Internal Control

1
Internal Control
2
Internal ControlHistorical Development

• Treadway Commission recommendations related to
  internal control
• Competent and involved audit committees
• Active and objective internal audit function
• Committee of Sponsoring Organizations (COSO)
• Establish a common definition of internal control
• Provide a standard against which business and
  other entities can assess their control systems
  and determine how to improve them.

3
Internal Control COSO

• COSO Internal Control Integrated Framework
  definition of internal control
• A process, effected by the entitys board of
  directors, management and other personnel,
  designed to provide reasonable assurance
  regarding the achievement of objectives on
• Effectiveness and efficiency of operations
• Reliability of financial reporting
• Compliance with applicable laws and regulations

4
Components of Internal Control

• The Control Environment
• Risk Assessment
• The Accounting Information and Communication
  System
• Control Activities
• Monitoring

5
Control Environment Factors

• Integrity and ethical values
• Commitment to competence
• Board of directors or audit committee
• Management philosophy and operating style
• Organizational structure
• Assignment of authority and responsibility
• Human resource policies and practices

6
Risk Assessment

• Factors related to increased financial reporting
  risk
• Changes in the regulatory or operating
  environment
• Changes in personnel
• Implementation of a new or modified information
  system
• Rapid growth of the organization
• Changes in technology affecting production
  processes or information systems
• Introduction of new lines of business, products,
  or processes

7
Accounting Information and Communication System

• Objectives
• Identify and record valid transactions
• Describe on a timely basis the transactions in
  sufficient detail to permit proper classification
  of transactions
• Measure the value of transactions appropriately
• Determine the time period in which the
  transactions occurred to permit recording in the
  proper period
• Present properly the transactions and related
  disclosures in the financial statements
• Chart of Accounts and accounting policies and
  procedures manual assist in this process.

8
Control Activities

• Performance reviews
• Information processing
• Authorization
• Forms and documents
• Physical controls
• Periodic reconciliations by third party
• Segregation of duties

9
Monitoring

• Ongoing monitoring activities
• Continuous monitoring of customer complaints
• Reviewing the reasonableness of management
  reports
• Separate evaluations
• The internal audit function

10
Limitations of Internal Control

• Errors may arise from misunderstandings of
  instructions, mistakes of judgment, fatigue, etc.
• Controls that depend on the segregation of duties
  may be circumvented by collusion
• Management may override the structure
• Compliance may deteriorate over time

11
The Auditors Consideration of Internal Control

• Obtain an understanding
• Document the understanding
• Determine planned assessed level of control risk
• Design and perform additional tests of controls
• Reassess control risk
• If necessary, modify planned substantive tests

12
The Auditors Consideration of Internal
ControlObtain an Understanding

• Obtaining an understanding should include
• Design of the system of controls
• Determine whether controls been placed in
  operation
• Encompass the five components of internal control
• Provides a basis for
• Assessing control risk
• Planning the audit
• Identify types of potential misstatements
• Consider factors that affect the risk of material
  misstatements
• Design substantive tests

13
The Auditors Consideration of Internal Control
Documenting Internal Control

• Forms of Documentation
• Questionnaires
• Written Narratives
• Flowcharts
• Walk-through tests are used to verify that
  documented controls have been placed into
  operation

14
The Auditors Consideration of Internal
ControlDetermine the Planned Assessed Level of
Control Risk

• Weak controls (substantive strategy)
• Assess control risk at maximum
• No tests of controls necessary in this case
• Effective controls (reliance strategy)
• Determine efficiency of gathering necessary
  evidence to justify lower assessment of control
  risk
• To assess control risk at a lower level, must
• Identify controls that are likely to prevent or
  detect material misstatements
• Perform tests of controls to evaluate their
  effectiveness

15
The Auditors Consideration of Internal
ControlDesign and Perform Additional Tests of
Controls

• Additional tests of controls (beyond those
  performed in obtaining an understanding) should
  be completed as necessary to support the assessed
  level of control risk. Audit procedures include
• Inquiries of client personnel
• Inspection of documents and reports
• Observation of the application of controls
• Reperformance of the controls

16
The Auditors Consideration of Internal
ControlReassess Control Risk and Modify Planned
Substantive Tests

• The assessed level of control risk impacts the
  nature timing and extent of substantive audit
  procedures.
• Auditors must document assessed level of control
  risk in workpapers.
• Should include the basis for any assertions for
  which control risk is assessed below maximum.

17
Communication of Internal Control Matters

• SAS 112 Communicating Internal Control Related
  Matters Identified in the Audit
• Three levels of internal control deficiencies
• Control deficiencies - deficiencies in design or
  operation of internal control
• Significant deficiencies control deficiencies
  that result in a more than a remote likelihood of
  a more than inconsequential misstatement.

18
Communication of Internal Control Matters

• Material weaknesses a significant deficiency
  that result in more than a remote likelihood of a
  material misstatement of the financial
  statements.
• Reporting requirements
• Auditors are required to report significant
  deficiencies and material weaknesses to
  management and the audit committee.
• Control deficiencies are typically communicated
  in a management letter.

19
SARBOX Perspective

• Section 404 requires auditors to assess and
  report on clients assertion concerning the
  effectiveness of internal controls.
• Scope of understanding and testing of controls
  significantly expanded.
• Must obtain understanding and test controls
  related to all significant account balances,
  classes of transactions and disclosures.
• ALP scoping framework all significant accounts,
  locations (or business units) and processes
  identified and tested.
• Level of assurance related to internal controls
  increased.