Chapter 12

Procedures used by the auditor to gather evidence about the design and implementation of specific controls

A written description of a client's internal controls, including the origin, processing, and disposition of documents and records and the relevant control procedures.

A diagrammatic representation of the client's documents and records and the sequence in which they are processed.

A series of questions about the controls in each audit area used as a means of indicating to the auditor aspects of internal control that may be inadequate.

The tracing of a selected transaction through the entire accounting process, including information systems, until it is reflected in the financial records using the same documents and IT that entity personnel use to ensure that the controls deisgned by management have been implemented.

A measure of the auditor's expectation that internal controls will neither prevent material misstatements from occurring nor detect and correct them if they have occured.

A foundational control that supports a direct control but that is not sufficiently precise to prevent or detect and correct misstatements at the assertion level.

A control that is precise enough to address the risk of material misstatement at the assertion level.

A methodology used to help the auditor assess control risk by matching key internal controls and internal control deficiencies with audit objectives.

Controls that are expected to have the greatest effect on meeting audit objectives; often referred to as identified or relevant controls.

A deficiency in the design or operation of a control that does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect and correct misstatements on a timely basis.

A deficiency or a combination of deficiencies in internal control over financial reporting that is less severe than a material weakness but important enough to merit attention by those charged with governance.

A deficiency or a combination of deficiencies in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected and corrected on a timely basis.

A control elsewhere in the system that offsets the absence of a key control.

An engagement that addresses controls at the service organization that are relevant to the user organization's financial statements; report by service auditors enables user auditors to perform risk assessment procedures and obtain audit evidence about whether controls at the service organization are designed and operating effectively.

An engagement that addresses controls relevant to security, availability, and processing integrity of the systems the service organization uses to process users' data and the confidentiality and privacy of the information these systems process; report by service auditors is restricted to specific parties with sufficient knowledge and understanding of the service organization's system and the nature of services it provides.

An engagement that, like a SOC 2, addresses controls relevant to security, availability, processing integrity, confidentiality, and privacy, but not at the same level of detail; report by service auditor is considered general use and can be distributed widely.

An optional letter written by the auditor to a client's management containing the auditor's recommendations for improving any aspect of the client's business.

A method of auditing an IT system that uses the auditor's test data to determine whether the client's information system correctly processes valid and invalid transactions.

An audit testing approach that involves the auditor's use of audit software to replicate some part of a client's application system.

A method of auditing transactions processed by IT whereby the auditor embeds a module in the client's application software to identify transactions with characteristics that are of interest to the auditor; the auditor is then able to analyze these transactions on a real-time, continuous basis as client transactions are processed.

Computer programs used by auditors that provide data retrieval, data manipulation, and reporting capabilities specifically oriented to the needs of auditors.