Chapter 11 - Internal Controls & COSO

What is Internal Control?

Policies and procedures designed to provide reasonable assurance that the company achieves its objectives in financial reporting reliability, compliance with laws/regulations, and operational efficiency.

What are the 3 primary management objectives of an effective internal control system?

1. Reliability of financial reporting (primary focus of financial statement auditors) ; 2. Efficiency and effectiveness of operations ; 3. Compliance with laws and regulations.

What are the 4 inherent limitations of internal control?

1. Personnel errors / human mistakes (fatigue, carelessness, misunderstanding) ; 2. Management override (authority to bypass controls for personal gain) ; 3. Collusion (two or more employees working together) ; 4. Cost-benefit tradeoff.

What are management's responsibilities for internal control under SOX Section 404a?

Management of public companies must: 1. Acknowledge responsibility for establishing and maintaining internal control over financial reporting (ICFR) in SEC filings ; 2. Evaluate the effectiveness of ICFR as of year-end ; 3. Identify the evaluation framework used (e.g. COSO 2013).

What are the auditor's responsibilities for internal control for ALL clients vs. LARGE PUBLIC clients (SOX 404b)?

All clients: Understand internal control design & implementation well enough to plan the audit. Large public clients (accelerated filers): Audit ICFR and issue an official audit opinion on the operating effectiveness of ICFR.

What is the COSO 2013 Internal Control Integrated Framework?

The most widely accepted internal control framework in the U.S., consisting of 3 objectives, 5 components (C-R-I-M-E), and 17 underlying principles.

What are the 5 components of the COSO Internal Control Framework (C-R-I-M-E)?

1. Control Environment ; 2. Risk Assessment ; 3. Information & Communication ; 4. Monitoring Activities ; 5. Existing Control Activities (Control Activities).

What is the Control Environment in COSO, and why is it called the 'umbrella'?

Actions, policies, and procedures reflecting the overall attitude of top management and directors ('tone at the top') regarding internal control. It serves as the umbrella for the other 4 components; without a strong control environment, other controls will fail.

What are the 5 principles underlying the Control Environment?

1. Commitment to integrity and ethical values ; 2. Independent Board of Directors / Audit Committee oversight ; 3. Organizational structure and lines of authority ; 4. Commitment to attracting and retaining competent personnel ; 5. Holding individuals accountable.

What is Risk Assessment in COSO?

Management's process for identifying and analyzing risks relevant to the preparation of financial statements in conformity with GAAP, forming the basis for determining how risks should be managed.

What are the 5 types of specific Control Activities in COSO?

1. Adequate separation of duties ; 2. Proper authorization of transactions and activities ; 3. Adequate documents and records ; 4. Physical control over assets and records ; 5. Independent checks on performance.

What are the 4 general guidelines for adequate Separation of Duties?

1. Separate custody of assets from accounting/recordkeeping ; 2. Separate authorization of transactions from custody of related assets ; 3. Separate operational responsibility from recordkeeping ; 4. Separate IT duties from user departments.

What is the difference between General Authorization and Specific Authorization?

General authorization applies to general classes of transactions (e.g. issuing fixed price lists, credit limits). Specific authorization applies to individual transactions (e.g. manager approval for used car sale or large capital purchase).

What principles dictate proper design and use of Documents and Records?

Documents should be prenumbered consecutively (completeness assertion), prepared at the time of transaction (timing/cutoff), designed for multiple uses when possible, and simple/understandable.

What are Physical Controls over assets and records?

Safeguards restricting unauthorized physical or online access to computer equipment, cash, inventory, and data files (e.g. keypad locks, fireproof safes, retina scanners, user IDs/passwords, firewalls).

What are Independent Checks on Performance?

Careful and continuous review of other controls by personnel independent of those who prepared the data (e.g. monthly bank reconciliations performed by a clerk independent of cash handling).

What is Information & Communication in COSO?

The accounting system's methods to initiate, record, process, and report transactions and maintain accountability for assets, satisfying all management assertions.

What is Monitoring in COSO?

Ongoing or periodic assessments by management to evaluate whether internal controls are operating as intended and modified as conditions change (e.g. internal audit department function).

What are IT General Controls versus IT Application Controls?

General controls apply to all IT functions across the firm (Access Management, System Change Management, IT Operations). Application controls apply to specific computerized accounting applications (Input, Processing, Output controls).

Give examples of IT General Controls for Access, System Change, and Operations.

Access: User IDs, passwords, 2-factor authentication, firewalls. System Change: Required testing/approval for software updates (pilot/parallel testing). Operations: Backup and disaster recovery plans.

Give examples of IT Application Controls for Input, Processing, and Output.

Input: Preformatted input screens, validity/format tests. Processing: Reasonableness checks on selling prices. Output: Sales department post-processing review.

What is a Control Deficiency?

A condition where a control is missing, poorly designed, not implemented, or not operating properly (e.g., skipped bank reconciliation review).

What is a Significant Deficiency in internal control?

An internal control deficiency, or combination of deficiencies, that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

What is a Material Weakness in internal control?

A deficiency or combination of deficiencies in ICFR such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis.

What reporting is required if a public company has even ONE Material Weakness at year-end?

Management must conclude that internal control over financial reporting is INEFFECTIVE, and the auditor must issue an ADVERSE opinion on ICFR.

[Practice Scenario 1] A cashier receives cash payments from customers and records cash receipts in the general ledger. Which separation of duties guideline is violated?

Separation of Asset Custody from Accounting/Recordkeeping (allows cashier to pocket cash and cover it up by adjusting accounts).

[Practice Scenario 2] A purchasing manager approves purchase orders and also signs the disbursement checks to vendors. Which separation of duties guideline is violated?

Separation of Authorization of Transactions from Custody of Related Assets.

[Practice Scenario 3] A programmer modifies live sales software code and puts it directly into production without user testing. Which IT general control is violated?

System Change Management (programming and deployment duties must be segregated; changes require user approval and testing).

[Practice Scenario 4] An accounts payable supervisor compares vendor reconciliations prepared by AP clerks every Monday. Which COSO component is represented?

Control Activities (specifically, Independent Checks on Performance).

In COSO, what is the 'Tone at the Top' and which component does it drive?

Tone at the Top refers to management's ethical attitude, integrity, and leadership commitment, which drives the Control Environment.