CHAPTER 7
AUDITING INTERNAL CONTROL OVER FINANCIAL REPORTING

Answers to Review Questions

7-1 Following are management’s and the auditor’s responsibilities under Section 404 of the Sarbanes-Oxley Act of 2002:

Management’s Responsibilities • Accept responsibility for the effectiveness of the entity's ICFR. • Evaluate the effectiveness of the entity's ICFR using suitable control criteria. • Support its evaluation with sufficient evidence, including documentation. • Present a written assessment of the effectiveness of the entity’s ICFR as of the end of the entity’s most recent fiscal year.

Auditor’s Responsibilities • The auditor must plan and perform the audit to obtain reasonable assurance about whether the entity maintained, in all material respects, effective internal control as of the date specified in management's assessment. • The audit of internal control should be “integrated” with the financial statement audit, and should express an opinion on the effectiveness of the entity’s ICFR.

7-2 “Likelihood” refers to the probability that a misstatement will not be prevented or detected. For a significant deficiency or a material weakness to exist, the likelihood of such an occurrence must be either “reasonably possible” or “probable.”

“Magnitude” refers to the significance that the control deficiency could have on the financial statements according to the judgment of a prudent official who considers the possibility of further, undetected, misstatements. If the auditor’s likelihood assessment is “reasonably possible” and if the magnitude of the deficiency is assessed as “significant,” then either a significant deficiency or material weakness exists depending on the magnitude of the potential effects of the deficiency on the entity’s financial statements.

7-3