Auditing - Ch. 06 Internal Control In A Financial Statement Audit

Front 1

What are the responsibilities of Auditors and Management in Internal Control?

Back 1

A process, effected by an entity's Board of Directors, Management, and Other personnel, designed to provide REASONABLE ASSURANCE regarding the achievement of 3 objectives.

Hint 1

ch. 6

Front 2

What are the objectives of Internal Control?

Back 2

1. Reliability of Financial Reporting
2. Effectiveness and Efficiency of Operations
3. Compliance with applicable laws and regulations

Hint 2

ch. 6

Front 3

Which Internal Control objectives are relevant to Auditors?

Back 3

1. Reliability of financial reporting
(the other two have to do with Management, BOD, government and Investors)

Hint 3

ch. 6

Front 4

List the components of Internal Control.

Back 4

1. Control Environment
2. Entity's Risk Assessment process
3. Information System and related business processes relevant to financial reporting and communication
4. Control Activities
5. Monitoring of Controls

Hint 4

ch. 6

Front 5

What are the factors affecting the Control Environment?

Back 5

1. Management's philosophy, operating style, Integrity, Ethics
2. Existence / Implementation of an entity code of ethics
3. Management's financial reporting attitudes
4. Organizational structure
5. Membership and operation of the board's AUDIT COMMITTEE
6. Presence/Performance of an Internal Audit function

Hint 5

ch. 6

Front 6

What is Risk Assessment in Internal Control?

Back 6

The entity's identification and analysis of relevant risks to help ensure achievement of its objectives.

Hint 6

ch. 6

Front 7

What is the COSO framework for the design of Internal Control Systems?

Back 7

ERM (Enterprise Risk Management) -
This risk assessment process should consider EXTERNAL and INTERNAL events and circumstances that may arise and adversely affect the entity's ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial statements.

Hint 7

ch. 6

Front 8

What are the types of Control Activities in Internal control?

Back 8

1. Performance Reviews
2. Segregation of Duties
3. Physical controls over the security of assets
4. Information Processing (data verification, new system development, System access restriction)

Hint 8

ch. 6

Front 9

Describe Control Activities in Internal Control?

Back 9

Policies and Procedures that help ensure that management's directives are carried out and are implemented to address risks identified in the risk assessment process.

Hint 9

ch. 6

Front 10

What is the importance of monitoring mechanisms in Internal control?

Back 10

Management should assess the quality of control performance on a TIMELY BASIS and TAKE NECESSARY CORRECTIVE ACTION. (need this so that they can respond to problems in a timely basis)

Hint 10

ch. 6

Front 11

What are the limitations of Internal Controls?

Back 11

1. Human error
2. Collusion
3. Management override
4. Cost/Benefit Analysis
*** There is often a trade-off between the cost and the effectiveness of Internal Controls.
*** The concept of REASONABLE ASSURANCE recognizes that the cost of an entity's internal control should not exceed the benefits that are expected to be derived.

Hint 11

ch. 6

Front 12

What is the difference in testing procedures for Public versus NonPublic companies in Internal Controls?

Back 12

Public clients and Non-Public clients:
1. Understand the client's internal control (top-down approach -- effective way is to do a walk-through)
** Document the understanding of internal control by doing a QUESTIONNAIRE, NARRATIVE, and/or an ACCOUNTING AND CONTROL SYSTEM FLOWCHART.
----
Process for Non-Public clients can stop at this point, because:
1. Controls are found to be ineffective
2. Testing of controls is not efficient.

Hint 12

ch. 6

Front 13

What are the General Phases of Internal Control for Public clients?

Back 13

1. Understand and Document client's internal controls
2. Assess control risk (Preliminary)
3. Perform Tests of Controls and Reassess (identify specific controls that will be relied upon, Perform tests of controls, Conclude on the achieved level of control risk)

Hint 13

ch. 6

Front 14

What is the purpose of the auditor's control risk assessment in Internal control evaluation?

Back 14

To Gain understanding of the client's internal controls and document the understanding.

Hint 14

ch. 6

Front 15

What is the relationship between the Control Risk assessment and Substantive Testing procedures?

Back 15

The Substantive procedure is OPTIONAL. This is done AFTER understanding the Internal control. The control risk is SET AT THE MAXIMUM LEVEL for some or all assertions because of one or all of the following factors:
1. Controls are assessed as ineffective
2. Testing the effectiveness of controls is inefficient

Hint 15

ch. 6

Front 16

What's the difference between a Reliance Strategy and a Substantive Strategy?

Back 16

A Substantive strategy means that the auditor will NOT rely on the entity's controls and will use substantive procedures as the main source of evidence about the assertions in the financial statements.
A Reliance Strategy means that the auditor intends to rely on the entity's controls.

Hint 16

ch. 6

Front 17

When is the Reliance Strategy and Substantive Strategy acceptable?

Back 17

SUBSTANTIVE STRATEGY - when controls are assessed as INEFFECTIVE and
Testing the Effectiveness of controls is INEFFICIENT
RELIANCE STRATEGY - when the auditor has a more detailed understanding of internal control, so he relies on the entity's controls.
SUBSTANTIVE STRATEGY - when controls are assessed as INEFFECTIVE and Testing the effectiveness of controls is INEFFICIENT.

Hint 17

ch. 6

Front 18

Explain Reliance Strategy.

Back 18

A Reliance Strategy means that the auditor intends to rely on the CLIENT'S CONTROLS!
After obtaining an understanding of Internal Controls, an auditor may choose to follow the Reliance Strategy by setting control risk BELOW THE MAXIMUM (Set CR at Moderate or Low) for some of all assertions.
It requires these:
1. Identify specific controls that will be relied upon
2. Perform tests of controls
3. Conclude on the achieved level of control risk

Hint 18

ch. 6

Front 19

Given the information about the strategy selected, what does this tell you about control risk (and the nature of the tests that will be performed)?

Back 19

The auditor uses the achieved level of Control Risk and the Assessed Level of Inherent Risk to assess the risk of material misstatement and to then determine the level of Detection Risk needed to bring Audit Risk to an acceptable LOW LEVEL. The level of Detection Risk is used to determine the nature, timing, and extent of SUBSTANTIVE TESTS.
** If the Tests of Control are consistent with the auditor's planned assessment of CR, then no extra tests of substantive procedure need be done.
** If, however, the Tests of Controls show that the controls are not working as assessed, then the CR low-level has not been reached and there needs to be more substantive procedures done.

Hint 19

ch. 6