Date post: | 29-Dec-2015 |
Category: |
Documents |
Upload: | neil-mcdaniel |
View: | 223 times |
Download: | 2 times |
Internal Control Over Financial Reporting
Learning Objectives
Define internal control and understand its importance to financial statement audits
Describe the components of internal control and their principles
Understand risks and controls in computerized information systems
Describe the concepts and processes related to the audit of internal control over financial reporting
Describe the nature of documentation the auditor uses in understanding and assessing internal control
The Audit Process
I. Making client acceptance and continuance decision
Chapter 1
II. Performing risk assessment
Chapters 3, 7 and 9-13
III. Obtaining evidence about internal control operating effectivenessChapters 8-13 and 16
IV. Obtaining substantive evidence about accounts, disclosures and assertionsChapters 8-13 and 16
V. Completing the audit and making reporting decisions
Chapters 14 and 15
The auditing profession, regulation, corporate governance, and audit quality
Chapters 1 and 2
Professional liability and the need for quality auditor judgments and ethical decisions
Chapter 4
Audit opinion formulation process and a framework for obtaining audit evidence
Chapters 5 and 6
Why is Internal Control Important to Financial Statement Audits?
Internal control is a process, effected by an entity’s BOD, management, and other personnel, designed to provide reasonable assurance regarding the achievement of certain objectives: Reliability of financial reporting Effectiveness and efficiency of operations Compliance with applicable laws and
regulations
Q: Which objectives are the auditor’s primary concern?
Components of Internal Control
Risk assessment – methods to identify, analyze, and manage risks
Control environment – the overall attitude, awareness and actions of the BOD and management
Control activities – policies and procedures that ensures management’s directives regarding IC are carried out
Information and communication – methods to identify, capture and communicate external and internal information
Monitoring – ongoing and periodic assessment of the effectiveness of the design and operation of the IC
Risk Assessment
Is management aware of, and responsive to, risks? External risks
e.g., technology, competition, customer demand
Internal riskse.g., embezzlement, computer downtime, poorly conceived business model
Principles of Risk Assessment
Specify the objectives with sufficient clarity to enable the identification and assessment of risk
Identify and analyze risks as a basis for determining how the risk should be managed
Consider the potential for fraud in assessing risks
Identify and assess changes that could significantly impact the internal controls
Principles of Control Environment
Commit to integrity and ethical valuesEnsure board is independent of and
exercises oversight for design and operation internal control
Establish structures, reporting lines, and appropriate authorities and responsibilities
Hold individuals accountable for responsibilities
Commit to attract, develop and retain competent individuals
Control Activities
Control activities two aspects/elements: Design – policies or prescriptions likely
prevent/detect Operation – working as designed
They are of two types: Preventive – e.g., access control Detective – e.g., reconciliation
Principles of Control Activities
Select and develop control activities specific to the risks identified during risk assessment
Select and develop general control activities over technology
Deploy control activities through policies that establish what is expected and in procedures that put policies into action
Principles of Information and Communication
Obtain/generate and use relevant, quality information
Communicate information with internal parties, including information on objectives and responsibilities for internal controls
Communicate information with external parties regarding matters affecting the functioning of internal controls
Principles of Monitoring
Select, develop and perform ongoing and periodic evaluations
Evaluate and communicate internal control deficiencies in a timely manner to those parties responsible for taking corrective actions
Computer Information Systems Characteristics
1. Transaction trail exists for a limited period and only in machine readable language
2. Processing errors are more systematic3. Segregation of duties has to be achieved
in a different manner4. Many transactions are automatically
initiated and processed5. The potential for errors and fraud is
higher due to unauthorized access
Overview of Information System Risks
Data is intercepted, modified, deleted or replaced with fraudulent dataData ports provide access to hackers, denial of service attacks or unauthorized access
Data Communications
Unauthorized access, manipulation of data, addition of unauthorized data
Data Files
Fraudulent programming, incorrect data processing, processing fraudulent data
Computer Programs
Sabotage, natural disaster, viruses, anything that impairs operations
Computer Operations
RisksComputer Processing Area
Information System Controls
Two groupings of information system controls are general and application controls.
General controls apply to many or all computer applications. They include: Planning and controlling data processing Controlling applications development and changes to
programs Controlling access Assuring business continuity Controlling data transmission
Application controls apply to individual applications. These controls help ensure that transactions are valid, properly authorized, and completely and accurately processed. They can be classified into input, processing, and output controls.
Relationship Between Generaland Application Controls
Cash receiptsapplication
controls
Salesapplications
controls
Payrollapplication
controls
Other cycleapplication
controls
General Controls
Risk of unauthorized changeto application software Risk of system crash
Risk of unauthorizedmaster file update
Risk of unauthorizedprocessing
Planning & Controlling the Data Processing Function
Fundamental concepts an auditor should consider when evaluating the organization of the data processing:
1. Authorization for all transactions originates outside the data processing department
2. Users are responsible for authorization, review, and testing of all application developments and changes in computer programs
3. Access to data is provided only to authorized users4. Data processing department is responsible for all custodial
functions associated with data, data files, software, and related documentation
5. Users, jointly with data processing, are responsible for the adequacy of application controls
6. Management periodically evaluates the information systems function for efficiency, integrity, security, and consistency with organizational objectives
7. Internal audit staff periodically audits applications and operations
Controlling Applications Development and Changes
Program Development There exists a process to determine that the
right applications are acquired, installed, and accomplish their objectives
Program Changes Only authorized changes are made to a
program All authorized changes are made to a program All changes are tested, reviewed, and
documented before implementation Only the authorized version of the computer
program is run
Controlling Access
Controlling Access to Equipment, Data, and Programs Access to data is limited to those with a need to know Ability to change, modify, delete data is restricted to
authorized persons Control system has the ability to identify potential
users as authorized or unauthorized Security department actively monitors attempts to
compromise the system Authentication
A system to verify that users are authorized to access data
There are three primary methods used to authenticate users:
What you know What you have Who you are
Security and backup plans for both physical assets and media Minimum elements in a backup and recovery
Standardized procedures for backup and disaster recovery
Plans for reconstructionPeriodic review and testing of plans and procedures
Controls to assure the completeness and accuracy of data transmission between computers and terminals Data encryption
Assuring Continuity and Controlling Data Transmission
Input controls ensure that transactions are fully and accurately captured, and properly recorded.
They include: Input validation tests (Edit tests)
Data type, reasonableness, limit, validityInvalid combination of itemsRecord countsBatch control and hash control totals
Self-checking digits Use of stored data to minimize data input On-screen input verification techniques
Input Controls
Processing Controls are designed to ensure that: The correct program is used for processing Transactions are processed appropriately The correct transactions update files
They include: Validation tests (correct program is used for
processing and correct transactions update files) Sequential tests (no unauthorized transactions added) Completeness tests (all authorized transactions
processed) Mathematical accuracy tests Data reasonable tests
Processing Controls
Output Controls are designed to ensure that: Processing results are accurate Output is distributed only to authorized
recipientsThey include:
Data reasonable tests Reconciliation of output to input control totals Review of error listings
Output Controls
Assessing General & Application Controls
Effective?
Test general controls
Do not rely on IT application controls
Effective?
Test applications controls
Do not rely on IT application controls
Test application controls and, if effective, reduce tests
No
Yes
Yes
No
Attestation Services andInternal Control
Section 404 of the Sarbanes-Oxley Act requires that: management document and assess the
effectiveness of internal control over financial reporting, and
the auditor that audits the company’s financial statements attest to management’s assessment and report on effectiveness of internal control.
Section 302 requires that CEO and CFO certify the effectiveness of internal control.
AS 5 establishes the requirements and provides directions when an auditor is engaged to audit both a company’s financial statements and internal control over financial reporting.
Objective of the Audit of Internal Control over Financial Reporting
The auditor's objective here is to express an opinion on the effectiveness of the company’s controls.
To do this, the auditor must obtain reasonable assurance about whether the company maintained effective internal control as of the date specified in management's assessment.
Maintaining effective internal control means that no material weaknesses exist.
Therefore, the objective of the audit of internal control is to obtain reasonable assurance that no material weaknesses exist as of the end of the client’s fiscal year.
Material Weakness vs. Significant Deficiency vs. Control Deficiency
Control deficiency – the design or operation of a control does not allow prevention or detection of misstatements on a timely basis
Significant deficiency – one or more control deficiencies that is less severe than a material weakness, yet important enough to merit attention by those who are responsible to oversee the company’s financial reporting
Material weakness – one or more control deficiencies that results in [an at least] a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis
Key features of AS5
Emphasis on top-down, risk-based approach and scalability
More emphasis on entity-level controlsGreater ability to rely on the work of
othersFocus on understanding and testing
controls in areas that present the highest risk
Steps in the Audit of Internal Control
The auditor must adhere to auditing standards in performing an audit of a company’s internal control. This involves: Planning the engagement Obtaining an understanding of internal control Testing and evaluating design effectiveness of
internal control Testing and evaluating operating effectiveness
of internal control Forming an opinion on the effectiveness of
internal control
Planning the Audit of Internal Control
When planning the audit of internal control, the auditor should evaluate how the following matters will affect the audit procedures:1. Knowledge of the company's internal control
obtained during other engagements2. Matters affecting the industry in which the
company operates3. Matters relating to the company's business4. The extent of recent changes, if any, in the
company, its operations, or its internal control
Planning the Audit of Internal Control
5. Preliminary judgments about materiality and risk
6. Control deficiencies previously communicated to the audit committee or management
7. Legal or regulatory matters which the company is aware of
8. The type and extent of available evidence9. Preliminary judgments about the effectiveness
of internal control10.Knowledge about risks identified when
accepting the client and the relative complexity of the operations
Testing and Evaluating the Design & Operation of Internal
Control
The auditor must first obtain an understanding of internal control using a top-down risk based approach.
Evaluating the design effectiveness involves determining whether the control, if operating as prescribed, can effectively prevent or detect errors or fraud.
To evaluate the operating effectiveness of a control, the auditor must determine whether the control is operating as designed and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively.
Forming an Opinion on the Effectiveness of Internal Control
When forming an opinion on internal control over financial reporting, the auditor should evaluate all evidence obtained from all sources, including: The auditor’s testing of controls Misstatements detected during the financial
statement audit Any identified control deficiencies
Note: The auditor's opinion relates to the effectiveness of the company's internal control as of a point in time and taken as a whole.
Reporting on Internal Control
The auditor may choose to issue a combined report or separate reports on the company's financial statements and on internal control over financial reporting.
If the auditor chooses to issue a separate report on internal control over financial reporting, a separate paragraph should be added to both the auditor's report on the financial statements and the auditor’s report on internal control.
The report on internal control is similar to that on financial statements.
When the client maintains, in all material respects, effective internal control as of the end of its (the client’s) fiscal year, the auditor issues an unqualified opinion. The auditor provides an opinion on the
effectiveness of internal control in the context of agreed upon criteria.
The auditor recognizes and conveys to users that there are limitations of internal control.
Unqualified Opinion on Internal Control over Financial Reporting
Adverse Audit Opinion on Internal Control over Financial
Reporting
When one or more material weaknesses in the client’s internal control over financial reporting exist, the auditor issues an adverse opinion. The report describes the weaknesses identified
in management’s report but does not discuss the actions being taken to overcome those problems.
The report does not discuss whether the control weakness was first identified by management or by the auditor.
Required Communications in an Audit of Internal Control
The auditor must communicate in writing to management and the audit committee all material weaknesses identified during the audit prior to the issuance of the auditor's report.
Significant deficiencies must also be communicated to the audit committee in writing.
In addition, the auditor should communicate to management, in writing, all deficiencies in internal control.
Documenting the Understanding and Assessment of Internal
Control
Audit documentation should clearly identify each component of the internal control.
It should show: How each significant control is tested The sampling approach and the size of the
sample used in testing The conclusions of the tests The individual performing the test The auditor’s conclusion about the
effectiveness of the control The implications for the audit of related
financial account balances
Assurance Services and Internal Control
The developments in information technology have created new assurance services opportunities, some of which the CPAs have already taken advantage of.PricewaterhouseCoopers:
assures data security for companies that trade on the Internet.