Chapter 7- Internal Control

Front 1

Internal control definition

Back 1

A process,effected by the entity’sboard of directors, management, and other personnel, designed to providereasonable assurance regarding, achievement of (the entity’s)objectives relating to:

-Operations

-Reporting

-Compliance

Front 2

Internal control objectives

Back 2

-in each area of internal control, objectives and sub-objectives must exist

Front 3

Foreign Corrupt Practices Act

Back 3

Passedin 1977 in response to American corporation practice of paying bribes andkickbacks to officials in foreign countries to obtain business --TheAct:

-Requiresan effective system of internal control

-Makesillegal payment of bribes to foreign officials

Front 4

Controls over financial reporting include:

Back 4

-preventative

-corrective

-detective

-controls overlap

Front 5

Preventative controls

Back 5

Aimedat avoiding the occurrence of misstatements in the financial statements

-Example: Segregation of duties

Front 6

Corrective controls

Back 6

Neededto remedy the situation uncovered by detective controls

-Example: Backups of master file

Front 7

Detective controls

Back 7

Designedto discover misstatements after they have occurred

-Example: Monthly bank reconciliations

Front 8

Types of controls overlap:

Back 8

-Complementary– function together

-Redundant– address same assertion or control objective

-Compensating– reduces risk existing weakness will result in misstatement

Front 9

Components of Internal Control

Back 9

-TheControl Environment

-RiskAssessment

-ControlActivities

-InformationSystem Relevant to Financial Reporting and Communication

-MonitoringActivities

Front 10

Control environment factors:

Back 10

-Commitmentto integrity and ethical values

-Boardof directors demonstrates independence from management and exercises oversightof internal control

-Establishmentof effective structure, including reporting lines, and appropriate authoritiesand responsibilities

-Commitmentto attract, develop, and retain competent employees

-Holdingemployees accountable for internal control responsibilities

Front 11

Criteria for risk assessment

Back 11

-Clearlyspecify objectives to allow the identification and assessment of risks relatedto those objectives

-Identifyand analyze risks to the achievement of its objectives to determine how theymay be managed

-Considerpotential fraud relating to the achievement of objectives

-Identifyand assess changes that could impact internal control

Front 12

Control activities

Back 12

-Performancereviews

-Transactioncontrol activities

-Physicalcontrols

-Segregationof duties

-Segregateauthorization, recording and custody of assets

Front 13

Monitoring

Back 13

Ongoingmonitoring activities include:

-Regularlyperformed supervisory and management activities

Example: Continuous monitoring of customer complaints

Front 14

Enterprise risk management (ERM)

Back 14

-COSO issued a new internal controlframework in 2004 on enterprise risk management. It does not replace the original COSOinternal control framework

-Theauditing standards are still structured around the original COSO internalcontrol framework

Front 15

Steps of overall approach with internal control include:

Back 15

1.Planthe audit

2.Obtain an understanding of the client and its environment, including internalcontrol

3.Assess the risks of material misstatement and design further audit procedures

4.Perform further audit procedures

5.Complete the audit

6.Form an opinion and issue the audit report

Front 16

Step 2: obtaining an understanding of the client and environment

Back 16

Theunderstanding of internal control is used to help the auditor to:

-Identifytypes of potential misstatements

-Considerfactors that affect the risks of material misstatement

-Designtests of controls (when applicable) and substantive procedures.

Front 17

Obtaining the understanding procedures:

Back 17

-Inquiringof entity personnel

-Observingthe application of specific controls

-Inspectingdocuments and reports

-Tracingtransactions through the information system relevant to financial reporting

Front 18

How is the understanding of internal control documented?

Back 18

-questionnaires

-written narratives

-flowcharts

-walk-throughs

Front 19

Step 3- assess the risks of material misstatements general approach

Back 19

-Identifyrisks while obtaining an understanding of the client and its environment,including its internal control

-Relatethe identified risks to what can go wrong at the relevant assertion level

-Considerwhether the risks are of a magnitude that could result in a materialmisstatement

-Considerthe likelihood that the risks could result in a material misstatement

Front 20

3 types of nature of transactions

Back 20

-Routinetransactions—e.g., revenue, purchases, and cash receipts and disbursements

-Non-routinetransactions—e.g., taking of inventory, calculating depreciation expense

-Estimationtransactions—e.g., determining the allowance for doubtful accounts

Front 21

Responses to high risks of assessing financial statements

Back 21

-Assigningmore experience staff or those with specialized skills

-Providingmore supervision and emphasizing the need to maintain professionalskepticism

-Incorporatingadditional elements of unpredictability in the selection of further auditprocedures to be performed

-Increasingthe overall scope of audit procedures, including the nature, timing or extent

Front 22

Step 4- preform further audit procedures: approach

Back 22

-Identifycontrols likely to prevent or detect material misstatements

-Performtests of controls to determine whether they are operating effectively

Front 23

What do tests of controls address?

Back 23

-Howcontrols were applied

-Theconsistency with which controls were applied

-Bywhom or by what means (e.g., electronically) the controls were applied

Front 24

What do tests of controls include?

Back 24

-Inquiries ofappropriate client personnel

-Inspectionofdocuments and reports

-Observationofthe application of controls

-Reperformanceofthe controls

Front 25

How is the work of internal auditors used?

Back 25

-Obtainingaudit evidence by using the internal auditors’ work performed as a part oftheir normal responsibilities

-Usinginternal auditors to provide direct assistance on the external audit.

Front 26

What do computer service organizations provide?

Back 26

processingservices to customers who decide not to invest in their own processing ofparticular data

-Examples: Outsource processing of payroll or Internetsales.

Front 27

Type 1 service auditor report

Back 27

Management’sdescription of the system and the suitability of the design of controls

Front 28

Type 2 service auditor report

Back 28

Attributesof 1, plus assurance on the operating effectiveness of controls

-AType 2 report may provide the user auditor with a basis for assessing controlrisk below the maximum.

Front 29

3 different deficiencies in internal control

Back 29

-less than significant

-significant deficiency

-material weakness

Front 30

Management's report on internal control under Section 404a

Back 30

-Acknowledgmentof responsibility for internal control

-Anassessment of internal control effectiveness as of the last day of the company’sfiscal yearn using suitable criteria

-Supportthe evaluation with sufficient evidence