Risk Assessment, Controls And Risk Management

Front 1

Risk

Back 1

Any threat to the economic welfare of a business
In monetary term combine value of exposed assets and probability of loss

Front 2

Risk = p(t) x p(f) x amount of loss

Back 2

p=probability
t=threat
f=failure of control

Front 3

Risks ^ Controls ^

Back 3

Risk assessment drives design of controls, direct correlation

Front 4

Minimize Risk (3)

Back 4

insure/reduce possible losses
increase controls
prevent threat occurence

Front 5

Factors Affecting Risks (5)

Back 5

frequency of independent checks
adequacy of controls and communication of authority & responsibility
physical controls
consistency of control enforcement

Front 6

Control Risk

Back 6

Risk of a control failure (mistakes/fraud aren't prevented or detected by controls)

Front 7

Inherent Risk

Back 7

Risk when there are no internal controls

Front 8

Detection Risk

Back 8

Risk that audit procedures will fail to detect misstatements

Front 9

AAR (Acceptable Audit Risk): direct correlation with three factors

Back 9

management integrity
# of financial statement users
financial condition of auditee

Front 10

Evidence Required by Auditor: inverse correlation with

Back 10

Calculated Detection Risk

Front 11

AAR = IR x CR x DR

Back 11

calculate audit risk

Front 12

Control Risk inverse to Detection Risk

Back 12

good internal controls, auditor can do less testing. Audit risk remains unchanged

Front 13

Auditor Assesses

Auditor Influences

Back 13

IR & CR

DR

Front 14

Audit Risk and Materiality determine:

Back 14

type and amount of evidence for auditor

Front 15

Amount of evidence determines:

Back 15

audit procedures to conclude with reasonable assurance

Front 16

Internal Control-Integrated Framework
COSO-1992

Back 16

broadly accepted model for designing and assessing internal controls
(applies to operations, reporting and compliance)

Front 17

Enterprise Risk Management-Integrated Framework
COSO - 2004

Back 17

internal control and risk mgmt guidelines

Front 18

Framework Components (5)

Back 18

control environment/risk assessment/control activities/monitoring/ information and communication

Front 19

COSO Control Activities (6)

Back 19

assignment of authority and responsibility
transaction authorizations
documentation and records
security of assets
separation of duties
independent verification

Front 20

Separation of Duties

Back 20

recording
authorization
custody
reconciliation

Front 21

General/Specific

Controls

Back 21

polices & procedures regarding the approach to IC (effects effectiveness of specific controls)/procedures that implement approach

Front 22

Components of IC Structure (3)

Back 22

Control Enviroment
Accounting System
Control Procedures (gen./specific)

Front 23

Methods of Internal Controls (5)

Back 23

Review/Monitoring
Physical Security
Operational
Organizational
Personnel Management

Front 24

Review (Monitoring) Controls

Back 24

Employee reviews
Internal/External Audits
SOX committee (compliance reviews)

Front 25

Physical Controls

Back 25

Smoke alarms
Maintenance on capital equipment
ID badge (physical security)

Front 26

Operational Controls

Back 26

Planning
Budgeting
Information Technology

Front 27

Organizational Controls

Back 27

each division has responsiblity

Front 28

Personnel Mgmt.

Back 28

Training
Development
Supervision

Front 29

Stakeholder Roles in Internal Controls (5- stakeholders)

Back 29

Board of Directors
External Auditors
Senior Mgmt.
Internal Auditors
Staff Line & Managers

Front 30

B of D
Audit Committee

Back 30

oversight
define corporate culture
set objectives
approve strategies

Front 31

External Auditors

Back 31

attest to financial statement (fairly represent company)

Front 32

Senior Mgmt.

Back 32

leadership
they must define, develop, document, implement, demonstrate internal controls

Front 33

Internal Auditors Role

Back 33

assess IC environments and make recommendations/improvements
Validate IC and compare to industry standards

Front 34

Staff Line & Managers Role

Back 34

Review & Monitor Controls
Contribute to design & implementation of IC

Front 35

SOX controls (3)

Back 35

established:
1. PCAOB 2. higher standards of corporate responsibility (internal) and 3. enhanced financial disclosure (external)

Front 36

PCAOB Standard #5

Back 36

auditors required to complete SEC #404, IC statement within annual report. Mgmt. evaluation of IC within 90 days prior to annual audit report

Front 37

PCAOB Standard #5 requirements (3)

Back 37

Audit is scaled to the size of the organization
Principles-based approach reliance of others' work
TDRA-top down risk assessment approach for auditing FS & IC

Front 38

TDRA (5)

Back 38

1. identify significant facts & disclosures
2. identify risks of material misstatements (risks of #1)
3. determine entity level controls which address risks
4. determine transaction based controls to compesate for entity-level control failures
5. determine nature/timing/extent of tests needed to complete IC assestment

Front 39

SOX section 302

Back 39

Requires:
1. CEO & CFO cerify reports filed to SEC and
2. Mgmt design & implementation of IC

Front 40

SOC section 404 (4)

Auditors Responsibility

Back 40

1. Annual report responsibility of Mgmt for IC
2. Annual report has assessment of effectiveness of IC
3. External Auditor, attest & report on Mgmt of controls and procedures.
4. Certify IC can ensure accuracy and IC was evaluated

Front 41

Cost/Benefit of 404 compliance (7)

Back 41

1. improved insight into procedures 2. more reliable reports 3. address control deficiencies 4. stronger IC 5. reduced fraud risk 6. improved efficiency 7. support for governance structure

Front 42

IC protects 5 areas

S.C.A.R.E.

Back 42

Safeguard Assets
Comply with laws & regs
Accomplish Goals
Reliability of records & reporting
Efficiency of operations

Front 43

Considerations during design of policies & procedures

Back 43

potential risks
actual risk exposure
stated risk

Front 44

FCPA (foreign corrupt practices act)

Back 44

SEC monitors compliance with IC provisions of FCPA
controls: 1.bribes in foreign countries are prohibited 2.accurate record keeping requirement

Front 45

Five types of Internals Controls

Back 45

1. preventive
2. corrective
3. detective
4. compensating
5. directive

Front 46

Preventive Controls

Back 46

separation of duties
security alarm

Front 47

Detective Controls

Back 47

random checks
reconciliations

Front 48

Corrective Controls

Back 48

fix mistakes found in detection

Front 49

Compensating Controls

Back 49

overcome deficiencies in controls
(external audits)

Front 50

Directive Controls

Back 50

policies for bidding & vendors
(good will)