INTERNAL

CONTROL

SECTION 9

Internal Control: Principles and Concepts

• The client’s system of internal is an important factor in an audit engagement

• The study of internal control often represents a significant part of field work

• We will examine:

1. Basic considerations2. Meeting the second standard of GAAS

ST. CATHARINES: Former stock broker Stan Magda has been jailed for contempt of court for refusing to say what happened to the $2 million his wife stole from the St. Catharines Standard.

Ontario Superior Court Justice Linda Walters sentenced the 59-year-old self described house husband to five says in jail yesterday and gave him until Sep. 7 to account for the money his wife stole from her employer.

Lucy Magda, 62, was sentenced to 34 months in penitentiary last July for embezzling $2.2 million over a five-year period while she was running the classified ad department at The Standard. She is now living in a half-way house in Dundas.

Once considered a trusted employee, she stuffed up to $6,000 a day in her handbag and covered her tracks by destroying or doctoring the paper trail. She was caught and immediately fired in the spring of 1997 after a temporary employee she had berated discovered discrepancies in the books.

She and her husband, who was no longer working, were both charged with theft related charges in1997. But the charges against Stan were dropped in January 2004, after she pleaded guilty to theft over $5,000.

The St. Catharines Standard had earlier won a $2.3 million civil judgment that held the couple jointly responsible for the missing funds. The case has dragged on in the courts for almost eight years with lawyers for the paper pressing the pair to account for the money.

During the theft investigation, Niagara police found what s detective described as an “Aladdin's cave” of stolen booty in the couple’s modest Thorold home. Police tallied about $1,170,000 worth of items, including hundreds of pairs of shoes and rooms full of unworn clothing that still had price tags.

They also found about $470,000 in cash stashed in the house and several hundred thousands in numerous bank accounts under aliases. Lucy had never earned more than $48,000 a year.

When asked about the money during pre-trial discoveries, Lucy told The Standard’s lawyer Peter Mahoney her late father had won the $470,000 while gambling with his buddies in the 1960’s, according to court documents.

She said her father, who died in 1975, told her to keep the money in the house until it was sold. She also claimed her dad had given her money to go shopping.

The Hamilton Spectator, Wednesday, June 22, 2005.

What is Internal Control?• Remember the second examination standard

• CICA 5200• Those policies and procedures established and

maintained by management that affect control risk relating to specific financial statement assertions at the account balance or class of transaction level

• Comprises of the entity's control environment and control systems installed by management

• Two subdivision of internal control

1. Administrative controls

• The plan of the organization and the procedures and records concerned with the decision process

• Also includes statistical analyses, time and motion studies, performance reports, and quality controls

• Some administrative controls do have an impact on accounting records

2. Accounting controls

• The plan of the organization and the procedures and records concerned with safeguarding of assets

• Designed to provide reasonable assurance that:

1. Transactions are authorized

2. Transaction recorded in conformity with?

3. Access to assets is authorized

4. Recorded accountability for assets is compared to existing records

Management’s Objectives for Internal Control

• Managements responsibility

• Objectives should include:1. Discharge of statutory responsibilities2. Profitability and cost minimization3. Prevention and detection of fraud and error4. Safeguarding of assets5. Reliability of accounting records6. Timely preparation of reliable financial information

Internal Control Environment

• A good internal control environment complements prescribed control procedures

• Should include:1. Management leadership2. Organizational structure3. Budgets and internal reports4. Internal auditing5. Reliable personnel6. Sound practices7. Company circumstances

Internal Accounting Control Principles

• Classified as preventative, detective, or corrective

• Preventative controls are used prior to or during the authorization, physical event, or recording of the transaction

• Detective controls are utilized after the transaction has occurred or been recorded

Major Categories of Controls

1. Authorization Procedures

• The purpose is to ensure that transactions are authorized by management personnel acting within the scope of their authority

• Authorizations may be routine or non-routine

• Authorization procedures are also important in limiting access to assets

2. Segregation of Duties

• It is important for an entity to segregate the authorization of transactions, recording of transaction, and custody of related assets.

• Independent performance of each of these functions reduces the opportunity for any one person to be in a position to both perpetrate and conceal errors or fraud

• Different departments and individuals

• Small companies?

3. Documentation Procedures

• Provides evidence of occurrence

• Signing or stamping documents

• Prenumbered documents

• Chart of accounts

• Accounting procedures that relate to timely processing

4. Access to Assets and Records

• Physical precautions

• Data processing

• Physical controls

• Access controls

• Backup and recovery

5. Independent Internal Verification

• Reviewing the accuracy and propriety of an employee’s work by another employee

• Who performs the task?

• How often?

• Errors and exceptions?

Meeting the Second Examination Standard

• A sufficient understanding of internal control should be obtained to plan the audit. When control risk is assessed below maximum, sufficient appropriate audit evidence should be obtained through tests of controls to support the assessment.

• Reliance on internal control

• If internal control is not tested, at what level is control risk set?

Objectives and Scope of the Standard

• Internal controls can change significantly from year to year

• Sufficient understanding of internal control

• Appropriate audit evidence

• Relationship between reliance on internal control and the amount of substantive audit work needed

Methodology for the Study of Internal Control

• Two closely related parts:

1. A review of the system

2. Tests of controls

Planning Phase

• The minimum study contemplated by the second examination standard

• General knowledge

• At the conclusion, the auditor must decide, for each major class of transactions, whether to continue or terminate the review

Study Phase

• The auditor obtains specific knowledge and understanding of the client’s prescribed control procedures

1. Gathering information

2. Verifying the understanding

3. Preliminary evaluation

1. Gathering Information

• Obtaining the information

• Generally information is organized according to one of the following approaches:

a) Transaction cycles

b) Financial Statement classification

c) Business function

• Questionnaires

• A series of questions relating to control procedures required to prevent and detect errors and irregularities

Campus Theatre

Internal Accounting Internal Control Questionnaire

December 31, 200X

CYCLE: Revenue CLASS OF TRANSACTIONS: Cash Receipts

Control Procedure Yes No Remarks

1. Are prenumbered tickets used and subsequently accounted for?

X

2. Is there restricted access to rolls of unused tickets?

X

3. Is a ticket machine used in issuing tickets? X

4. Are tickets voided upon admission of patrons?

X

5. Is there segregation of duties between issuance of tickets and admission of patrons?

X

6. Is there an independent daily cash count and reconciliation with tickets issued?

X

7. Are cash receipts deposited in total daily? X Deposited weekly

Prepared by: ILA

Date: 9/8/200X

• Flowcharts

• Separate flowcharts are prepared for each major class of transactions

• Narratives

• Written comments by the auditor about the system

2. Verifying the Understanding

• Reinforces the understanding of the information gathered

• Transaction walkthrough

3. Making a Preliminary Evaluation

a) Rely on internal?

b) Which internal controls?

c) Substantive auditing procedures necessary due to weakness in internal control

• When is internal control considered reliable?

• When there is no planned reliance on a internal control procedure

• Communication to management

• A material weakness exists when there more than a relatively low risk that error or fraud would have a material effect on the financial statements

• At what percentage?

Prepared by:ILADate: 9/10/200X

Campus Theatre

Preliminary Evaluation: Cash Receipts Transactions

December 31, 200X

Errors and FraudNecessary Control

ProceduresThe Theatre’s Prescribed

Control Procedures

Planned

Reliance

Yes No

1 Tickets may be issued without accounting for cash

Prenumbered tickets All tickets are prenumbered and the theatre manager accounts for tickets issued

X

2 Unused tickets may be stolen and sold for cash

Physical control and restricted access

Unused tickets are stored in a safe. Only the manager has access

X

3 Tickets may be issued out of sequence and cash may not be accounted for

Mechanical equipment for issuing tickets

Ticket machines are used in issuing tickets X

4 Doorperson could resell tickets or combine with cashier to resell tickets and keep the cash

Mutilation of tickets upon admission of patron

Doorperson tears tickets in half when admitting patron X

5 The cashier may collect cash and admit patron without issuing ticket

Segregation of duties in admissions

Cashier issues tickets and the doorperson admits patrons with tickets

X

Prepared by:ILADate: 9/10/200X

Campus Theatre

Preliminary Evaluation: Cash Receipts Transactions

December 31, 200X

Errors and FraudNecessary Control

ProceduresThe Theatre’s Prescribed

Control Procedures

Planned

Reliance

Yes No

6 Cash may be over or short due to mistakes in making changes

Independent daily cash count and reconciliation with tickets issued

Theatre manager makes a daily cash count and reconciliation X

7 All cash receipts may not be deposited

Deposit total cash receipts daily

Cash receipts are deposited wekly

X

Tests of Controls

• Performed in order to obtain reasonable assurance that the controls expected to be relied upon are in use and operating as planned throughout the period of reliance

1. Nature of Test of Controls

• Concerned with four questions:

• Were the procedures performed?

• How?

• By whom?

• Throughout the period

• The failure to perform a required procedure or the failure to perform it properly

• CICA 5215

• Document inspection

• Inquiry and observation

• Also reperformance

• Assume that in the billing department, a second clerk must independently verify the correctness of unit selling prices on invoices by comparing the price to an authorized price list

• What would be the evidence of this control?

• In testing compliance by reperformance?

• Each instance of the use of incorrect prices would be regarded as an exception

2. Extent and Timing

• Throughout the accounting period being audited

• An example of Tests of Controls

• Campus Theatre cash receipts scenario

Campus Theatre

Audit Program

December 31, 200X

Tests of Controls: Revenue cycle Class of Transactions: Cash Receipts

Working Paper

ReferenceAudit Procedure

Done by

Auditor Date

1 Examine tickets for prenumbering. Six series of 100 throughout the year.

2 Observe storage of unused tickets and inquire about authorized access to the safe. At interim and year-end.

3 Observe the use of ticket machines issuing tickets. At interim and year-end.

4 Observe the doorperson in admitting patrons and examine ticket receptacle for mutilated tickets. At interim and year-end.

5 Observe segregation of duties between the cashier and the doorperson. At interim and year-end.

6 Examine documentary evidence of daily cash counts and reconciliations with tickets issued. One week, for each of six months.

Final Evaluation of Controls

• On completion of the tests of controls

• Nature of the Evaluation

• Weaknesses affecting different classes of transactions do not offset each other

• The number of exceptions may be of such magnitude to doubt that the control procedure can be relied on

• The auditor should look at what was the underlying cause of the exception

• In some cases you might expect some exceptions

• It is essential to attempt to see if the exception was caused by an error

• Fraud?

• Purpose of the Evaluation

• To determine the extent to which the clients controls can be relied on in performing substantive tests

• Three level of risk

• Low

• Medium

• High

• To what is the final evaluation directed?

• Should be documented in the working papers

1. Strengths

2. Weaknesses

3. Effects on substantive tests

4. Communication to management

Prepared by: ILA Date: 9/15/200X

Campus Theatre

Evaluation of Internal Control Over Cash Receipts

December 31, 200X

Strengths

All of the controls on which reliance is planned were tested for compliance. These controls were found to be functioning as planned. In my judgment, the control risk associated with these controls is low.

Weaknesses

Cash is deposited in the bank only once a week. This procedure is not satisfactory for good internal control.

Effect on Substantive Tests

For controls in which control risk is low, the planned audit program should be implemented. For the control over depositing cash, the substantive tests should be extended.

Management Communication

Indicate that the failure to deposit cash intact daily also makes cash vulnerable to theft. Suggest that the manager make daily deposits using the banks night depository vault.

Determining Effects on Substantive Tests

• The second examination standard does not permit complete reliance on internal control

• The auditor relies on internal control to reduce control risk, and substantive tests to reduce detection risk

• Reliance on internal control may affect the nature, timing, and extent of substantive tests.

• Nature

• The type of auditing procedure to be performed

• For the verification of sales transactions

• For a low risk of errors in sales transactions as demonstrated by tests of controls

• For a high risk of errors

• Timing

• The time when the testing is done

• When there is a low risk of errors in processing sales transactions

• When the risk of errors is high

• Extent

• The amount of substantive testing to be performed

• When the risk of errors in processing sales transaction is low

• When the risk is high

Internal Control Letter to Management

• It is important that the auditor communicate any awareness of significant weaknesses in internal control to management

• Internal control letter

• Communication should be made at the earliest practicable date to the appropriate official

Problem 1: Distinguish between a substantive approach and a combined approach in auditing a financial statement assertion.

Problem 2: The following are errors or fraud and other irregularities that have occurred in Fresh Foods Grocery Store Ltd., a wholesale and retail grocery company.

1. The incorrect price was used on sales invoices for billing and shipments to customers because the wrong price was entered into a computer file.

2. A vendors invoice was paid twice for the same shipment. The second payment arose because the vendor sent a duplicate copy of the original two weeks after payment was due.

3. Employees in the receiving department took sides of beef for their personal use. When a shipment of meat was received, the receiving department filled out a receiving report and forwarded it to the accounting department for the amount of goods actually received. At the time, two sides of beef were put in an employee’s pickup truck rather than in the storage freezer.

4. During the physical count of inventory of the retail grocery, one counter wrote down the wrong description of several products and miscounted the quantity.

5. A salesperson sold an entire carload of lamb at a price below cost because she did not know the cost of lamb had increased in the past week.

6. On the last day of the year, a truckload of beef was set aside for shipment but was not shipped. Because it was still on hand, it was counted as inventory. The shipping document was dated the last day of the year so it was also included as a current-year sale.

Required:

a. For each error or fraud and other irregularity, identify one or more types of controls that were absent.

b. For each error or fraud or other irregularity, identify the objectives that have not been met.

c. For each error or fraud and other irregularity, suggest a control to correct the deficiency.

Problem 3: Recently, while eating lunch with some friends at a cafeteria at your university, you observe a practice that is somewhat unusual. As you reach the end of the cafeteria line, a server asks how many persons are in your party. He then totals the food purchases on the trays for all of your party and writes the number of persons included in the group on your bill. He hands you the bill and asks you to pay when you finish eating. Near the end of the meal, you decide you want a piece of pie and coffee so you return to the line, select your food, and again go through the line. The server goes through the same procedures, but this time he staples the second bill to the original and returns it to you.

When you leave the cafeteria, you hand the stapled bills to the cashier, who totals the two bill's, takes your money, and puts the bills on a spindle.

Required:

a. What internal controls has the cafeteria instituted for its operations?

b. How can the manager of the cafeteria evaluate the effectiveness of the controls?

c. How do these controls differ from those used by fast-food outlets?

d. What are the costs and benefits of the cafeteria’s system?

Problem 4: Lew Pherson and Marie Violette are friends who are employed by different public accounting firms. One day during lunch they are discussing the importance of internal controls in determining the amount of audit evidence required for an engagement. Pherson expresses the view that internal controls must be carefully evaluated in all companies, regardless of their size, in basically the same manner. His public accounting firm requires a standard internal control questionnaire on every audit as well as a flowchart of every transaction area. In addition, he says the firm requires a careful evaluation of the system and a modification in the evidence accumulated based on the controls and weaknesses in the system.

Violette responds by saying she believes internal control cannot be adequate in many of the small companies she audits although she recognizes that the CICA Assurance Handbook requires her to obtain a sufficient understanding.” She disagrees with the Handbook Recommendations and goes on to say, “Why should I spend a lot of time obtaining an understanding of internal control and assessing control risk when I know it has all kinds of weaknesses before I start? I would rather spend the time it takes to fill out all those forms in testing whether the statements are correct.”

Required:

a. Express in general terms the most important difference between the nature of the potential controls available for large and small companies.

b. Criticize the positions taken by Pherson and Violette, and express your own opinion about the similarities and differences that should exist in understanding internal control and assessing control risk for different-sized companies.