CPA Exam — AUDAssessing Risk and Developing a Planned ResponseMedium

An auditor is developing an overall audit strategy for a client that primarily operates through a complex, decentralized organizational structure with numerous subsidiaries in various countries. This structure will most likely lead the auditor to initially plan for:

  1. AA predominantly substantive approach due to potential control weaknesses.
  2. BIncreased emphasis on understanding entity-level controls.
  3. CA greater proportion of analytical procedures over tests of details.
  4. DA lower materiality threshold to account for dispersed operations.
Show answer & explanation

Correct answer: B. Increased emphasis on understanding entity-level controls.

A complex, decentralized structure increases the importance of entity-level controls, such as those related to management oversight, risk assessment processes, and the consolidation process. Understanding and assessing the effectiveness of these overarching controls is crucial for developing an appropriate audit strategy for dispersed operations.

Why the other options are wrong

  • A. While control weaknesses might exist, the initial focus is on understanding the overarching control structure, not immediately defaulting to substantive procedures.
  • C. Analytical procedures are useful, but understanding entity-level controls is a more fundamental initial step for complex structures than simply changing the mix of procedures.
  • D. Materiality is determined based on financial statement users' needs, not directly by organizational structure complexity.

Entity-Level Controls

Entity-level controls are controls that have a pervasive effect on the entity's internal control system as a whole. They are typically broader in scope and relate to the control environment, risk assessment, and monitoring activities.

  • Operate at the company-wide level.
  • Crucial for decentralized or complex organizations.
  • Examples: tone at the top, management's risk assessment, internal audit.

Memory trick: Decentralized means you need strong 'entity' glue.

More Assessing Risk and Developing a Planned Response questions