Chapter 6 Auditing

Internal Control in a Financial Statement Audit

• Management is responsible for designing and maintaining a system of internal control that …

1. Provides reasonable assurance that assets and records are properly safeguarded, and

2. The entity’s information system generates reliable information

•Auditor is responsible for…

1. Obtaining an understanding of internal control, and

2. Assessing control risk (to design tests of controls and substantive testing)

Definition on Internal Control

• A process designed and carried out by an entity’s board of directors, management, and other personnel to provide reasonable assurance about the achievement of the entity’s objectives in the following categories:

1. Reliability, timeliness, and transparency of internal and external, nonfinancial and financial reporting

2. Effectiveness and efficiency of operations, including safeguarding assets,

3. Compliance with applicable laws and regulations (established by COSO’s Internal Control-Integrated Framework)

The COSO Framework

• Five Components: (CRIME)

– Control Environment

– Entity’s Risk Assessment

– Control Activities

– Information and Communication

– Monitoring Activities

Control Environment

• The control environment is the set of standards, processes,

and structures that provide the basis for carrying out internal

control across the organization.

• The board of directors and senior management establish the

tone at the top regarding the importance of internal control and

expected standards of conduct

Control Environment - Principles

• Principle 1: The organization demonstrates a commitment to integrity and ethical values.

• Principle 2: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

• Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

• Principle 4: The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

• Principle 5: The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

Examples of Control Environment

• Think of it as “tone at the top”

• Elements of the control environment include:

– Corporate governance, the Board of Directors, and Audit Committee

– Organization-wide commitment to integrity and ethics

– Management operating style

– Organizational structure

– Commitment to financial reporting competencies

– Authority and responsibility

– Human resource policies

Risk Assessment

• Risk assessment involves a dynamic and iterative process

for identifying and analyzing risks to achieving the entity’s

objectives, thereby forming a basis for determining how

risks should be managed.

• Management considers possible changes in the external

environment and within its own business model that may

impede its ability to achieve its objectives.

Risk Assessment- Principles (Part 2)

• Principle 6: The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

• Principle 7: The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

• Principle 8: The organization considers the potential for fraud in assessing risks to the achievement of objectives.

• Principle 9: The organization identifies and assesses changes that could significantly impact the system of internal control.

Examples of Risk Assessment

• The client’s business risks can arise or change due to the following circumstances:

– Changes in the operating environment

– Corporate restructuring

– Expanded international growth

– New personnel

– New technology

– Rapid growth

– New accounting pronouncement

– New information systems

– New business models, products, or activities

Control Activities

• Control activities are the actions established by ___Management___ to

help ensure that management directives to mitigate risks to the achievement

of objectives are carried out. Control activities are performed at all levels of

the entity and at various stages within business processes, and over the technology environment.

Control Activities- Principles

• Principle 10: The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

- Performance Reviews

- Physical Controls

- Segregation of Duties (_Authorization _, _Recording_, __Custody_)

- Information Processing Controls

• Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives.

• Principle 12: The organization deploys control activities through policies that establish what is expected and procedures that put policies into action

More on Control Activities

• Control activities are policies and procedures implemented across the organization to reduce the risk of financial reporting misstatements

• Control activities involve the design and operations of controls

• Organizations use preventative and detective controls

• Examples of control activities:

– Segregation of duties

– Approval and co-signing requirements

– Documentation trails and pre-numbered sequence controls

– Restricted physical access

– Reconciliations

– Computerized controls for accounting information systems (e.g., data validation controls)

Information and Communication

• Information is necessary for the entity to carry out internal control responsibilities in support of achievement of its objectives.

• Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day internal control activities.

• Communication enables personnel to understand internal control responsibilities and their importance to the achievement of objectives.

Information and Communication- Principles

• Principle 13: The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.

- Identify and record all valid transactions

- Classify transactions properly

- Measure the value of transactions properly

- Record transactions in the proper period

- Properly present transactions and disclosures

• Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

• Principle 15: The organization communicates with external parties regarding matters affecting the functioning of internal control.

Monitoring Activities

• Ongoing evaluations, separate evaluations, or some combination of the two are used to ascertain whether each of the five components of internal control, including controls to effect the principles within each component, are present and functioning.

• Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board.

Monitoring Activities - Principles

• Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

• Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

Examples of Monitoring

• Detection procedures to ensure proper functioning and prompt reporting / remediation of control violations

• Think of it as “_Trust, but verify__”

• Examples include:

– Employee hotlines to facilitate whistleblowing

– An effective internal audit function

– Checks and reconciliations

Auditor’s Consideration of Internal Control

• Develop an understanding of internal control

▪ Evaluate the design of controls ▪ Determine if controls have been implemented

• Document understanding

• Determine whether you intend to rely on the controls

▪ _NO__ → Substantive strategy ▪ set control risk at the maximum, and only perform substantive testing

▪ _YES__ → Reliance strategy

▪ Set control risk at less than maximum, plan and perform tests of controls, and then perform substantive testing

▪ Perform substantive procedures based on the level of control risk

How to Determine When to Rely on Controls?

Consider a substantive strategy when one or all of the following exist:

– Controls do not pertain to an assertion

– Controls are assessed as ineffective (design or operation)

– Testing of the effectiveness of controls is inefficient

Reliance Strategy

• Using a reliance strategy means the auditor intends to rely on entity’s controls

– Obtain an understanding of internal control

– Plan and perform tests of controls

• If test results indicate that achieved control risk is higher than planned → increase the planned substantive procedures and document the revised control risk assessment

• If test results support the planned level of control risk, no revisions of the planned substantive procedures are required

Obtaining an Understanding of Internal Control

• Understanding of IC is used to:

– Identify types of potential misstatements

– Pinpoint the factors that affect the RMM

– Design tests of controls and substantive procedures

• When obtaining an understanding, consider complexity and sophistication of operations and systems including IT systems

• Use the following procedures to obtain an understanding of IC:

– Inquiries of management and entity personnel

– Inspection of entity documents and reports

– Observation of entity activities and operations

• Document your understanding of IC

Limitations of an Entity’s Internal Control

• Management override of internal control

• Human errors or mistakes

• Collusion

• Cost prohibitive (especially for smaller entities)

Assessing Control Risk

When using a reliance strategy, set control risk at a lower level (at moderate or low)

– Identify specific controls that will be relied upon

– Perform tests of controls

• Test design and operating effectiveness of controls

– Conclude on the achieved level of control risk