administrative office and major facilities.3 Review year-end financial statements of prior year and interim financial statements of current and prior year.
4 Review auditor’s report on prior year’s financial statements:Was there a scope limitation?Were certain matters emphasized?Did the auditor disclaim an opinion or issue an adverse opinion?Were there other modifications of the auditor’s standard report?
5 Review prior year’s income tax returns.
6 Obtain the results of the most recent income tax examination.
7 Review reports issued to agencies, such as the following:Securities and Exchange Commission (SEC)Federal Housing Administration, Small Business Administration, and Department of LaborCredit agencies and banks
Visit to Administrative Office
During a visit to the client’s administrative office, the auditor should do the following:
1 Meet with in-house legal counsel and inquire about:LitigationCompliance with laws and regulationsKnowledge of fraud or suspected fraudWarrantiesPostsales obligationsArrangements, such as joint ventures, with business partnersThe meaning of contract terms
2 Meet with financial and administrative officers and obtain or determine the following:The functions of each executiveThe executive responsible for the auditThe existence of an internal audit functionOrganization chartsLocations and relative importance of all offices, showrooms, warehouses, and factoriesCorporate manuals or memoranda that provide information about the following:Nature and description of the entity’s productsProduction and distribution methodsInternal controlGeneral ledger chart of accountsMethods of financing the entity’s operationsSchedule of long-term debtNames of banks and account executive at each bank; for each bank, determine the following:Outstanding indebtedness and terms of paymentLines of creditOther banking servicesFor nonpublic companies, a schedule of stockholders with the following information:NamesAddressesCertificate numbersNumber of shares heldShareholder function in the businessPurchase terms:Terms of paymentAre letters of credit used for foreign purchases?Sales terms:Terms of paymentAre letters of credit used for foreign sales?Changes in the entity’s marketing strategies, sales trends, or contractual arrangements with its customersThe existence of related-party transactions such as the following:Purchases and salesLoansReceiving or providing services, such as management, legal, and administrativeInformation systems:System changesSystemic control failuresOther information systems-related risksSchedule of all affiliates and nonconsolidated subsidiariesCustomers and suppliers on whom the entity is economically dependentMost recent trial balanceGeneral ledger and books of original entry:Are accounting records up to date?What is the quality of accounting records?Extent of client responsibility, including the involvement of the internal audit function, for preparation of the following:Trial balanceSchedulesAdjustments and accrualsConfirmationsInventory instructionsFinancial statementsIncome tax returnsTentative audit schedule; agree to dates for the following:Physical inventoryCash and securities countMailing and confirmationsStart of fieldwork
3 Obtain the entity’s forms and documents, such as the following:Purchase requisitionsPurchase ordersSales authorizationsSales ordersSales invoicesProduction ordersProduction requisitionsReceiptsChecksPayroll cardsSales returns and creditsPurchase returns and credits
4 Examine work area that will be allocated to the auditor.
5 Walk through the accounting area:Observe work conditions.Meet employees.Determine employee functions.
Visit to Facility
During the visit to the client’s facility, the auditor should do the following:
1 Meet with management.
2 Walk through a production cycle and note the following:Initiation of orderRequisition of materialsMovement of productionCompletion of productionStorage of completed productShipment to customer
3 Document flow of production.
4 Note conditions of facility and equipment.
5 Visit materials stockroom, observe condition of the inventory, and review the following:Inventory recordsReceiving reportsInventory reports
The Client’s Business: Continuing Client
For a continuing client, information about the business is obtained from the following:
1 Client’s permanent file
2 Prior year’s audit documentation
3 Prior year’s audit team
4 Client’s current year budgets
5 Client’s current year interim financial statements
6 Members who had professional assignments with the client during the year; these assignments include the following:Review of interim financial statementsIncome tax planningSystems and other consulting services
7 Discussions with client management
Discussions with Client Management
The in-charge auditor and the staff member who will supervise the audit should visit the client before beginning the audit to determine the following:
1 Change in product line
2 Addition or deletion of factories, offices, warehouses, or showrooms
3 Addition of new administrative departments
4 Acquisition of subsidiaries
5 Existence of new or continuing related parties
6 Changes in production or distribution methods
7 Changes in sources of financing
8 Changes in internal control
9 Acquisition of new office equipment, such as computers
10 Changes in key personnel
11 New long-term commitments, such as:LeasesEmployment contracts
12 Adoption of employee compensation and benefit plans
Using a Risk-Based, Top-Down Approach to Evaluate Internal Control
Section 315 does not provide any definitive guidance on how auditors can most effectively and efficiently comply with the requirement to evaluate control design on every engagement. However, auditors of nonpublic companies would be well served to apply the lessons learned by auditors of public companies who have been required to audit their clients’ internal controls ever since the Sarbanes-Oxley Act became effective.
Lessons from SOX 404
In the years immediately following the effective dates of Section 404 of the Sarbanes-Oxley Act (SOX 404), many auditors adopted an evaluation approach that started by identifying all (or nearly all) of the company’s controls and then documenting and testing each of these
