Chapter 7 Auditing Day 1

Background on audits of ICFR

• Major accounting scandals occurred in the late 1990s and early 2000s

• Enron and Worldcom in late 2001 and early 2002 are the last straw for regulators

• Demand for strong internal controls over the financial reporting to prevent fraud and errors

• Demand for disclosures about the quality (or weaknesses) of internal controls over financial reporting

Background on audits of ICFR (Part 2)

• Congress passed Sarbanes-Oxley (SOX) Act of 2002 related to publicly-traded companies

– Management required to report on the effectiveness of its ICFR

• Section 302 requires quarterly certifications

• Section 404(a) requires annual report

– External audit required on the effectiveness of ICFR

• Section 404(b) requires an audit based on PCAOB standards, Audit Standard No. 5 (AS5)

AS5 guidance:

– Integrated audits of ICFR and financial statements

– Top-down, risk-based approach to evaluating ICFR

• Dodd-Frank Act of 2010 exempts smaller public companies, “non-accelerated filers,” (common equity of < $75 million)

Management Responsibilities under Section 404

• Management’s report includes:

1. Their responsibility for establishing and maintaining adequate ICFR,

2. Their assertion on the effectiveness of ICFR as of the end of the fiscal year (“as of” assertion)

– If control deficiencies during the year are remediated prior to year-end, can still issue an unqualified “clean” report

• Management must comply with the following requirements in order for the external auditor to complete an audit of ICFR:

– Accept responsibility for the effectiveness of the entity’s ICFR

– Evaluate the effectiveness of the entity’s ICFR using suitable control criteria

– Support the evaluation with sufficient evidence, including documentation

– Present a written assessment regarding the effectiveness of ICFR at year-end

Auditor Responsibilities under Section 404

• Audit management’s assertion about the effectiveness of ICFR

– Objective of audit is “to express an opinion on the effectiveness of the company’s ICFR”

– Plan and perform the audit to obtain reasonable assurance about whether the entity maintained, in all material respects, effective internal control as of the date in management’s assertion (i.e., as of year-end)

ICFR Definitions

• ICFR per AS5 – “A process designed by, or under the supervision of, the company’s principal executive and principal financial officers, or persons performing similar functions,

• and effected by the company’s board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting

• and the preparation of financial statements for external purposes in accordance with GAAP, and includes those policies and procedures that…”

ICFR Definitions (Part 2)

• ICFR per AS5 – “… and includes those policies and procedures that

1. Pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company;

2. Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and

3. Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements

Internal Control Deficiencies Defined

• Control Deficiency

– Exists when the _ Design/Operation __ of a control does not allow management or employees, in the normal course of performing their assigned functions, to __to prevent or detect misstatements __on a timely basis.

Design deficiency exists when:

(1) a control is missing, or

(2) an existing control is not properly designed to meeting the objective

• Operating deficiency exists when a properly designed control does not operate as designed

Internal Control Deficiencies Defined (Part 2)

• _Significant Deficiency _ – A control deficiency, or a combination of control deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.

• __Material Weakness__ – A deficiency, or a combination of deficiencies, in ICFR, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis

Management’s Assessment Process

Management must follow a top-down, risk-based approach:

1. Identify financial reporting risk and controls

• Risk = risk of a material misstatement to f/s

• ID controls that address f.r. risks including entity-level controls and pervasive elements of ICFR (see next slide for examples)

2. Consider which locations and business units to include in the evaluation

3. Evaluate evidence about the operating effectiveness of ICFR • Evidence = test controls, ongoing monitoring, or both

Management’s Assessment Process

• Management issues a report on ICFR (see example on next slide)

– If no material weaknesses as of year-end, conclude ICFR is effective

• If a material weakness (MW), must disclose the following:

– Nature of MW

– MW’s impact on financial reporting and its ICFR

– Management’s plans for remediating the MW

Integrated Audits of ICFR and Financial Statements

• An integrated audit is composed of the audits of internal control and the financial statements.

• The control testing impacts the planned substantive procedures. Also, the results of the substantive procedures are considered in the evaluation of internal control.

Planning the Audit of ICFR

• Risk assessment - Assess the risk of MW including risk of fraud and risk of management override of controls.

Consider:

– Controls over significant, unusual transactions, particularly those that result in late or unusual journal entries

– Controls over journal entries and adjustments made in the period-end

– Controls over related party transactions

– Controls related to significant management estimates

– Controls that mitigate incentives for, and pressures on, management to falsify or manage financial results

• Scaling the audit (based on size and complexity)

• Using the work of others (assess objectivity and competence first)

Entity- Level Controls

1. Control Environment

– Management’s philosophy and operating style promote effective ICFR

– Sound integrity and ethical values are developed and understood

– Board or audit committee understands and exercises oversight responsibility over FR and IC

2. Period-end Financial Reporting Process

– Understand, test, and evaluate the entire process including inputs, procedures performed, outputs of the processes to produce f/s

– Consider IT involvement, who participates from mgt, number of locations involved, types of adjusting entries, nature of oversight, etc.

Identify Significant Accounts and Disclosures

• Identify significant accounts and disclosures that have a reasonable possibility of containing a material misstatement, based on risk

– Size and composition of the account

– Susceptibility to misstatement due to errors or fraud

– Volume of activity, complexity, and homogeneity of the individual transactions processed through the account or reflected in the disclosure

– Nature of the account or disclosure

– Accounting and reporting complexities associated with the account or disclosure – Exposure to losses in the account

– Possibility of significant contingent liabilities arising from the activities reflected in the account or disclosure

– Existence of related party transactions in the account

– Changes from the prior period in account or disclosure characteristics

Understanding Likely Sources of Misstatements

• Understand likely sources of potential material misstatements to f/s:

– Understand the flow of transactions related to the relevant assertions

– Identify the points within the entity’s processes at which a misstatement could arise that would be material

– Identify the controls that management has implemented to address these potential misstatements

– Identify the controls that management has implemented over the prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could result in a material misstatement of the financial statements