chapter 9 the study of the internal control and assessment of control risk

9 - 1Copyright 2003 Pearson Education Canada Inc.

CHAPTER 9The Study of theInternal Control

and Assessment of Control Risk


What is What is internal internal controlcontrol??


What is What is internal internal controlcontrol??

Internal control consists of the policies &procedures established & maintained bymanagement to assist in orderly &efficient conduct of business.


- reliability of controls

Internal control is a process designed toprovide reasonable assurance regardingthe achievement of management’s ob-jectives regarding:

Accounting Records

Our recordsare reliable!


- reliability of controls- optimizing use of resources

Internal control is a process designed toprovide reasonable assurance regardingthe achievement of management’s objectives regarding:

Waste


- reliability of controls- optimizing use of resources- safeguarding of assets



- reliability of controls- optimizing use of resources- safeguarding of assets- preventing & detecting fraud & error



performpreliminaryanalytical

procedures

Steps in audit planningSteps in audit planning

preplan

understandinternal control

and assesscontrol risk

setmateriality, and

assess acceptableaudit risk andinherent risk

obtainbackgroundinformation

obtain information about client’s legal obligations


performpreliminaryanalytical

procedures

Steps in audit planningSteps in audit planning

preplan

Why is an understanding of internal control important?

setmateriality, and

assess acceptableaudit risk andinherent risk

understandinternal control

and assesscontrol risk

obtainbackgroundinformation

obtain information about client’s legal obligations


Second Examination Standard:A sufficient understanding of internalcontrol should be obtained to plan the audit.

Why is anunderstanding

of internalcontrol

important?


Audit Risk has 3 components Audit Risk has 3 components which combine to make the which combine to make the

audit risk modelaudit risk model::

= x xaudit risk

inherent risk

control risk

detection risk

therisk that material

misstatements will not be prevented ordetected by

internal controls


Key Internal Control ConceptsKey Internal Control Concepts

- internal control is the client’s responsibility and should be designed to help the client attain goals


- internal control is the client’s responsibility and should be designed to help the client attain goals- internal control should provide reasonable but not absolute assurance; cost/benefit must be considered



- internal control is the client’s responsibility and should be designed to help the client attain goals- internal control should provide reasonable but not absolute assurance; cost/benefit must be considered- internal control has inherent limita- tions (e.g., misunderstandings, mis- takes, fatigue, carelessness, collusion, management override)



What are the components of What are the components of internal control?internal control?


the controlenvironment

What are the elements ofWhat are the elements ofinternal control?internal control?


The control environment is theactions, policies, and procedures thatreflect management’s attitude regard-

ing controls and their importance.

All of these controls are unnecessary!


Factors related to the Control Factors related to the Control Environment:Environment:


Factors related to the Control Environment:Factors related to the Control Environment:

- management’s philosophy and operating style



- management’s philosophy and operating style Consider the following: - their approach to taking and monitoring business risk


Factors related to the Control Environment:Factors related to the Control Environment:- management’s philosophy and operating style Consider the following: - their attitude and actions toward financial reporting



- management’s philosophy and operating style Consider the following: - their emphasis on meeting financial and operating goals

...our bonusesare based on net income.We all want fat bonuses!

What can we do?



- board of directors & committees The audit committee maintains communication between the Board of Directors and internal and external auditors.

BOARD OFDIRECTORS

auditcommittee

internalauditors

externalauditors



- organizational structure The auditor should consider lines of responsibility and authority.


What are theformal methods that

management uses to communicateinternal controls to

employees?

Factors related to the Control Environment:Factors related to the Control Environment:- assignment of authority and responsibility

EmployeeHandbook

CompanyPolicies

JobDescription

Memo:


Factors related to the Control Environment:Factors related to the Control Environment:- management’s control methods

Do management’smethods send a clear

message about theimportance of

control?



- management’s control methods

Do manage-ment’s methodsserve to detect

misstatements?

Do management’s methods send a clear message

about the importance of

control?



- systems development methodology

Does management have amethodology for developingand modifying systems and

procedures?



- personnel policies and practices Management should ensure that competent, trustworthy, motivated personnel are employed to meet client goals and objectives.

Employees are the critical component of effective internal control.


With competent, trustworthy, motivated per-sonnel, even a poorly designed system ofinternal control may function adequately.

Employees are the critical com-ponent of effective internal control.


Without such personnel, even a well-designed system will probably fail.

With competent, trustworthy, motivated per-sonnel, even a poorly designed system ofinternal control may function adequately.


- management’s reaction to external influences


Is management aware of external influences such as changes in the

economy and technology?



- internal audit

Does an internal audit department exist? Does

it effectively monitorcontrol policies and procedures,

and enhance operational

effectiveness and efficiency?



- internal audit

Does internalaudit assist the

external auditors and reduce audit

fees?

Does an internal audit department exist?

Does it…?


controlsystems



Accounting systems have severalsubcomponents - classes of

transactions

accountingsystems



controlprocedures

What are the components of What are the components of internal control?internal control?


controlprocedures

Control procedures are policies and pro-cedures, in addition to those related to

other components, established to enablethe entity to address risks in the achievement of their objectives.


Categories of Control Categories of Control ProceduresProcedures


1. Adequate segregation of duties - separate custody of assets from accounting

The Controller



1. Adequate segregation of duties - separate custody of assets from authorization of transactions

As custodian ofthe corporate auto fleet, I hereby authorize retire- ment of auto #43 because of obso- lescence.

#43

Joe

Categories of Control Categories of Control Procedures Procedures


1. Adequate segregation of duties - separate operational responsibility from record keeping responsibility


Example: Ace company has two plants; one inGreat Britain and one in Canada. Manage-ment is deciding whether the plant controllersshould report directly to the plant managersor the corporate vice president of finance.


plantcontroller

V.P.-production

V.P.- finance

plantmanager

plantcontroller

V.P.-production

V.P.- finance

plant manager

plantcontroller

plant manager

plantcontroller

plant manager

Which arrangement creates a potential conflict of interest?

plantcontroller

plant controller


plantcontroller

V.P.-production

V.P.- finance

plant manager

plantcontroller

plant manager

Which arrangement creates a potential conflict of interest?

If the plant controller reports directly to theplant manager, a potential conflict of interestexists. In an effort to make that plant’s resultsappear favourable, the plant manager may at-

tempt to influence the plant controller.


1. Adequate segregation of duties - separate duties within EDP



What kind of company typically has What kind of company typically has difficulty accomplishing adequate difficulty accomplishing adequate

segregation of duties?segregation of duties?


What kind of company typically has What kind of company typically has difficulty accomplishing adequate difficulty accomplishing adequate

segregation of duties?segregation of duties?

Small companies frequently have diffi-culty with segregation of duties becauseof fewer employees and cost constraints.


What is collusioncollusion??


Collusion is the defeat of adequate separation of duties wherein Employees cooperate to perpetrate fraud.

...we’re agreed.We’ll be rich be-yond our wildest

dreams!

What is collusioncollusion??


What is the most effective way to What is the most effective way to preventprevent collusion? collusion?


Hire competent, trustworthy,motivated personnel.

What is the most effective way to What is the most effective way to preventprevent collusion? collusion?


Why is collusion particularly Why is collusion particularly troublesome for auditors?troublesome for auditors?


Competent, untrustworthy, motivatedpersonnel oftenknow how to conceal theirfraud.

Why is collusion particularly Why is collusion particularly troublesome for auditors?troublesome for auditors?


1. Adequate segregation of duties2. Proper authorization of transactions and activities



1. Adequate segregation of duties2. Proper authorization of transactions and activities - general authorization - management establishes authorization policies


accountspayablepolicies &procedures

cashreceiptspolicies &procedures

personnelpolicies &procedures


1. Adequate segregation of duties2. Proper authorization of transactions and activities - specific authorization - management makes authorizations on a case-by- case basis. I’m the

president andI want to approve

every cashpayment!



1. Adequate segregation of duties2. Proper authorization of transactions and activities3. Adequate documents and records should provide reasonable assurance that all assets are properly controlled and all transactions are correctly recorded.



DocumentDocumentGuidelinesGuidelinesDocumentsshould be:prenumbered and accountedfor

PURCHASE ORDER 32494 Date: Vendor: 234 Reynolds Rd. Winnipeg, MB R2V 4E3 Purchasing agent: Quantity Description Price

WAIT FORESTU N I V E R S I T Y

total cost of order

Est. shipment date: Terms of sale (including discounts and freight costs): Carrier:

Internal Use Only: (routing instructions)1.PO made in purchasing 3. receiving notes ship2.Copies to vendor, receiv. 4. acctg. reconciles

M a n u f a c t u r i n g


DocumentDocumentGuidelinesGuidelinesDocumentsshould be:preparedduring or soon after therelated transaction



total cost of order



M a nu f a ct ur i n g


DocumentDocumentGuidelinesGuidelinesDocumentsshould be:understand-able andcorrectlydesigned(includingrouting andauthorization)



total cost of order





DocumentDocumentGuidelinesGuidelines

Documentsshould be:designedformultiplepurposes

bc



total cost of order




a


2. Proper authorization of transactions and activities3. Adequate documents and records4. Adequate safeguards over assets and records - physical: locking rooms, fenced areas, fireproof safes, safe deposit boxes, security guards; access; backup files and recovery



2. Proper authorization of transactions and activities3. Adequate documents and records4. Adequate safeguards over assets and records5. Independent, continuous checks on performance - those reviewing performance should be independent of those performing a task



5. Independent checks on performance


Segregation of duties is the leastexpensive method of performing

independent checks.


The accounting information andThe accounting information andcommunication system should becommunication system should be

designed to satisfy audit objectives.designed to satisfy audit objectives.


- existence - the system should ensure that recorded transactions exist - no fictitious transactions


designed to satisfy audit objectives:designed to satisfy audit objectives:


- existence- completeness - the system should ensure that all existing transactions are recorded




How do the How do the existenceexistence and and completenesscompletenessobjectives differ?objectives differ?



- existence- completeness



Existence con-cerns the existence offictitious data; i.e., overstatement.



Existence con-cerns the existence offictitious data; i.e., overstatement.

Completeness concerns omission of information; i.e., under-

statement.


- existence- completeness- accuracy - the system should ensure that recorded transactions are stated at the correct amounts




- existence- completeness- accuracy- classification - the system should ensure that transactions are properly classified, possibly through use of a chart of accounts.




- existence- completeness- accuracy- classification- timing - the system should ensure that transactions are recorded on the correct dates. Generally, transactions should be recorded during or shortly after their occurrence.




- existence- completeness- accuracy- classification- timing- posting and summarization -the system should ensure that transactions are included in the accounting records and accurately summarized.




Monitoring activitiesMonitoring activities deal with deal with ongoing or periodic assessmentongoing or periodic assessment

of internal control.of internal control.


Internal auditing departmentsInternal auditing departments frequently perform monitoring frequently perform monitoring

activities.activities.


accountingsystems

the controlenvironment

control procedures



ControlExamina-

tionOverview Obtain an understanding

of internal control.

HOW?HOW?


ControlExamina-

tionOverview

- review prior year’s working papers- interview prior year auditors- interview client personnel- study client policies and procedures- study client documents, records, information and communication system

Obtain an understandingof internal control.


ControlExamina-

tionOverview

How do auditors document their under-

standing of internalcontrol?


ControlExamina-

tionOverview

- narratives- flowcharts- internal control questionnaires




ControlExamina-

tionOverview

- narratives- flowcharts- internal control questionnaires

What is aninternal controlquestionnaire?




Internal Control QuestionnaireInternal Control Questionnaire

- a series of questions about internal controls and their application to groups of accounts and cycles



- a series of questions about internal controls and their application to groups of accounts and cycles- generally, a “no” answer indicates an internal control weakness



What are theadvantages provided by

an IC questionnaire?

- a series of questions about internal controls and their application to groups of accounts and cycles- generally, a “no” answer indicates an internal control weakness


What are theadvantages provided by



- can be designed to cover most aspects of internal control - is relatively applicable from one en- gagement to another- when complete, can be quickly re- viewed for weaknesses



What are thedisadvantages of using




- concentrates on pieces of internal control rather than the system as a whole- has questionable reliability; oral client responses should be supported by other evidence- may be too standardized for some clients, especially smaller clients

What are thedisadvantages of using



Arefinancial statements

auditable?

ControlExamina-

tionOverview



auditable?

ControlExamina-

tionOverview

When would theWhen would theanswer be answer be NONO??



auditable?

ControlExamina-

tionOverview

- management lacks integrity- significantly deficient accounting records or internal controls

When would theWhen would theanswer be answer be NONO??


ControlExamina-

tionOverview

Assess control risk, basedon understanding.


ControlExamina-

tionOverview

Assess the cost/benefit offurther enhancing under-

standing of internal control.


ControlExamina-

tionOverview

max. support low

Assesscontrol

risk.


ControlExamina-

tionOverview

- maximum: poor controls indicate a very risky situation or more efficient to do 100% substantive audit

max. support low

Assesscontrol

risk.


ControlExamina-

tionOverview

- maximum: poor controls indicate a very risky situation or not efficient- supportable: risk is at a level supported by understanding obtained

max. support low

Assesscontrol

risk.


ControlExamina-

tionOverview

- supportable: risk is at a level supported by understanding obtained- low: effective controls indicate a lower level of risk that could be supported

max. support low

Assesscontrol

risk.


ControlExamina-

tionOverview

Plan & perform tests of controls.


ControlExamina-

tionOverview

Decidewhether the initial

internal control assessmentwas appropriate.


ControlExamina-

tionOverview

Based on appropriatelevel of detection risk,

perform substantive tests.


When should weaknesses be When should weaknesses be reported to the clientreported to the client??


When should weaknesses be When should weaknesses be reported to the clientreported to the client??

When there are significantdeficiencies in the design oroperation of internal control.


GAAS requires the auditor to communicate(oral or written) with the

audit committeeregarding the significant

deficiencies.

Significant deficienciesin the design or operation of

internal control.