Risk Assessment_ Internal Control Evaluation

Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,Chapter 5,Risk Assessment: Internal Control Evaluation,“If everything seems under control, youre just not going fast enough.”,- Mario Andretti, Race car driver,McGraw-Hill/Irwin,Copyright 2008 by The McGraw-Hill Companies, Inc. All rights reserved,.,Chapter 5 Objectives,Distinguish between managements and auditors responsibilities regarding an entitys internal control.,Define and describe,internal control,.,Define and describe the five basic components of internal control and specify some of their characteristics.,Explain the phases of an evaluation of control and risk assessment and the documentation and extent of audit work required.,Describe additional responsibilities for management and auditors of public companies required by Sarbanes-Oxley and,Auditing Standard No.5,.,List the major components of the auditors report on internal control over financial reporting.,Describe situations in which the auditors report on internal control over financial reporting would be modified.,Explain the communication of internal control deficiencies to those charged with governance such as the audit committee and other key management personnel.,Explain the limitations of all internal control systems.,5-,3,Responsibility for Internal Control,Management responsibility,Management has primary responsibility for internal control,Sarbanes-Oxley Act of 2002 (publicly traded companies),Auditor responsibility,Second standard of fieldwork,PCAOB Auditing Standard No. 5 (,AS 5,):,An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements,5-,4,Managements Responsibility for Internal Control (Sarbanes-Oxley),In addition to certifying the companys financial statements (Section 302), management must also report on the companys internal control over financial reporting (Section 404).,Specifically, the companys annual report must include:,A statement that management is responsible for establishing and maintaining adequate internal control over financial reporting.,A statement identifying the framework (usually COSO) management uses to evaluate the effectiveness of the companys internal control.,A statement providing managements assessment of the effectiveness of the companys internal control.,5-,5,AS 5,: An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements,Auditors must provide their opinion on the effectiveness of clients internal control.,Not a separate engagement,Integrated,audit of internal control and financial statements,5-,6,COSO,C,ommittee,o,f,S,ponsoring,O,rganizations of the National Commission of Fraudulent Financial Reporting (Treadway,Commission,5-,7,Why Assess Control Risk?,Determine nature, timing, and extent of audit procedures.,Trade-off between testing of controls and substantive procedures.,Note: Control testing required for public companies (,AS 5,), but not for private companies and not-for-profit organizations.,5-,8,Exhibit 5.2,Trade-off Between Tests of Controls and Substantive Testing,5-,9,Internal Control An Integrated Framework (COSO),Internal Control,A,process, effected by an entitys,board of directors,management, and other personnel, designed to provide,reasonable assurance,regarding the achievement of objectives in the following categories:,(1),Reliability of financial reporting,(2) Compliance with applicable laws and regulations,(3) Effectiveness and efficiency of operations.,5-,10,Internal ControlIntegrated Framework,5-,11,Interrelated Components of Internal Control,5-,12,Control Environment,Sets the tone of an organization, influencing the control consciousness of its people.,It is the foundation for all other components.,5-,13,Control Environment,Philosophy And operating style,Integrity And ethical values,Organizational structure,Commitment to competence,Functioning of board,Authority and responsibility,Internal audit,Human resources policies,External environment,5-,14,Risk Assessment,The,entitys,identification and analysis of relevant risks to achievement of its objectives.,COSOs,Enterprise risk management,(ERM) framework,5-,15,Control Procedures,The policies and procedures that help ensure management directives are carried out.,Physical controls over the security of assets,Segregation of duties,Information Processing,Approvals and authorization,Verifications and reconciliations,Performance reviews,5-,16,Separation of Duties,5-,17,Information Processing Controls,Information technology general controls (ITGC),Physical security,Hardware controls,Segregation of IT duties,Documentation,Back-up procedures,Information technology application controls (ITAC),Input controls,Processing controls,Output controls,Spreadsheet controls,5-,18,Information and Communication,The identification, capture, and exchange of information in the form and time frame that enables people to carry out their responsibilities.,5-,19,Monitoring,Managements,process that assesses the quality of the internal controls performance over time.,Internal auditing,Follow-up of reporting errors,5-,20,General Phases of Internal Control Evaluation,Phase 1: Understand and document,Understand the clients internal control,Document the understanding of internal control,Internal Control questionnaire,Narrative,Accounting and control system flowcharts,Phase 2: Assess control risk (Preliminary,),Phase 3: Testing and reassessment,Perform test of controls audit procedures,Re-assess control risk,5-,21,Payroll System Flowchart,5-,22,Bridge Workpaper,5-,23,Assertions about Class Transactions and Events for the Period: Payroll Cycle,5-,24,Dual Direction Test of Payroll Controls,5-,25,AS 5: An Audit of Internal Control over Financial Reporting That Is Integrated with an Audit of Financial Statements (for Publicly Traded Companies),Phases of the engagement,Plan the engagement,Use a top-down approach to gain an understanding,Identify entity-level controls,Walkthroughs,Testing internal control effectiveness,Design effectiveness,Operating effectiveness,Evaluating control deficiencies,Deficiencies,Significant deficiencies,Material weaknesses,Wrapping up: Forming an opinion on the effectiveness of internal control over financial reporting,Reporting on internal control,5-,26,Step 1: Plan the Audit,Consider knowledge of industry,Consider knowledge of business,Consider extent of changes in operations,Consider extent of changes in internal control,Evaluation must be done for all relevant assertions for all significant accounts or disclosures. Thus, significant accounts, locations, and assertions must be identified.,The key to determining whether an account, location, or assertion is significant is whether there is a more-than-reasonable possibility that a material misstatement could be associated with it.,Just as,control risk,is used to determine the nature, timing, and extent of substantive procedures,inherent risk,is,used to determine the nature, timing, and extent of tests of controls.,5-,27,Step 2: Use a top-down approach to gain an understanding,Identify entity-level controls,Perform walkthroughs,Auditor must perform work related to:,Company-wide anti-fraud,programs,Controls that have a,pervasive,effect,Auditor must obtain “principal evidence,” but can incorporate work of internal auditors and others,Must assess competence and objectivity,Limited reliance,Cant reduce work on,control environment,5-,28,Entity-Level Controls,Controls related to the control environment.,Controls related to management override.,Centralized processing and controls including shared service environments.,Controls to monitor results of operations.,Controls to monitor other controls.,Managements risk assessment.,Period-end financial reporting process,Policies that address significant business control and risk management practices,5-,29,Test Controls: Design Effectiveness,Design effectiveness,determines whether the controls over financial reporting,if operating effectively, would be expected to prevent or detect errors or fraud that could result in a material misstatement in the financial statements.,After an understanding of internal controls is gained through inquiry, inspection, and observation, the controls are evaluated for the possibility that the controls would not prevent or detect a misstatement.,5-,30,Test Controls: Operating Effectiveness,Operating effectiveness,is whether the control is,operating as designed,and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively.,A sample of transactions is examined using inquiry, observation, inspection, and reperformance.,Tests of controls are not performed if design is not effective.,5-,31,Step 4a: Evaluate control deficiencies,Whether the result of a design deficiency or an operating deficiency, an,internal control deficiency,exists when the design or operation of a control does not allow the entitys management or employees to detect or prevent misstatements in a timely fashion.,A,design,deficiency,is a problem relating to either a necessary control that is missing or an existing control that is so poorly designed that it fails to satisfy the controls objective.,An,operating,deficiency, on the other hand, occurs when a properly designed control is either ignored or inappropriately applied (possibly because employees are poorly trained).,More serious internal control deficiencies can be categorized into one of two groups,significant deficiencies,or,material weaknesses, depending on their severity.,5-,32,Step 4b: Identify significant deficiencies,Significant deficiencies,are defined as conditions, or combinations of conditions, that could adversely affect the organizations ability to initiate, record, process, and report financial data in the financial statements.,While not material, they are important enough to bring to the attention of those charged with governance (usually the audit committee).,Absence of appropriate separation of duties.,Absence of appropriate reviews and approvals of transactions.,Evidence of failure of control procedures.,5-,33,Step 4c: Identify Material Weaknesses,A,material weakness,in internal control is defined as a deficiency, or combination of deficiencies, that results in a,reasonable,possibility,that a,material,misstatement,would not be prevented or detected on a timely basis.,Restatement of previously issued financial statements to reflect the correction of a misstatement.,Evidence of material misstatements (caught by the audit team) that were not prevented or detected by clients internal controls.,Ineffective oversight of financial reporting process by entitys audit committee.,Indication of fraud (either material or immaterial) by senior management.,5-,34,Summary of Internal Control Deficiencies,Three categories,Internal control deficiency,Significant deficiency,Material weaknesses,The difference between a significant deficiency and a material weakness is the (1),likelihood,and (2),materiality,that a potential (or actual) misstatement would not be detected on a timely basis.,5-,35,Step 5: Wrapping up: Forming an opinion on the effectiveness of internal control over financial reporting,Auditors can issue one of three types of opinions on internal control over financial reporting:,Unqualified,. No material weaknesses found.,Disclaimer of opinion,.,The audit team cannot perform all of the procedures considered necessary.,Adverse opinion,. One or more material weaknesses found.,5-,36,Step 6: Reports on Internal Control,Separate report on internal control,Opinion on financial statements contained in separate audit report,Extra paragraph added to report on internal control referencing opinion on financial statements.,Integrated audit report and report on internal control,Includes auditors opinions on 1) internal control,effectiveness, and 2) the fairness of the companys,financial statements,.,5-,37,Reporting to Audit Committee on Internal Control Related Matters,Sarbanes-Oxley requires that the report be in writing.,The auditor may communicate during or after audit.,Communications with management is not required; however, communications with management or other individuals within the entity who may, in the auditors judgment, benefit from the communications are not precluded.,5-,38,Limitations of Internal Control,Human error,Collusion,Management override,Cost/benefit analysis,There is often a trade-off between the cost and the effectiveness of internal controls.,The concept of,reasonable assurance,recognizes that the cost of an entitys internal control should not exceed the benefits that are expected to be derived.,5-,39,