chp 11 & 12 - internal controls and control risk

internal control definition

policies and procedures designed to provide reasonable assurance that the company achieves its objectives in the following:

• reliability of financial reporting

• compliance with laws/regulations

• effectiveness/efficiency of operations

limitations of internal controls - causes

1. personnel errors - misunderstanding instructions, being careless or fatigued

2. managment override

3. collusion

4. cost-benefit tradeoff

management responsibility for internal controls

• for all companies: management must establish and maintain a system of internal controls

• for all public companies: management must,

  • acknowledge in SEC filings they are responsible for establishing and maintaining IC system for financial reporting (ICFR)

  • assess the effectiveness of the IC structures as of year end and certify this in filings

    • 1. Design & Implementation

    • 2. Operating Effectiveness

auditor responsibility for ICFR

for all clients: must understand IC system well enough to plan and perform the audit

• extent of understanding will vary

  • for non-public and small public clients, may only learn only enough to evaluate design & implementation

for large public clients: must audit ICFR and issue an audit opinion about the operating effectiveness of ICFR

• requires testing effectiveness of controls

• identify: deficiencies, significant deficiencies, material weaknesses

  • issue adverse opinion if there is even one material weakness

5 components of internal control (mgmt’s role)

• 1. control environment

  • sets the tone, influences control consciousness of its people

• 2. risk assessment

  • entity’s identification and analysis of relevance of risk to achievement of objectives, forms basis for determining how the risks should be managed

• 3. control activities

  • policies and procedures that help ensure management directives are carried out

• 4. information & communication

  • info. used both internally and externally for decision making is relevant and of high quality

• monitoring

  • process that assesses quality of IC performance over time

control environment (mgmt’s role)

• integrity and ethical values

• commitment to competence

• BOD or audit committee participation

• management’s philosophy and operating style

• organizational structure

• assignment of authority and responsibility

• human resources policies and practices

risk assessment (mgmt’s role)

management’s identification and analysis of risks relevant to the financial statements

do they have a mechanism in place for identifying sources/changes to risk from:

• changes in operating environment

• new personnel

• new/revamped info systems

• rapid growth

• new technology

• new business models

• corporate restructuring

• expanded foreign operations

• new accounting pronouncements

control activities (mgmt’s role)

• proper authorization of transactions

• physical controls over assets and records

• adequate documents and records

  • prenumbered

  • prepared timely

• segregation of duties:

  • asset custody from accounting

  • asset custody from authorization

  • operational responsibility from accounting

  • IT duties from user departments

• independent checks on performance

information and communication (mgmt’s role)

determine whether system:

• identifies and records all valid transactions

• describes transactions in sufficient detail to properly classify for timely financial reporting

• measures value of transactions to permit proper recording in F/S

• determines proper time period for recording

• properly presents transactions and disclosures in F/S

monitoring (mgmt’s role)

process of assessing quality of IC over time to determine:

• are controls operating as intended?

• are controls modified as appropriate as conditions change?

auditor’s process to evaluating ICFR

two distinct evaluations:

1. Design and Implementation of Controls

2. Operating Effectiveness of Controls

procedures to obtain and understanding of IC (auditor’s role)

main procedures:

• evaluate prior experience with client

• walkthrough

• inquiry

• read policies and manuals

• examine documents and records

• observe activities and operations

goal: understand management’s process so we can identify control activities and preliminary assess control risk

procedures for evaluating operating effectiveness (auditor’s role)

• Tests of Controls (TOC)

  • tests to determine whether key controls are operating effectively and as designed

• Main Procedures:

  • inquiry

  • examine documents, records, reports - inspection

  • observe control activities

  • re-perform control procedures

we must decide the extent of our procedures (auditor’s role)

1. Desired PDR

2. Desired Achieved CR

Consider:

• frequency of operation

• manual vs. automated

• reliance on evidence from prior year’s audit

• testing of controls related to significant risks

• testing less than the entire audit population

• outsourced controls & service centers

do exceptions discovered during TOCs indicate a f/s misstatement?

NO! but, an identified misstatement indicates a control deficiency exists

TOC chart

evaluating TOC

the severity of a deficiency does not depend on whether a misstatement actually has occurred but rather on whether there is a reasonable possibility that the company’s controls will fail to prevent or detect a misstatement

risk factors that affect the possibility that deficienc(ies) will result in a misstatment

• the nature of the F/S accounts, disclosures, and assertions involved

• the susceptibility of the related asset or liability to loss or fraud

• the subjectivity, complexity, or extent of judgment required to determine the amount involved

• the interaction or relationship of the control with other controls, including whether they are interdependent or redundant

• the interaction of the deficiencies

• the possible future consequences of the deficiency

material weakness

exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis

deficiency

an IC deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the entity’s F/S will not be prevented, or detected and corrected, on a timely basis

significant deficiency

an IC deficiency, or a combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by those charged with governance