The stages/activities involve in analyzing and measuring internal control are:
A. Obtaining an apprehension of the entity’s internal control construction.
B. Assessing the preliminary degree of control hazard.
C. Obtaining evidentiary affair to back up the assessed degree of control hazard.
D. Measuring the consequences of evidentiary affair.
E. Determining the necessary degree of sensing hazard.
Phase A. Obtaining an apprehension of the entity’s internal control construction. In be aftering the audit scrutiny, each of the five constituents of internal control must be studied and understood by the hearer to enable him to ( 1 ) place types of possible misstatements ; ( 2 ) consider factors that affect the hazard of misstatement ; and ( 3 ) Begin to plan appropriate testing process. Understanding the Control Environment
The hearer should obtain sufficient cognition of the control environment to understand management’s and the board of director’s attitude, consciousness, and actions refering the control environment. The hearer should concentrate on the substance of management’s policies, processs, and related actions instead than their signifier because direction may set up appropriate policies and processs but non move on them.
Understanding Control Procedures
Because some control processs are integrated in specific constituents of the control environment and accounting system, as the hearer obtains an apprehension of the control environment and accounting system, he is besides likely to obtain cognition about some control processs. The hearer should see the cognition about the presence or absence of the control processs obtained from the apprehension of the control environment and accounting system in finding whether it is necessary to give extra attending to obtain an apprehension of control processs to be after the audit. Understanding the Accounting and Internal Control Systems
To understand the design of the accounting information system, the hearer determines ( 1 ) the major categories of minutess of the entity ; ( 2 ) how those dealing are initiated ; ( 3 ) what accounting records exist and their nature ; ( 4 ) how minutess are processed from induction to completion, including the extent and nature of computing machine usage ; ( 5 ) the nature and inside informations of the fiscal coverage procedure followed. Typically, this is accomplished and documented by a narrative description of the system or by flowcharting. The operation of the accounting information system is frequently determined by following one or few minutess through the system ( called a dealing walk-through ) . Information controls associating to the accounting system are concerned with accomplishing aims such as: Minutess are executed in conformity with management’s general or specific mandate.
All minutess and other events are quickly recorded in the right sum, in the appropriate histories and in the proper accounting period so as to allow readying of fiscal statements in conformity with an identified fiscal coverage model. Access to assets and records is permitted merely in conformity with management’s mandate. Recorded assets are compared with the bing assets at sensible intervals and appropriate action is taken sing any differences. When obtaining an apprehension of the accounting and internal control systems to be after the audit, the hearer obtains cognition of the design of the accounting and internal control systems.
When the minutess selected are typical of those minutess that pass through the system, this process may be treated as portion of trials of control. The nature, timing, and extent of the processs performed by the hearer to obtain an apprehension of the accounting and internal control systems will change with, among other things: The size and complexness of the entity and of its computing machine system. Materiality considerations.
The type of internal controls involved.
The nature of the entity’s certification of specific internal controls. The auditor’s appraisal of built-in hazard.
Normally, the auditor’s apprehension of the accounting and internal control systems important to the audit is obtained through old with the entity and is supplemented by: a. Inquiries of appropriate direction, supervisory and other forces at assorted organisational degrees within the entity, together with mention to certification, such as processs manuals, occupation descriptions, and flow charts ; B. Inspection of paperss and records process by the accounting and internal control systems ; and c. Observation of the entity’s activities and operations, including observation of the organisation of computing machine operations, direction forces and the nature of dealing processing.
The hearer determines the policies, processs, methods, and records placed in operation by inspecting paperss and straight detecting the policies and processs in usage. The hearer can analyze existent, completed paperss and records to convey the contents of the manual to life and better understand them. In add-on, the hearer can detect client forces in the procedure of fixing them and transporting out their normal accounting and control activities. This farther enhances understanding and cognition that controls have been placed in operation. Documentation of Understanding
The hearer should document the apprehension of the entity’s internal control construction elements obtained to be after the audit. The signifier and extent of this certification is influenced by the size and complexness of the entity, every bit good as the nature of the entity’s internal control construction. By and large, the more complex the internal control construction and the more extended the processs performed, the more extended the auditor’s certification should be.
1. Internal Accounting Control Questionnaire
Internal accounting control questionnaire contains a series of inquiries designed to observe control failings. Most questionnaires are designed to give “yes” , “no” , or “not applicable” replies to the inquiries. A “yes” reply by and large indicates a satisfactory grade of internal accounting control while a “no” reply indicates a possible failing in control or at least indicates that farther probe is required. If the failing is material, them it should be reported to a senior direction, the board of managers, and the audit commission. “Material failing is one in which the processs or grade of conformity with the processs fail to supply sensible confidence that material mistakes or abnormalities would be prevented or quickly detected during the accounting process.” In finishing the internal control questionnaire, the hearer should see the undermentioned critical facets:
1. Is the system of internal control sound?
2. If it is non dependable, what mistakes might happen?
3. What alternate audit processs should be adopted if the system is undependable? Advantages
They provide audit confidence that attending is given to presence or absence of all controls listed and that certain characteristics of the system are non overlooked. They provide a agency of obtaining unvarying certification of internal control system reviewed. They provide inexperient audit staff members with counsel in executing internal control reappraisals. They facilitate the early sensing of possible failings in the system. Disadvantages
Hearer may see the questionnaire device for carry throughing an automatic rating of internal control. Controls listed on questionnaire may non accommodate the peculiar fortunes of a specific audit. The hearer may overlook pertinent control non included in the questionnaires. 2. Flow charts
Flowchart is a symbolic diagram of a specific portion of an internal accounting control system bespeaking the consecutive flow of informations and/or authorization. An internal control flow chart uses standardised symbols, complecting lines, and notes to stand for information, papers, and papers flow. It provides a pictural overview of a client’s internal control activities. It illustrates the interaction of persons, records, and control related to a peculiar section or category of minutess. Internal control flowcharts by and large reflect the segregation of responsibilities by utilizing a column across the top to reflect different sections and the flow of paperss and the flow of paperss from left to compensate. Advantages
Easily understood. Since flow charts provide a ocular description supplemented by a written narrative, they are more easy understood. Better overall image or complex system. A complex system may be reduced to a one or two-page flow chart which might otherwise necessitate a 15-page internal control questionnaire or a 10-page narrative memo. Parallels EDP certification. EDP systems are normally documented with flow charts which make it easier for EDP purchase forces to associate to the hearers. It is easy to update.
Higher degree of cognition and preparation are required to fix a good flow chart of a complex system. Flow charts take more clip to fix and necessitate more cognition. It is more hard to descry internal control failing.
The ff. inquiries should be answered before a flow chart is prepared:
1. Who performs the assorted maps in the modus operandi?
2. Why are these maps performed?
3. What work is performed, and is the work considered input or end product?
4. When are the maps performed and in what sequence?
5. How are the maps performed and in what sequence?
Conference with senior direction, supervisors, and employees utilizing the above checklist should be conducted by the independent hearer before flowcharting the modus operandi. In add-on, transcripts of all signifiers, paperss and studies used in the modus operandi to be flowcharted should be obtained. A primary intent of the internal control flow chart is to pass on efficaciously. The ff. techniques should help in meeting this end: Standardized symbols. Hearers use a unvarying set of symbols developed by the American National Standards Institute ( ANSI ) . Flowlines. The flow of paperss should be from top to bottom and left to compensate. Arrowheads may be used on all lines and should be used when the flow is non standard or is bi-directional.
Documents. When a papers is created, its beginning should be indicated. Multiple-document symbols are required when multiple transcripts of the papers are prepared. The temperament of every transcript or each papers should be shown. Processing. Processing symbols are used to place any processs applied to paperss such as their being filed. Notes. Remarks and accounts should be used to do the flow chart easier to understand or more complete. The ff. guidelines may be utile in fixing a flow chart:
Determine the category of minutess or dealing rhythm to be flowcharted. Obtain an apprehension of internal control by doing enquiries of client forces, detecting employee activities, and analyzing paperss, records,
and policies and processs manuals. Form the flow chart into columns, utilizing a different column for each section, map, or single. Pull a study of the flow chart. Pull the flow chart and insert remarks and notes.
Test the flow chart for completeness by following a few minutess through the chart.
3. Narrative Description
A narrative is a written description of a peculiar stage or stages or a control system. Although utile for depicting simple systems, narrations may be equal when a system is complicated or often revised. If the systems are extended and/or composite, separate narrations may be prepared for a smaller groups of control which relate to specific categories of minutess or histories. Some hearer prepare narrative descriptions to attach to internal control questionnaire or flow charts in order to supply information non otherwise included. Advantages:
Narrative is flexible and may be bespoke for battle. Requires a elaborate analysis and therefore forces auditor to understand operation of the system. Disadvantages:
Hearer may non hold the ability to depict the system right and briefly. This may necessitate more clip and careful survey.
Hearer may overlook of import parts of internal control system. A ill written internal accounting control narrative can take to a misinterpretation of the system therefore ensuing in the improper design and application of conformity trials.
4. Internal Control Checklist
This contains a elaborate numbering of the methods and patterns which characterize good internal control or of point to be considered in reexamining internal control.
5. Decision tabular arraies
In this attack, the system is depicted as determination points. Advantages and disadvantages are similar to those of the flow chart attack.
STAGE B. ASSESSING THE PRELIMINARY LEVEL OF CONTROL RISK
After obtaining an apprehension of the accounting and internal control systems, the hearer should do a preliminary appraisal of control hazard, at the averment degree, for each stuff history balance or category of minutess. The preliminary appraisal of control hazard is the procedure where the hearer evaluates the effectivity of a client’s internal control policies and processs in forestalling or observing material misstatements in the fiscal statement averments, viz. : ( 1 ) / ( 2 ) Existence/ Occurrence. Procedures that require certification, blessings, mandate, confirmation, and rapprochements. ( 3 ) Completeness. Procedures that guarantee that all minutess that occur are recorded such as accounting for numerical sequence of paperss. ( 4 ) Right and duties. Procedures that guarantee that the entity has a right to plus or an duty to pay originating from the dealing. ( 5 ) / ( 6 ) Valuation/ Measurement. Procedures that guarantee that a proper monetary value is charged and that mathematical truth are present in entering and in developing the accounting records and fiscal statement. ( 7 ) Presentation and Disclosure.
Procedures that indicate that a reappraisal has been made to determine that a dealing has been recorded in the proper history and that fiscal statement revelation have been reviewed by competent forces. The procedure of geting at the auditor’s appraisal of control hazard is an iterative procedure that is refined as the auditor’s obtain more and more grounds about the effectivity of assorted internal control policies and processs. After obtaining the apprehension of the internal control construction, the hearer may measure control hazard at the maximal degree. The term maximal degree is used in this subdivision to intend the greatest chance that a material misstatement that could happen in a fiscal statement averment will non be prevented or detected on a timely footing by an entity’s internal control construction. Control hazard may be assessed in quantitative footings, such as per centums, or in nonquantitative footings that range, for illustration, from a upper limit to a lower limit.
Measuring control hazard at below the maximal degree involves- Identifying specific internal control construction policies and process relevant to specific averments that are likely to forestall or observe material misstatements in those averments. Performing trials of control to measure the effectivity of such policies and processs. The preliminary appraisal of control hazard for a fiscal statement averment should be high unless the hearer: a. Is able to place internal controls relevant to the averment which are likely to forestall or observe, and correct a material misstatement ; and b. Plans to execute trials of control to back up the appraisal. Assessing Inherent Risk
In developing the overall audit program, the hearer should measure built-in hazard at the fiscal degree. In developing the audit plan, the hearer should associate such appraisal to material history balances and categories of minutess at averment degree, or presume that built-in hazard is high for the averment. To measure built-in hazard, the hearer uses professional opinion to measure legion factors, illustrations of which are: At the Financial Statement Level
The unity of direction.
Management experience and cognition and alterations in direction during the period. Unusual force per unit area on direction.
The nature of the entity’s concern.
Factors impacting the industry in which the entity operates. At the Account Balance and Class of Transactions Level
Fiscal statement histories likely to be susceptible to misstatement. The complexness of implicit in minutess and other events which might necessitate utilizing the work of an expert. The grade of judgement involved in finding history balances. Susceptible of plus to loss or embezzlement.
The completion of unusual and complex minutess.
Minutess non subjected to ordinary processing.
Relationship between the Assessment of Inherent and Control Risks Management frequently reacts to inherent hazard state of affairss by planing accounting and internal control systems to forestall or observe, and right misstatements and hence, in many instances, built-in hazard and control hazard are extremely interrelated. In such state of affairss, if the hearer attempts to measure built-in hazard and control hazards individually, there is a possibility of inappropriate hazard appraisal. As a consequence, audit hazard may be more suitably determined in such state of affairss by doing a combined appraisal. Designation of Specific Internal Control Policies to Specific Assertions Auditors are interested in control activities because they assist in set uping the cogency of fiscal statement averments. Controls that enhance the dependability of the fiscal statements may be preventative controls or sensing controls.
Preventive controls avoid mistakes and abnormalities while sensing controls acknowledging that mistake will happen even under ideal conditions provide for a “double-check” to turn up important happenings after the fact. If an entity’s controls are found to be effectual, the hearer may cut down the selected auditing processs to prove a group of averments. Control activities may supply direct grounds about the many averments. In placing internal control construction policies and processs relevant to specific fiscal statement averments, the hearer should see that the policies and processs can hold either a permeant consequence on many averments or a specific consequence on an single averment, depending on the nature of the peculiar internal control construction component involved. Conversely, some control processs frequently have a specific consequence on an single averment embodied in a peculiar history balance or dealing category. The aim of processs performed to obtain apprehension of the internal control construction is to supply the hearer with cognition necessary for audit planning.
The aim of trial of controls is to supply evidentiary affair to utilize in measuring control hazard. When the hearer concludes that processs performed to obtain the apprehension of the internal control construction besides provide evidentiary affair for measuring control hazard, he should see the grade of confidence provided by that evidentiary affair. Although such evidentiary affair may non supply sufficient confidence to back up an assessed degree of control hazard that is below the maximal degree of certain averments, it may make so for other averments and therefore supply a footing for modifying the nature, timing, or extent of the substantial trials that the hearer programs for those averments.
STAGE C. OBTAINING EVIDENTIAL MATTER TO SUPPORT THE ASSESSED LEVEL OF CONTROL RISK
The hearer obtains evidentiary affair to enable him to find the proper degree of control hazard by executing trial of controls or conformity trials on selected policies and processs. Conformity processs are designed to obtain sensible confidence that those internal controls on which trials necessitating review of paperss back uping minutess to derive grounds that controls have operated decently and enquiries about and observation of controls which leave no audit trail. Trial of Controls
Procedures directed toward either the effectivity of the design or operations of an internal control construction policy or process are referred to as trials of controls. Trials to obtain such evidentiary affair normally include processs such as enquiries of appropriate entity forces, review of paperss and studies, and observations of the application of specific internal control construction policies and processs. Trials of control are performed to obtain audit grounds about the effectivity of the: a. Design of the accounting and internal control systems, that is, whether they are appropriately designed to forestall or observe and rectify material misstatements ; and b. Operation of the internal controls throughout the period. The hearer should obtain audit grounds through trials of controls to back up any appraisal of control hazard which is less than high. The lower the appraisal of control hazard, the more support the hearer should obtain that accounting and internal control systems are appropriately designed and runing efficaciously.
When obtaining audit grounds about the effectual operation of internal controls, the hearer considers how they were applied, the consistence with which they were applied during the period and by whom they were applied. The construct of effectual operation recognizes that some divergences may hold occurred. Deviations from prescribed controls may be caused by such factors as alterations in cardinal forces, important seasonal fluctuations in volume of minutess and human mistake. In computing machine information system environment, the aims of trials of controls do non alter from those in a manual environment ; nevertheless, some audit processs may alter. The hearer may happen it necessary, or may prefer, to utilize computer-assisted audit techniques.
STAGE D. EVALUATING THE RESULTS OF THE EVIDENTIAL MATTER
Based on the consequences of the trials of controls, the hearer should measure whether the internal controls are designed and runing every bit contemplated in the preliminary appraisal of control hazard. The rating of divergences may ensue in the hearer reasoning that the assessed degree of control hazard needed to be revised. In such instances, the hearer would modify the nature, timing, and extent of planned substantial processs. The decision reached as a consequence of measuring control hazard is referred to as the assessed degree of control hazard. In finding the evidentiary affair necessary to back up a particular assessed degree of control hazard below the maximal degree, the hearer should see the features of evidentiary affair about the control hazard.
By and large, nevertheless the lower the assessed degree of control hazard, the greater the confidence the evidentiary affair must supply that the internal control construction policies and processs relevant to an averment are designed and runing efficaciously. Normally, the auditor’s observation provides more dependable audit grounds than simply doing enquiries. However, audit grounds obtained by some trials of controls, such as observation, pertains merely to the point in clip at which the processs was applied. The hearer may make up one’s mind, hence, to supplement these processs with other trials of control capable of supplying audit grounds about other period of clip. In finding the appropriate audit grounds to back up a decision about control hazard, the hearer may see the audit grounds obtained in anterior audits.
In a go oning battle, the hearer will be cognizant of the accounting and internal control systems through work carried out antecedently but will necessitate to update the cognition gained and see the demand to obtain farther audit grounds of any alterations in control. The hearer in add-on, should see whether the internal controls were in usage throughout the period. An audit of fiscal statements is a cumulative procedure ; as the hearer assesses control hazard, the information obtained may do him to modify the nature, timing, or extent of the planned trials of controls for measuring control hazard. The rating is based on the effectivity of the entity’s control construction in forestalling and/pr observing stuff misstatements, as determined by the trials of controls.
STAGE E. DETERMINING THE NECESSARY LEVEL OF DETECTION RISK
The hearer uses the acceptable degree of sensing hazard to find the nature, timing, and extent of the auditing processs to be used to observe material misstatements in the fiscal statement averments, scrutinizing processs designed to observe such misstatements are referred to in this subdivision as substantial trials. The degree of sensing hazard relates straight to the auditor’s substantial processs. The auditor’s control hazard appraisal, together with the built-in hazard appraisal, influence the nature, timing, and extent of the substantial processs to be performed to cut down hazard, and hence audit hazard, to an tolerably low degree. In this respect the hearer would see:
a. The nature of substantial processs, for illustration, utilizing trials directed toward independent parties outside the entity instead than trials directed toward parties or certification within the entity, or utilizing trials of inside informations for a peculiar audit aims in add-on to analytical processs ; B. The timing of substantial processs, for illustration, executing them at period instead than at an earlier day of the month ; and c. The extent of substantial processs, for illustration, utilizing a larger sample size. As the acceptable degree of sensing hazard lessening, the confidence provided from substantial trials should increase. Consequently, the hearer may make one or more of the ff
Change the nature of substantial trials from a less effectual to a more effectual processs, such as utilizing trials directed toward parties or certification within the entity Change the timing of substantial trials, such as executing them at year-end instead than at interim day of the month. Change the extent of substantial trials, such as utilizing a larger sample size. There is an reverse relationship between the sensing hazards and the combined degree of built-in and control hazards. The substantial trials that the hearer performs consist of trials of inside informations of minutess and balances, and analytical processs. The aim of trials of inside informations of minutess performed as substantial trials is to observe material misstatements in the fiscal statements. The hearer should acknowledge, nevertheless, that careful consideration should be given to the design and rating of such trials to guarantee that both aims will be accomplished.
Audited account Hazard in the Small Business
The hearer needs to obtain the same degree of confidence in order to show an unqualified sentiment on the fiscal statements of both little and big entities. However, many internal controls which would be relevant to big entities are non practical in the little concern for illustration is the segregation of responsibilities. In fortunes where segregation of responsibilities is limited and audit grounds of supervisory control is missing, the audit grounds necessary to back up the auditor’s sentiment on the fiscal statements may hold to be obtained wholly through the public presentation of substantial processs. How Adequacy or Inadequacy of Internal Control Affects Audit Procedures The primary ground for analyzing and measuring internal control is to supply a footing for trusting upon the system and for finding the extent of year-end substantial trials to be performed.
There is an reverse relationship between the effectivity of internal control and the extent of elaborate audit processs ; more effectual system requires less elaborate testing. Strengths and failings identified during the rating of internal accounting control and trials of conformity will impact the nature, timing, and extent of audit processs. The audit is non specifically designed to seek for mistakes or abnormalities, although during the survey and rating of internal accounting control system and the public presentation of substantial trials, mistakes, or abnormalities may be discovered. The hearer must see the audit deduction when mistakes or abnormalities are likely to be. Documentation of the Assessed Level of Control Risk
The hearer should document in the working documents.
a. The understanding obtained of the entity’s accounting and internal control systems ;
B. The appraisal of control hazard. When control hazard is assessed at less than high, the hearer would besides document the footing for the decisions.
Figure 11.2 Relationship of Effectiveness of Internal Control and Substantive Tests Controls ab initio considered effectual
Controls initial non considered effectual or non be efficient Reduce control hazard
Assess control hazard at upper limit ( 100 % )
Reduce acceptable hazard of overreliance on internal control
Acceptable hazard of overreliance on internal control- 100 % ( maximal ) Perform trials of control ( enquiries, review, observation, and reperformance ) Perform no trials of controls
Increase sensing hazard
Decrease sensing hazard
Reduce planned substantial trial
1. Use less persuasive substantial trials.
2. Perform the substantial trials at interim day of the month.
3. Decrease extent of substantial trial by choosing a smaller sample size. Perform extended substantive testing
1. Use more effectual substantial trials.
2. Perform substantial trials at year-end
3. Increase extent of substantial trials by choosing a larger sample size.
Communication of Performance, Improvements and Observations in Internal Control Management. As a consequence of obtaining an apprehension of the accounting and internal control systems and trials of controls, the hearer may go cognizant of failings in the systems. The hearer should do the direction cognizant, every bit shortly as practical and at an appropriate duty, of stuff failings in the design or operation of the accounting and internal control systems, which have come to the auditor’s attending. The communicating to direction of stuff failings would normally in authorship.
Management missive may be made that will incorporate constructive suggestions or betterments in internal control or other suggestions for increased efficiency in operations. This missive is considered a byproduct instead than the purpose of the audit and is frequently completed sometimes after the completion of the field work. If nevertheless, the hearer identifies material failings, he has a professional duty to pass on them to both senior direction and the board of managers. The hearer should publish a written study at the earliest possible that it is documented in the work documents. Reportable Conditionss
Specifically, these are the affairs coming to the auditor’s attending that, in his opinion, should be communicated to the audit commission because they represent important lacks in the design or operation of the internal control construction, which could adversely impact the organization’s ability to record, procedure, sum up, and report fiscal informations consistent with the averments of direction in the fiscal statements. Examples of reportable conditions are as follows: Lacks in internal control construction design
Inadequate overall internal control construction design
Absence of appropriate segregation of responsibilities consistent with appropriate control aims. Absence of appropriate reappraisals, and blessings of minutess, accounting entries, or systems end product. Inadequate processs for suitably measuring and using accounting rules. Inadequate commissariats for the safeguarding of assets.
Absence of other internal control techniques considered appropriate for the type and degree of dealing activity. Evidence that a system fails to supply complete and accurate end product that is consistent with aims and current demands because of design defects. Failures in the operation of the internal control construction
Evidence of failure of identified controls in forestalling or observing misstatements of accounting information Evidence that a system fails to supply complete and accurate end product consistent with the entity’s control objectives because of the misapplication of control processs. Evidence of failure to safeguard assets from loss, harm, or embezzlement. Evidence of knowing override of the internal control construction by those in authorization to the hurt of the overall aims of the system. Evidence of failure to execute undertakings that are portion of the internal control construction, such as rapprochement non prepared or non seasonably prepared. Evidence of wilful error by employees or direction.
Evidence of use, disproof, or change of accounting records or back uping paperss. Evidence of knowing misapplication of accounting rules. Evidence of deceit by client forces to the hearer. Evidence that employees or direction lack the makings and developing to carry through their assigned maps. Others
Absence of sufficient degree of control consciousness within the organisation Failure to follow up and rectify antecedently identified internal control construction lacks. Evidence of important or extended unrevealed related party minutess. Evidence of undue prejudice or deficiency of objectiveness by those responsible for accounting determinations. Reporting- Form and Content
Conditionss noted by the hearer that are considered reportable under this subdivision or that are the consequence of understanding with the client should be reported, preferred in composing. If the information is communicated orally, the hearer should document the communicating by appropriate memorandums or notations in the working documents. Any study issued on reportable conditions should:
Indicate that a intent of the audit was to describe on the fiscal statements and non to supply confidence on the internal control construction. Include the definition of reportable conditions. Include the limitation on distribution as discussed in the old paragraph. If no reportable conditions are found, an hearer may non publish a missive saying that. Such a missive may misdirect users by connoting a greater degree of confidence about the deficiency of any important lacks than the hearer could truly supply. However, an hearer may publish a missive bespeaking that no stuff failings were found during the class of an audit.