Auditing & Assurance Services - Chapter 5: Risk Assessment: Internal Control Evaluation

Vocabulary practice flashcards covering internal control definitions, COSO framework components, SOX 404 integrated audits, control deficiencies, and audit reporting.

Internal Control

A process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives across three categories: reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.

Committee of Sponsoring Organizations of the National Commission of Fraudalnt Financial Reporting Treadway Commission (COSO)

A joint initiative comprising representatives from the FEI, AAA, IIA, IMA, and AICPA established to improve financial reporting; it developed an integrated internal control framework consisting of $5$ components and $17$ principles.

Management's Responsibility for Internal Control

The requirement that management establish and maintain adequate internal control over financial reporting (ICFR), as well as assess and formally report on the effectiveness of ICFR.

Auditors' Responsibility for Internal Control

The requirement to assess control risk to determine the nature, timing, and extent of substantive testing, evaluate controls mitigating fraud risks, and, for public companies with a public float greater than $\text{\$}75\text{ million}$, audit and issue an opinion on the effectiveness of internal control over financial reporting.

Control Environment

The foundational COSO component that sets the entity's 'tone at the top' through integrity, ethical values, board oversight independent of management, organizational structure, competence, and individual accountability for internal control.

Audit Committee

A subcommittee of the board of directors composed of $3$ to $6$ independent 'outside' members who provide a buffer between the audit team and management, oversee financial reporting and internal audit, hire external auditors, and supervise the anonymous fraud hotline.

Risk Assessment (COSO Component)

Management's process of identifying and analyzing relevant risks that could prevent the achievement of its objectives—specifically focusing on financial reporting objectives and fraud risks.

Control Activities

Policies and procedures established to help ensure management directives are carried out, including performance reviews, segregation of duties, physical controls over assets and records, and information processing approvals.

Preventive Controls

Control activities aimed at stopping misstatements and errors before they occur, such as segregation of duties and restricted access to assets or accounting records.

Detective Controls

Control activities designed to identify and uncover misstatements or errors after they have taken place, such as bank reconciliations, supervisory reviews, and periodic physical inventory counts.

Separation of Duties

An internal control activity that divides responsibilities among different individuals for authorization of transactions, custody of assets, record keeping, and reconciliation to prevent errors and single-person concealment of fraud.

Information and Communication (COSO Component)

The component of internal control concerning the identification, capture, and exchange of relevant, high-quality information in a timely manner that enables personnel to understand and fulfill their control responsibilities.

Audit Trail

The chronological, traceable chain of activities produced by an information system that connects initial transaction data identification directly to the final financial statements.

Monitoring (COSO Component)

The process of assessing the design and operating quality of internal control performance over time through ongoing supervisory activities, separate evaluations by internal audit, and whistleblower programs.

Dodd-Frank Act Section 922

A federal provision requiring the SEC to pay monetary whistleblower awards ranging between $10\%$ and $30\%$ of collected sanctions to individuals voluntarily providing original information that leads to a successful enforcement action yielding sanctions over $\text{\$}1\text{ million}$.

Reasonable Assurance

The internal control concept recognizing that the cost of implementing and maintaining an entity's internal control should not exceed the expected benefits derived from it.

Entity-Level Controls

Controls that pertain to the overall entity's internal control environment and the financial statements taken as a whole, such as tone at the top, controls against management override, and centralized IT security policies.

Transaction-Level Controls

Controls applied to specific processes, transaction cycles, or account balances—such as controls over cash collections, accounts payable approvals, and inventory counts.

Walkthrough

An audit procedure in which an auditor traces a single transaction from origination through company information systems and processes until it is posted in financial records to understand internal control design.

Design Effectiveness

An evaluation of whether an internal control—if operated by persons with requisite authority and competence as designed—would successfully prevent or detect material misstatements on a timely basis.

Operating Effectiveness

An evaluation of whether a control is functioning as designed in actual practice, tested through inquiry, observation, document inspection, and re-performance.

Integrated Audit

An audit engagement mandated by SOX Section $404$ and PCAOB AS $2201$ for accelerated filers where the auditor tests and issues opinions simultaneously on both the fairness of the financial statements and the effectiveness of internal control over financial reporting.

Top-Down Approach

A risk-based approach required by PCAOB standards for auditing internal control that begins at the financial statement and entity-level control layer and works downward toward significant accounts, disclosures, and relevant assertions.

SOC 1 Type 1 Report

A service auditor's report covering the service organization's description of its internal control system and the suitability of the design of those controls as of a specific date, without testing operating effectiveness.

SOC 1 Type 2 Report

A service auditor's report providing assurance on the description, suitability of design, and operating effectiveness of internal controls at a service organization over a specified period.

Design Deficiency

An internal control deficiency occurring when a necessary control is missing or an existing control is so poorly structured that it fails to meet the control objective even when functioning as designed.

Operating Deficiency

An internal control deficiency occurring when a properly designed control is ignored, incorrectly executed, or operated by poorly trained personnel.

Material Weakness

A deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

Significant Deficiency

A deficiency, or combination of deficiencies, in internal control that is less severe than a material weakness yet important enough to merit attention by those charged with governance.

Unqualified Opinion on ICFR

The auditor's report stating that the entity maintained, in all material respects, effective internal control over financial reporting based on specified criteria, issued when no material weaknesses were found.

Adverse Opinion on ICFR

The auditor's report stating that an entity has not maintained effective internal control over financial reporting, issued whenever one or more material weaknesses exist as of fiscal year-end.

Disclaimer of Opinion on ICFR

An auditor's report issued when there is a significant scope limitation preventing the audit team from performing all necessary procedures to evaluate the effectiveness of internal control.