Small Audits Made Easy & Profitable—An Overview

1. Small AuditsMade Easy & Profitable—An Overview Presented by: Larry L. Perry, CPA CPA Firm Support Services, LLC www.cpafirmsupport.com

2. Learning Objectives www.cpafirmsupport.com To understand the philosophies underlying cost-beneficial audit approaches To be aware of the framework for approaching small audits to achieve high quality, efficiently To understand how to make small audits more profitable

3. What is a Small Audit? www.cpafirmsupport.com • Professional standards don’t define a small audit • Some standards-setters say small entities are those with less than $10,000,000 (Does this work for you?) • Common guidelines for identifying a small audit: • Three or less accounting personnel • Revenues under $1,000,000 • 100 audit hours or less • Small audit strategies, procedures and documentation may also be applicable to larger engagements. • A small audit is principles-based and tailored to specific engagement circumstances

4. Building the Foundation for Efficiency www.cpafirmsupport.com • Thinking holistically—increasing efficiency on small audits requires prioritizing efficiency from start to finish of the engagement • A functioning quality control system—substance over form from the top down • Knowing what we are doing! • We must know what is required so we can accomplish audit objectives in the minimum amount of time • Micro-managing efficiency—taking advantage of every opportunity to save engagement time, even if it is only five minutes!

5. Statement on Quality Control Standards No.8 www.cpafirmsupport.com • Quality control standards result in higher quality audit evidence • Leader involvement is the key • Substance vs. form • A quality control document is required • Standards must be integrated with engagement performance • Client acceptance and retention evaluations—risk at the financial statement level • Planning documentation • Assigning personnel • Consultation • Supervision

6. Polling Question No. 1 www.cpafirmsupport.com SQCS No. 8 only impacts CPA firm administration and has no affect on engagement performance and documentation. A. True. B. False.

7. Getting the Evidence Picture for Small Audits • 1. CPA Firm’s Quality Control System • 2. Practice Aids • 3. Reading General Ledger • 4. Flowcharts and Walk-throughs; 5,10,15 units • Prior Period Control Risk • Analytical Procedures • Detailed Tests of Balances www.cpafirmsupport.com

8. Getting Rid of Old Evidence Paradigms www.cpafirmsupport.com The Old • Tests of controls (dual purpose) • Analytical procedures • Detailed tests of balances The New • Considering the affects of prior year’s work • Reading the general ledger • Performing and documenting a systems walk-through procedure • Documenting other risk assessment procedures • Using analytical procedures for substantive evidence • Reducing detailed test of balances

9. Planning the Most Efficient Small Audit Documentation that Satisfies Audit Standards www.cpafirmsupport.com For small audits: • Client acceptance and retention evaluations • General ledger analysis worksheet • Small audit ICQs, flowcharts, or memos designed by financial statement classification • Systems walk-through memo or form • Analytical procedures worksheets for both planning and review

10. Additional Efficient Documentation for Small Audits • Risk of material misstatements evaluation by financial statement classification • Risk assessment working paper to guide selection of types of tests based on RMM • Tolerable misstatement calculations by financial statements classifications • Sampling and non-sampling decisions worksheet • Audit planning document • Audit programs tailored for RMM • Management representation letter www.cpafirmsupport.com

11. Audit Risk in the Standards www.cpafirmsupport.com • Defined as the risk the auditor may unknowingly fail to modify an opinion on materially misleading statements due to error or fraud • The auditor is required to assess risk at both the financial statement and assertions levels • Client acceptance and continuance form contains information about risk at financial statement level • Inherent and control risks comprise risk of material misstatement at the account classification level • Risk at both levels must be linked to audit responses and procedures that are designed to mitigate the risks—this forms the audit strategy and the audit plan

12. Four Efficient Risk Assessment Procedures www.cpafirmsupport.com • Use general organizational, operational, and governance information from Client Acceptance and Continuance Form to obtain a basic understanding of the client’s business and industry • Read and analyze the detailed general ledger for support tests, unusual transactions, GJEs, errors, etc.—Document • Prepare internal control flowcharts and documentation of systems walk-through procedures (use flowcharting guides or ICQs for reference) • Prepare a document summarizing all engagement planning activities and decisions Other documentation for understanding a client’s business and industry is elective based on facts and circumstances!

13. A Practical Approach to Planning—Start to Finish Planning is ongoing—cumulative results of procedures may enable/require auditor to change the audit plan www.cpafirmsupport.com Deliver the engagement letter Plan client assistance Assign the right people if you can Arrange proper workspace Plan appropriate audit documentation Discuss opportunities to save time Decide on risk assessment procedures Evaluate risk at the financial statement level Evaluate risk by relevant financial statement assertions (account classifications) Set tolerable misstatement for account classifications Decide to sample or not Hold planning meeting Complete planning document

14. Polling Question No. 2 www.cpafirmsupport.com Assessing risks of material misstatement affects small audits in which of the following ways? • It results in necessary audit responses • It is the foundation for designing audit strategies • It helps identify opportunities for efficiency • A and C • All the above

15. Look for Key Controls on Small Audits www.cpafirmsupport.com Key controls are primarily at the entity level • Significant deficiencies or material weaknesses occur when key controls are not operating properly • Can be informal and don’t have to be written • Can be performed by one or a few persons and don’t have to be documented Activity-level controls • They may prevent significant deficiencies or material weaknesses when key controls are not designed or operating • Some can be informal but ordinarily should be documented

16. Can We Test and Rely onOwner/Manager Key Controls? www.cpafirmsupport.com • When performance of controls is documented? Yes! • INQUIRY • INSPECTION • OBSERVATION • When controls are performed and not documented? Yes! • INQUIRY • INSPECTION • OBSERVATION • When they are designed but not performed? Of course not! These are significant deficiencies or material weaknesses. • Reliance on tests of controls depends on an auditor’s evaluation of the integrity of client personnel and findings from other risk assessment procedures!

17. Can We Rely on Prior Periods’ Control Risk Assessment? www.cpafirmsupport.com • Risk assessment standards say tests of controls performed in up to three prior periods can influence the current year risk assessment if: • There are no changes in personnel, procedures, or policies, and • The prior period assessment is not being used to mitigate a risk of material misstatement

18. Can a Small Entity Have Good Internal Controls? www.cpafirmsupport.com

19. Understanding Financial Statement Assertions www.cpafirmsupport.com • Assertions are the representations of management embodied in financial statements • Auditing procedures are performed to evaluate relevant financial statement assertions • AU-C 315, Audit Evidence, identifies assertions for: • Classes of transactions and events • Account balances at the period end • Presentation and disclosure

20. Remembering and Applying Assertions www.cpafirmsupport.com C ompleteness O ccurrence and cutoff V aluation and accuracy E xistence R ights O bligations D isclosure and presentation

21. Why Is Understanding Assertions Important? www.cpafirmsupport.com Auditors must consider all relevant assertions in account classifications during the risk assessment process and when designing and modifying programs • Failure to eliminate different procedures evaluating the same assertion can result in over auditing • Eliminating procedures designed to evaluate a particular assertion without adding an alternative procedure could result in collecting insufficient evidence

22. Tests of Controls www.cpafirmsupport.com • Evaluate the design and operating effectiveness of control activities with compliance-type tests which • Are performed to reduce substantive tests of balances • Consist mainly of observations, inspections, and inquiries • Can be based on inquiries of persons performing informal key controls in small entities • Tests for monetary errors in the operation of an accounting system include recalculation and re-performance (substantive-type tests) • Often are applied as “dual-purpose” tests as part of compliance-type tests of controls • Only 10% to 20% are necessary if compliance tests are performed

23. More Types of Tests www.cpafirmsupport.com Systems walk-through procedure • Discussed in AU-C 315, it is often the most efficient annual confirmation of internal control for risk assessment • Performed by tracing documents and data from inception of transactions to termination (informal tests of controls) • Includes recalculations and re-performance • Combined with other risk assessment procedures, such as reading the general ledger and good prior year experience with a client, this procedure may permit a control risk assessment at some level less than high to moderate • Provides substantive evidence that contributes to evaluating financial statement assertions

24. Striking It Rich with Analytical Procedures www.cpafirmsupport.com • Analytical procedures begin with professional skepticism and the auditors’ thought process • Depending on the effectiveness of analytical procedures, tests of balances can be reduced a little or a lot • Types of analytical procedures in the order of their effectiveness: • Quantity reconciliations • Reasonableness tests • Corroborating procedures

25. Reading the General Ledger www.cpafirmsupport.com • Recognized as a risk assessment procedure in the auditing standards • Can be done manually or by using data extraction software • Provides significant amounts of substantive evidence and should be part of every small audit strategy, audit plan, and related documentation • A general ledger analysis worksheet is efficient documentation and would include: • Unusual amounts or postings • Transactions or GJs greater than ISIs lower limit • Checks selected for support tests • Other unusual items

26. Detailed Tests of Balances www.cpafirmsupport.com • Physical examination of assets • Confirmation of account balances • Inspection of support for transactions and balances • Observation of the work of client personnel • Inquiries of client personnel • Account analysis • Tests of mechanical accuracy of supporting documents and general ledger accounts

27. The Essence of Audit Objectives A cost-beneficial audit strategy for small audits should maximize less expensive evidence from risk assessment and analytical procedures and minimize more costly tests of balances www.cpafirmsupport.com

28. Polling Question No. 3 www.cpafirmsupport.com Objectives for small audits are quality and efficiency. Designing a cost-beneficial audit strategy is a key to efficiency. A. True. B. False.

29. Breaking Small Audit Myths www.cpafirmsupport.com • The truth is: • A small entity can have a good system of internal control • Owner/manager controls can be audited • Inquiry and observation procedures can be used to test informal owner/manager controls • Substantive evidence can be obtained from risk assessment procedures on small audits • More evidence from risk assessment procedures means less evidence is required from tests of balances, even on small audits

30. Establishing and Using Materiality Levels www.cpafirmsupport.com • AU-C 320—materiality judgments are unique to each audit engagement and are estimates of how knowledgeable users would evaluate materiality • Risk always affects materiality levels • Material misstatements in financial statements are determined by the considerations of a reasonable person • Risk and materiality judgments directly affect the amount of evidence necessary to evaluate relevant financial statement assertions

31. Estimates of Materiality www.cpafirmsupport.com Planning Materiality Definition—the maximum amount by which statements could be misstated by known (likely) and unknown error and not affect the decisions of users The preliminary estimate is an estimate of how users would evaluate materiality and a guide for engagement planning, not a precise determination of materiality Tolerable misstatement is the maximum amount of known and likely error an auditor can accept without proposing AJEs and is affected by risk at the financial statement and assertion levels The lower limit for individually significant items is any amount up to tolerable misstatement based on risk (high risk = lower limits; low risk = higher limits)

32. Summary of Time Savings Opportunities on Small Audits www.cpafirmsupport.com • Lower RMM at assertion levels (account classification levels) raises TM and the lower limit for ISIs • Higher TM results in smaller sample sizes in sampling applications • Higher lower limits for ISIs results in fewer ISIs that must be audited 100% as required by audit standards

33. Understanding Sampling and Non-sampling www.cpafirmsupport.com • Audit sampling is the application of a procedure to less than 100% of a population • Everything else is non-sampling • Sampling is applicable when sampling populations (recorded population minus ISIs) are material and analytical and TOB procedures aren’t efficient approaches to satisfying audit objectives • Sampling populations less than the lower limits of ISIs may not require sampling or non-sampling procedures unless they represent a separate class of transactions, related party transactions or other unusual transactions

34. Efficiency Should Always Guide Decisions to Sample or Not to Sample www.cpafirmsupport.com • Characteristics of the population (size and variations of units) guide decision to sample or not to sample • Ease of obtaining evidence also affects decision-making • Non-statistical sampling applications are normally only used when they are most efficient

35. Performing Small Audits Summary • Key Issues for performing effective and efficient small audits include • Integrate the CPA firm’s quality control system into engagement performance • Use client acceptance and retention evaluations to obtain information about an entity’s business and risk • Read general ledger account activity to identify unusual matters (potential risks of misstatement) • Document all unusual matters on one spreadsheet • Document internal control on a flowchart or table • Confirm internal control documentation and collect substantive evidence with a system walk-through procedure • Create a planning document www.cpafirmsupport.com

36. Polling Question No. 4 www.cpafirmsupport.com Auditors always have to sample when sampling populations are greater than the lower limit for individually significant items A. True B. False

37. The End (or is it a new beginning?) • What to do if you want more • Email Larry Perry: larry@cpafirmsupport.com with questions • Visit www.cpafirmsupport.com for resources • Register for free email newsletter on CPA Firm Support website • Read Larry Perry’s weekly articles/blog, Today’s World of Audits, at www.accountingweb.com under A&A and Bloggers Crew tabs for small audit and other subjects • Watch for Larry Perry’s Performing Small Audits, Reviews and Compilations for Entities using the AICPA’s FRF for SMEs from Wiley & Sons in 2015 www.cpafirmsupport.com