Study Unit 9 Internal Controls

Front 1

Risk Assessment

Back 1

The process whereby management identifies the organizations vulnerabilities.

Front 2

Risk Management

Back 2

the ongoing process of designing and operating internal controls that mitigate the risks identified in the organizations risk assessment.

Front 3

Risk can be quantified as a combintation of two factors:

Back 3

1. the severity of consequences .
2. liklihood of occurrence.

Front 4

Inherent risk

Back 4

the susceptibility of one of the companies objectives to obstacles arising from the nature of the objectives.

Example a uranium mine is inherently riskier than a strip mall

Front 5

Control risk

Back 5

the risk that the controls put in place will fail to prevent an obstacle from interfering with the achievement of the objective.

Example a policy requiring two approvals for expenditures over a certain dollar amount could be bypassed by collusion

Front 6

Detection risk

Back 6

Th risk that an obstacle to an objective will not be detected before a loss has occurred.

FOr example: An embezzlement that continues for a year before detection is much costlier than one that is discovered after one month .

Front 7

Total risk

Back 7

Inherent risk x Detection Risk x Control risk.

Front 8

Internal Controls

Back 8

The whole system of controls established by management to carry on the business of the enterprise in an orderly and efficient manner, to ensure adherence to management policies, safeguard the assets, and ensure as far as possible the completeness and accuracy of the records.

Front 9

What does section 404 of SOX require companies to issue

Back 9

a report stating that
1. Management takes responsibility for establishing and maintaining the firms system of internal controls.
2. The system has been functioning effectively over the reporting period.

Front 10

PCAOB Auditing Standard No. 5

Back 10

"An audit of internal control over financial reporting that is integrated with an audit of financial statements. "

Front 11

A companys internal control cannot be considered effective if _________________.

Back 11

one or more material weaknesses exist.

Front 12

Material Weakness

Back 12

A deficiency or combination of deficiencies, in internal control that results in a reasonable possibility that a material misstatement of the financial statement will not be prevented or timely detected and corrected.

Front 13

COSO definetion of internal control

Back 13

A process designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
1. Effectiveness and efficiency of operations
2. Reliability of financial reporting Compliance with applicable laws and regulations.

Front 14

Effectiveness and Efficiency of Operations

Back 14

Operational objectives relate to the achievement of the entities mission concerning performance, including attainment of earning objectives and safeguarding of resources.

Front 15

Reliability of financial reporting

Back 15

To make sound decisions, investors creditors and other users must have access to reliable financial reports, especially financial statements issued for general use.

Front 16

Compliance with applicable laws and regulations.

Back 16

1. conduct activities, and often take specific actions in accordance with applicable laws and regulations.
2. Subject to laws at the local, state and federal levels.
3. responsible, not absolute assurance.

Front 17

The benefits of internal controls must always exceed

Back 17

exceed the costs of implementing them.

Front 18

What are the 5 components of COSO's internal control framework.

Back 18

The Control Environment
Risk Assessment
Control Activities
Information and communication
monitoring

Front 19

The Control Environment

Back 19

setting the tone of an entity. The foundation for all other components of internal control

Front 20

Risk Assessment

Back 20

Identification and analysis of relevant risks to achievement of the objectives. it forms a basis for determining how risks should be managed.

Front 21

Relevant risks include

Back 21

Events and circumstances that may adversely effect an entities ability to initiate, authorize, record, process and report financial data consistent with financial statement assertions.

Front 22

Control Activities

Back 22

Policies and procedures that help ensure management directives are carried out.

Front 23

Information and communication

Back 23

Pertinent information must be identified, captured, and communicated in a form and timeframe that enables people to carry out responsibilities.

Front 24

Monitoring

Back 24

Internal control systems need to be monitored. This process asesses the quality of the systems performance over time.

Front 25

The pillars of a control environment

Back 25

1. Organizational Structure
2. Policies are stated principles that require, guide, or restrict action.
3. Objectives and goals.
4. Management philosophy and operating style.
5. Assignment of authority and responsibility.

Front 26

Board of Directors role

Back 26

Most Publicly held companies are required to have a board consisting of both inside and outside members.

Front 27

Audit committee

Back 27

subcommittee of the board of directors whose purpose is to help keep the external auditors independent of management.

Front 28

The control process

Back 28

Establishing standards
Measuring performance against the standards
examining and analyzing deviations
Taking corrective action
Reappraising the standards based on experience

Front 29

Primary controls

Back 29

Preventive
Detective
Corrective
Directive

Front 30

Preventive controls

Back 30

deter the occurrence of unwanted events

Front 31

Detective controls

Back 31

alert the proper people after an unwanted event.

Front 32

Corrective controls

Back 32

correct the negative effects of unwanted events

Front 33

Directive controls

Back 33

cause or encourage the occurrence of a desirable event

Front 34

Secondary controls

Back 34

Compensatory controls
Complementary controls

Front 35

compensatory controls

Back 35

reduce ri wehn the primary controls are ineffective. but they do not by themselves, reduce risk to an acceptable level.

Front 36

Complementary controls

Back 36

work with other controls to reduce risk to an acceptable level.

Front 37

TIme-based classification

Back 37

Feedback controls
Concurrent controls
feedforward controls

Front 38

Feedback controls

Back 38

Report information about completed activities. Permit improvement in the future performance by learning from past mistakes.

Front 39

Concurrent controls

Back 39

adjust ongoing processes. Monitor activities in the present to prevent them from deviating too far from standards.

Front 40

Feedforward controls

Back 40

Anticipate and prevent problems. These controls require a long-term perspective.

Front 41

Financial controls

Back 41

"Accounting Controls"
based on relevant established accounting principles

Front 42

Operating controls

Back 42

"Administrative Controls" for production and support activities. Based on management principles and methods.

Front 43

People Based controls

Back 43

Dependent on the intervention of humans for their proper operation.

Front 44

Systems based controls

Back 44

Executed whenever needed with no human intervention

Front 45

Control Activities

Back 45

Designed and placed in operation to ensure that management directives are executed

Front 46

Segregation of duties

Back 46

assigning different employees to perform functions such that an employee acting alone is prevented from committing an error or concealing a fraud in the normal course of his/her duties.

Front 47

Four types of functional responsibilities that should be segregated

Back 47

Authority to execute transactions
Record keeping of the transaction
Custody of the assets affected by the transactions Periodic reconciliation of the existing assets to recorded amounts.

Front 48

The reconciliation of recorded accountability with the assets must be performed by a part of the organization either

Back 48

1. unconnected with the original transaction or
2. Without custody of the assets involved.

Front 49

Foreign corrupt practices act

Back 49

To prevent secret payments of corporate funds for purposes that congress has determined to be contrary to public policy.

Front 50

Section 404 Sarbox :Internal control report

Back 50

1. Statement of managements responsibility for internal control.
2. Managements assessment of the effectiveness of internal control as of the end of the most recent fiscal year.
3. Identification of the framework used to evaluate the effectiveness of internal control
4. A statement about whether significant changes in controls were made after their evaluation.
5. A statement that the external auditor has issued an attestation report

Front 51

Sarbanes Oxley Section 201 Prohibited activities

Back 51

1. Bookkeeping/other services
2. Financial information systems design.
3.appraisal/valuation services
4. actuarial services
5. internal audit outsourcing
6. management functions/HR
7. Broker or dealer, Investment advice
8. legal services

Front 52

Audit Partner Rotation

Back 52

CPA firms must rotate audit partners so that the same individual is not supervising a clients audit for an extended period of time.

Front 53

Section 302 Corporate responsibility for financial reports

Back 53

In each annual and quarterly report:
1. signing officer has reviewed
2. report doesn't have any untrue statements of fact or omission
3. the financial statements are fairly preseneted in all material respects the financial condition and results

Front 54

Section 302 What are the signing officers responsibilities

Back 54

1. Establishing and maintaing internal controls
2. They ahve designed such internal controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to such officers by others.
3. have evaluated the effeciveness of the issuers internal controls as of a date within 90 days prior to the report
4. have presented in the report their conclusions about the effectiveness of their internal controls based on their eval

Front 55

WHAT DOES THE PCAOB HAVE THE AUTHOIRTY TO DO

Back 55

To promulgate standards for the practice of auditing

Front 56

What are the four objectives of Auditing Standard 5

Back 56

1. Focus the internal control audit on the most imprtant matters.
2. Eliminate Procedures that are unecessary to achieve the intended benefits.
3. Make the audit clearly scalable to fit the size and complexity of any company.
4. simplify the text of the standard.

Front 57

What are the four different audit approaches

Back 57

1. substantive procedures approach.
2. Balance sheet approach
3. Systems based approach
4. Risk based approach.

Front 58

Substantive procedures

Back 58

aka the vouching approach. audit resources are targeted on testing large volumes of transactions and account balances without any particular focus on specified areas.

Front 59

balance sheet approach

Back 59

substantive procedures are focused on balance sheet accounts, with only limited procedures being carried out on income statement/profit and loss accounts.

Front 60

Systems basedd approach

Back 60

internal controsl audit, then to direct substantive procedures primoarily where it is considered that systems objectives will not be met.

Front 61

Risk based approach.

Back 61

audit resources are directed towards those areas of the financial statements that may contain misstatements, as a consequence of the risks faced by the business.