cpa audit review ch9 review 4

C.Search for significant deficiencies in the operation of internal control.

The auditor should obtain an understanding of the entity and its environment, including its internal control, and assess the risks of material misstatement. The limited purpose of this consideration does not include the search for significant deficiencies or material weaknesses.

Need not test the service organization’s internal control if the user entity has effective controls related to service organization processing.

The significance of controls at the service organization depends on the degree of interaction between its activities and those of the user entity. The degree of interaction is the extent to which the user entity can, and chooses to, implement effective controls over service organization processing. In these circumstances, the user auditor may be able to obtain an understanding from the user entity of the service organization’s services that suffices to assess the RMMs. Accordingly, the user auditor need not obtain a type 1 or type 2 report.

Desirable by-product of an audit engagement.

During an audit, the auditor may become aware of matters related to internal control that may be of interest to management and those charged with governance. Those matters meeting the definition of significant deficiencies or material weaknesses in internal control should be communicated in writing. Other deficiencies that merit attention should be communicated to management either orally or in writing. The auditor may make constructive suggestions to the client for improvements in its internal control for the benefit of management or others.

D.Suggested corrective action for management’s consideration concerning a material weakness need not be communicated to the client.

Although the auditor should communicate material weaknesses to management and those charged with governance, suggested corrective action need not be communicated.

C.The communication by the auditor must be in writing.

The auditor communicates on a timely basis and in writing to those charged with governance significant deficiencies and material weaknesses identified during the audit. This communication includes those remediated during the audit. The auditor also communicates on a timely basis and in writing to the appropriate level of management significant deficiencies and material weaknesses communicated (or intended to be communicated) to those charged with governance. (But certain deficiencies should not be reported directly to management.)