copyright © 2014 pearson education chapter 10 considering internal control

Copyright © 2014 Pearson Education

Chapter 10

Considering Internal Control

Chapter 10

Considering Internal Control

Copyright © 2014 Pearson Education10-2

Describe the three primary objectives of effective internal control.

Contrast management’s responsibilities for maintaining internal control with the auditor’s responsibilities for evaluating and reporting on internal control.

Explain the five components of the COSO internal control framework.

Obtain and document an understanding of internal control.


Assess control risk by linking key controls and control deficiencies to transaction-related audit objectives.

Describe the process of designing and performing tests of controls.

Understand Section 404 requirements for auditor reporting on internal control.

Describe the differences in evaluating, reporting, and testing internal control for nonpublic companies.


Describe the three primary objectives of effective internal control.

11

10-4


Management has three broad objectives in designing an effective internal control system

Compliance with laws and

regulations

Reliability of financial reporting Efficiency/

effectiveness of operations


Contrast management’s responsibilities for maintaining internal control with the auditor’s responsibilities for evaluating and reporting

on internal control.

22

10-6


Management must establish and maintain the entity’s internal controls

Management’s design and implementation of internal controls is based on two key underlying concepts:

Reasonable assurance

Inherent limitations


Management of all public companies are required to issue an internal control report that includes the following:An acknowledgement of responsibility

for internal controlsResults of annual internal control

assessment


Management must evaluate the design of internal controls over financial reporting.

Management must also test the operating effectiveness of those controls.


Must assess control risk in every audit

Primarily concerned about controls over: • reliability of financial reporting • classes of transactions


Obtains understanding of controls

Performs tests of controls: significant account balances classes of transactions

disclosures and related financial statement assertions


Explain the five components of the COSO internal control framework.

33

10-14


Integrity and ethical values

Commitment to competence

Board of directors or audit committee participation


Management’s philosophy and operating style

Human resource policies and practices

Organizational structure


Identify factors that may increase risk

Estimate the significance of the risk

Assess the likelihood of the risk occurring

Determine actions necessary to manage the risk


1. Adequate separation of duties

2. Proper authorization of transactions and activities

3. Adequate documents and records

4. Physical control over assets and records

5. Independent checks on performance


Custody of assets

Authorizationof transactions

Operationalresponsibility

IT duties

from

from

from

from

Accounting

The custody ofrelated assets

Record-keepingresponsibility

User departments


Transaction Approval Policies

General Authorization

Specific Authorization


Prenumbered consecutively

Prepared at the time of transaction

Designed for multiple use

Constructed to encourage correct preparation


The most important type of protectivemeasure for safeguarding assets andrecords is the use of physical precautions.


The need for independent checks arisesbecause internal control tends to changeover time, unless there is frequent review.


The purpose of an accounting informationand communication system

InitiateInitiate

RecordRecord

ProcessProcess

Reporttransactions

Reporttransactions

Maintain Accountability

for Related Assets

Maintain Accountability

for Related Assets


Monitoring activities deal with management’songoing and periodic assessment of thequality of internal control performance…

to determine whether controls are operatingas intended and modified when needed.


Obtain and document an understanding of internal control.

44

10-27


Auditing standards require auditors to obtain an understanding of internal control for every audit.

Procedure to obtain an understanding: Inspection Inquiry of entity personnel Observation of employees


Narrative

FlowchartInternalcontrol

questionnaire


1. The origin of every document and record in the system

2. All processing that takes place

3. The disposition of every document and record in the system

4. An indication of the controls relevant to the assessment of control risk


Update and evaluate auditor’s previousexperience with the entity

Make inquiries of client personnel

Examine documents and records

Observe entity activities and operations

Perform walk-throughs of the accounting system


Assess control risk by linking key controls and control deficiencies to transaction-related audit

objectives.

55

10-33


Assess whether the financial statementsare auditable.

Determine assessed control risk supportedby the understanding obtained.

Use a control risk matrix to assesscontrol risk.


Many auditors use the control risk matrixto assist in the control risk assessmentprocess at the transaction level.


Identify audit objectives

Identify existing controls

Associate controls with related audit objectives

Identify and evaluate control deficiencies, significant deficiencies, and material weaknesses


Identify existing controls

Identify the absence of key controls

Consider the possibility of compensating controls

Decide whether there is a significant deficiency or material weakness

Determine potential misstatements that could result


Auditor must communicate in writing significant deficiencies and material weaknesses to the audit committee

Management letters from the auditor Less significant control weaknesses Ideas for operational improvements


Describe the process of designing and performing tests of controls.

66

10-40


The procedures to test effectiveness of controlsin support of a reduced assessed controlrisk are called tests of controls.


Inquire of client personnel

Reperform client

procedures

Examine documents,

records, reports

Observe control-related

activities


Reliance on evidence from prior year’s audit

Testing of controls related to significant risks

Testing less than the entire audit period


Assessed Control Risk

Type ofprocedure

High level:Procedures to obtain

an understandingLower level:

Tests of controls

InquiryInspection

Observation

Reperformance

Yes–extensiveYes–with transaction

walk-throughYes–with transaction

walk-throughNo

Yes–someYes–using sampling

Yes–at multiple times

Yes–using sampling


Control risk assessment

process results

Tests of controls

Control risk assessments

Planned detection

risk

Related substantive

tests

Balance related audit

objectives


Understand Section 404 requirements for auditor reporting on internal control.

77

10-46


The scope of the auditor’s report on internal controlis limited to obtaining reasonable assurance that material weaknesses in internal control are identified.


No material weaknessesNo scope restrictions

One or more material weaknesses

Scope limitation

Unqualified

Adverse

Qualified or disclaimer


Describe the differences in evaluating, reporting, and testing internal control for

nonpublic companies.

88

10-49


1. Reporting requirements

2. Extent of required internal controls

3. Extent of understanding needed

4. Assessing control risk

5. Extent of tests of controls needed


Internal controls over financial reportingInternal controls over financial reporting

Internal controls used to assesscontrol risk below maximum

Controls that must be tested inan audit of internal controls

Controls that must be tested inan audit of financial statements


Copyright

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America.

copyright © 2014 pearson education chapter 10 considering internal control

Documents