1 chapter 9 the study of internal control and assessment of control risk

CHAPTER 9The Study of

Internal Control and Assessment of

Control Risk

What is What is internal internal controlcontrol??

Internal control is a process designed toprovide reasonable assurance regardingthe achievement of management’s ob-jectives regarding:

- reliability of financial reporting- operational effectiveness and efficiency- compliance with laws and regulations

Internal control is a process designed toprovide reasonable assurance regardingthe achievement of management’s ob-jectives regarding:

The Foreign Corrupt PracticesAct requires “proper recordkeeping

systems” of SEC companies; i.e., reliable financial statements and ac-

counting records.

performpreliminaryanalytical

procedures

Steps in audit planningSteps in audit planning

preplan

understandinternal control

and assesscontrol risk

setmateriality, and

assess acceptableaudit risk andinherent risk

obtainbackgroundinformation

obtain information about client’s legal obligations

performpreliminaryanalytical

procedures

Steps in audit planningSteps in audit planning

preplan

Why is an understanding of internal control important?

setmateriality, and

assess acceptableaudit risk andinherent risk

understandinternal control

and assesscontrol risk

obtainbackgroundinformation

obtain information about client’s legal obligations

Second Fieldwork Standard:A sufficient understanding of internalcontrol is to be obtained to plan the audit and to determine the nature, tim-ing, and extent of tests to be performed.

Why is anunderstanding

of internalcontrol

important?

Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the audit risk modelaudit risk model: (AU 312): (AU 312)

= x xaudit risk

inherent risk

control risk

detection risk

therisk that material

misstatements will not be prevented ordetected by

internal controls

- internal control is the client’s responsibility and should be designed to help the client attain goals- internal control should provide reasonable but not absolute assurance; cost/benefit must be considered- internal control has inherent limita- tions (e.g., misunderstandings, mis- takes, fatigue, carelessness, collusion, management override)

Key Internal Control ConceptsKey Internal Control Concepts

What are the components of What are the components of internal control?internal control?

the controlenvironment

The control environment is theactions, policies, and procedures thatreflect management’s attitude regard-

ing controls and their importance.

All these controls are unnecessary!

Factors related to the Control Environment:Factors related to the Control Environment:

- integrity and ethical values

Does man-agement com-municate com-

pany values andbehavioral stan-

dards to personnelthrough policy state-ments, codes of con-

duct, and by example?

Does managementremove or reduce

incentives or temp-tations that mightprompt personnelto engage in dis-honest, illegal,

or unethicalacts?

- commitment to competence

Does management consider com-petence levels for specific jobs

and how those levels translate into requisite skills and knowledge?

- board of directors or audit committee The audit committee maintains communication between the Board of Directors and internal and external auditors. The committee is composed of outside members of the board. SEC companies are required to have an audit committee.

BOARD OFDIRECTORS

auditcommittee

internalauditors

externalauditors

- management’s philosophy and operating style

- management’s philosophy and operating style Consider the following: - their approach to taking and monitoring business risk

Factors related to the Control Environment:Factors related to the Control Environment:- management’s philosophy and operating style Consider the following: - their attitude and actions toward financial reporting

- management’s philosophy and operating style Consider the following: - their emphasis on meeting financial and operating goals

...our bonusesare based on net income.We all want fat bonuses!

What can we do?

- organizational structure The auditor should consider lines of responsibility and authority.

What are theformal methods that

management uses to communicateinternal controls to

employees?

Factors related to the Control Environment:Factors related to the Control Environment:- assignment of authority and responsibility

EmployeeHandbook

CompanyPolicies

JobDescription

- human resource policies and practices Management should ensure that competent, trustworthy, motivated personnel are employed to meet client goals and objectives.

Employees are the critical com-ponent of effective internal control.

With competent, trustworthy, motivated per-sonnel, even a poorly designed system ofinternal control may function adequately.

Employees are the critical com-ponent of effective internal control.

Without such personnel, even a well-designed system will probably fail.

With competent, trustworthy, motivated per-sonnel, even a poorly designed system ofinternal control may function adequately.

Risk assessment for financial reportingis management’s identification and anal-ysis of risks relevant to financial state-

ment preparation in conformity with GAAP.

riskassessment

controlactivities

Control activities are policies and pro-cedures, in addition to those related to

other components, established to enablethe entity to address risks in the achievement of their objectives.

1. Adequate separation of duties - separate custody of assets from accounting

Mr. Controller

Categories of Control ActivitiesCategories of Control Activities

1. Adequate separation of duties - separate custody of assets from authorization of transactions

As custodian ofthe corporate auto fleet, I hearby authorize retire- ment of auto #43 because of obso- lescence.

1. Adequate separation of duties - separate operational responsibility from record keeping responsibility

Example: Ace company has two plants; one inGreat Britain and one in the U.S.A. Manage-ment is deciding whether the plant controllersshould report directly to the plant managersor the corporate vice president of finance.

plantcontroller

V.P.-production

V.P.- finance

plant manager

plantcontroller

plant manager

plantcontroller

V.P.-production

V.P.- finance

plant manager

plantcontroller

plant manager

plantcontroller

plant manager

Which arrangement creates a potential conflict of interest?

plantcontroller

V.P.-production

V.P.- finance

plant manager

plantcontroller

plant manager

Which arrangement creates a potential conflict of interest?

If the plant controller reports directly to theplant manager, a potential conflict of interestexists. In an effort to make that plant’s resultsappear favorable, the plant manager may at-

tempt to influence the plant controller.

1. Adequate separation of duties - separate duties within EDP

What kind of company typically has What kind of company typically has difficulty accomplishing adequate difficulty accomplishing adequate

segregation of duties?segregation of duties?

What kind of company typically has What kind of company typically has difficulty accomplishing adequate difficulty accomplishing adequate

segregation of duties?segregation of duties?

Small companies frequently have diffi-culty with segregation of duties because

of fewer employees.

Collusion is the defeat of adequate sep-aration of duties wherein employees

cooperate to perpetrate fraud.

...we’re agreed.We’ll be rich be-yond our wildest

dreams!

What is collusioncollusion??

What is the most effective way to What is the most effective way to preventprevent collusion? collusion?

hire competent, trustworthy,motivatedpersonnel

What is the most effective way to What is the most effective way to preventprevent collusion? collusion?

Competent, untrustworthy, motivatedpersonnel oftenknow how to conceal theirfraud.

Why is collusion particularly Why is collusion particularly troublesome for auditors?troublesome for auditors?

1. Adequate separation of duties2. Proper authorization of transactions and activities

1. Adequate separation of duties2. Proper authorization of transactions and activities - general authorization - management establishes authorization policies

accountspayablepolicies &procedures

cashreceiptspolicies &procedures

humanresourcespolicies &procedures

I’m thepresident and

I want to approveevery cashpayment!

Categories of Control ActivitiesCategories of Control Activities1. Adequate separation of duties2. Proper authorization of transactions and activities - specific authorization - management makes authorizations on a case-by- case basis.

1. Adequate separation of duties2. Proper authorization of transactions and activities3. Adequate documents and records should provide reasonable assurance that all assets are properly controlled and all transactions are correctly recorded.

DocumentDocumentGuidelinesGuidelinesDocumentsshould be:prenumbered and accountedfor

PURCHASE ORDER 32494 Date: Vendor: 234 Reynolda Rd. Winston-Salem, NC27109 Purchasing agent: Quantity Description Price

WAIT FORESTU N I V E R S I T Y

total cost of order

Est. shipment date: Terms of sale (including discounts and freight costs): Carrier:

Internal Use Only: (routing instructions)1.PO made in purchasing 3. receiving notes ship2.Copies to vendor, receiv. 4. acctg. reconciles

U N I V E R S I T Y

DocumentDocumentGuidelinesGuidelinesDocumentsshould be:preparedduring or soon after therelated transaction

total cost of order

U N I V E R S I T Y

DocumentDocumentGuidelinesGuidelinesDocumentsshould be:understand-able andcorrectlydesigned(includingrouting andauthorization)

total cost of order

U N I V E R S I T Y

DocumentDocumentGuidelinesGuidelines

Documentsshould be:designedformultiplepurposes

total cost of order

U N I V E R S I T Y

2. Proper authorization of transactions and activities3. Adequate documents and records4. Physical control over assets and records - locking rooms, fenced areas, fireproof safes, safe deposit boxes, security guards, backup files

2. Proper authorization of transactions and activities3. Adequate documents and records4. Physical control over assets and records5. Independent checks on performance - those reviewing performance should be independent of those performing a task

5. Independent checks on performance

Separation of duties is the leastexpensive method of performing

independent checks.

informationand

communication

The accounting information andThe accounting information andcommunication system should becommunication system should be

designed to satisfy audit objectives.designed to satisfy audit objectives.

informationand

communication

- existence - the system should ensure that recorded transactions exist - no fictitious transactions

designed to satisfy audit objectives:designed to satisfy audit objectives:

- existence- completeness - the system should ensure that all existing transactions are recorded

How do the How do the existenceexistence and and completenesscompletenessobjectives differ?objectives differ?

- existence- completeness

Existence con-cerns the existence offictitious data; i.e., overstatement.

Completeness concerns omission of information; i.e., under-

statement.

- existence- completeness- accuracy - the system should ensure that recorded transactions are stated at the correct amounts

- existence- completeness- accuracy- classification - the system should ensure that transactions are properly classified, possibly through use of a chart of accounts.

- existence- completeness- accuracy- classification- timing - the system should ensure that transactions are recorded on the correct dates. Generally, transactions should be recorded during or shortly after their occurrence.

- existence- completeness- accuracy- classification- timing- posting and summarization -the system should ensure that transactions are included in the accounting records and accurately summarized.

monitoring

Monitoring activities deal with Monitoring activities deal with ongoing or periodic assessmentongoing or periodic assessment

of internal control.of internal control.

Internal auditing departmentsInternal auditing departments frequently perform monitoring frequently perform monitoring

activities.activities.

monitoringcontrol

activities

riskassessment

the controlenvironment

information andcommunication

ControlExamina-

tionOverview Obtain an understanding

of internal control.

HOW?HOW?

ControlExamina-

tionOverview

- review prior year workpapers- interview prior year auditors- interview client personnel- study client policies and procedures- study client documents, records, information and communication system

Obtain an understandingof internal control.

ControlExamina-

tionOverview

- narratives- flowcharts- internal control questionnaires

What is aninternal controlquestionnaire?

How do auditors document their under-

standing of internalcontrol?

Internal Control QuestionnaireInternal Control Questionnaire

What are theadvantages provided by

an IC questionnaire?

- a series of questions about internal controls and their application to groups of accounts and cycles- generally, a “no” answer indicates an internal control weakness

What are theadvantages provided by

- can be designed to cover most aspects of internal control - is relatively applicable from one en- gagement to another- when complete, can be quickly re- viewed for weaknesses

- concentrates on pieces of internal control rather than the system as a whole- has questionable reliability; oral client responses should be supported by other evidence- may be too standardized for some clients, especially smaller clients

What are thedisadvantages of using

Arefinancial statements

auditable?

ControlExamina-

tionOverview

- management lacks integrity- significantly deficient accounting records or internal controls

When would theWhen would theanswer be answer be NONO??

ControlExamina-

tionOverview

Assess control risk, basedon understanding.

ControlExamina-

tionOverview

Assess the cost/benefit offurther enhancing under-

standing of internal control.

ControlExamina-

tionOverview

high medium low

Assesscontrol

ControlExamina-

tionOverview

- high: poor controls indicate a very risky situation

high medium low

Assesscontrol

ControlExamina-

tionOverview

- high: poor controls indicate a very risky situation- medium: mix of effective and in- effective controls indicate a moderate level of risk

high medium low

Assesscontrol

ControlExamina-

tionOverview

- medium: mix of effective and in- effective controls indicate a moderate level of risk- low: effective controls indicate a low level of risk

high medium low

Assesscontrol

ControlExamina-

tionOverview

Perform tests of controls.

ControlExamina-

tionOverview

Decidewhether the initial

internal control assessmentwas appropriate.

ControlExamina-

tionOverview

Based on appropriatelevel of detection risk,

perform substantive tests.

What are What are reportable conditionsreportable conditions??

Reportable conditions are signifi-cant internal control deficiencieswhich adversely affect financial

data (AU 325).

AU 325requires the auditor to com-

municate (oral or written)with the audit committeeregarding the reportable

conditions.

Reportable conditions are signifi-cant internal control deficiencieswhich adversely affect financial

data (AU 325).

1 chapter 9 the study of internal control and assessment of control risk

Documents

risk management and internal control system - reference...

· the charter (internal audit charter) introduction 31...

management's guide to risk management and internal control

internal control and risk management framework: volume i

the evolution of internal control - chapters site ·...

coso internal control framework introductory...

section 404 audits of internal control and control risk ·...

chapter 10 section 404 audits of internal control and...

chapter 5 risk assessment: internal control evaluation

the pillars of internal control and risk management

chapter 20 - internal control - · pdf filechapter 20 -...

risk assessment and internal control

thai banker's internal audit club · maturity internal...

internal controls · improve their control systems. coso ....

risk management and internal control system of deposit

· internal control and risk management: it coordinates...

internal control weaknesses and client risk management

analisis internal control ... -...

governance, risk management, and internal control

agency risk management and internal control standards