Chapter 11 Internal Control and COSO Framework

A system of internal control consists of:

Policies and procedures designed to provide management with reasonable assurance that the company achieves its objectives and goals

Management typically has three broad objectives in designing an effective internal control system:

• Reliable financial statement reporting (Good F/S)

• Efficient and effective operation (Well run business)

• In compliance with laws and regulations (Legal responsibility)

MANAGEMENT, not the auditor, must

Establish and maintain the entity’s internal controls

Two key concepts underlie management’s design and implementation of internal control:

• Reasonable assurance: Controls can only give reasonable, NOT absolute assurance over an objective

• Inherent limitations: even when designed appropriately, controls

  • cannot prevent collusion

  • Are susceptible to management override

  • require competent and dependable individuals

Reasonable assurance:

Controls can only give reasonable, NOT absolute assurance over an objective

Inherent limitations:

even when designed appropriately, controls

• cannot prevent collusion

• Are susceptible to management override

• require competent and dependable individuals

SOX Section 404 →

Internal control report

Management of all Public companies are to issue an internal control report that includes the following:

• A statement that management is Responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting

• An Assessment of the effectiveness of the internal control structure and procedures for financial reporting as of the end of the company’s fiscal year

Management’s assessment of internal control over financial reporting consists of two key aspects:

Management must

• Evaluate the design of internal control over financial reporting

• test the operating effectiveness of those controls

Auditors are required to:

• Obtain an underatanding of internal control relevant to the audit on every audit engagement

• Report on the effectiveness of internal control overfinancial reporting, if the client is an accelerated filer (Public company)

Auditors are primarily concerned about:

• Controls over the Reliability of financial reporting

• Controls over classes of Transactions

Management Sets Internal Controls over

• Financial reporting → Auditor responsible for (Opinion)

• Operations→ how well managers run their business (CEO cares a lot, auditor not so much)→ can inpcat inherant risk

• Laws and regulations → Auditor responsible for (B/c law says)

Poor operational controls can

increase risk

COSO Components of Internal Control (framework for controls (COSO))(Is a cycle)

• Control environment

• Risk assessment

• Control activities

• Information and communication

• Monitoring

Control environment

Consists of the actions, policies, and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity

Risk assessment

Involves a process for identifying and analyzing risks that may prevent the organization from achieving its objectives

Control activities

Policies and procedures that help ensure that necessary actions are taken to address risks to the achievement of the entity’s objectives

Information and communication

• To initiate, record, process, and report the entity’s transactions and to maintain accountability for the related assets

• 
  

Monitoring

Deal with ongoing or periodic assessment of the quality of internal control by management to determine that controls are operating as intended and that they are modified as appropriate for changes in conditions

Management designs and implements and is responsible for the COSO framework of controls: 5 Components→ Auditor gives an assessment

1. Control environment:

2. Risk assessment

3. Control activities

4. Information and communication

5. Monitiring

Control environment:

• Tone at the top

• governance

• Attitude

Risk assessment

ID areas where things can go wrong/went wrong

• Walk through (go through the process, notice spots where it goes wrong/what areas have issues)

Control activities

Design a control or procedure to address the risk

• Separation of duties

• Review

Information and communication

Write this control up and communicate (share) with people, document the results

• Share and communicate

  • Narritive/flowchart

Monitiring

Ongoing assessment to make sure the control is working

• Continued monitoring

Technology can strengthen a company’s system of internal control but can also provide challenges

To address risks associated with reliance on technology, organizations often

implement specific IT controls

Auditing standards describe two categories of controls for I T systems:

• General controls: Everything (mandatory passwords, password changes)

• Application controls: Specific applications

*Auditors also assess

IT-related controls (Know that it exists)