Chapter 9 Internal Controls and Control 9 1

Chapter 9: Internal Controls and Control 9 -1 Risk Copyright © 2007 Pearson Education Canada

Chapter 9 objectives w Explain why the study of internal control is important w List the four components of internal control w Discuss the relationship between the control environment and application controls w Examine how control risk is assessed w Describe the process used to understand, document and test internal controls w Identify internal control reports 2 Copyright © 2007 Pearson Education Canada

What is Internal Control? w A process designed and effected by management (or board or employees) in providing reasonable assurance about the achievement of the entity’s objectives (reliable reporting, effectiveness and efficiency, compliance with laws) w See CICA Handbook 5141. 042 3 Copyright © 2007 Pearson Education Canada

GAAS and Internal Controls w Why is it mandatory for the auditor to understand the internal control system? w How likely is it that there are NO internal controls at all? 4 Copyright © 2007 Pearson Education Canada

Management responsibilities with respect to internal control w w w Should be cost-effective Provide reliable accounting and operating data Safeguard assets and records Promote operational efficiency Prevent and detect error, fraud or illegal acts Ensure compliance with laws and regulations 5 Copyright © 2007 Pearson Education Canada

Auditor responsibilities with respect to internal control w Exercise professional skepticism w Document and evaluate internal controls of financial systems w Test controls if reliance intended w Communicate weaknesses that could cause material errors 6 Copyright © 2007 Pearson Education Canada

Concepts when studying internal control w Remember, it is management’s responsibility to establish and maintain internal controls: the auditor evaluates and may test these controls w The auditor can provide reasonable, but not absolute assurance w Internal controls have inherent limitations 7 Copyright © 2007 Pearson Education Canada

Inherent limitations of internal controls w No such thing as 100% internal controls w Effectiveness depends upon the competency and dependability of individuals (or systems) executing the controls w Most internal controls can be overridden using collusion 8 Copyright © 2007 Pearson Education Canada

Four components of internal control 9 Copyright © 2007 Pearson Education Canada

The control environment w Actions, policies and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about controls w The essence of an effectively controlled organization lies in the attitude of its management w Control environment (CE) factors are assessed as part of the knowledge of business and are used to develop a client risk profile 10 Copyright © 2007 Pearson Education Canada

CE factor: management philosophy and operating style w Management should operate ethically and honestly w Like behaviour should be encouraged among employees, perhaps by means of documented policies such as a code of ethics w Service policies could include a commitment to quality and competence 11 Copyright © 2007 Pearson Education Canada

CE factor: board of directors and audit committee w Board should include independent directors w Audit committee should have competence in financial reporting assessment w Board members should participate actively, meet with internal and external auditors 12 Copyright © 2007 Pearson Education Canada

CE factor: organizational structure w A structure that is appropriate for planning, directing and controlling operations w Authority and responsibility assignments clear w Information systems steering committee to oversee systems development and management of information systems 13 Copyright © 2007 Pearson Education Canada

CE factor: methods of assigning authority and responsibility w Take into account reporting relationships and responsibilities within organizational culture w Organizational goals, ethical and social issues considered w Development and implementation of policies such as job descriptions and codes of conduct 14 Copyright © 2007 Pearson Education Canada

CE factor: management control methods w Methods used to implement objectives and policies (many possible examples) w Logical access controls and monitoring for data communications w Monitoring activities of employees w Implementing of effective budgeting systems with follow up of differences 15 Copyright © 2007 Pearson Education Canada

CE factor: systems development methodology w Policies and procedures for selecting, development/purchase and maintenance of information systems w Formal methodologies for customized systems w Implementation of systems consistent with organizational objectives 16 Copyright © 2007 Pearson Education Canada

CE factor: management reaction to external influences w Monitoring of the external environment, including changes in laws w Ability to respond to changes in the external environment, including changes in business procedures or organizational structures 17 Copyright © 2007 Pearson Education Canada

CE factor: human resource policies and practices w Hiring practices to ensure competent and trustworthy employees w Evaluation and compensation processes to help motivate employees to continued competence and honesty 18 Copyright © 2007 Pearson Education Canada

Role of internal audit w To help ensure independence, internal audit should report to the audit committee of the board of directors w Can be part of control environment when effective, competent, independent and well -trained w Can contribute to reduced external audit costs 19 Copyright © 2007 Pearson Education Canada

Risk assessment w Involves managements identification and analysis of risks relevant to the preparation of financial statements in conformity with GAAP w Management needs to: identify risks, estimate significance, assess likelihood of occurrence, develop action plans to reduce the risk to an acceptable level 20 Copyright © 2007 Pearson Education Canada

Control systems include: w General controls: control systems that affect multiple classes of transactions (also called application systems) w Application (or accounting system) controls: can be manual, computer-assisted, or fully automated 21 Copyright © 2007 Pearson Education Canada

Impact of inadequate general controls w Organization and management: Cannot rely on automated or combined controls w Systems acquisition, development and maintenance: Cannot rely upon automated or combined controls w Operations and information systems support: May result in going concern issues 22 Copyright © 2007 Pearson Education Canada

Accounting (application) system control procedures w Appropriate segregation of duties w Proper authorization of transactions and activities w Adequate documents and records w Adequate safeguards over access to and use of assets and records w Independent verification of performance and the accuracy of recorded amounts 23 Copyright © 2007 Pearson Education Canada

Monitoring w Deals with ongoing or periodic assessment of the quality of internal control performance by management w Internal audit department may provide independent evaluation of the quality of the monitoring process 24 Copyright © 2007 Pearson Education Canada

Internal control audit process: 1. Obtain understanding w Obtain understanding of design and operation w Methods used to understand document this process: – Flow charts – Narrative – Internal control questionnaire 25 Copyright © 2007 Pearson Education Canada

Knowing the difference between a strength and a weakness w Question 9 -17, p. 278 w Identifying the absent control when an error or fraud occurred w Which audit objective(s) were not met? w Also be able to identify: Controls to help prevent the problem from occurring 26 Copyright © 2007 Pearson Education Canada

Internal control audit process: 2. Assess control risk w Using the audit risk model w Control risk is assessed at one of the following levels: – Maximum (100%) – no reliance, only substantive testing is completed – High – Moderate – Low w Decide whether controls will be tested or not (it may be more efficient to only go substantive) 27 Copyright © 2007 Pearson Education Canada

Internal control audit process: 3. Test controls if reliance is intended w Procedures completed to ensure that key controls have been operating: – – Inquiry Inspection Observation Reperformance w Procedures must be linked to audit objectives 28 Copyright © 2007 Pearson Education Canada

Where controls are functioning: w Identify the errors that are less likely to occur w Link to the related substantive test w Perform less or limited or no substantive procedures in this area w More analytical procedures can be used 29 Copyright © 2007 Pearson Education Canada

Identify the potential impact of weaknesses w If a control is not functioning, or does not exist, this is a WEAKNESS: – Need to identify potential monetary error (is the impact MATERIAL? ) – Do expanded substantive tests, if necessary – Analytical procedures – No internal controls testing in this area 30 Copyright © 2007 Pearson Education Canada

Internal control audit process: 4. Decide PDR and substantive tests w After control testing you are better able to assess planned detection risk (PDR or just DR) w Then substantive tests are designed for each audit objective based on the PDR for that cycle or objective 31 Copyright © 2007 Pearson Education Canada

Internal control audit process: 5. Report potentially material weaknesses w Specific wording is required for these weaknesses w Must be reported to management, board and audit committee (GAAS requires) w Other weaknesses (i. e. non-material) would also be included in a management letter 32 Copyright © 2007 Pearson Education Canada