1. Internal control over Financial reporting : An IS control perspective
CA ANAND PRAKASH JANGID

2. Agenda Check in Financial Reporting & Regulation
Understanding Internal Control
IS Controls & Internal controls
Summary

3. What is common among them????

4. Financial Reporting & Regulation

5. Effects
Goodwill?
Public Trust?
Belief?
Jobs
Penalties
Money

6. Inefficient Internal Controls
Causes
Greed
Inefficient Internal Controls
Loopholes
Lack of Guidance

7. Key Audit standards and IS controls
SA Planning an Audit of Financial Statements SA 315- Identifying and assessing the risk of material misstatement through understanding the entity and its environment SA Audit considerations relating to an entity using a service organization SA

8. SA 300
The effect of information technology on the audit procedures, including the availability of data and the expected use of computer assisted audit techniques. Evidence of management’s commitment to the design, implementation and maintenance of sound internal control, including evidence of appropriate documentation of such internal control.

9. SA 315 : Para A50
Controls in IT systems consist of a combination of automated controls (for example, controls embedded in computer programs) and manual controls.
Further, manual controls may be independent of IT, may use information produced by IT, or may be limited to monitoring the effective functioning of IT and of automated controls, and to handling exceptions.
When IT is used to initiate, record, process or report transactions, or other financial data for inclusion in financial statements, the systems and programs may include controls related to the corresponding assertions for material accounts or may be critical to the effective functioning of manual controls that depend on IT.

10. SA 315 : Para 52
Information Technology also poses specific risks to an entity’s internal control, including, for example :
Reliance on systems or programs that are inaccurately processing data, processing inaccurate data, or both.
Unauthorized access to data that may result in destruction of data or improper changes to data, including the recording of unauthorized or nonexistent
Transactions, or inaccurate recording of transactions. Particular risks may arise where multiple users access a common database.
The possibility of IT personnel gaining access privileges beyond those necessary to perform their assigned duties thereby breaking down segregation of duties.
Unauthorized changes to data in master files.
Unauthorized changes to systems or programs.
Failure to make necessary changes to systems or programs.
Inappropriate manual intervention.
Potential loss of data or inability to access data as required.

11. SA 402
Para 3: “ Services provided by a service organization are relevant to the audit of a user entity’s financial statements when those services, and the controls over them, are part of the user entity’s information system, including related business processes, relevant to financial reporting” Para 5 : Information available on general controls and computer systems controls relevant to the client's applications

12. SA COMMUNICATING DEFICIENCIES IN INTERNAL CONTROL TO THOSE CHARGED WITH GOVERNANCE AND MANAGEMENT
Duties of Auditor
To find significant deficiencies in the IC system.
Impact on F/S after performing Risk Assessment Procedures (SA 315).
Obtaining Written Representations from Management (SA 580) and communication.

13. SA IDENTIFYING AND ASSESSING THE RISK OF MATERIAL MISSTATEMENT THROUGH UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT
Auditor’s Role
Obtain Understanding of the Internal Control System.
Perform Risk Assessment Procedures.
Categorization of Risks.

14. SA 330 - THE AUDITOR’S RESPONSES TO ASSESSED RISKS
Auditor’s Role
Classifying assessed risks as inherent or controllable
Design Responses to assessed risks
Communicate to Management (SA 265)

15. IS Controls and CARO
Para 34 of SA 400

16. Clause 49 – CEO-CFO Certification
The CEO and the CFO certify that they:
accept the responsibility for establishing and maintaining internal controls;
have evaluated the effectiveness of internal control systems
have disclosed to the Auditors and the Audit Committee:
deficiencies in internal controls (in design & operation) and
remediation steps (taken or proposed to be taken)
They have indicated to the Auditors and Audit Committee significant changes in internal control during the year

17. Understanding Internal Controls

18. Internal Controls
Internal control is defined as a process affected by an organization's structure, work and authority flows, people and management information systems, designed to help the organization accomplish specific goals or objectives.
It means policies framed by the management in order to have stronger and adequate control within the organization which can be checked by the internal auditor in order to ensure that the goals and objectives are duly met.

19. Components of Internal Controls
Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring
Control Environment
The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.
Risk Assessment
Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.
Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.
Information and Communication
Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream. There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.
Monitoring
Internal control systems need to be monitored--a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

20. Equation of Internal Control
General Financial Controls
IS Controls
Internal Controls

21. IS Controls
IS Controls
Application Controls
IT General Controls

22. Objective of IS Controls
Maintaining Confidentiality
Preserving Integrity
Ensuring Availability

23. Applications Controls
Application software is the software that processes business transactions.
The application software could be a payroll system, a retail banking system, an inventory system, a billing system or, possibly, an integrated ERP.
It is the application software that understands data with reference to their business context. The rules pertaining to the business processes are implemented in the application software.

24. Examples of Applications
General Ledger
Fixed Assets
Inventory Control
Enterprise Resource Planning
Human Resources
And, everyone’s favorite – Payroll…

25. Types of Application Controls
Input Controls
Processing Controls
Output Controls
Integrity Controls
Management Trail

26. Examples for Application controls
Input Controls
Data checks and validations
Automated authorization, approval, and override
Automated SOD
Processing Controls
Automated file identification and validation
Automated functionality and calculations
Audit trails and overrides
Data extraction, filtering, and reporting
Interface balancing
Automated functionality and aging
Duplicate checks
Output Controls
General ledger and sub-ledger posting
Update authorization

27. Examples for Application Controls
Integrity Controls
Data encryption, which locks data by cipher
Data backup, which stores a copy of data in an alternate location
Access controls, including assignment of read/write privileges
Input validation, to prevent incorrect data entry
Data validation, to certify uncorrupted transmission
Management Trail
Systems Control Audit Review File and Embedded Audit Modules (SCARF/EAM)
Snapshots
Audit hooks
Integrated Test Facility
Continuous and Intermittent Simulation

28. General Controls
IT general controls (ITGC) are controls that apply to all systems components, processes, and data for a given organization or information technology (IT) environment. The objectives of ITGCs are to ensure the proper development and implementation of applications, as well as the integrity of programs, data files, and computer operations. ITGCs may also be referred to as General Computer Controls which are defined as: Controls, other than application controls, which relate to the environment within which computer-based application systems are developed, maintained and operated, and which are therefore applicable to all applications. These are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems.

29. Types of IT General Controls
Logical access controls over infrastructure, applications, and data.
System development life cycle controls.
Program change management controls.
Data center physical security controls.
System and data backup and recovery controls.
End User controls.
IS Security

30. Key areas which needs attention
Logical Access
Grant of access
Revocation of Access
SDLC
Documentation of Requirements
Integration testing and UAT
Training to end users
Change Management
Source Code versioning
Rollback Plan
Release Management
Archival of older versions

31. Key areas which needs attention
Data Center and Physical Access
Physical Locks and Bio metric locks
Data Center Environment
Security Personnel
Backup and Recovery
Backup Procedures
Recovery Procedures
Application data and environment
Backup Tapes
End User
Acceptable Usage
Password Policy
Ticket Management
Logs and Review

32. Key areas which needs attention – IS Security
Antivirus
Firewall
Wireless Network
Computers
Server
Network
Servers
Encryption
MAC Filter
Patch Updates
Virus Definition Updates
Automatic Log out and screen lock

33. Summary
With the advent of IT in every sphere of business it have been evident that we Chartered Accountants need to rise and seize this opportunity.

34. When are these opportunities??
Check out
When are these opportunities??
Half our life is spent trying to find something to do with the time we have rushed through life trying to save.
Will Rogers

35. Questions???

36. Thank You
CA ANAND PRAKASH JANGID