during the audit that have not been communicated by other parties and are sufficiently important in the auditor's professional judgment to merit management's attention. The written communication requirement under paragraph 9 specifically concerns significant deficiencies communicated to those charged with governance. Not every ordinary deficiency requires governance-level reporting.

Where it goes wrong. Assuming that deficiencies that do not qualify as significant are never required to be communicated to management.

Authority. SA 265

Question 11 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

The audit committee requests a written explanation of Suryodaya's significant deficiencies. Which combination of information should the auditor include under SA 265?

1. Only the names of responsible employees, the date of discovery and the monetary value of detected misstatements.
2. Only management's proposed remedial action and an assurance that the deficiencies will not recur in subsequent periods.
3. A description of each significant deficiency, its potential effects and sufficient information explaining the context and purpose of the communication. (correct answer)
4. Only the auditor's final opinion on the overall effectiveness of internal control and the compliance status of management.

Answer: C — A description of each significant deficiency, its potential effects and sufficient information explaining the context and purpose of the communication.

Explanation. SA 265, paragraph 11, requires written communication of significant deficiencies to include a description of the deficiencies and an explanation of their potential effects. Sufficient contextual information must also explain that the audit's purpose was to express an opinion on financial statements, that internal control was considered to design appropriate audit procedures rather than to express an opinion on its effectiveness, and that only deficiencies considered sufficiently important are being reported. The communication is not an overall internal control opinion.

Where it goes wrong. Confusing a communication of significant deficiencies with a separate assurance report expressing an opinion on internal control effectiveness.

Authority. SA 265

Question 12 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

The CFO personally authorised journal entries that constitute a significant internal control deficiency. The engagement partner considers direct communication of this finding to the CFO inappropriate. What is the proper approach?

1. Communicate the significant deficiency in writing to those charged with governance and assess the appropriateness of direct management communication. (correct answer)
2. Communicate only with the CFO because senior management must always receive every control-related observation directly.
3. Omit the deficiency from written communication because the individual responsible for it is part of senior management.
4. Wait for the CFO to approve the proposed communication before informing the audit committee of the deficiency.

Answer: A — Communicate the significant deficiency in writing to those charged with governance and assess the appropriateness of direct management communication.

Explanation. SA 265, paragraphs 9 and 10(a), requires timely written communication of significant deficiencies to those charged with governance and communication to management at an appropriate level unless direct communication is inappropriate. Application paragraph A20 recognises circumstances where findings may call management's integrity or competence into question. In such cases, the auditor should consider communicating directly with those charged with governance rather than compromising the independence and effectiveness of the communication.

Where it goes wrong. Assuming that the management individual responsible for the deficiency must always receive direct communication before governance is informed.

Authority. SA 265

Question 13 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor identifies that a particular class of transactions has a high risk of material misstatement relating to completeness. How should the auditor determine the further audit procedures required under SA 330?

An auditor identifies that a particular class of transactions has a high risk of material misstatement relating to completeness. How should the auditor determine the further audit procedures required under SA 330?

1. Use an identical audit programme for every financial statement area because the overall audit opinion covers all assertions.
2. Concentrate exclusively on financial statement level risks without considering the specific assertion affected.
3. Design procedures whose nature, timing and extent are specifically responsive to the assessed assertion-level risk. (correct answer)
4. Perform only procedures selected by management because management understands the transaction processing system better.

Answer: C — Design procedures whose nature, timing and extent are specifically responsive to the assessed assertion-level risk.

Explanation. SA 330, paragraph 6, requires further audit procedures whose nature, timing and extent are based on and responsive to assessed risks at the assertion level. Paragraph 7 requires consideration of the reasons for each risk assessment, including inherent risk and relevant control risk. Accordingly, the auditor should design procedures addressing the particular completeness risk rather than apply an identical programme to all assertions or rely on management's preferences.

Where it goes wrong. Confusing overall responses to financial-statement-level risks with procedures specifically designed for assertion-level risks.

Authority. SA 330

Question 14 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. During an audit of a listed company, the auditor identifies pervasive weaknesses in governance, accounting personnel and financial reporting controls. Which response would be most consistent with SA 330?

During an audit of a listed company, the auditor identifies pervasive weaknesses in governance, accounting personnel and financial reporting controls. Which response would be most consistent with SA 330?

1. Increase professional skepticism, assign suitably experienced personnel, strengthen supervision and introduce unpredictability into audit procedures. (correct answer)
2. Concentrate only on testing the largest asset balance and retain the original supervision and staff allocation arrangements.
3. Rely more heavily on management representations because weaknesses in financial reporting make other evidence difficult to obtain.
4. Reduce year-end procedures and rely on interim analytical reviews to avoid placing unnecessary pressure on management.

Answer: A — Increase professional skepticism, assign suitably experienced personnel, strengthen supervision and introduce unpredictability into audit procedures.

Explanation. SA 330, paragraphs 5 and A1-A3, identifies broad responses to financial-statement-level risks, including heightened professional skepticism, assigning experienced staff, increased supervision and unpredictable audit procedures. Where the control environment is ineffective, the auditor may also perform more extensive substantive procedures, particularly at period end. Retaining the original approach without modification would not adequately address pervasive risks. Management representations are not a substitute for sufficient appropriate audit evidence.

Where it goes wrong. Treating pervasive weaknesses as risks affecting only one account balance instead of adapting the entire engagement approach.

Authority. SA 330

Question 15 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor assesses a particular financial statement assertion as presenting a substantially higher risk of material misstatement than originally anticipated. Which approach most appropriately reflects the evidence requirement under SA 330?

An auditor assesses a particular financial statement assertion as presenting a substantially higher risk of material misstatement than originally anticipated. Which approach most appropriately reflects the evidence requirement under SA 330?

1. Maintain the same audit evidence requirements because the level of risk affects only the auditor's internal planning documentation.
2. Reduce the evidence obtained because high-risk areas generally require more reliance on management's explanation and representations.
3. Increase the number of procedures without considering whether the additional procedures address the specific assessed risk.
4. Obtain more persuasive evidence, which may involve more reliable third-party evidence or corroboration from independent sources. (correct answer)

Answer: D — Obtain more persuasive evidence, which may involve more reliable third-party evidence or corroboration from independent sources.

Explanation. SA 330, paragraph 7(b), and application paragraph A19, require more persuasive audit evidence as the auditor's risk assessment increases. This may involve increasing evidence quantity or obtaining evidence that is more relevant and reliable, such as third-party evidence or corroboration from independent sources. Merely increasing procedure volume is not sufficient if those procedures do not address the assessed risk. Management representations alone would not provide the required increase in persuasiveness.

Where it goes wrong. Assuming that increasing sample size automatically makes evidence persuasive, irrespective of its relevance and reliability.

Authority. SA 330

Question 16 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. An auditor examines individual purchase invoices to establish whether transactions recorded in the books are genuine and separately verifies the existence of machinery appearing in the balance sheet. How should these procedures be classified?

An auditor examines individual purchase invoices to establish whether transactions recorded in the books are genuine and separately verifies the existence of machinery appearing in the balance sheet. How should these procedures be classified?

1. Both are substantive analytical procedures because they involve comparisons between financial records and supporting information.
2. Invoice examination is a test of transaction details, while machinery verification is a test of balance details. (correct answer)
3. Both are tests of controls because they involve examination of documents relating to accounting transactions.
4. Invoice examination is a test of balances, while machinery verification is a test of transactions.

Answer: B — Invoice examination is a test of transaction details, while machinery verification is a test of balance details.

Explanation. SA 330, paragraph 4(a)(i), and ICAI Study Material Chapter 3, §8.6, explain that tests of details include tests of transactions and tests of balances. Tests of transactions involve vouching, such as examining purchase invoices to establish authenticity. Tests of balances involve verification of assets or liabilities, such as establishing the existence of machinery. Neither procedure is automatically a test of controls merely because supporting documents are inspected.

Where it goes wrong. Confusing vouching of individual transactions with verification of closing account balances.

Authority. SA 330

Question 17 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor identifies a significant risk of material misstatement relating to a complex year-end transaction. The auditor decides to address the significant risk exclusively through substantive procedures. Which requirement applies?

An auditor identifies a significant risk of material misstatement relating to a complex year-end transaction. The auditor decides to address the significant risk exclusively through substantive procedures. Which requirement applies?

1. The substantive procedures must be specifically responsive to the significant risk and must include tests of details. (correct answer)
2. The substantive procedures may consist entirely of broad analytical comparisons because detailed testing is unnecessary for significant risks.
3. The auditor may omit substantive procedures if management has provided a satisfactory explanation of the transaction.
4. The auditor must perform only tests of controls because complex transactions cannot be examined substantively.

Answer: A — The substantive procedures must be specifically responsive to the significant risk and must include tests of details.

Explanation. SA 330, paragraph 21, specifically addresses substantive procedures responsive to significant risks. The auditor must perform substantive procedures specifically responsive to the assessed significant risk. Where the approach consists only of substantive procedures, those procedures must include tests of details. Broad analytical procedures or management explanations alone cannot satisfy this express requirement. The procedures must directly address the particular characteristics and potential misstatements associated with the significant transaction.

Where it goes wrong. Assuming that substantive analytical procedures alone are sufficient where the auditor adopts an exclusively substantive response to a significant risk.

Authority. SA 330

Question 18 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. Before finalising the audit, the engagement partner reviews whether the financial statements agree with the underlying accounting records and examines significant manual journal entries passed during financial statement preparation. Which requirement is principally being addressed?

Before finalising the audit, the engagement partner reviews whether the financial statements agree with the underlying accounting records and examines significant manual journal entries passed during financial statement preparation. Which requirement is principally being addressed?

1. The requirement to perform substantive procedures only where the auditor has identified weaknesses in internal control.
2. The requirement to obtain written representations from management concerning every adjustment made during the financial reporting process.
3. The substantive procedures relating to the financial statement closing process under SA 330. (correct answer)
4. The requirement to perform tests of controls over every manual journal entry before assessing the overall audit risk.

Answer: C — The substantive procedures relating to the financial statement closing process under SA 330.

Explanation. SA 330, paragraph 20, specifically requires substantive procedures relating to the financial statement closing process. These include agreeing or reconciling the financial statements with underlying accounting records and examining material journal entries and other adjustments made during preparation of the financial statements. These procedures are not restricted to situations involving control weaknesses. Management representations or tests of controls do not replace the auditor's own substantive examination of the closing process.

Where it goes wrong. Confusing substantive procedures over the financial statement closing process with tests of controls over routine transaction processing.

Authority. SA 330

Question 19 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company earns rental income from a building containing 60 apartments. The number of occupied apartments, contractual rental rates and vacancy periods are reliably available. Which substantive audit approach may provide persuasive evidence regarding recorded rental income?

A company earns rental income from a building containing 60 apartments. The number of occupied apartments, contractual rental rates and vacancy periods are reliably available. Which substantive audit approach may provide persuasive evidence regarding recorded rental income?

1. Inspect a few rent receipts and automatically project the observed amounts to the entire annual rental income without further evaluation.
2. Develop an independent expected rental income using apartment numbers, contractual rates and vacancy information and investigate significant differences. (correct answer)
3. Obtain written management confirmation of the total rental income and accept the recorded balance without independent verification.
4. Examine only the company's bank reconciliation statements because rental collections always agree with rental revenue.

Answer: B — Develop an independent expected rental income using apartment numbers, contractual rates and vacancy information and investigate significant differences.

Explanation. SA 330, paragraph 4(a)(ii), and ICAI Study Material Chapter 3, §8.7, recognise substantive analytical procedures based on plausible relationships among financial and non-financial information. Rental income can be independently estimated using apartment numbers, contractual rates and vacancy periods. This may provide persuasive evidence where relationships are predictable. Significant differences must still be investigated. A few receipts or management representations alone cannot establish the reasonableness of the complete rental income balance.

Where it goes wrong. Assuming that all analytical procedures are merely preliminary comparisons rather than procedures capable of providing substantive audit evidence.

Authority. SA 330

Question 20 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. An auditor intends to adopt a combined approach, relying partly on effective purchase controls and partly on substantive procedures. Which statement correctly describes the relationship between the two approaches?

An auditor intends to adopt a combined approach, relying partly on effective purchase controls and partly on substantive procedures. Which statement correctly describes the relationship between the two approaches?

1. Once tests of controls are successful, substantive procedures are required only if the auditor subsequently identifies fraud.
2. The auditor may omit tests of controls even though the assessed risk is based on an expectation that those controls operate effectively.
3. A combined approach eliminates the need to link substantive procedures with the assessed assertion-level risks.
4. Tests of controls support reliance on control effectiveness, while substantive procedures remain required for each material class, balance and disclosure. (correct answer)

Answer: D — Tests of controls support reliance on control effectiveness, while substantive procedures remain required for each material class, balance and disclosure.

Explanation. SA 330, paragraphs 8 and 18, establishes the requirements for tests of controls and substantive procedures. Tests of controls are required when the auditor intends to rely on operating effectiveness or when substantive procedures alone cannot provide sufficient appropriate evidence. However, paragraph 18 separately requires substantive procedures for every material class of transactions, balance and disclosure, regardless of assessed risk. A combined approach therefore does not eliminate either applicable requirement.

Where it goes wrong. Assuming that the combined approach allows the auditor to dispense with mandatory substantive procedures when controls operate effectively.

Authority. SA 330

Question 21 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company has not experienced any actual material misstatement in its cash records. However, the auditor identifies weaknesses in cash custody, authorisation and independent reconciliation, exposing substantial balances to possible misappropriation. Which conclusion is most appropriate under SA 265?

A company has not experienced any actual material misstatement in its cash records. However, the auditor identifies weaknesses in cash custody, authorisation and independent reconciliation, exposing substantial balances to possible misappropriation. Which conclusion is most appropriate under SA 265?

1. A significant deficiency may exist because significance depends on professional judgment and potential consequences, not solely on actual misstatements. (correct answer)
2. No deficiency can be reported because cash records have not yet been found to contain an actual material error.
3. The deficiencies can be classified as significant only if the statutory auditor has already modified the audit opinion.
4. The deficiencies need not be evaluated because individual weaknesses are unrelated to the combined internal control system.

Answer: A — A significant deficiency may exist because significance depends on professional judgment and potential consequences, not solely on actual misstatements.

Explanation. SA 265, paragraphs 6(b), 7 and 8, together with application paragraphs A5-A11, establishes that significant deficiencies are identified through professional judgment. Their significance depends on factors such as the likelihood and potential magnitude of misstatement, susceptibility of assets to fraud and financial statement amounts exposed. Actual misstatements are not necessary. Cash custody and authorisation weaknesses may be significant because of the potential exposure even when no loss has yet been detected.

Where it goes wrong. Assuming that an internal control deficiency cannot be significant unless an actual material misstatement has already occurred.

Authority. SA 265

Question 22 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. The auditor identifies a significant deficiency during the audit but has not yet communicated it to management or those charged with governance. Which statement correctly reflects the communication requirements?

The auditor identifies a significant deficiency during the audit but has not yet communicated it to management or those charged with governance. Which statement correctly reflects the communication requirements?

1. Written communication to those charged with governance is necessary only when management formally agrees with the auditor's findings.
2. Communication to management is sufficient because separate communication to governance is optional where management knows about the deficiency.
3. The auditor must communicate the significant deficiency in writing to governance and also communicate it in writing to management at an appropriate level, unless direct management communication is inappropriate. (correct answer)
4. The auditor may defer both communications until the next financial year because the deficiency was identified during the current audit.

Answer: C — The auditor must communicate the significant deficiency in writing to governance and also communicate it in writing to management at an appropriate level, unless direct management communication is inappropriate.

Explanation. SA 265, paragraphs 9 and 10(a), requires significant deficiencies to be communicated in writing to those charged with governance on a timely basis. The auditor must also communicate such deficiencies in writing to management at an appropriate level of responsibility, unless direct communication is inappropriate in the circumstances. Management's agreement is not a prerequisite, and delaying communication until a subsequent financial year would not satisfy the timely communication requirement.

Where it goes wrong. Confusing communication to management with the separate mandatory written communication to those charged with governance.

Authority. SA 265

Question 23 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. A company's audit committee argues that the auditor's written communication of significant internal control deficiencies constitutes an opinion on the effectiveness of the company's entire internal control system. Which response is correct?

A company's audit committee argues that the auditor's written communication of significant internal control deficiencies constitutes an opinion on the effectiveness of the company's entire internal control system. Which response is correct?

1. Agree, because SA 265 requires the auditor to express an overall opinion on the adequacy and operating effectiveness of all internal controls.
2. Agree, because communicating significant deficiencies automatically constitutes a separate assurance engagement on internal financial controls.
3. Disagree only where the company is privately held, since listed companies must receive a complete internal control effectiveness opinion under SA 265.
4. Disagree, because the audit considers relevant internal control to design appropriate audit procedures, not ordinarily to express an opinion on its effectiveness. (correct answer)

Answer: D — Disagree, because the audit considers relevant internal control to design appropriate audit procedures, not ordinarily to express an opinion on its effectiveness.

Explanation. SA 265, paragraphs 1-2 and 11(b)(ii), explains that the auditor considers internal control relevant to financial statement preparation to design appropriate audit procedures. Such consideration is not, by itself, an engagement to express an opinion on the effectiveness of internal control. The written communication must explain this limitation and clarify that reported matters are those identified during the audit and considered sufficiently important to merit governance attention.

Where it goes wrong. Confusing a communication of significant deficiencies discovered during a financial statement audit with an independent opinion on internal control effectiveness.

Authority. SA 265

Question 24 · 2 marks · Chapter 3: Risk Assessment and Internal Control · hard

Scenario. During the audit, management informs the auditor that the significant internal control deficiencies have been known for two years but have not been rectified because remedial measures would be expensive. What should the auditor conclude?

During the audit, management informs the auditor that the significant internal control deficiencies have been known for two years but have not been rectified because remedial measures would be expensive. What should the auditor conclude?

1. No further communication is necessary because management's prior knowledge establishes that the deficiency has already been reported.
2. The significant deficiencies must still be communicated in writing to those charged with governance on a timely basis. (correct answer)
3. The auditor should omit the deficiencies because management is entitled to decide whether the cost of remediation is justified.
4. The auditor should communicate only if remedial actions are rejected by the audit committee after formal voting.

Answer: B — The significant deficiencies must still be communicated in writing to those charged with governance on a timely basis.

Explanation. SA 265, paragraph 9, and application paragraph A16, require written communication of significant deficiencies to those charged with governance on a timely basis. This requirement applies even when management or governance is already aware of the deficiencies and has decided not to remedy them because of costs or other considerations. The responsibility for evaluating the costs and benefits of remediation belongs to management and governance, but it does not remove the auditor's communication obligation.

Where it goes wrong. Assuming that management's prior knowledge or decision not to incur remediation costs eliminates the auditor's separate reporting responsibility.

Authority. SA 265

Question 25 · 2 marks · Chapter 3: Risk Assessment and Internal Control · medium

Scenario. An auditor performs substantive procedures over sales transactions at an interim date. The auditor wishes to extend the conclusions to the reporting date. Which approach is consistent with SA 330?

An auditor performs substantive procedures over sales transactions at an interim date. The auditor wishes to extend the conclusions to the reporting date. Which approach is consistent with SA 330?

1. Extend the interim results automatically because substantive procedures performed before year-end remain valid until the audit report date.
2. Rely entirely on management representations concerning subsequent transactions without obtaining further audit evidence.
3. Cover the remaining period through further substantive procedures, or through substantive procedures combined with tests of controls, as appropriate. (correct answer)
4. Discard all interim audit evidence and repeat every substantive procedure only after the financial year has ended.

Answer: C — Cover the remaining period through further substantive procedures, or through substantive procedures combined with tests of controls, as appropriate.

Explanation. SA 330, paragraph 22, permits substantive procedures to be performed at an interim date, but the auditor must obtain a reasonable basis for extending conclusions to period end. The remaining period may be covered through substantive procedures combined with tests of controls, or through further substantive procedures alone when sufficient. Interim results cannot be extended automatically without considering intervening transactions and risks. Nor does the standard require discarding all valid interim evidence.

Where it goes wrong. Assuming that interim substantive testing automatically covers the remaining period without additional audit procedures.

Authority. SA 330