us 500-12 u.s. aam vs. dttl aam—a...

© 2008 Deloitte Touche Tohmatsu

US 500-12U.S. AAM vs. DTTL AAM—A Refresher

©2011 Deloitte Global Services Limited

Objectives

Participants will refresh their knowledge on:• Applying the AICPA and the PCAOB Standards.

• Utilizing the U.S. Audit Approach Manual and other guidance to locate the requirements specific to standards of the AICPA or PCAOB.

• Planning an audit in accordance with the standards of the AICPA or PCAOB.

• Conducting an audit of internal control over financial reporting in accordance with the standards of the AICPA or PCAOB.

• Locating and using resources to support conducting an integrated audit.

2

©2011 Deloitte Global Services Limited 3

U.S. AAM Refresher


Engagement letters

• A properly executed engagement letter shall be obtained for all engagements, including all necessary signatures, before beginning significant portions of fieldwork.

• The illustrative engagement letters contained in INFORM within the U.S. Technical Library shall be used when preparing an engagement letter.

<U.S. Audit Approach Manual – Process - 1400.04a and 1400.04c, emphasis added>

4


Engagement letters—which form?

Which U.S. illustrative engagement letter form would be applicable for the audit of a non-accelerated filer (i.e., an issuer that is not required to have an integrated audit)?

5

FORM 1310SP-FS, IILLUSTRATIVE FINANCIAL STATEMENT AUDIT ENGAGEMENT LETTER — PUBLIC ENTITY

https://techlib.deloitte.com/default.aspx?contextId=ccd062ed-2c68-4385-a74a-b00f76cfb727


Engagement letters—which form?Which U.S. illustrative engagement letter form would be applicable for an integrated audit of a public entity?

6

FORM 1310SP, IILLUSTRATIVE INTEGRATED AUDIT ENGAGEMENT LETTER — PUBLIC ENTITY

https://techlib.deloitte.com/default.aspx?contextId=ccd062ed-2c68-4385-a74a-b00f76cfb727


Materiality

If we are performing an integrated audit, is the determination of materiality different for a financial statement audit and the audit of internal control over financial reporting?

No. If we are performing an integrated audit, we shall use the same materiality used to audit the financial statements in planning and performing our audit of internal control over financial reporting.

<U.S. Audit Approach Manual 2210.01b, emphasis added>

7

©2011 Deloitte Global Services Limited 8

Benchmark

Determination of Materiality

• Profit before tax from continuing operations

• Typically what users of the financial statements focus on

• Typically 5%-10% of estimated profit before tax

• Engagement partner may use professional judgment to determine use of other percentages

Materiality

<based on DTTL Audit Approach Manual 2210.10>


Performance materiality

For audits of SEC listed entities, for purposes of determining the amount to be deducted from materiality to arrive at performance materiality, we shall use the greater of the amounts determined using the iron curtain approach and the approach in U.S. AAM 2220.05.<U.S. Audit Approach Manual 2220.05b, emphasis added>

9


Iron Curtain approach

The iron curtain approach quantifies a misstatement based on the effects of correcting the misstatement existing in the balance sheet at the end of the current year, irrespective of the misstatement’s year(s) of origination. <Based on U.S. Audit Approach Manual Glossary>

10


Rollover approach

Under the rollover approach, uncorrected misstatements include those that have an impact on net income and include the current period carryover effects of misstatements identified in prior periods <U.S. Audit Approach Manual Glossary>

11


Rollover vs. Iron Curtain example

• Assume that in 20X2, Registrant A began over-accruing a liability each year by $20.

• Therefore, at the end of 20X6, liabilities are overstated by $100.• The $20 annual over-accrual was not considered material to

any of the individual prior period financial statements. • In 20X6, should the registrant evaluate the error in the current

year as a $100 overstatement of liabilities (iron curtain approach), or as a $20 overstatement of expenses (rollover approach)?

12


20x6Iron Curtain

A

20x6Rollover B

Overstatement of expenses $ 20 $ 20

Entry to adjust (100) (20)

Understatement of expenses (as adjusted) $ (80) $ —

Overstatement of liabilities $ 100 $ 100

Entry to adjust (100) (20)

Overstatement of liabilities (as adjusted) $ — $ 80

A Under the Iron Curtain approach, after the adjustment, entries will be correct but expenses will be understated by $80.

B

Under the Rollover approach, after the adjustment, expenses will be correct but liabilities will be overstated by $80.

13

Rollover vs. Iron Curtain example


Rollover vs. Iron Curtain example: Solution

In 20X6, should the registrant evaluate the error in the current year as a $100 overstatement of liabilities (iron curtain approach), or as a $20 overstatement of expenses (rollover approach)?•Evaluate the errors using both approaches and adjust the Financial statements if either approach results in quantifying a misstatement that is material.•The 100 overstatement in 2006 under the iron curtain approach is material, thus the FS should be adjusted.•The 80 understatement of expenses is also material for 2006, thus prior year FS should be corrected regardless of materiality for those years.

14


• When an entity has components, the group engagement team is required to identify material classes of transactions, account balances, and disclosures and their relevant assertions based on the consolidated financial statements <U.S. Audit Approach Manual G860.01b and 2250.02a>

• The group engagement team is required to determine the extent to which audit procedures should be performed at selected components to obtain sufficient appropriate audit evidence to obtain reasonable assurance about whether the group financial statements are free of material misstatement.

Note: This includes determining the components at which to perform audit procedures, as well as the nature, timing, and extent of the procedures to be performed at those individual components.

• In determining the components at which to perform audit procedures, the group engagement team is required to assess the risks of material misstatement to the group financial statements associated with the component and correlate the amount of audit attention devoted to the component with the degree of risk of material misstatement associated with that component.

<U.S. Audit Approach Manual G860.01c>

Develop overall audit strategy and audit plan for group audits―AICPA and PCAOB audits

15


Consider these factors when assessing the risks of material misstatement associated with a particular component and the determination of the necessary audit procedures:•The nature and amount of assets, liabilities, and transactions executed at the component•The materiality of the component•The risks associated with the component that present a reasonable possibility of material misstatement to the group financial statements•Whether the risks of material misstatement associated with the component apply to other components such that, in combination, they present a reasonable possibility of material misstatements to the group financial statements•The degree of centralization of records or information processing•The effectiveness of the control environment, particularly with respect to management’s control over the exercise of authority delegated to others and its ability to effectively supervise activities at the component•The frequency, timing, and scope of monitoring activities by the entity or others at the component•Whether significant changes have occurred during the period under audit•The length of time since a particular component was last selected and the results of the audit procedures performed. <U.S. Audit Approach Manual G860.01d>

Develop overall audit strategy and audit plan for group audits―AICPA and PCAOB audits

16


Determine whether there is a reasonable possibility of material misstatement in the residual balance of a consolidated material balance •In order to determine whether our audit plan is sufficient, it is important to evaluate whether our plan will allow us to conclude that we have obtained sufficient appropriate audit evidence to obtain reasonable assurance about whether the group financial statements are free of material misstatement. •As such, the group engagement team is required to evaluate whether the portion of each material balance at the group level* for which no substantive procedures are planned at the group or component level (i.e., the “residual balance” of the material balance at the group level) presents a reasonable possibility of material misstatement to the group financial statements.

*Material balances at the group level include income statement and balance sheet accounts that are material to the group financial

statements, considering both quantitative and qualitative factors

<U.S. Audit Approach Manual G860.02g>

Scope the group audit―AICPA and PCAOB audits

17


Example: The group engagement team’s planned scope is as follows “Horizontal scoping” : Example: The group engagement team’s planned scope is as follows “Horizontal scoping” :

Subjected to Substantive Procedures in the CY

Residual Balance

Cash 79% 21%Accounts Receivable 70% 30%Other Current Assets 77% 23%Goodwill 100% 0


Total Balance at Significant

Components

% of balance tested at

significant components U.S. 3 EMEA 1 EMEA 3 APAC Total % Remaining

Assets

Cash $9,180,733 79% $492,000 $264,000 $700,000 $980,820 $2,436,820 21%

Accounts Receivable 6,073,946 70% 800,000 800,000 1,000,000 2,600,000 30%

Other Current Assets 630,000 77% 50,000 40,000 100,000 190,000 23%

Goodwill 20,970,022 100% 0%

Significant Components Residual Balance - Consolidated Material Account Balances

18


Determine whether there is a reasonable possibility of material misstatement in the residual balance of a consolidated material balance (continued)


Considerations (AS 9.12 and G860.01d):•The nature and amount of assets, liabilities and transactions executed at the component •The materiality of the component•The risks associated with the component that present a reasonable possibility of material misstatement to the group financial statements•Whether the risks of material misstatement associated with the component apply to other components such that, in combination, they present a reasonable possibility of material misstatement to the group financial statements•The degree of centralization of records or information processing•The effectiveness of the control environment•The frequency, timing, and scope of monitoring activities •Whether significant changes have occurred during the period under audit•The length of time since a particular component was last selected and the results of the audit procedures performed.

Considerations (AS 9.12 and G860.01d):•The nature and amount of assets, liabilities and transactions executed at the component •The materiality of the component•The risks associated with the component that present a reasonable possibility of material misstatement to the group financial statements•Whether the risks of material misstatement associated with the component apply to other components such that, in combination, they present a reasonable possibility of material misstatement to the group financial statements•The degree of centralization of records or information processing•The effectiveness of the control environment•The frequency, timing, and scope of monitoring activities •Whether significant changes have occurred during the period under audit•The length of time since a particular component was last selected and the results of the audit procedures performed.

19


Determine Whether there is a Reasonable Possibility of Material Misstatement in the Residual Balance of a Consolidated Material Balance If, after performing the analysis on the preceding slides, the group engagement team determines that a reasonable possibility of material misstatement to the group financial statements exists in the residual balance of one or more material balances at the group level, the group engagement team is required to modify the audit plan accordingly.

<U.S. Audit Approach Manual G860.02h>


20


The ISAs require the group engagement team to request the component auditor to communicate matters relevant to the group engagement team’s conclusion with regard to the group audit .<U.S. Audit Approach Manual G885.06>

The standards of the PCAOB have specific requirements on the documentation that must be obtained, reviewed, and retained by the group engagement team related to the work performed by the component auditors. Some of this documentation may have been obtained in connection with complying with U.S. AAM G885.06. (See next slide for detail listing)<U.S. Audit Approach Manual G885.06b>

The standards of the PCAOB, also require the group engagement team to determine that the component auditors' audit documentation is prepared and retained in compliance with the standards of the PCAOB.

<U.S. Audit Approach Manual G885.07ab>

Communicate with component auditors―PCAOB audits

21


PCAOB AS 3.19 and PCAOB AU 543.12 require that the following be obtained, reviewed, and retained by the group engagement team:•An audit summary memorandum, including all cross-referenced supporting working papers relating to significant matters and significant documentation matters•A list of significant risks, the component auditors' response, and the results of the component auditors' related procedures•Sufficient information relating to any significant matters that are inconsistent with or contradict the final conclusions•Any findings affecting the consolidating or combining of accounts in the consolidated financial statements•Sufficient information to enable the office issuing the audit report to agree or to reconcile the financial statement amounts to the information underlying the consolidated financial statements•A schedule of accumulated misstatements, including a description of the nature and cause of each accumulated misstatement, and an evaluation of uncorrected misstatements, including the quantitative and qualitative factors the component auditor considered to be relevant to the evaluation•All significant deficiencies and material weaknesses in internal control over financial reporting, including a clear distinction between those categories•Letters of representations from management•All matters to be communicated to those charged with governance. <U.S. Audit Approach Manual G885.06b>:

Communicate with component auditors―PCAOB audits

22


Information produced by the entity

When using information produced by the entity we shall evaluate whether the information is sufficiently reliable for our purposes, including as necessary in the circumstances (1)Obtaining audit evidence about the accuracy and completeness of the information, and

(2)Evaluating whether the information is sufficiently precise and detailed for our purposes.

<U.S. Audit Approach Manual G510.11>

23


Reliance on information produced by the entity

When information produced by the entity is used by us to perform audit procedures, we should obtain audit evidence about the completeness and accuracy of the information‒Controls over preparation and maintenance of information produced by the

entity include the following elements: • Controls over the accuracy and completeness of the source data

• Controls over the creation and modification of the applicable report logic and parameters.

‒Controls over the accuracy and completeness of the source data may be addressed by our tests of controls of the related classes of transactions, account balances, and disclosures. Additional testing of general IT controls may provide audit evidence that the program and data sources are protected from unauthorized access or changes.

<Based on U.S. Audit Approach Manual G510.13-13b>

24


Illustrative example 1Information produced by the entity is tested through typical substantive procedures

The engagement team is evaluating the following control:

The assistant controller reviews an Accounts Receivable (AR) Aging Report on a monthly basis in determining the appropriateness of the reserve for bad debt.

The AR Aging report is a standard report (non-customized) generated out of the SAP ERP application.

The following procedures were performed by the engagement team during their substantive testing of AR.

•Foot and crossfoot aging report (Accuracy); •Agree Total Aging Balance to G/L (Completeness);•Selected a sample of A/R confirms and traced them into the Aging Report (Accuracy); AND•Determine appropriateness of aging for a sample of line items in the Aging Report (Accuracy – Aging)

25


Illustrative example 2Information produced by the entity is used to perform a control

The engagement team is evaluating the following control:The Assistant Controller reviews an ERP report that identifies the number of units sold by SKU and units in ending inventory by SKU to compute the number of months sales on hand. This information is then used to evaluate the inventory valuation.

26

Question #1 – •Controls over the accuracy and completeness of the source data are addressed by our tests of controls of the sales and inventory systems, including the proper SKU. (Note: When designing control and substantive procedures, consider the IPE that will be utilized and design control or substantive tests to incorporate appropriate testing related to the proper entry of SKU upon sales to increase efficiencies and eliminate the need for additional samples.)

Question #2 – •Select X items from (1) the sales journal and perpetual inventory and trace back to bill of ladings or production data and (2) the bill of lading or production records and trace to the source data. Alternatively, consider integrating this testing into the detail tests of sales and inventory (i.e., use the same samples for both purposes).


Illustrative example 2 (continued)

Year 1 – Approach•Source Data: Test the accuracy and completeness of source data through testing controls over the sales and inventory systems, including entry of SKU when a sale occurs.•Report Logic: Test the report directly to determine whether the report is being appropriately created by:

• Reconciling sales and inventory amounts to sales journal and perpetual inventory.

• Select X items from the number of units sold and the units in ending inventory columns of the report and trace back to the source data by SKU (e.g., the sales journal or perpetual inventory).

• Foot and cross-foot report totals and recalculate

Year 2 – Approach•Source Data: Same as Year 1 approach•Report Logic:

• Carry forward a summary of direct testing of the report logic performed in the previous year, including a description of the report, how it was tested, and the conclusions we reached.

• Obtain evidence in the change management system that validates that the source code underlying the report has not been changed since it was previously tested by us.

27


Information produced by the entity―FAQs

Information produced by the entity (IPE)―FAQs includes:

• FAQs on the requirements and guidance in U.S. AAM G510

• Illustrative testing approaches by IPE type

• Illustrative testing approaches for certain IPE fact patterns

28


Access the IPE―FAQs1. Deloitte Technical Library 2. Deloitte Policies and Guidance3. U.S. Guides, Practice Aids, and FAQs for Auditors4. Audit Process

29


Nature of tests of controls

Some types of tests, by their nature, produce greater evidence of the effectiveness of controls than other tests.

Least Evidence Most Evidence

Inquiry Observation Inspection Reperformance

30


Timing for tests of controls

31


Illustrative example

32


Figure 4200.1

Nature of Control Frequency of Performance of

the Control

Number of SelectionsControl Addresses a Significant

RiskNo Deviations Planned

Post-Change Pre-Change

Manual Many times per day 45 25

Manual Daily 25 15Manual Weekly 8 5Manual Monthly 3 2Manual Quarterly 2 1Manual Annually 1 1

Effective for all audits for periods beginning on or after December 15, 2010.

We may use professional judgment to determine that larger sample sizes may be appropriate <U.S. Audit Approach Manual 4200.23>

33


Figure 4200.2

34


OE testing strategy thought process

Risks Identified?

Significant Risk

Normal risk

Where can we leverage use of work of others?

Where do we think we need to get or are

already getting our

own independent evidence?

Where can we leverage

knowledge obtained from

prior year audits?

e.g., Lower risk,

No significant changes

e.g., Competent,

objective evidence

e.g., Higher risk,

observations,dual purpose tests

Options:• PYK • Independent testing• UWO• Combination

Control Environment

Risk Assessment

Monitoring

Information & Communication

General IT Controls

BusinessCycles

35


Deviations and deficiencies

A deviation (or an exception) is a condition that exists if we identify circumstances that indicate that a control is not being performed in the manner described by the entity.

A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis.

• A deficiency in design exists when (a) a control necessary to meet the control objective is missing or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective would not be met.

• A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.

36


Considerations when evaluating deviations

To determine

• The tests of controls that have been performed provide an appropriate basis for reliance on the controls

• Additional tests of controls are necessary• The potential risks of misstatement need to be addressed

using substantive procedures.

<based on US Audit Approach Manual 4300.05>

Specific inquiries

Deviation from control

37


Ineffective general IT controls

Assessing impact of Ineffective

general IT controls

Pervasiveness

Complexity of environment

Relates to material COTABD?

Proximity to applications and data

Nature and significance

Cause and frequency

Likelihood of increased risk

38


General IT controls

• General IT controls are ordinarily not designed to address risks of material misstatement at the assertion level. Instead, general IT controls address risks arising from IT that may affect the continued effective operation of automated application controls and the reliability of information produced by the entity.

• Although ineffective general IT controls do not by themselves cause misstatements, they may cause application controls to operate improperly, thereby allowing misstatements to occur and not to be detected.

• General IT controls are assessed in relation to the associated risk arising from IT and their effect on applications and data that become part of the Financial Statements.

39


Concluding on an audit of ICFR

Objective Express opinion on effectiveness of ICFR

Auditors obtain evidence about whether material weaknesses exist at date of management’s

assessment.

If material weaknesses exist, ICFR is not effective <AS 5 paragraph 2>.

Therefore we evaluate severity of any identified deficiency(s) to assess whether they represent a

material weakness.

40


Considerations when evaluating deficiencies

ConsiderationsEffect on our test of OE of controls

Management’s actions

Qualitative factors affecting the likelihood that a misstatement could occur

Impact statistically if using attribute sampling

Circumstances and reasons for deviation

41


Questions on other areas of differences between US AAM and DTTL AAM

1.When performing an integrated audit, are we required to test the operating effectiveness of controls in each of the five components?

2.Could a risk of material misstatement for an assertion be related to one or a combination of relevant controls?

3.Can an engagement team perform their testing of a control subsequent to period-end?

4.For integrated audits, if an entity adopts new controls during the year, do we need to test the controls being replaced?

5.What are the required control procedures to be performed on equity method investments?

42


Answers

1.Yes

2.Yes

3.Yes

4.Yes

5.The selection of accounting methods for its investments. The recognition of equity method earnings and losses. The audit ordinarily would not extend to controls at the equity method investee.

43

© 2008 Deloitte Touche Tohmatsu

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms.

This publication is for internal distribution and use only among personnel of Deloitte Touche Tohmatsu Limited, its member firms, and its and their affiliates. None of Deloitte Touche Tohmatsu Limited, Deloitte Global Services Limited, Deloitte Global Services Holdings Limited, the Deloitte Touche Tohmatsu Verein, any of their member firms, or any of the foregoing’s affiliates shall be responsible for any loss whatsoever sustained by any person who relies on this publication.

http://www.deloitte.com/about

us 500-12 u.s. aam vs. dttl aam—a...

Documents