Aud 2 Internal Control

Front 1

What does Internal Control provide?

Back 1

Reasonable Assurance on:
 Material misstatements will be prevented
 Reliability/Integrity of F/S will be preserved
 Assets are protected against misuse

Front 2

Internal Control requirements under SOX

Back 2

o CEO/CFO must disclose I/C deficiencies
o Management must provide assessment of I/C
o Management must certify F/S

Front 3

Objectives of Internal Control

Back 3

 Reliability of Financial Reporting
 Operational Efficiency/Effectiveness
 Compliance with Law and Regulatory

Front 4

Components of Internal Control

Back 4

(CRIME)
Control Activities
Risk Assessment
Info & Communication Systems
Monitoring
Environment

Front 5

Components of risk assessment that affect risk of operating environment

Back 5

1. New personnel
2. New info system
3. Rapid growth
4. New technology
5. New business model/products/activities
6. Corporate restructuring
7. Expand foreign operations
8. New accounting pronouncements

Front 6

Components of Control Activities

Back 6

 Performance Reviews
 Information Processing
 Physical Controls
 Segregation of Duties

Front 7

Components of Information & Communication

Back 7

 Auditor needs to understand
o Major transaction classes
o Transaction initiation
o Support records/documents
o Transaction processing
o F/S internal reporting process
o F/S external communication process

Front 8

Components of Control Environment

Back 8

1. Integrity and ethical values
2. Commitment to competence
3. Board of directors/audit committee
4. Management's philosophy
5. Organizational structure
6. Assignment of authority & responsibility
7. Human resources policies

Front 9

Internal Control testing should be strong as IRON

Back 9

o Inquiry – Interview company personnel
o Re-performance – Can it be replicated?
o Observation – Watch the control be applied
o iNspection – Dig into the details/documents

Front 10

Tracing vs. Vouching

Back 10

 Tracing = Completeness
Starts with source document and traces forward to the
journal entry
 Vouching = Existence
Starts with entry and searches for a voucher or
source document to support the entry

Front 11

Segregation of duties

Back 11

(ARC)
 Authorization of asset disbursement
 Recording of Assets
 Custody of assets

Front 12

Control Deficiencies - Material Weakness

Back 12

o Reasonable possibility that controls will not
prevent a material misstatement
o Written report to management required
o Report declaring that no material weaknesses
were found is allowed
o Previous weaknesses reported that still exist
should be reported again
o Should be reported no later than 60 days after
audit report release date
o If one or more material weaknesses is uncorrected
at year-end, an Adverse Opinion on internal
control must be given

Front 13

Control Deficiencies - Significant Deficiency

Back 13

o Adversely affects company’s ability to report F/S
in accordance with GAAP
o “More than a remote likelihood” of material
misstatement by “more than an inconsequential
amount”
o Written report to management required
o Report declaring that no significant deficiencies is
not allowed
o Previous deficiencies reported that still exist
should be reported again
o Should be reported no later than 60 days after
audit report release date

Front 14

Control Deficiency

Back 14

o A control is not operating as intended
o Written report to management not required

Front 15

What needs to be assess on internal audits if auditor decides to use them

Back 15

1. Competence
2. Objectivity
a. Organizational status
b. Areas audited

Front 16

Auditors should assess the Internal Audits Competence by considering

Back 16

1. Educational level
2. Professional certifications
3. Audit policies, programs, procedures
4. Practices regarding assignment of internal auditors
5. Supervision and review
6. Quality of documentation
7. Performance evaluation

Front 17

Written Communication regarding Internal Controls should include

Back 17

1. The purpose of an audit is to express an opinion on the fs
2. The audit is not expressing an opinion of internal controls
3.consideration of internal control was NOT designed to identify all deficiencies or material weaknesses
4. Definition of material weakness
5. Identify significant deficiencies and material weaknesses
6.Limit use of communication to mgt , those charged with governance