[Sticky Nicky]

here is the exact same question presented in two different review materials with two different correct answers and explanations, talk about messing with your head!

Roger:
When considering internal control, an auditor should be aware of the concept of reasonable assurance, which recognizes that:

a) Internal control may be ineffective due to mistakes in judgment and personal carelessness.
b) Adequate safeguards over access to assets and records should permit an entity to maintain proper accountability.
c) Establishing and maintaining internal control is an important responsibility of management.
(Correct)d) The cost of an entity’s internal control should not exceed the benefits expected to be derived.

CORRECT ANSWER EXPLANATION:
Correct! The concept of reasonable assurance recognizes that there is a cost associated with establishing and maintaining internal controls, which should not exceed the benefit derived from having the control, as opposed to absolute assurance, which would disregard the cost of controls. The fact that internal control may be ineffective due to mistakes or carelessness is an inherent limitation of internal control, one of the reasons we can obtain reasonable, but not absolute assurance as to the effectiveness of internal control. While safeguards over access to assets and records do permit proper accountability and establishing and maintaining internal control is an important responsibility of management, neither is related to the concept of reasonable assurance.
Question ID #3021574

And now here is Ninja:
When considering internal control, an auditor should be aware of the concept of reasonable assurance, which recognizes that:

Correct A.
internal control policies and procedures may be ineffective due to mistakes in judgment and personal carelessness.

B.
adequate safeguards over access to assets and records should permit an entity to maintain proper accountability.

C.
establishing and maintaining internal control is an important responsibility of management.

Incorrect D.
the cost of an entity’s internal control should not exceed the benefits expected to be derived.

Explanation: No matter how well internal controls may be designed and operated, they can only provide an entity with reasonable, but not absolute, assurance about achieving the entity’s objectives. Certain limitations are inherent to internal control, including the following:

Human judgment in decision making can be faulty.
Breakdowns in internal control can occur because of human failures such as simple errors or mistakes.
Errors may occur in the use of information produced by IT when that information is not effectively used because the individual responsible for reviewing the information does not understand its purpose or fails to take appropriate action.
Controls can be circumvented by collusion or inappropriate management override.
Management may make judgments on the nature and extent of the controls it chooses to implement and the nature and extent of the risk it chooses to assume.

Question #: 1453 Category: 2F9 Consider Limitations of Internal Control

[DZagt]

I believe Ninja is correct.

[Sticky Nicky]

i believe they are both correct and the answer choices should'nt include them both…Roger book even address word for word that reasonable assurance deals with cost/benefit

[Sticky Nicky]

here is ninjas definition of reasonable assurance:

Reasonable assurance is the degree of assurance to convince a “reasonable man” within the cost-benefit constraint.

Regarding internal control: The concept of reasonable assurance recognizes that the cost of an entity's internal control structure should not exceed the benefits that are expected to be derived.

Regarding audit opinion: Obtaining reasonable assurance that the financial statements are not misstated recognizes both the time and economic limits (cost-benefit concept) in the application of audit procedures and the inherent uncertainties involved in accounting estimates, audit sampling, and human (even professional) judgment. The concept of due professional care recognizes human fallibility—that no task can be performed with the guarantee that there will be no fault or error of judgment.

The “reasonable man” concept is applied by considering whether or not a reasonable person, having all the facts and the normal strength of character, would reach the same conclusions as the auditor.

[DZagt]

You could make a case for the Roger one. Although, if I saw that question on the test I'd pick the Ninja answer. Its more relevant to reasonable assurance to me as opposed to the cost benefit principle.

[Sticky Nicky]

id pick cost benefit..considering ninjas definition of reasonable assurance confirms that Rogers is correct

[Anonymous]

This is why AUD sucks. For every question, you're not looking for the one right answer; you're looking for the best answer…which, granted, NINJA and Roger consider different things in this situation. But, on exam-day, just try to remember that if there's 2 possible right answer, it's the best answer that you're looking for.

[jeff]

NINJA's Answer and Explanations line up with the authoritative literature:

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0ahUKEwiAi_KPkO_PAhXLKyYKHf0UA-MQFggcMAA&url=http%3A%2F%2Fwww.aicpa.org%2Fresearch%2Fstandards%2Fauditattest%2Fdownloadabledocuments%2Fau-c-00315.pdf&usg=AFQjCNHxoShYkAq7kTNfUaQFWkhKmKxnSQ&sig2=QDWhGxjl2CnaW83fxjO1aA&bvm=bv.136593572,d.eWE

.A53 Limitations of internal control. Internal control, no matter how effective,
can provide an entity with only reasonable assurance about achieving the
entity's financial reporting objectives. The likelihood of their achievement is affected
by the inherent limitations of internal control. These include the realities
that human judgment in decision making can be faulty and that breakdowns
in internal control can occur because of human error. For example, an error
in the design of, or in the change to, a control may exist. Equally, the operation
of a control may not be effective, such as when information produced for
the purposes of internal control (for example, an exception report) is not effectively
used because the individual responsible for reviewing the information
does not understand its purpose or fails to take appropriate action. [Paragraph
renumbered by the issuance of SAS No. 128, January 2015.]

.A54 Additionally, controls can be circumvented by the collusion of two
or more people or inappropriate management override of internal control. For
example, management may enter into undisclosed agreements with customers
that alter the terms and conditions of the entity's standard sales contracts,
which may result in improper revenue recognition. Also, edit checks in a software
program that are designed to identify and report transactions that exceed
specified credit limits may be overridden or disabled. [Paragraph renumbered
by the issuance of SAS No. 128, January 2015.]

.A55 Further, in designing and implementing controls, management may
make judgments on the nature and extent of the controls it chooses to implement
and the nature and extent of the risks it chooses to assume. [Paragraph
renumbered by the issuance of SAS No. 128, January 2015.]

[Author]

Replies