Internal Control Evaluation

Front 1

What was the Sarbanes-Oxley Act intended to strengthen?

Back 1

The Sarbanes-Oxley Act is intended to strengthen corporate financial reporting by assessing stiffer criminal penalties for white-collar crimes, increasing management accountability, and enhancing auditor independence.

Front 2

Management's responsibilities regarding an internal control

Back 2

Responsible for organization internal control
Certifying the company's financial statements
Reporting on the company's internal control over financial reporting
Disclosing any material weaknesses in internal control

Front 3

The Sarbanes-Oxley Act specifically requires the company's annual report to include

Back 3

A statement that management is responsible for establishing and maintaining adequate internal control over financial reporting
A statement identifying the framework management uses to evaluate the effectiveness of the company's internal control
A statement providing management's assessment of the effectiveness of the company's internal control

Front 4

Material weaknesses in internal control may prevent...

Back 4

Management from concluding that the company's internal control over financial reporting is effective

Front 5

Primary reasons for auditors to conduct an evaluation of a company's internal control

Back 5

Sarbanes-Oxley requires an audit of management's assessment of internal controls for publicly traded companies
To assess control risk to give the auditors a basis for planning the audit and dermining the nature, timing, and extent of audit procedures for the account balance (substantive) audit program

Front 6

Three opinions auditors provide when conducting an evaluation of a company's internal control

Back 6

One on the company's financial statements
One on management's evaluation of their internal controls over financial reporting
One on the effectiveness of a company's internal controls

Front 7

Control risk

Back 7

The probability that a company's controls will fail to prevent or detect material misstatements due to errors or frauds that would otherwise have entered the system

Front 8

To assess control risk external auditors must...

Back 8

Evaluate existing internal controls and assess the control risk for the period under audit

Front 9

How are control risks expressed?

Back 9

With descriptive terminology (e.g., maximum, slightly below maximum, high, moderate, low)
Probability number (e.g., 100, 50, or 10 percent, but never zero)

Front 10

What does it mean to assess control risk as "maximum" or 100 percent (i.e., poor control)?

Back 10

Auditors will tend to perform a great deal of substantive procedures with large sample sizes (extent) at or near the company's fiscal year-end (timing), using procedures designed to obtain high-quality external evidence (nature)

Front 11

What does it mean to assess control risk as "low" or 10 to 20 percent (i.e., effective control)?

Back 11

Auditors perform fewer substantive procedures with smaller sample sizes (extent), at an interim date before the company's fiscal year-end (timing), using a mixture of procedures designed to obtain high-quality external evidence and lower quality internal evidence (nature)

Front 12

What does control risk illustrate?

Back 12

The trade-off between audit effectiveness (catching errors or fraud) and audit efficiency (completing the audit in a timely fashion)

Front 13

Internal control

Back 13

Internal control is a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following three categories:
Reliability of financial reporting
Effectiveness and efficiency of operations
Compliance with applicable laws and regulations

A dynamic process operating every day within a company's structure

Front 14

Primary concern for external auditors

Back 14

External auditors are primarily concerned with the financial reporting controls. However, some controls related to operations and compliance can be relevant to the external audit

Front 15

Key compoent of an entity's internal control

Back 15

People

People establish the objectives, put controls in place, and operate them

Front 16

Internal control assurance

Back 16

Internal control provides reasonable assurance, not absolute assurance, the control objectives will be achieved.

Front 17

Types of control breakdowns

Back 17

Because people operate the controls, breakdowns can occur. Human error, deliberate circumvention, management override, and improper collusion among people who are supposed to act independently can cause failure to achieve objectives.

Front 18

Reasonable assurance

Back 18

In auditing standards, the concept of reasonable assurance recognizes that the costs of controls should not exceed the benefits that are expected from the controls

Front 19

What are the basic components of internal control?

Back 19

Control environment
Risk assessment
Control activities
Monitoring
Information and communication

Front 20

Control environment

Back 20

The control environment sets the tone of the organization
It is the foundation for all other components of internal control
It provides discipline and structure
Control environment factors include the integrity, ethical values, and competence of the company's people

Front 21

Audit committee

Back 21

A subcommittee of the board of directors that is generally composed of three to six "outside" members
The purpose of including outside member is to provide a buffer between the audit team and operating management. The buffer allows the audit team to report any controversial findings to members of the board of directors without fear of reprisal

Front 22

Important duties of the audit committee

Back 22

Appointment, compensation, and oversight of the audit firm conducting the company's audit
Resolution of disagreements between management and the audit team
Oversight of the company's internal audit function
Approval of nonaudit services provided by the professional services firm performing the audit engagement

Front 23

Business Risk

Back 23

Factors, events, and conditions that can prevent the organization from achieving its business objectives

Front 24

Risk Assessment

Back 24

Steps take by management to identify risks, estimate their significance and likelihood, and consider how to manage the risk.

Front 25

Purpose of setting objectives for risk assessment

Back 25

By setting objectives, management can identify critical success factors and institute policies and procedures to ensure they are met

Front 26

Control Procedures

Back 26

Imposed on the accounting system for the purpose of preventing, detecting, and correcting errors and frauds that could enter and flow through to the financial statements

Front 27

Control procedures include...

Back 27

Performance reviews
Segregation of duties
Physical controls
Information-processing controls

Front 28

Performance review

Back 28

Periodic comparison and action to correct errors lowers the risk that material misstatments remain in the accounts

Front 29

Segregation of duties

Back 29

Four types of function responsibilities should be performed by different departments, or at least by different persons on the company's accounting staff:
Authroization to execute transactions
Recording transactions
Custody of assets involved in the transactions
Periodic reconciliation of existing assets to recorded amounts

Front 30

Incompatible responsibilities

Back 30

Combinations of responsibilities that place a person alone in a position to create and conceal erros, frauds, and misstatements in her or his normal job. Duties should be divided so that no one person can control two or more of these responsibilities.

Front 31

Physical controls

Back 31

Physical access to assets and important records, documents, and blank forms should be limited to authorized personnel

Front 32

Information-processing controls

Back 32

The information system produces a trail of computer operations (audit trail) from data identification to reports. It starts with the source documents and proceeds through to the financial reports.

Front 33

Audit trail

Back 33

Auditors often follow this trail frontward and backward. They will follow it backward from the financial reports to the source documents to determenine whether everthing in the financial reports is supported by appropriate source documents (the existence or occurrence assertion)
They will follow it forward from source documents to reports to determine whether everything that happened (transactions) was recorded in the accounts and reported in the financial statements (the completeness assertion)

Front 34

Categories of information-processing controls

Back 34

General controls
Application controls

Front 35

Information technology general controls (ITGC)

Back 35

Apply to all applications systems and help ensure their continued proper operation. They can be though of in the same lights as the control environment because if the ITGC are weak, the application controls cannot be relied on.

Front 36

Information technology application controls (ITAC)

Back 36

ITAC include computerized steps within the application software and related manual procedures to control the processing of various types of transactions. ITAC are specific to each cycle. They are divided into the following categories: input controls, processing controls, and output controls

Front 37

Input controls

Back 37

Designed to provide reasonable assurance that data received fro processing by the computer department have been authorized properly and converted into machine-sensitive form, and that data have not been lost, suppressed, added, duplicated, or improperly changed

Front 38

Processing controls

Back 38

Error-condition check routines written into the computer program.
Designed to provide reaonable assurance that data processing has been performed as intended without any omission or double counting of transactions.

Front 39

Output controls

Back 39

The final check on the accuracy of the results of computer processing. These controls should be designed to ensure that only authorized persons receive reports or have access to files produced by the system.

Front 40

Spreadsheet controls

Back 40

Financial reporting controls extend over the entire process from initiation fo transactions to the financial statements. Many of the final adjusting entries, consolidating entries, and footnote amounts are created by speadsheet applications, which must also be controlled

Front 41

Spreadsheets can be evaluated using...

Back 41

Inventory the spreadsheets including name, description, department, frequency, and extent of changes
Evaluate the use and complexity of the spreadsheets
Determine the necessar level of controls for the spreadsheet
Evaluate existing controls for the spreadsheet
Develop action plans for remediating control deficiencies

Front 42

Information and communication

Back 42

A necessary prerequisite for achieving management's objectives. To make effective decisions, managers must have access to timely, reliiable, and relevant information.
Communication includes report production and distribution. Communication also involves expectations, responsibilities of individuals and groups, and other important matters.

Front 43

Monitoring

Back 43

Monitoring does not include regular management and supervisory control activites and other actions personnel take in performing their dutieis. It involves ongoing evaluation of the controls.

Front 44

Criteria for evaluating a company's financial reporting controls and the bases for auditors' assessment of control risk as it related to financial statements

Back 44

The five components of internal control

Front 45

Phases of an evaluation of control and risk assessment

Back 45

Phase 1: Understand and document the client's internal control
Phase 2: Assess the control risk (preliminary)
Phase 3: Perform tests of controls and reassess control risk

Front 46

Phase 1: Understand and document the client's internal control

Back 46

A major goal in audits is to be efficient without losing effectiveness. Generally, the more auditors know about good controls, the fewer substantive procedures they need to perform. It gives auditors an overall acquaintance with the control environment and management's risk assessment, the flow of transactions through the accounting system, and the design of some client control procedures. This step should be performed in a "top-down" risk-based manner that first examines company-level controls (CLCs) and then controls at significant business units.

Front 47

Steps in the top-down approach

Back 47

Identify, understnad, and evaluate the design of CLCs
Identify significant accounts and relevant assertions
identify significant processes and major classes of transactions
Idenfity points at whiich errors or fraud could occur
Idenfiy controls to test that prevent or detect errors or fraud on a timely basis
Clearly link individual controls with the significant accounts and assertions to which they relate

Front 48

Account's significance

Back 48

Based on the inherent risk of the account

Front 49

Inherent risk

Back 49

The likelihood of containing a material misstatement before the consideration of internal control

Front 50

Relevant assetions

Back 50

Represent the possibility of a material misstatement

Front 51

Control environment evaluation

Back 51

Primary evidence is gather through observation and inquiry and some examination of documents

Front 52

Risk assessment evaluation

Back 52

How the client assesses and responds to risk
Responses to these inquires should be supported by documentation and observation

Front 53

Information and communication assessment

Back 53

Obtain an understanding of the accounting system's flow of transactions and other processes that mitigate financial reporting risk.
Accounting manuals should contrain statement of objectives and policies. Other sources of information include (1) previous experience with the company as found in last year's audit, (2) responses to inquiries directed to client personnel, (3) inspection of documents and records, and (4) obeservation of activities and operations made in a walk-through of one or a few transactions

Front 54

Walk-through

Back 54

Consists of tracing one or more transactions through the audit trail from initiation of the transaction to its inclusion in the financial statements

Front 55

Document the internal control understanding

Back 55

Audit documentation of a decision to assess control risk as 100 percent (no reliance on internal control to reduce procedures) should explain reaons for the decision. However, for future reference in next year's audit, the memorandum should contrain an explanation of effectiveness-related or efficiency-related reasons for the assessment.
For decision to assess control risk at lower than the maximum, audit documentation is requires and should include records showing the audit team's understanding of the controls/ The understanding can be summarized in the form of questionnaires, narratives, and flowcharts.

Front 56

Internal control questionnaire

Back 56

A checklist of internal control-related questions used to gain and document an auditor's understanding of the client's internal control

Front 57

Narrative description

Back 57

Audit documentation that describes the environmental elements, the accounting system, and the control procedures in an entity's internal control

Front 58

Accounting and control system flowcharts

Back 58

The flowchart should communicate all relevant information and evidence about segregation of responsibilities, authorization, and accounting and control procedures in an understandable, visual form. The starting point in the system should, if possible, be placed at the upper left-hand corner. The flow of procedures and document should be from left to right and from top to bottom as much as is possible.

Front 59

Deciding not to test controls

Back 59

Auditors of nonpublic entities can decide to stop the evaluation work in Phase 1 for either of two reasons, both of them coordinated with the final audit program. First, the audit team could conclude that no more evidence is needed to show the control is too poor to justify reductions of subsequent audit procedures. Essentially, this decision is a matter of audit effectiveness.
Second, the audit team could decide that more time and effort would be spent testing controls to lower the control risk assessment than would be saved by being able to justify less effective or fewer substantive procedures (providing the controls turn out to be working well). The cost of obtaining a low control risk assessment can be high. The additional work on controls is not economical. The decision to stop work on control risk assessment in this case is a matter of audit efficiency.

Front 60

Phase 2: Assess the control risk (preliminary)

Back 60

The audit team should be able to make a preliminary assessment of the control risk. One way to make the assessment is to analyze the control strenghts and weaknessess.

Front 61

Control strengths

Back 61

Strenghts are specific features of good general and application controls

Front 62

Control weaknesses

Back 62

Weaknesses are the lack of controls in particular arears. Auditors do not need to perform tests of controls on weaknesses just to prove they are weaknesses.
Apparent weaknesses in any of the input, processing, and output controls are matters of concern. However, absence of a control at one stage may be offset by compensating controls at another stage.

Front 63

Bridge workpaper

Back 63

Stenghts and weaknesses should be documented in a bridge workpaper, so called because it connects ("bridges") the control evaluation to subsequent audit procedures. In the bridge workpaper, the Test of Controls Audit Program column contains tests of controls for auditing the control strengths and Compensating Substantive Procedures related to the weaknesses.

Front 64

Phase 3: Perform Tests of Controls and Reassess Control Risk

Back 64

When auditors reach the third phase of an evaluation of internal control, they will have identified specific controls of which risk could be assess below maximum

Front 65

To reduce the control risk assessment, auditors must determine...

Back 65

(1) the required degree of complaince with the control policies and procedures
(2) the acutal degree of complience.

Front 66

Test of control statement

Back 66

A test of controls is a twop-part statement. Part 1 is an identification of the data population from which a sample of items will be selected for audit. Part 2 is an expression of an action taken to produce relevant evidence. In general, the action is to determine whether (1) the selected items correspond to a standard and (2) the selected items agree with information in another data population.

Front 67

Test of controls

Back 67

Test of controls should be applied to samples of transactions and control procedures executed throughout the period under audit. The reason for this requreiment is that the conclusions about controls will be generalized to the whole period under audit.

Front 68

Perform tests of controls

Back 68

When the audit team determines that a speciofic control procedure could have a significant effect in reducing control risk to a low level for a specific assertion, they ordinarily need to perform additional tests of controls to obtain sufficient audit evidence to support the conclusion about the effectiveness of the design ro operation of that control procedure

Some test of controls inveolve reperfromance
Some tests of controls depend on documentary evidence

Front 69

Direction of the tests of controls

Back 69

Completeness direction ensures that all valid employees are included
Occurrence test ensures that all employees included are bona fide employees of the organization

Front 70

Reassess the control risk

Back 70

The audit manager or senior accountant in charge of the audit should evaluate the evidence obtained from an understanding of the internal controls and from the tests of controls. If the control risk is assessed very low, the substantive proceudres on the account balances cna be limited in cost-saving ways. On the other hand, if tests of controls reveal weaknesses substantive procedures need to be added to lower the risk of failing to detect material misstatements in the financial statements.

Front 71

Final control risk assessment

Back 71

Recognize that the final evaluation of a company's internal control is the assessment of the control risk related to each assertion. These assessments are an auditor's express of the effectiveness of internal control for preventing, detecting, and correcting specific errors and frauds in management's financial statement assertions.

Front 72

Assessment of control risk

Back 72

SHould be coordinated with the final audit plan. The final account balance audit plan includes the list of substantive procedures to detect material misstatements in account balances and financial statement disclosures.

Front 73

Dual purpose tests

Back 73

The general audit procedures can be used both as tests of controls and as substantive procedures. A single procedure can produce both control and substantive evidence and, thus, serve both purposes.

Front 74

PCAOB Audit Standard No. 2 (AS 2)

Back 74

Details the work that external auditors of public companies must perform to comply with Section 404 of Sarbanes-Oxley

Front 75

SAS 65 "Auditor's Consideration fo the Internal Audit Function"

Back 75

Much of the intial work, including documentation and testing of controls, is done by employees of the firm including the internal audit staff and outside parties hired by management.

Encourages external auditors to use the work of internal auditors; however, the external auditor's own work must provide the principal evidence for the audit opinion on internal controls

Front 76

Important difference between AS2 and GAAS

Back 76

What is considered the end of the fiscal year?

The auditor must understand and evaluate the controls for the entire period to dertermine their effect on the nature, timing, and extend of substantive procedures

Front 77

For the auditor to satisfactorily complete an audit of internal control over financial reproting, management must...

Back 77

Accept responsibility for the effectiveness of the company's internal control over financial reporting
Evaluate the effectiveness of the company's internal control over financial reporting using suitable control criteria
Support its evaluation with sufficient evidence, including documentation
Present a written assessment of the effectiveness of the company's internal control over financial repring as of the end of the company's most recent fiscal year

Front 78

AS 2 six-step audit procedure to audit financial reporting controls

Back 78

Planning the engagement
Evaluating management's assessment process
Gaining an understanding of internal control over financial reporting
Testing and evaluating design effectiveness of internal control over financial reporting
Testing and evlauting operating effectiveness of internal control over financial reporting
Forming an opinion on the effectiveness of internal control over financial reporting

Front 79

Design effectiveness

Back 79

Determines whether the controls over financial reporting, if operating effectively, would be expected to prevent or detect errors or fraud that could result in a material misstatement in the financial statements

Front 80

Operating effectiveness

Back 80

Whether the control is operating as designed and whterh the person perofrming the control possesses the necessary authority and qualifications to perform the control effectively

Front 81

Internal control deficinecy

Back 81

Exists when the design or operation of a control does not allow the company's management or employees to detect or prevent misstatements in atimely fashion

Front 82

Significant deficiencies

Back 82

Defined as conditions that could adversely affect the organization' s ability to initiate, record, process, and report financial data in the financial statements

Front 83

Material weakness

Back 83

A condition that results in more than a remote likelihood that a material misstatement exists in financial statements

Front 84

Control deficiencies

Back 84

Internal control deficiency
Significant deficiency
Material weakness

Front 85

Management's assessment

Back 85

If the auditor determines that management’s process for assessing internal control over financial reporting is inadequate, the auditor should modify her or his opinion for a scope limitation. If the auditor determines that management’s
report is inappropriate, the auditor shoud modify her or his report to includes, at a minimum, an explanatory paragraph describing the reasons for this conclusion.

Front 86

Effectiveness of Internal Control over financial reporting

Back 86

The internal control reprot may be included with the external auditor's opinion on the financial statement or may be a separate reprot

Front 87

Types of deficiencies identified by AS 2 that the external auditor must classify as a significant deficiency in internal controls

Back 87

Ineffective oversight by the audit committee
A material misstatement in the financial statements that was not identified by the system of internal control
Significant deficiencies in internal contrl that remain uncorrected after a reasonable period of time

Front 88

Auditor can issues one of three types of reprots on internal control

Back 88

Unqualified. No material weaknesses exist.
Qualified or disclaimer. Auditor cannot perform all of the procedures considered necessary.
Adverse opinion. One or more material weakness exist.

Front 89

In additon to the document requirements (AU 339), the auditor should document...

Back 89

The understanding obtained and the evaluation of the design of each of the five components of the company's internal control over financial reporting
The process used to determine significant accounts and disclosures and major classes of transactions, including the determination of the locations or business units at which to perform testing
The identification of the points at which misstatements related to relevant financial statement assertions could occur within significant accounts and disclusres and major classes of transactions
The extent to which the auditor relied on work perofrmance by others as well as the auditor's assessment of their competence and objectivity
The evaluation of any deficiencies noted as a result of the auditor's testing
Other findings that could result in a modification to the auditor's report

Front 90

Internal control communications

Back 90

Auditors' communications of significant deficiencies and material weaknesses are intended to help management carry out its responsibilites for internal control monitoring and change. However, external auditors' observations and recommendations are usually limited to external financial reporting matters.

Front 91

Management letter

Back 91

This letter may contain commentary and suggestions on a variety of matters in addition to internal control matters