Chapter 11 Internal Control and COSO Framework

Internal Control Objectives (1 of 2)

A system of internal control consists of:
- Policies and procedures designed to provide management with reasonable assurance that the company achieves its objectives and goals
Management typically has three broad objectives in designing an effective internal control system:
- Reliable financial statement reporting (Good F/S)
- Efficient and effective operation (Well run business)
- In compliance with laws and regulations (Legal responsibility)

Management and Auditor Responsibilities for Internal Control

MANAGEMENT, not the auditor, must Establish and maintain the entity’s internal controls
Two key concepts underlie management’s design and implementation of internal control:
- Reasonable assurance: Controls can only give reasonable, NOT absolute assurance over an objective
- Inherent limitations: even when designed appropriately, controls
  - cannot prevent collusion
  - Are susceptible to management override
  - require competent and dependable individuals

Management’s Section 404 Reporting Responsibilities (1 of 2)
SOX Section 404 → Internal control report

Management of all Public companies are to issue an internal control report that includes the following:
- A statement that management is Responsible for establishing and maintaining an adequate internal control structure and procedures for financial reporting
- An Assessment of the effectiveness of the internal control structure and procedures for financial reporting as of the end of the company’s fiscal year
Management’s assessment of internal control over financial reporting consists of two key aspects:
- Management must
  - Evaluate the design of internal control over financial reporting
  - test the operating effectiveness of those controls

Auditor Responsibilities for Understanding Internal Control

Auditors are required to:
- Obtain an underatanding of internal control relevant to the audit on every audit engagement
- Report on the effectiveness of internal control overfinancial reporting, if the client is an accelerated filer (Public company)
Auditors are primarily concerned about:
- Controls over the Reliability of financial reporting
- Controls over classes of Transactions

Management Sets Internal Controls over

Financial reporting → Auditor responsible for (Opinion)
Operations→ how well managers run their business (CEO cares a lot, auditor not so much)→ can inpcat inherant risk
Laws and regulations → Auditor responsible for (B/c law says)

Public

Transactions
Journal entries
Financial reporting internal controls (required by SOX 404)(Management puts them in place)
- Understanding of the existence of controls?
- Test and issue an opinion (Internal control opinion) over financial reporting (404) controls (those related to generation of the Financial statements)

Private

Transactions
Journal entries
Financial reporting internal controls (Optional)
- Understand the existence of controls
  - Assess control risk
    - → No controls: Max risk level
- *Optional to reduce test control (reduce control risk)

Poor operational controls can increase risk

Figure 11.1
Example Section 404 Management Report on Internal Control over Financial Reporting
The management of Marble Corporation is responsible for establishing and maintaining adequate internal control over financial reporting. Marble’s internal control system was designed to provide reasonable assurance to the company’s management and board of directors regarding the preparation and fair presentation of published financial statements. Marble management assessed the effectiveness of the company’s internal control over financial reporting as of December 31, 2023. In making this assessment, it used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in Internal Control—Integrated Framework (2013). Based on our assessment, we believe that, as of December 31, 2 023, the company’s internal control over financial reporting is effective based on those criteria. Marble’s independent auditors have issued an audit report on our assessment of the company’s internal control over financial reporting. This report appears on the following page.
February 15, 2024
Fred Narsky, President Karen Wilson, Chief Financial Officer

Let’s Discuss (1 of 6)

Describe the three broad objectives management has when designing effective internal control.
Section 404(a) of the Sarbanes–Oxley Act requires management to issue a report on internal control over financial reporting.
- Identify the specific Section 404(a) reporting requirements for management.

Let’s Discuss (2 of 6)

What two aspects of internal control must the auditor assess when performing procedures to obtain an understanding of internal control?
What two aspects of internal control must the auditor assess when performing procedures to obtain an understanding of internal control?

COSO Components of Internal Control (framework for controls (COSO))(Is a cycle)

Control environment
- Consists of the actions, policies, and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity
Risk assessment
- Involves a process for identifying and analyzing risks that may prevent the organization from achieving its objectives
Control activities
- Policies and procedures that help ensure that necessary actions are taken to address risks to the achievement of the entity’s objectives
Information and communication
- To initiate, record, process, and report the entity’s transactions and to maintain accountability for the related assets
Monitoring
- Deal with ongoing or periodic assessment of the quality of internal control by management to determine that controls are operating as intended and that they are modified as appropriate for changes in conditions

Figure 11.3
Five Components of Internal Control
Over:

Operations
Financial reporting
Compliance with laws

Management designs and implements and is responsible for the COSO framework of controls: 5 Components→ Auditor gives an assessment

Control environment:
- Tone at the top
- governance
- Attitude
Risk assessment
- ID areas where things can go wrong/went wrong
  - Walk through (go through the process, notice spots where it goes wrong/what areas have issues)
Control activities
- Design a control or procedure to address the risk
  - Separation of duties
  - Review
Information and communication
- Write this control up and communicate (share) with people, document the results
  - Share and communicate
    - Narritive/flowchart
Monitiring
- Ongoing assessment to make sure the control is working
  - Continued monitiring

Let’s Discuss (3 of 6)

What are the five components of internal control in the COS O internal control framework?
- What is the relationship among these five components?
How do the COSO principles help an organization assess whether internal controls are designed and operating effectively?

Let’s Discuss (4 of 6)

Frank James, a highly competent employee of Brinkwater Sales Corporation, had been responsible for accounting-related matters for two decades. His devotion to the firm
and his duties had always been exceptional, and over the years, he had been given increased responsibility. Both the president of Brinkwater and the partner of an
independent CPA firm in charge of the audit were shocked and dismayed to discover that James had embezzled more than $500,000 over a 10-year period by
not recording billings in the sales journal and subsequently diverting the cash receipts.
- What major factors permitted the embezzlement to take place?

Internal Controls Specific to Information Technology

Technology can strengthen a company’s system of internal control but can also provide challenges
- To address risks associated with reliance on technology, organizations often implement specific IT controls
Auditing standards describe two categories of controls for I T systems:
- General controls: Everything (mandatory passwords, password changes)
- Application controls: Specific applications
*Auditors also assess IT-related controls (Know that it exists)