View source for AUD

==Types of Engagements==

There are 5 different types of '''Engagements''':

* Preparation
* Compilation
* Review
* Audit
* Agreed-Upon Procedures

{| class="wikitable";
|+ Types of Financial Statement Engagements
|-
! style=width:20em |  !! style=width:15em | Preparation !! style=width:15em | Compilation !! style=width:15em | Review !! style=width:15em | Audit
|-
| '''Type''' || style="background:#FFC900; text-align:center;" | Non-Attest || style="background:#FFC900; text-align:center;" | Non-Attest || style="background:#88EE88; text-align:center;" | Attest || style="background:#88EE88; text-align:center;" | Attest
|-
| '''Assurance Provided''' || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]] || style="background:yellow; text-align:center;" | '''Limited Assurance''' || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Independence''' || [[file:RedX.png | 15px | center]] || style="background:yellow; text-align:center;" | '''Not required, but must state lack of independence in compilation report''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Report Issued?''' || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Terminology Used''' || style=text-align:center; | N/A || style=text-align:center; | N/A ||  style=text-align:center; | Conclusion || style=text-align:center; | Opinion
|-
| '''Requires CPA Signature?''' || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Notes to Financial Statements Required?''' || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|}

{| class="wikitable";
|+ Types of Non-Financial Statement Engagements
|-
! style=width:20em |  !! style=width:15em | Review !! style=width:15em | Examination !! style=width:15em | Agreed-Upon Procedures
|-
| '''Type''' || style="background:#88EE88; text-align:center;" | Attest || style="background:#88EE88; text-align:center;" | Attest || style="background:#88EE88; text-align:center;" | Attest 
|-
| '''Assurance Provided''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Independence''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Report Issued?''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Terminology Used''' || style=text-align:center; | Conclusion || style=text-align:center; | Opinion ||style=text-align:center; | ??
|-
| '''Requires CPA Signature?''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|}

* An audit is the term only used when looking at the financial statements. The non-financial equivalent uses the term "examination".

=== Who Makes The Rules? ===
Before we begin, it's important to understand that there are two types of companies:
# Public companies = are open for the public to invest in and trade shares on a stock exchange
# Non-Public companies = are not open to public and shares do not trade on a stock exchange.
'''Public companies may also be referred to as issuers, and non-public companies may be referred to as non-issuers.''' Before the enactment of the Sarbanes-Oxley Act of 2002 (SOX), the auditing profession was largely self-regulated, with the American Institute of Certified Public Accountants (AICPA) playing a key role in setting standards for audits. However, in the wake of major corporate scandals in the early 2000s, the Public Company Accounting Oversight Board (PCAOB) was established by congress through SOX and they now set the standards for public companies.

==== Public Companies (Issuers) ====

Today, the '''PCAOB''' sets the standards for '''public companies''', while the AICPA still sets the standard for the non-public companies. In research, it is unclear what standards are used for engagements of public companies outside of the '''Auditing Standards (AS)''', which are used for audits of public companies. For testing purposes, whenever it asks about a public company, PCAOB standards apply. 

{| class="wikitable";
|+ SOX Rules
|-
! # To Remember !! style=width:80em | Description 
|-
| 1 ||* PCAOB inspection is required every year for audit firms with 100 or more audits in a year. <br>* If an individual is going from the audit firm to the client as a CEO, CFO, controller, chief accounting officer, or equivalent, the audit firm is ineligible to perform the audit for 1 year after the '''final day of the individuals employment at the audit firm''' (a.k.a "'''Cooling-Off Period'''").
|-
| 3 ||* PCAOB inspection is required every 3 years for audit firms with 99 or fewer audits in a year.
|-
| 5 ||* The lead and reviewing audit partners must rotate off the audit every 5 years. They must remain out for 5 more years before re-joining.<br>* Under law, auditors must retain their working papers for at least 5 years. Criminal penalties if not.
|-
| 7 ||* All audit partners other than lead and review partners must rotate off the audit every 7 years. They must remain out for 2 years before re-joining.<br>* Auditors must retain their audit working papers for at least 7 years. If disposed of before 7 years, punishment depends on whether it was held for 5 years or not. Under 5 are criminal penalties, over 5 AICPA sanctions.
|}

==== Non-Public Companies (Non-issuers) ====
For '''non-public companies''', the '''AICPA''' standards apply. The AICPA standards are broadly referred to as '''Generally Accepted Auditing Standards (GAAS)'''. There are 2 rulemaking bodies within the AICPA that are on the exam.

* AICPA's '''Auditing Standard Board (ASB)''' = Handles reviews, audits, and agreed-upon procedures of both financial statement related engagements (SAS standards) and non-financial statement engagements (SSAEs standards).

* AICPA's '''Accounting and Review Services Committee (ARSC)''' = Handles preparation, compilations, and reviews of financial statements.

There are 3 sets of standards that are needed for the test:
* '''Statements on Auditing Standards''' = SASs = issued by Auditing Standards Board for audits of financial statements for non-public companies.
* '''Statements on Standards for Accounting and Review Services''' = SSARSs = apply to preparations, compilations, and reviews of nonissuers' financial statements.
* '''Statements on Standards for Attestation Engagements''' = SSAE = applies to engagements outside of financial statements.

[[File:Standards_Flowchart.png]]

=== Assertions That Management Can Make ===

Management makes assertions about the financial statements. It is up to the auditor to test whether those assertions are correct or not.

There are 8 '''Relevant Assertions''' that management can make. Those are:

[[file:Crocodile_Cape.jpg | 400px| right]]

{| class="wikitable";
|+ Relevant Assertions
|-
! !! style=width:11em | Balance Sheet Assertions !! style=width:11em | Income Statement Assertions
|-
| '''C'''ompleteness || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''A'''ccuracy || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''P'''resentation || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''E'''xistence || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''C'''utoff || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''R'''ights / Obligations || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''O'''ccurrence || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''C'''lassification || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|}

Helpful Mnemonics:
* CAPE CROC
* Balance Sheet items Exist, Income Statement items Occur.

==Engagement==

There's no real step-by-step guide, but here are the general steps of an attestation engagement:
# Acceptance
# Planning
# Risk Assessment
# Performing Further Audit Procedures
# Reviewing Results (forming a conclusion / opinion)

There are certain things that are performed not at any one particular step, but rather are constantly considered and re-visited as needed throughout the attestation engagement. Those are:
* Audit Strategy
* Audit Plan
* Determining Materiality
* Monitoring Independence

=== Step 1: Acceptance ===
The formal acceptance of an engagement is with the signing of an '''Engagement Letter'''. This is written by the auditor and signed by the client. The Engagement Letter is signed for '''all 5 types of engagements'''.

There are 5 sections of the letter:
* Objective and Scope of the Engagement
* Responsibilities of the Auditor
* Responsibilities of Management
* Other Relevant Information
* Reporting Section (What will be issued)

Below is a chart that has the terminology that could be used on the exam when asking where responsibility lies. Most of these terms are very difficult to understand, and some mean the same thing. These terms are explained in later steps.

{| class="wikitable";
|+ Items each party is responsible for...
|-
! style=width:35em | Management is Responsible for... !! style=width:35em | CPA is responsible for...
|-
| Preparation and fair presentation of financials in accordance with '''GAAP'''. || Conduct the engagement in accordance with applicable standards (ex. '''GAAS''')
|-
| Financials are free of material misstatements || Identify and assess the risk of material misstatement
|-
| Design, implementation, and maintenance of internal controls || Obtain an understanding of internal controls
|-
| Unrestricted access to people and information || Obtain an understanding of the entity and its environment
|-
| style="text-align:center;" | --- || Design and perform Further Audit Procedures
|-
| style="text-align:center;" | --- || Obtain audit evidence that is sufficient to provide an opinion.
|}


[[file:EngagementLetter.png]]

=== Step 2: Planning: Audit Strategy and Audit Plan ===
Planning the Audit consists of:
#Establishing the overall '''Audit Strategy''', and
# Developing the '''Audit Plan'''. <ref>'''AU-C 300.02''',''AICPA Risk Assessment & Response to Assessed Risk'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00300.pdf#page=1></ref>

Planning is a continual process that begins shortly after the completion of the previous audit and continues until the completion of the current audit engagement. <ref>'''AU-C 300.A2''',''AICPA Risk Assessment & Response to Assessed Risk'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00300.pdf#page=4></ref> AU-C 300.A11 states that "The audit strategy and audit plan are not necessarily discrete or sequential processes". It also states that they are "interrelated" and that "changes in one may result in consequential changes to the other." <ref>'''AU-C 300.A11''',''AICPA Risk Assessment & Response to Assessed Risk'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00300.pdf#page=6></ref> The auditor should update and change both the audit strategy and audit plan during the course of the audit as necessary. <ref>'''AU-C 300.10''',''AICPA Planning an Audit''', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00300.pdf#page=3></ref>

AICPA standards notes:
* The Audit Plan is more detailed and formal than the Audit Strategy. <ref>'''AU-C 300.A14''',''Planning The Audit''', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00300.pdf#page=6></ref>
* The Audit Strategy and Audit Plan are "interrelated" and that "changes in one may result in consequential changes to the other." <ref>'''AU-C 300.A11''',''AICPA Risk Assessment & Response to Assessed Risk'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00300.pdf#page=6></ref>

{| class="wikitable";
|+ Planning
|-
! !! style=width:11em | Audit Strategy !! style=width:11em | Audit Plan
|-
| Selection of Engagement Team || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Determining Allocation and Deployment of Resources || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Determine Nature, Timing, and Extent of Risk Assessment Procedures || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| Determine Nature, Timing, and Extent of Further Audit Procedures || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|}

=== Step 3: Risk Assessment ===

[[file:ObtainAnUnderstanding.png]]

The overall goal of the audit is to reduce '''Audit Risk''' to an acceptably low level. To do this, the auditor must assess the risk of material misstatement (RMM). The test will also refer to this step as "Obtaining the Understanding of the Client" or just "obtaining an understanding". The auditor is assessing two types of risk here:

* Inherent Risk
* Control Risk

====Audit Risk Model====

[[file:Audit_Risk_Model.png | 500px | right]]

{| class="wikitable";
|+ Audit Risk Model
|-
! style=width:11em | Type of Risk !! style=width:28em | Definition !! style=width:17em | Example / Formula !! style=width:05em | Can CPA Control?
|-
| Inherent Risk <ref name="AU-312.21>'''AU 312.21''',''AICPA Standards of Field Work'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-00312.pdf#page=6></ref> || Risk that a misstatement could exist before considering client's internal controls || Petty cash has a high inherent risk due to the inherent ease to steal cash. || [[file:RedX.png | 15px | center]]
|-
| Control Risk <ref name="AU-312.21></ref> || Risk that misstatement will not be caught by the client's controls || Controls that are poorly designed or insufficient have a high control risk. || [[file:RedX.png | 15px | center]]
|-
| Detection Risk <ref name="AU-312.21></ref> || Risk that the procedures performed by the auditor will not detect misstatements. More accurate term would be "non-detection risk" || The more procedures performed, the lower the detection risk || [[file:GreenCheckmark.png | 15px | center]] 
|-
| Risk of Material Misstatements <ref name="AU-312.21></ref> || Whenever you see this term, you should read it as "assessing inherent risk and control risk" || Inherent Risk + Control Risk. || [[file:RedX.png | 15px | center]]
|-
| Audit Risk <ref name="AU-312.21></ref> || Risk that the auditor expresses an inappropriate positive opinion on financial statements that are actually materially misstated. More accurate term would be mis-audit risk. || Inherent Risk + Control Risk + Detection Risk || [[file:GreenCheckmark.png | 15px | center]] 
|}

Since both Inherent Risk and Control Risk are not controlled by the auditor, the auditor must determine the risk level that exists for each. The auditor determines this by performing the following procedures:

* '''Perform Risk Assessment Procedures''' <ref name = risk-assess-procedures>'''AU-C 315.06''',''AICPA Risk Assessment & Response to Assessed Risks'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00315.pdf#page=2></ref>
** Inquiries to management, internal audit, and others, both within and outside of the entity, who could assist in assessing inherent and control risk (a.k.a. RMM).
** Observations
** Inspection
* Understand nature of the client: business operations, investment and financing activities, ownership structure, and governance structure. <ref name = risk-assess-procedures></ref>
* Understand external factors: Industry conditions & government regulations that affect the entity. <ref name = risk-assess-procedures></ref>
* Understand operating strategy. <ref name = risk-assess-procedures></ref>
* Understand financial performance. <ref name = risk-assess-procedures></ref>


'''The risk assessment determines the nature, timing, and extent of Further Audit Procedures.''' <br>
Part of risk assessment is evaluating the design of internal controls and determining whether they have been implemented. This can also be termed "Gaining an Understanding of Internal Control"<br>
The auditor is '''not''' yet assessing the effectiveness of internal controls. That will be performed in the next step.<br>
The risk of assessing control risk too low is the auditor's biggest fear, as this could lead to providing incorrect assurance. <br>
Once we understand the RMM, we can set the detection risk, so that the Audit Risk will be at an acceptably low level. Setting the detection risk can be thought of as "how much work will we have to do".

=== Step 4: Performing Further Audit Procedures ===
"Further Audit Procedures" is the term provided by the AICPA, but we can think of it as "performing audit procedures." After we've made our initial assessment about inherent and control risk, we can begin designing and performing the audit procedures. There are two types of Further Audit Procedures:

* Substantive Procedures
* Test of Controls

[[file:FurtherAuditProcedures.png]]

==== Test of Controls ====
If we determined in the Risk Assessment phase that controls were designed well and are currently functioning at the client, we may rely on those controls to avoid having to perform substantive procedures. To what extent we can rely on the control depends on how effective we judge the control to be at preventing, detecting, and/or correcting a material misstatement.

{| class="wikitable";
|+ Internal Controls
|-
! !! style=width:11em | Risk Assessment Phase !! style=width:11em | Further Audit Procedures Phase
|-
| Evaluating '''Design''' of Control || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Determining if they have been '''Implemented'''|| [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Determining '''Operational Effectiveness''' || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|}

To test the effectiveness of controls, the auditor will do the following:
* Make inquiries
* Make inspections
* Make Observations
* Reperformance
* Perform Recalculation
* Attribute Sampling (only when controls are relied on heavily)

The auditor is not required to do all of the above, but must do more than just make inquires. '''Inquiries alone are not sufficient to determine effectiveness.''' <br>
For private companies (a.k.a. "non-issuers"), the auditor is '''NOT''' required to attest to internal control effectiveness unless management requests and auditor agrees. <br>
For publicly traded companies (a.k.a. "issuers"), the auditor is '''required''' to report on the effectiveness of internal controls.

==== Substantive Procedures ====
Substantive Procedures are performed to detect material misstatements. There are 2 types:

* Test of Details
* Analytical Procedures

===== Analytical Procedures =====
This is sometimes referred to as "Substantive Analytical Procedures". Analytical Procedures is simply using numbers and ratios to determine whether the balances are in line with expectations or not. The expectation can come from:

* Industry expectation
* Prior period or interim period financials.
* Budgets and forecasts
* Expected relationships.

Analytical procedures should be performed on high volume, relatively predictable transactions.<br>
Analytical procedures alone '''may''' be sufficient to reduce Audit Risk to an acceptably low level. This means in certain situations, applying Analytical Procedures can avoid having to perform Test of Details.

===== Test of Details =====
Due to the amount of details, this has been given it's own section. Scroll down to find.

== Test of Details ==
Test of Details are procedures performed to obtain evidence regarding the "relevant assertions" provided by management. Relevant assertions is a term that encompasses everything management is asserting and having the auditor review. For example, when the client gives the auditor their financial statements, one assertion that management is making is that the balances are accurate. It is up to the auditor to collect evidence and form an opinion on the accuracy of that assertion. Exactly what tests are done depends on:

* The type of engagement: An audit would involve more extensive work than a review.
* The assertions that are made: Different tests are applied for each assertion.
* The accounts being reviewed (a.k.a. "cycles"): There are 3 general cycles covered:
** The Revenue and Sales Cycle
** The Purchases and Inventory Cycle
** The Payroll Cycle

Because it would be inefficient to test all 100% of the activity, sampling is typically done. Tests of Detail are then performed on the sample to obtain '''reasonable assurance'''.

{| class="wikitable";
|+ Internal Controls
|-
! !! style=width:11em | Procedure Timing !! style=width:11em | Sampling Size
|-
| High Risk of Material Misstatement || End of year or at unpredictable times || [[file:GreenUpArrow.png | 25px | center]]
|-
| Low Risk of Material Misstatement || Before end of year (interim date) || [[file:RedDownArrow.png | 25px | center]]
|}

===Sampling and Performing Tests===

Steps for Sampling:

'''1. Consider the purpose of the audit procedures''' <ref name="sampling.step.1">'''AU-C 530.06''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00530.pdf#page=3</ref>
* Determining materiality levels for a deviation/misstatement <ref>'''AU-C 530.A9''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00530.pdf#page=5</ref>
'''2. Identify the population from which the sample will be taken from'''
{| class="wikitable" text-align: center style="float:right";
|+ 
|-
!  !! style=width:08em | As the rate goes... !! style=width:08em | The sample size goes...
|-
| Sampling Risk|| [[file:RedDownArrow.png | 25px | center]] || [[file:GreenUpArrow.png | 25px | center]]
|-
| Tolerable Deviation Rate || [[file:RedDownArrow.png | 25px | center]] || [[file:GreenUpArrow.png | 25px | center]]
|-
| Expected Deviation Rate || [[file:RedDownArrow.png | 25px | center]] || [[file:RedDownArrow.png | 25px | center]]
|}
* Determine expected rate of deviation. <ref>'''AU-C 530.A10''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00530.pdf#page=5</ref>
** Based on auditor's professional judgement.
** The amount will likely be provided in the problem.
* Determine the tolerable rate of deviation.
** Based on the auditor's professional judgement.
** The amount will likely be provided in the problem.
'''3. Determine acceptable levels of sampling risk'''

{| class="wikitable" text-align: center style="float:right";
|+ 
|-
!  !! style=width:05em | Sampling Risk !! style=width:05em | Confidence Level !! style=width:05em | Sample Size
|-
| Less Sampling Risk|| [[file:RedDownArrow.png | 25px | center]] || [[file:GreenUpArrow.png | 25px | center]] || [[file:GreenUpArrow.png | 25px | center]]
|-
| More Sampling Risk || [[file:GreenUpArrow.png | 25px | center]] || [[file:RedDownArrow.png | 25px | center]] || [[file:RedDownArrow.png | 25px | center]]
|}

* Sampling Risk = 1 - Confidence Level
* The lower the sampling risk, the higher the confidence interval.
'''4. Determine sample size'''
*
'''5. Choose the sample selection method.'''
*
'''6. Perform auditing procedures on sample.'''
* Types of Variable Sampling Methods
'''7. Evaluate results.'''
*
'''8. Document the work performed and results obtained in the working papers.'''

====Risk Types: Sampling Risk vs. Non-Sampling Risk====

{| class="wikitable" text-align: center;
|+ Sampling & Non-Sampling Risk
|-
!  !! style=width:20em | Sampling Risk !! style=width:20em | Non-Sampling Risk
|-
| <strong>Definition</strong>|| Risk that auditor's conclusion from the sample is different than the conclusion that would've been reached if the entire population was tested. || Risk that wrong conclusion is reached from something other than sampling.<ref name='AU-C 530.05>'''AU-C 530.05''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00530.pdf#page=2.</ref>
|-
| <strong> Think of as...</strong> || When the auditor does everything right, but the sample results lead you to an incorrect conclusion. || When the auditor makes an error with sampling.
|-
| <strong>Examples</strong> || None Provided || (1) Auditor applies inappropriate procedure <br>(2) Auditor misinterprets audit evidence <br> (3) Auditor fails to recognize misstatements or control deviations. <ref>'''AU-C 530.A4''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00530.pdf#page=4.</ref>
|}

With sampling risk, the questions will probably focus on the two types of wrong conclusions that can be drawn:

* Audit Efficiency Error
* Audit Effectiveness Error

{| class="wikitable" text-align: center;
|+ Affects of Wrong Conclusions from Sampling
|-
!  style=width:10em | !! style=width:20em | Audit Efficiency Error !! style=width:20em | Audit Effectiveness Error
|-
|'''Synonym'''||Unnecessary Audit Effort || Potential Audit Failure
|-
| '''Definition'''|| Sample test results indicates issues when there actually are none. <ref name="AU-C 530.05"></ref> || Sample test results indicate there are no issues when there actually are.<ref name="AU-C 530.05"></ref>
|-
| '''Result''' || Additional unnecessary audit procedures. || The lack of indication can lead to giving a wrong opinion. '''Most serious.'''
|-
| '''What does "issues" mean?''' || colspan=2 | (1) For tesing controls, an issue means the control is not working correctly.<br> (2) For testing of details (a.k.a. testing an account balance), an issue would be a material misstatement.<ref name="AU-C 530.05></ref>
|}

====Sampling Approach, Types, and Methods ====

[[file:Sampling_Approach.png]]

{| class="wikitable" style="text-align: center";
|+ Sampling Approaches: Statistical vs. Non-Statistical
|-
!  style=width:15em | !! style=width:15em | Statistically !! style=width:15em | Non-Statistically
|-
|'''Key Word(s)*'''||Scientifically, Statistically, Quantify || Subjective Judgement
|-
| '''Determine Sample Size'''|| [[file:GreenCheckmark.png | 25px]] (See Key Words) || [[file:GreenCheckmark.png | 25px]] (See Key Words) 
|-
| '''Make Sample Selections'''|| [[file:GreenCheckmark.png | 25px]] (See Key Words) || [[file:GreenCheckmark.png | 25px]] (See Key Words) 
|-
| '''Design an Efficient Sample'''|| [[file:GreenCheckmark.png | 25px | center]] || [[file:RedX.png | 25px | center]]
|-
| '''Measure Sufficiency of Evidence'''|| [[file:GreenCheckmark.png | 25px | center]] || [[file:RedX.png | 25px | center]]
|-
| '''Evaluate Sample Results'''|| [[file:GreenCheckmark.png | 25px | center]] || [[file:RedX.png | 25px | center]]
|-
| '''Ability to Measure Confidence Level'''|| [[file:GreenCheckmark.png | 25px | center]] || [[file:RedX.png | 25px | center]]
|-
| '''Ability to Measure Precision'''|| [[file:GreenCheckmark.png | 25px | center]] || [[file:RedX.png | 25px | center]]
|}
<nowiki>*</nowiki> Key Term(s) are terms that the questions will use to describe each approach.

====Delegating Work====
The auditor can delegate tasks by using the work of:
* Internal Auditors
* Service Auditors
* Specialists

When using the work of someone else, the auditor must ensure the following:

{| class="wikitable" text-align: center;
|+ Requirements for Reliance on Others
|-
!  style=width:10em | !! style=width:10em | Internal Auditors !! style=width:10em | Specialist !! style=width:10em | Service Auditor
|-
| '''Competent''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Independent''' || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Objective*''' || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || style="text-align:center" | Independence Required
|}

 * Objectivity is a term generally used when the person is not required to be independent, but is still expected to be impartial. An example would be Internal Auditor's work for the company, but answer to the audit committee instead of company management.

===== Internal Auditors =====
The Internal Auditor (IA) can be given some work as long as the external auditor does the following:
* Auditor determines IA are competent.
* Auditor determines IA are objective.
* Auditors applies a systematic and disciplined approach, including quality control.
* Receives written acknowledgement from management stating that IA's are permitted to follow instructions of auditor, and management will not interfere with the work.

{| class="wikitable" text-align: center;
|+ Permitted Functions For Internal Auditors
|-
!  style=width:20em | !! style=width:15em | Permitted
|-
| Preparing Schedules|| [[file:GreenCheckmark.png | 15px | center]]
|-
| Compiling Documents|| [[file:GreenCheckmark.png | 15px | center]]
|-
| Performing Non-Judgement Tasks || [[file:GreenCheckmark.png | 15px | center]]
|-
| Making Judgements || [[file:RedX.png | 15px | center]]
|-
| Performing Critical Audit Procedures (Fraud) || [[file:RedX.png | 15px | center]]
|}

The external auditor should make all significant judgements. Tasks that involve assessing, selection, determination, valuation, etc. are not able to be performed by IA. <br>
External Auditors always have sole responsibility for the audit opinion expressed. The external auditor should oversee the work that the IA does.

===== Using Service Auditors =====

A service auditor is used when a company outsources a business function to another business. An example would be hiring a payroll company to process their payroll. The auditor of the business (a.k.a. User Auditor) will need to receive a report from a Service Auditor attesting to the controls in place at the service organization. This is done through a report from the service auditor titled a '''SOC Report'''.

[[file:Service_Auditor.png]]

There are 3 types of SOC reports:

{| class="wikitable" style="text-align: center;"
|+ Service Auditor Reports
|-
!  style=width:10em | !! style=width:15em | SOC 1 !! style=width:15em | SOC 2 !! style=width:15em | SOC 3
|-
| Attestation Matters|| Controls relating to financial reporting || Controls relating to security, availability, processing, integrity, confidentiality, and privacy. || Controls relating to security, availability, processing, integrity, confidentiality, and privacy.
|-
| Who Can Use Report|| User Auditor Only || Only Parties Stated in Report || Anyone
|}

Any one of those SOC reports can be 1 of 2 "types". The type depends on whether the report attests to the effectiveness of controls or not:

{| class="wikitable" text-align: center;
|+ Service Auditor Report Types
|-
!  style=width:15em | !! style=width:10em | Type 1 !! style=width:10em | Type 2
|-
| Suitability of Controls || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| Design of Controls || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Effectiveness''' of Controls || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|}

A common question will be "which of these reports attest to the effectiveness of internal controls relating to financial reporting", which would be a '''SOC 1 Type 2''' report.

===== Using Work of Specialist =====

If a client has a situation that is rare and complex, the auditor may need to find a specialist who can provide the auditor with evidence that the situation is not materially misstated. Examples include:
* Actuarial Calculations
* Estimation of oil and mineral reserves.
* Valuation of environmental cleanup costs.

The auditor should assess the specialist's objectivity and competence. The auditor should only refer to work of the specialist if issuing a qualified or adverse opinion.

=== Transaction Cycle Testing ===
The auditor's ultimate goal is to obtain evidence to form an opinion on the '''relevant assertions''' made by management. The auditor will do this for all accounts. In the process of business, many of these accounts are involved in the same business function. For example, when a company makes a sale, it not only affects the revenue account, but also the cash account, the accounts receivable account, and the sales return account. These groups of interworking accounts are referred to as "Transaction Cycles". The auditor will seek evidence for the transaction cycles to obtain reasonable assurance over all of the accounts.

There are 5 "cycles" covered:
** The Revenue and Sales Cycle
** The Cash Receipts Cycle
** The Purchases and Inventory Cycle
** The Cash Disbursement Cycle
** The Payroll Cycle

An important aspect of the transaction cycles is proper '''Segregation of Duties'''. These 3 activities should be done by different people/departments:
* Authorize
* Records (a.k.a. Recording or Recordkeeping)
* Custody

Authorize = They may keep records outside of the financial statement accounts, such as list of employees or summary of hours worked, but they authorize by forwarding their records to the appropriate departments for processing. Beginning of Cycle.

Records = Receives documents from the initial sources and updates appropriate journals. Mid-Cycle.

Custody = Maintains control over the asset. End of Cycle.

==== Revenue and Sales Cycle ====

Below is a gif walkthrough of the Revenue Cycle:

[[file:RevenueCycle.gif]]

The documents in the cycle are:

{| class="wikitable" text-align: center;
|+ Documents
|-
!  Document || style=width:35em | Description
|-
| Customer Order|| Order customer submits to the company.
|-
| Sale Order || Sales Department uses Customer Order to create Sales Order.
|-
| Approved Sales Order (ASO) || Sales Order is reviewed by Credit Department. If credit is approved, Credit Department issues Approved Sales Order.
|-
| Acknowledgment || Sent by Sales Department to Customer once Credit is approved.
|-
| Bill of Lading (BOL) || Similar to a title. Title of goods.
|-
| Packaging Slip || Details what is being shipped.
|-
| Remittance Advice || Details the charges and the total amount due. Similar to invoice, but it's mailed back with payment.
|-
| Daily Invoice Summary || A/R Department keeps list of invoices it receives each day. Forwards to GL Department for updating the General Ledger at days end.
|}

[[file:RevenueDocumentFlowchart.png]]

==== Cash Receipts Cycle ====
Below is a walkthrough of the steps in the Cash Receipt Cycle:

[[file:CashReceiptCycle.gif]]

Here is a more easily readable and memoizable flowchart:

[[file:CashReceiptCycle2.png]]

==== Purchases and Inventory Cycle ====

{| class="wikitable" text-align: center;
|+ Documents
|-
! Document || style=width:35em | Description
|-
| Purchase Requisition|| Document created by Warehouse that shows what items need to be reordered.
|-
| Purchase Order || Document created by Purchasing Dept. and sent to Vendor to place an order. 
|-
| Receiving Report || Filled out by the Receiving Dept. to show what items were received from Vendor.
|}

[[file:PurchaseCycle.gif]]

==== Cash Disbursements Cycle ====

The Cash Disbursements cycle picks up where the purchasing cycle ended. It begins when the company receives the invoice from the vendor.

{| class="wikitable" text-align: center;
|+ Documents
|-
! Document || style=width:35em | Description
|-
| Vendor Invoice|| document that recaps what was purchased and the total cost to be paid.
|-
| Approved Vendor Invoice || Invoice is considered "approved" after the Purchasing Department confirms its accuracy with what was received.
|-
| Tickler File || File folders organized by date. Allows to easily pull and pay at correct day.
|}


[[file:DisbursementCycle.gif]]

==== Payroll Cycle ====

{| class="wikitable" text-align: center;
|+ Documents
|-
! Document || style=width:35em | Description
|-
| Authorized Employees' Rates and Deductions || List that shows what each employee should be paid.
|-
| Employee Clock Cards || Employees record the start and end times of their workday on this card. Used for Summary of Hours Worked by Employee.
|-
| Job Time Tickets || Employees record time worked on each task/job on this card. Used for Summary of Hours Worked by Job.
|-
| Payroll Register || Shows how much each employee should be paid for the work period.
|-
| Payroll Voucher || Show's how much should be paid out for the payroll.
|}

[[file:PayrollCycle2.png]]

==Evaluating==

{| class="wikitable" text-align: center;
|+ Potential Results
|-
!  Type (issuer) || Type (non-issuer) || style=width:35em | Definition
|-
| Unqualified || Unmodified || No issues with audit. "F/S are presented fairly"
|-
| Qualified || Modified || Small issue(s) with audit. "F/S are presented fairly, with the exception of..."
|-
| Adverse || Adverse || F/S are not presented fairly.
|-
| Disclaimer || Disclaimer || Not able to collect enough evidence to form an opinion/conclusion.
|-
| Withdraw || Withdraw || Cancels the engagement.
|}


[[file:MaterialPervasive.png]]


=== Disclaimer ===

==== Scope Limitations ====
A scope limitation means the auditor was not able to obtain all the information needed.

[[file:ScopeLimitation.png]]

* A piecemeal opinion is giving a disclaimer of opinion only on the particular financial statements that are affected by the scope limitation. For the non-affected financials, the auditor gives an unmodified opinion on those.
* For management-imposed scope limitations, the auditor should do the audit and qualify the opinion if they determine that the issue is not "pervasive". If it is pervasive, they should withdraw if possible, or disclaim an opinion. <ref>'''Modifications to the Opinion in the Independent Auditor’s Report''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-c-00705.pdf#page=3</ref>

==Auditor's Report==

=== Report Layout ===

Due to Wiki's basic formatting options, there's currently no good way to show the various reports on here. See the report tabs at the excel file below for coverage of the report language specifics

[[file:AUD_excel.xlsx]]

===Add On Paragraphs ===
There are specific situations that could be tested on. Those are:

[[file:SpecificSituations.png]]


[[file: MatterParagraphs.png]]


[[file: AddOnParagraphs.png]]



=== Special Purpose Framework ===

The accrual basis is used under GAAP. If another basis is used, it requires an Emphasis-of-Matter paragraph be added to the Auditor's report.

Non-Accrual methods are called '''Other Comprehensive Bases of Accounting (OCBOA)''' and consist of :
# Cash Basis
# Tax Basis
# Regulatory Basis
# Contractual Basis
# Any Other Basis

Additionally, under these methods, the name may be different. The test will likely only ask for the names used on the Cash Basis. Those are:

{| class="wikitable" text-align: center;
|+ Terminology
|-
!  FS Type || Accrual || Cash
|-
| Balance Sheet || Balance Sheet || Statement of Assets and Liabilities Arising From Cash Transactions
|-
| Income Statement || Income Statement || Statement of Revenue Collected and Expenses Paid
|}

=== Key Audit Matters ===

* Key audit matters are '''communicated to management'''.
* Key audit matters are matters that, in the auditor's opinion, were significant in the audit of the financial statements.
* Only used with modified or unmodified opinions. Are NOT used in adverse or disclaimed opinions.
* Can (and should) include in KAM even if included in an emphasis-of-matter or other matter paragraph.

==Government Audits==
Nothing here. To begin editing, scroll to the top and hit the edit button.

==Professional Responsibilities==

The AICPA Code of Professional Conduct has 3 different sets of standards based on the member's job.

{| class="wikitable" style="text-align: center";
|+ Sets of Standards
|-
!  !! style=width:15em | Applies To !! style=width:30em; | Definition !! style=width:15em | Example
|-
| '''Part 1''' <ref>'''Part 1 Code of Professional Conduct''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=26</ref> || Members in Public Practice || style="text-align:left" | Render attest, tax, and management advisory services.<ref>'''Code of Professional Conduct 0.300.050.03''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=10</ref> || Employed at CPA Firm.
|-
| '''Part 2''' <ref>'''Part 2 Code of Professional Conduct''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=151</ref> || Members in Business || style="text-align:left" | Prepare financial statements in employment of others, perform internal auditing, and serve in fianncial and management capacities in industry, education, and government. <ref>'''Code of Professional Conduct 0.300.050.03''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=10</ref> || Employed in a Corporate Business
|-
| '''Part 3''' <ref>'''Part 3 Code of Professional Conduct''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=175</ref> || All Others || style="text-align:left" | N/A || Retired or Unemployed
|}

When the client is mentioned, it includes the following people:
* officers or directors of the client.
* anyone who is a greater than 10% shareholder of the client.

{| class="wikitable";
|+ Rules of Conduct
|-
! Rule !! style=width:08em | Sections !! style=width:30em | Definition !! style=width:05em | Part 1 !! style=width:05em | Part 2 !! style=width:05em | Part 3
|-
| '''Integrity & Objectivity Rule''' || 1.100 <ref>'''Code of Professional Conduct 1.100''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=33</ref><br>2.100 <ref>'''Code of Professional Conduct 2.100''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=156</ref> || Member Shall: <br>(1) Maintain objectivity and integrity, <br>(2) Be free of conflicts of interest, <br>(3) Not misrepresent facts, and <br>(4) Not subordinate their judgement to others. || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Independence Rule''' || 1.200 <ref>'''Code of Professional Conduct 1.200''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=41</ref> || Defined by bodies appointed by AICPA || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''General Standards Rule''' || 1.300 <ref>'''Code of Professional Conduct 1.300''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=121</ref><br>2.300 <ref>'''Code of Professional Conduct 2.300''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=166</ref> || When accepting and performing professional services, a member shall: <br>(1) Only accept tasks that the professional, or their firm, can reasonably expect to complete with professional competence, <br>(2) Exercise professional care while performing the service, <br>(3) Adequately plan and supervise the service, and<br> (4) Obtain sufficient relevant data in completing the task. || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Compliance with Standards Rule''' || 1.310 <ref>'''Code of Professional Conduct 1.310''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=123</ref><br>2.310 <ref>'''Code of Professional Conduct 2.310''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=167</ref> || A member must comply with standards issued by professional bodies designated by the AICPA.  || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Accounting Principles Rule''' || 1.320 <ref>'''Code of Professional Conduct 1.320''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=124</ref><br>2.320 <ref>'''Code of Professional Conduct 2.320''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=168</ref> ||  Cannot provide positive or limited assurance when there are material misstatements. You are not violating this rule if you can demonstrate that you performed the attestation engagement appropriately. || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Acts Discreditable''' || 1.400 <ref>'''Code of Professional Conduct 1.400''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=126</ref><br> 2.400 <ref>'''Code of Professional Conduct 2.400''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=170</ref><br> 3.400 <ref>'''Code of Professional Conduct 2.400''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=175</ref>|| See Below || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| '''Contingent Fees Rule''' || 1.510 <ref>'''Code of Professional Conduct 1.510''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=134</ref><br> || A contingent fee is an agreement between two parties where a fee will only be assessed as long as a certain outcome is attained. Not permitted for auditing work. Permitted in rare situations with tax work. See below for more details. || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Commissions and Referral Fees''' || 1.520 <ref>'''Code of Professional Conduct 1.520''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=137</ref><br> || Similar rules to contingent fees. || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Advertising and Other Forms of Solicitation''' || 1.600 <ref>'''Code of Professional Conduct 1.600''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=140</ref><br> || Advertising cannot be false, misleading, or deceptive. Also all partners of a firm must have AICPA designation in order to use it after the company name. || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Confidential Information''' || 1.700 <ref>'''Code of Professional Conduct 1.700''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=142</ref><br> || Cannot share confidential information unless:<br> (1) Requested by a court through subpoena or summons.<br> (2) As apart of a review of your professional practice.<br> (3) To initiate or respond to a inquiry made to an appropriate body.<br> (4) If it is only the client name and no other confidential information.<br> (5) To your liability insurance carrier as apart of a claim.<br> (6) Disclosing for review of a prospective purchase, sale, or merger of your practice.<br> (7) Disclosing to spouse, even in a divorce, because both individuals are clients. || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| '''Form of Organization and Name''' || 1.800 <ref>'''Code of Professional Conduct 1.800''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=147</ref><br> || This rule addresses the rules around names, designation, titles, etc.  || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|}

=== Conceptual Framework ===

The code (1.000.010) consists of the rules and interpretations of the rules. While it attempts to address many situations, not all situations can be addressed. For any situation that is not addressed in the code, it instructs to use a "Conceptual Framework". The conceptual framework consists of the following 3 steps:

# Identify Threats
# Evaluate the Significance of the Threats
# Apply Safeguards

A situation that may violate the rules is called a "threat". You evaluate whether the risk that the threat violates a rule is within an "acceptable level". This "acceptable level" is subjective, defining it as something a "reasonable and informed third party" would conclude. If you determine that the risk is not within an acceptable level, you lastly analyze whether applying "safeguards" would lower to an acceptable level. If not, you withdraw from the attest engagement.

==== 1. Identify Threats ====

'''Threats''' are defined in section 1.000.010.06 as '''relationships or circumstances that could compromise a member's compliance with the rules.'''

There are 7 types of threats:
# Adverse Interest
# Advocacy
# Familiarity
# Management Participation
# Self-Interest
# Self-Review
# Undue Influence

===== Threat 1: Adverse Interest =====

When the client and member's interest are opposing. Example given is when the two are involved in a lawsuit.

===== Threat 2: Advocacy =====

When the two interests are aligned to the point that his or her objectivity or independence becomes compromised. Some examples include:
* Firm acts as investment advisor for company, or it's officer, director, or a greater than 10% shareholder.
* Firm underwrites or promotes the client's shares.
* Firm acts as registered agent for client.
* Firm endorses client's products or services.

===== Threat 3: Familiarity =====

Similar to advocacy except it involves a long or close relationship with the client. Examples include:
* Member's immediate family, close relative, or close friend is employed at the client.
* Former firm member joins the client in a key position.
* Senior personnel have long association or close business relationship with client.

===== Threat 4: Management Participation =====

The threat that a member may take on the role of management for the client.

===== Threat 5: Self-Interest =====

When a member has an interest or relationship with the client and stands to gain a benefit from the client. Examples include:

* Having a '''financial interest''' in the client.
* Member's spouse is employed or interviewing for job with client.
* Contingent fee arrangement for tax refund claim.

===== Threat 6: Self-Review =====

Threat that the member will not evaluate audit evidence clearly. Examples given involves when you also peform work that is used as audit evidence. Examples are:

* You do bookkeeping services for the client.
* You rely on work product that was done by your firm.
* Someone who was associated with the client in a employment or contractor role joins the firm as a partner.

===== Threat 7: Undue Influence =====

Threat that the member will not follow his best judgement due to the client's reputation/expertise, aggressive/dominant personality, or other ways.

* The client threatens to fire the firm
* The client threatens to not hire the firm in the future over a disagreement.
* The client threatens any other professional service over a disagreement.

==== 2. Evaluate Significance of Threats ====

The member should determine whether a threat is at an acceptable level. An '''acceptable level''' is defined as '''when a reasonable and informed third party who is aware of the relevant information would be expected to conclude that the threat would not compromise the member's compliance with the rules.''' Members should use both qualitative and quantitative factors when evaluating the significance of a threat.

==== 3. Safeguards ====

'''Safeguards''' are defined as '''actions or other measures that may eliminate a threat or reduce a threat to an acceptable level.''' There is no strict outline for safeguards. They can be anything done by the client, the firm, or other bodies, that reduce the acceptable level of a threat.

===Independence===
A member must be both:
* Independent in Fact (a.k.a. Independence of Mind)
* Independent in Appearance


Situations that will impair that independence are:
* Loans to and from attest client (includes client's officers, directors, and >10% shareholders)
** '''Exception:''' If the client is a financial institution, then the member can have:
*** Credit card(s) through the institution as long as the balance is $10K or less.
*** Auto loan and lease as long as the auto is collateral.
*** Loans fully collateralized by the cash surrender value of insurance cash deposits.
*** Home mortgage, secured loan, or immaterial unsecured loan, as long as '''all''' of the following are true:
**** was obtained prior to either (1) client becoming a client, or (2) member becoming a covered member.
**** no payments are missed, terms stay the same, no re-financing.
**** if underwater on loan (FMV is less than outstanding balance), then excess loan amount cannot be material to member's net worth.
* Member has any ownership in attest client through self-managed investment vehicle or more than 5% through a diversified mutual fund.
* Employed, or appear to be acting in the capacity of, an employee of the client.
* Employee of member's firm holds directorship or trusteeship with not-for-profit client, unless it is honorary with no power to affect management decisions.
* Actual or threatened litigation between client and covered member.
* Unpaid fees from the client, if the unpaid fees were for services performed > 1 year from the attest report date.
** Does not apply if client is in bankruptcy.
* Receives and accepts gift from client where the value of the gift is clearly significant to the recipient.

Additionally, certain people and/or organizations that could influence a member are also prohibited from certain situation in order for the member to maintain independence. This is called a '''"covered member"'''.

{| class="wikitable";
|+ Relevant Definitions
|-
! Term !! style=width:50em | Definition
|-
| Independent In Fact || Also referred to as '''"Independence of Mind"'''. Must avoid situations that could compromise professional judgement. <ref name="Code-of-Conduct-Definitions 0.400.21">'''Code of Conduct Definitions''', ''AICPA'', https://pub.aicpa.org/codeofconduct/ethics.aspx?targetdoc=et-cod&targetptr=et-cod0.400.21</ref>
|-
| Independent in Appearance || Must avoid circumstances that would cause a '''reasonable and informed person''' to conclude that the independence has been compromised. <ref name = "Code-of-Conduct-Definitions 0.400.21"></ref>
|-
| Direct Financial Interest || An ownership interest in an equity or a debt security issued by an entity, including rights and obligations to acquire such an interest and derivatives related to such interest. Examples include stock, bonds, stock options, warrants, and mutual fund shares, among other. <ref name="plain-english-18">'''Plain English Guide to Independence''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/interestareas/professionalethics/resources/tools/downloadabledocuments/plain-english-guide.pdf#page=29</ref>
|-
| Indirect Financial Interest || A financial interest owned through an investment vehicle, an estate, a trust, or other intermediary where the beneficiary [does not participate] in the intermediary's investment decisions. <ref name="Code-of-Conduct-Definitions 0.400.22">'''Code of Conduct Definitions''', ''AICPA'', https://pub.aicpa.org/codeofconduct/ethics.aspx?targetdoc=et-cod&targetptr=et-cod0.400.22</ref>
|-
| Covered Member || See Below
|-
| Immediate Family || Spouse, spousal equivalent, or tax return '''dependents'''. Dependents do not have to necessarily be related to you to fall under this definition, they just have to have been claimed as a dependent on your most recent tax return. <ref name="Code-of-Conduct-Definitions 0.400.19">'''Code of Conduct Definitions''', ''AICPA'', https://pub.aicpa.org/codeofconduct/ethics.aspx?targetdoc=et-cod&targetptr=et-cod0.400.19</ref>
|-
| Close Relative || A parent, sibling, or a non-dependent child. A non-dependent child means a child who you didn't claim as a dependent on your most recent tax return. <ref name="Code-of-Conduct-Definitions 0.400.19">'''Code of Conduct Definitions''', ''AICPA'', https://pub.aicpa.org/codeofconduct/ethics.aspx?targetdoc=et-cod&targetptr=et-cod0.400.19</ref>
|-
| Key Position || A position in which an individual has the ability to exercise influence over the financial statements. These include positions of CEO, CFO, President, other leadership position that affects the financial statements, Controller, Treasurer, Internal Audit, General Counsel, or Member of the Board <ref name="Code-of-Conduct-Definitions 0.400.27">'''Code of Conduct Definitions''', ''AICPA'', https://pub.aicpa.org/codeofconduct/ethics.aspx?targetdoc=et-cod&targetptr=et-cod0.400.27</ref>
|}

====Covered Member====
A '''covered member''' is any of the following: <ref>'''Plain English Guide to Independence''', ''AICPA'', https://us.aicpa.org/content/dam/aicpa/interestareas/professionalethics/resources/tools/downloadabledocuments/plain-english-guide.pdf#page=18</ref>
* An individual on the attest engagement team.
* Individual in a position to influence the attest engagement
* A partner, partner equivalent, or manager who provides more than '''10 hours''' of non-attest services to the attest client.
* A partner or partner equivalent in the same physical office as the lead attest engagement partner.
* The firm
* Any entity that can be controlled by any of the individuals or entities listed above.

1.240 outlines that a covered member cannot have either of the following in the attest client:
* A direct financial interest, or
* A '''material''' indirect financial interest. (they are allowed to own a '''non-material''' indirect financial interest.)

Additionally, 1.240 states that all partners, professional employees, and their immediate family members, cannot in the aggregate own more than '''5%''' of the attest client. When the shares are owned through an investment vehicle such as a partnership, LLC, 529 plan, retirement plan, or other similar type of plan, whether the financial interest is direct or indirect depends on the decision-making ability that the individual has. If they have the ability to control the business making or investment decisions of the plan, then it is a direct financial interest. If they do not have the control ability, then it is an indirect financial interest.

If a covered member receives an unexpected financial interest in the client during the audit, such as through a gift or inheritance, then they cannot participate in the audit until they dispose of it, and they have 30 days to dispose of it before impairing their independence.

What is the difference between a material indirect vs non-material indirect?<br>
The AICPA does not provide specific guidance on determining materiality. Instead, they instruct that professional judgement should be used. The common threshold seems to be 5% ownership in the company. If 5% or less, then it is an immaterial indirect interest and does NOT impair independence. If above 5%, then it is a material indirect interest and impairs independence.

====Exceptions====
There are certain carved-out exceptions for people who are close to the member, like family. See chart below for classification, and the specific rules below the chart.

{| class="wikitable";
|+ 
|-
! Type !! style=width:08em | Immediate Family !! style=width:08em | Close Relative !! style=width:08em | Employment Exemption !! style=width:08em | Financial Interest Exemption
|-
| Spouse (or equivalent) || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Dependent Child || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Dependent Relative || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|-
| Parent || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| Sibling || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| Non-Dependent Child || [[file:RedX.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]] || [[file:GreenCheckmark.png | 15px | center]]
|-
| Other Non-Dependent Relative || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]] || [[file:RedX.png | 15px | center]]
|}

=====Immediate Family=====
An immediate family member may be employed by the attest client as long as they don't hold any of the following:
* They are not in a '''key position''' at the attest client.
* They cannot own, at any time, '''5%''' or more of the attest client's outstanding shares.

=====Close Relatives=====
A close relative can be employed by the attest client as long as they are not in a '''key position''' at the attest client.

A close relative can have a financial interest in the client as long as the meet all of the following:
* The investment is not material to the close relative. If the member is not aware of the close relative's finances, then they meet this requirement as long as they have no reason to think it's material to the relative.
* The financial interest does not allow the close relative to exert influence over the attest client.

===Acts Discreditable===
.400.005.01 says that, with the exception of certain acts that are explicitly stated as "Acts Discreditable", a member should follow the "Conceptual Framework" steps laid out in the member's applicable part (part 1, 2, or 3) in order to determine whether it is an acts discreditable or not. .000.010.01 says that not every relationship and circumstance that a member could face can be explicitly stated in the code of conduct, and therefore a member should follow the "Conceptual Framework" steps laid out in making a determination. .400.005.02 says that a member must be able to demonstrate that safeguards were applied that eliminated or reduced significant threats to an acceptable level, or else a member will be considered to be in violation of the Acts Discreditable Rule.

Explicitly stated Acts Discreditable are:
* Discrimination and harassment in employment practices.
* Solicitation or disclosure of CPA exam questions and answers.
* Failure to file a tax return or pay a tax liability.
* Negligence in the preparation of financial statements or records.
* Failure to follow the requirements of applicable financial reporting framework and the requirements of regulatory bodies (SEC, PCAOB, etc.).
* False, misleading, or deceptive acts in marketing professional services.
* Using the CPA credential in a jurisdiction where they have not been approved by the state to use it.
* Provide written notice to clients and return/safely store client records upon sale, transfer, or disposal of the firm.
* Removing client files or proprietary information from a firm without their permission upon termination of employment.
* Disclosure of confidential information obtained without permission.
* Failure to provide required documents within '''45 days''' of request from client, unless approved reason to withhold (see chart).

{| class="wikitable";
|+ Record Types and Your Right to Withhold
|-
! style=width:12em | Type !! style=width:14em | Definition !! style=width:08em | Example !! style=width:27em | Right to Withhold
|-
| Client-Provided || Records that were provided by the client || Quickbooks File, Tax Form W-2 || Cannot Withhold
|-
| CPA's Work Product || Item(s) that the client seeks from the CPA. || Audit Report, Tax Return  || Can only withhold if: <br>(1) Fees relating to that specific work product are unpaid, <br> (2) The work product is not finished yet, <br> (3) Litigation involving the work product is ongoing, or <br> (4) For purposes of complying with professional standards.
|-
| CPA-Prepared Records || Item(s) that the client doesn't seek but will need. || Adjusting Journal Entries || Can only withhold if fees relating to that specific work product are unpaid.
|-
| CPA Working Papers || These are items created by the CPA to "show their work" || Word Files, Excel Files || Have right to withhold unless legal or contractual obligation to provide.
|}

===Contingent Fee, Commissions, and Referral Fees===
A contingent fee is an agreement between two parties where a fee will only be assessed as long as a certain outcome is attained. 

==== Attestation Work ====
The AICPA Code of Professional Conduct outlines the following situations where a contingent fee or commission is NOT permitted:

# Any Audit or Review of financial statements.
# Any compilation where '''both''' of the following are true:
## There is a reasonable expectation that a third party will rely on the financials
## You are not independent and did not disclose disclose your lack of independence.
# An examination of prospective (forward looking) financial statements.

{| class="wikitable";
|+ Contingent Fee Allowed vs Disallowed
|-
!  '''ASSURANCE''' !! style=width:15em | Permitted?
|-
| Audit (attestation) or Review of Financial Statements || [[file:RedX.png | 15px | center]]
|-
| Compilations to be relied on that lack independence <br> and independence disclosure. || [[file:RedX.png | 15px | center]]
|-
| All Other Compilation Situations || [[file:GreenCheckmark.png | 15px | center]]
|-
| Preparations || [[file:GreenCheckmark.png | 15px | center]]
|-
| Examination of prospective (forward looking) financials || [[file:RedX.png | 15px | center]]
|-
| All Other Situations || [[file:GreenCheckmark.png | 15px | center]]
|-
|}
 

==== Tax Work ====
For tax work, basing the fee on the outcome of your work is generally prohibited, with a few exceptions:

* Representing client in an IRS audit or other judicial proceeding.
* Claim for refund filed with the IRS relating to assessed penalties and interest.
* Obtaining a Private Letter Ruling from the IRS.
* Outcome of court case or other governmental agency finding.
* Fixed by public authority.
* Based on a price quotation submitted in competitive bidding.
* Some other very specific situations. See Code of Professional Conduct Section 1.510.010.04. <ref name="code-1.510">'''AICPA Code of Conduct 1.510.010.04''',''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=136></ref>

All other tax related work is '''prohibited''' from charging contingent fees. This includes filing a tax return, filing an amended tax return, or filing a claim for refund (outside of just penalties/interest). <ref> '''Contingent Fee Tax Advice: IRS Allows Some, Not All''',''Forbes'', https://www.forbes.com/sites/robertwood/2017/05/10/contingent-fee-tax-advice-irs-allows-some-not-all/?sh=14766ee39d71></ref>

{| class="wikitable";
|+ Contingent Fee Allowed vs Disallowed
|-
!  '''TAX WORK''' !! style=width:15em | Permitted?
|-
| Preparing Tax Return || [[file:RedX.png | 15px | center]]
|-
| Preparing Amended Tax Return || [[file:RedX.png | 15px | center]]
|-
| Filing A Claim for Refund (Form 843) || [[file:RedX.png | 15px | center]]
|-
| Giving Advice on Any of the 3 Above || [[file:RedX.png | 15px | center]]
|-
| Obtaining Private Letter Ruling For Client || [[file:GreenCheckmark.png | 15px | center]]
|-
| Representing Client Before Revenue Agent || [[file:GreenCheckmark.png | 15px | center]]
|-
|}

==== Spousal Work ====

A member's spouse is '''NOT prohibited''' from charging a contingency fee or commission for work the spouse does. However, the work can in no way be associated with the member. The code lays out the following 2 rules:
* The contingent fee activity must be separate from the member's practice, and 
* The member must not be significantly involved in the spouse's activity. <ref name="code-1.510"></ref>

In summary, your spouse can charge a contingent fee for work that has nothing to do with your practice and where you have no involvement in the work.

==== Investment Advisory ====

The AICPA Code of Professional Conduct does not absolutely say "yes" or "no" when it comes to investment advisory services. Instead, it provides a couple of specific examples where contingency fees are allowed. The document describes these situations as "interpretations". It then states that if a specific interpretation is not listed, the CPA should use the "Conceptual Framework for Members in Public Practice" and be able to demonstrate that safeguards were applied that provided enough assurance that it was allowed.

The first specific interpretation allows for the CPA to charge a fee based on the percentage of the overall investment portfolio as long as '''all''' of the following are met:
# The fee is determined based on a specific percentage of the overall portfolio.
# The dollar amount of the overall portfolio is determined at the beginning of each quarter and only adjusted for the additions or withdrawals made by the client.
# The fee arrangement is not renewed more frequently than on a quarter basis. (a.k.a. arrangement must span at least 1 quarter of the year).<ref name="code-1.510.040">'''AICPA Code of Conduct 1.510.040''',''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=136></ref>

The second specific interpretation allows for the CPA to charge a contingency fee or commission for investment advisory services to both of the following:
# Individuals who work for a company who is a client but they themselves are not. For example, you could audit a company and separately provide investment advise to a person who works at the company for a contingency fee.
# Employee benefit plans where the company is a client. This allows you to provide investment advise for the company's 401(k) plan for a contingency fee.<ref name="code-1.510.050">'''AICPA Code of Conduct 1.510.050''',''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=137></ref>

==== Conceptual Framework to Use When No Specific Guidance Is Available ====

The conceptual framework should be used for all rules when it is unclear whether a specific situation is allowed or not.

The conceptual framework is a three step process:
# Identify Threats
# Evaluate the Significance of the Threat
# Identify and Apply Safeguards

A member is not in violation of the rule if the "threat to the compliance of the rule" is at an '''acceptable level'''. An acceptable level is defined as "If the member evaluates the threat and concludes that a reasonable and informed third party who is aware of the relevant information would be expected to conclude that the threat does not compromise a member’s compliance with the rules, the threat is at an acceptable level, and the member is not required to evaluate the threat any further under this conceptual framework approach."

If it is determined that it is NOT at an acceptable level, then "the member should apply safeguards to eliminate the threat or reduce it to an acceptable level. The member should apply judgment in determining the nature of the safeguards to be applied because the effectiveness of safeguards will vary, depending on the circumstances." If the member does not believe the safeguards have reduced the threat to an acceptable level, then he should decline/discontinue the engagement.<ref name="code-1.000.010">'''AICPA Code of Conduct 1.000.010''',''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=26></ref>

==== Commission and Referral Specific Rules ====

Many of the rules for contingency fees apply to commissions as well. Additionally:
* 1.520.040 outlines that, if you are not able to perform the activities yourself without being in violation of the rule, then you also cannot get around the rule by using a third party. Simply outsourcing the task and receiving a commission, referral, or kickback from an individual or entity will still put you in violation of the rule.<ref name="code-1.520.040">'''AICPA Code of Conduct 1.520.040''',''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=139></ref>
* In any instance that a commission or referral fee is permitted, you must disclose the fee in writing to the client.

{| class="wikitable";
|+ Fee Situations
|-
!  !! style=width:15em | Permitted?
|-
| Purchase and resell a product to a client for Profit || [[file:GreenCheckmark.png | 15px | center]]
|-
| Refer a client and collect a referral fee || [[file:GreenCheckmark.png | 15px | center]]
|-
|}

=== Advertising and Other Forms of Solicitation ===

Advertising cannot be false, misleading, or deceptive. This is defined as '''any''' of the following:
* Creates false or unjustifiable expectations of positive results.
* Imply the ability to influence any court, regulatory body, or similar entity.
* Increase price substantially shortly after agreeing to service and not advising the client of the likelihood at the agreement.
* Any other situations that would cause a reasonable person to misunderstand or be deceived.

A member with an AICPA designation, such as the Personal Financial Specialist (PFS), can use the letters after their name. However, in order to use it after the companies name, '''all partners''' of the firm must have the designation.<ref name="code-1.600.030">'''AICPA Code of Conduct 1.600.030''',''AICPA'', https://us.aicpa.org/content/dam/aicpa/research/standards/codeofconduct/downloadabledocuments/2014-december-15-content-asof-2020-June-20-code-of-conduct.pdf#page=141></ref>

=== Client Confidentiality ===

Able to disclose confidential client information in the following situations:
# Requested by a court through subpoena or summons.
# As apart of a review of your professional practice.
# To initiate or respond to a inquiry made to an appropriate body.
# If it is only the client name and no other confidential information.
# To your liability insurance carrier as apart of a claim.
# Disclosing for review of a prospective purchase, sale, or merger of your practice.
# Disclosing to spouse, even in a divorce, because both individuals are clients.

=== Form of Organization and Name ===

* Cannot have a misleading firm name. Misleading if a reasonable person would misunderstand.
* A member may own an interest in a separate business that performs similar work.
* Only members of the firm who are legally partners (meaning they are apart of the partnership agreement) may use the term "partner".
* Allowed to use the name(s) of former partners in the firm's name.
* Firm can only designate itself as "Members of the AICPA" if all the CPA owners are members of the AICPA (does not require that all members are, just all CPA members).
* Can only affix CPA to the firm name if all members are CPA's.
* If not all members are CPA's, you can only use CPA after your personal name.

== References ==