MCQ 3 — SA 260 × SA 265 A deficiency can exist even when no misstatement occurred During the audit o

MCQ 3 — SA 260 × SA 265

A deficiency can exist even when no misstatement occurred

During the audit of Nova Ltd., the auditor discovers that employees in the procurement department can create new vendors in the ERP system without independent approval.

The following additional facts are established:

no unauthorised vendor was actually identified during the audit;
monthly analytics performed by the finance controller compare vendor master data with supporting documentation;
the analytics control has operated consistently;
because of this compensating control, the auditor assesses the likelihood of an undetected material misstatement arising from the vendor-master weakness as low;
nevertheless, the auditor believes the absence of preventive authorisation is important enough to merit the attention of those charged with governance.

The CFO argues:

“Since the compensating control operates effectively and there is no identified misstatement, this is not an internal-control deficiency that needs to be communicated.”

Which ONE of the following is most appropriate?

A. The CFO’s position is correct because an internal-control deficiency exists only when the auditor identifies an actual or probable financial statement misstatement.

B. The CFO’s position is correct because an effective compensating control eliminates the underlying deficiency for purposes of SA 265.

C. The CFO’s position is not correct; the absence of a control necessary to prevent or detect and correct misstatements on a timely basis can constitute a deficiency, and whether it is a significant deficiency depends on the auditor’s professional judgment regarding its importance to TCWG.

D. The CFO’s position is not correct only because every deficiency in the vendor-master process is required to be communicated in writing to TCWG regardless of its significance.