Presentation on theme: "Chapter 7 Understanding Internal Control over Financial Reporting and Auditing Design Effectiveness."— Presentation transcript:
Chapter 7 Understanding Internal Control over Financial Reporting and Auditing Design Effectiveness
Learning Objectives 1. Understand the value of effective internal control. 2. Learn the components and mechanisms of internal control. 3. Describe the internal control-related requirements imposed on management of public companies. 4. Analyze the relationship between management’s assertions, ICFR, and activities of an integrated audit. 5. Explain the approach and steps an auditor uses to understand a company’s ICFR and assess its design effectiveness.
Audit Planning and Risk Assessment Exhibit 7-1
Authoritative Sources for this Chapter Sarbanes Oxley Act (SOX) Securities and Exchange Commission (SEC) Public Company Accounting Oversight Board (PCAOB) American Institute of CPAs (AICPA) Statements on Auditing Standards (SAS) International Auditing and Assurance Standards Board (IAASB) International Standards on Auditing (ISA) Committee of Sponsoring Organizations (COSO) Foreign Corrupt Practices Act, 1977 (FCPA)
Auditors and ICFR Auditor has to understand the client’s Internal Control over Financial Reporting and assess the effectiveness of its design: An important part of planning To be able to select which controls to test in the audit and plan substantive audit procedures
Corporate Accountants and ICFR Accountants inside a company need to understand Internal Control over Financial Reporting because good ICFR helps the company: use cost effective procedures manage costs of processing accounting information manage productivity of the company’s financial functions maintain an effective financial control system
Definition of Internal Control over Financial Reporting Internal control over financial reporting is a subset of the entire system of internal control Two important sources of definitions PCAOB’s definition in AS 5 COSO’s definition in Internal Control Framework The COSO definition is broader than the PCAOB’s definition …this makes sense because the PCAOB defines the target of an audit, while COSO’s Internal Control Framework is for more general use
PCAOB AS 5, Definition of Internal Control Internal control over financial reporting is a process designed by, or under the supervision of, the company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the company’s board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP and includes those policies and procedures that --
PCAOB AS 5 Definition (continued) Pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements
Investor Confidence and Internal Control In the simplest terms, investors can have much more confidence in the reliability of a corporate financial statement if corporate management demonstrates that it exercises adequate control over bookkeeping, the sufficiency of books and records for the preparation of accurate financial statements, adherence to rules about the use of company assets and the possibility of misappropriation of company assets. (PCAOB Release 2004-001, p. 3)
Concepts from COSO Definition Internal control is a process. It is a means to an end, not an end in itself. Internal control depends on people. It is not just policy manuals and forms, but people at every level of an organization. Internal control only provides reasonable assurance – not absolute assurance. Internal control objectives may address single or overlapping categories of internal control components.
COSO Categories of Internal Control Reliability of financial reporting Directly relates to integrated audit goals Effectiveness and efficiency of operations Important to management Compliance with laws and regulations Less directly related to integrated audit goals Important to management
Overview of the COSO IC Structure Control environment Risk assessment Control activities Information and communication Monitoring The PCAOB uses these same categories in As 12, Identifying and Assessing Risks of Material Misstatement.
Control Environment “Tone at the top” Integrity and ethical values Commitment to competence Board of Directors or audit committee participation Management’s philosophy and operating style Organizational structure Assignment of authority and responsibility Human resources policies
Risk Assessment Risks defined: Anything that can keep an organization from achieving its objectives. Organization must set its objectives Organization must identify threats to achieving the objectives Guidance to risk assessment is in the COSO Enterprise Risk Management (ERM) Framework Risk can be From external and internal factors At entity and activity levels
Risk Assessment Considerations Significance or degree of impact of the risk on the company Likelihood of the risk occurring or frequency with which it may occur Best ways to manage the risk
Ways to Identify Risks Qualitative and quantitative approaches to identify higher-risk activities Period review of economic and industry factors Business planning conferences and meetings Forecasting Strategic planning
External and Internal Sources of Risk External Technological developments Changing customer needs or expectations Competition New legislation and regulation Natural catastrophes Economic changes Internal Disruption in information systems processing Personnel: hiring, training, motivation Change in management responsibilities Entity’s activities and employee access to assets Unassertive or ineffective board or audit committee
Circumstances Demanding Special Risk Assessment Attention Changed Operating Environment New Personnel New or Revamped Information Systems Rapid Growth New Technology New Lines, Products, Activities Corporate Restructurings Foreign Operations
Control Activities Control activities defined: the policies and procedures that help ensure management directives are carried out Policies: establish what should be accomplished in carrying out management’s directives to address risk Procedures: the activities that should be followed to carry out the policies
Categories of Control Activities Performance reviews Used to monitor the business, often on an ongoing basis Information processing Controls over use of IT to initiate, record, process and report transactions and other financial data General and Application controls Physical controls Over assets and access to information Segregation of duties Assigning different people responsibility for authorizing transactions, recording transactions and maintaining custody of assets Collusion is a threat to segregation of duties
Information and Communication Quality of Information Content appropriate: Is the needed information available? Information timely: Is it available when required? Information current: Is the latest information available? Information accurate: Are the data correct? Information accessible: Can the information be obtained easily by the appropriate parties? Communication Tool for control related to ICFR Means of enabling achievement of the objectives of the business
Monitoring Ongoing monitoring: those things that are a part of running the business Separate monitoring: activities conducted for the specific purpose of monitoring Tradeoff…the more ongoing monitoring exists the less separate monitoring may be needed
COSO Guidance on Monitoring Internal Control Systems Monitoring is a normal state of affairs in the organization. Monitoring is a formal part of the organization. Someone has responsibility for developing monitoring procedures. Employees execute monitoring activities and make reports as a normal part of their jobs. Management assesses reports and take whatever action is needed.
Management’s Responsibility for Internal Control Foreign Corrupt Practices Act, 1977 Requires management of public companies to maintain a system of control Sarbanes Oxley Act Section 302: management certification Section 404: management assessment, report and audit Dodd Frank Act Permanently exempts smaller public companies from the requirement of having ICFR audited; retains management requirement to assess ICFR and report
SOX Section 302 Management Certification Specific officers or those with officer functions must sign Reviewed the SEC filing; annual or quarterly report SEC filing does not include anything material that is untrue SEC filing does not omit anything material that makes statements untrue Fair financial reporting Management is responsible for internal control Controls permit people within the company to prepare the SEC reports Have evaluated effectiveness of ICFR within 90 days prior and are presenting their conclusions Have told the auditor and audit committee about ICFR problems Have told the auditor and audit committee of management fraud Have reported any changes in internal control Have reported any events that occurred after the report date that may affect internal control
SOX Section 404 Annual SEC filing must include an internal control report Report states management’s responsibility for internal control and producing financial information Report includes management’s assessment at fiscal year end about internal controls and procedures for financial reporting SEC Interpretive Release 2007: No requirement that management’s assessment be performed using the guidance in the Interpretive Release, but the guidance provides an acceptable way to perform the assessment of ICFR
SOX Section 404, Audits of ICFR ICFR must be audited for all companies except those exempted by Dodd Frank Auditor must Be registered with PCAOB Attest to (audit) management’s report Follow PCAOB standards for an audit of ICFR Since SOX requires that the financial statement and ICFR audit be one integrated engagement, the same auditor must do both
Background to an Audit of ICFR Objective of an integrated audit report on ICFR and the financial statements Opinion on the fairness of the financial statements Opinion on the effectiveness of ICFR Opinions can be in a combined or separate reports If the auditor disagrees with management’s assessment this is added to the audit report Auditor must audit the financial statements to audit ICFR Auditor uses information and conclusions from each part of the audit in the other part of the audit
Approach to an Integrated Audit Identify what would make the financial statements materially misstated. Focus on management’s assertions in understanding the accounting system Identify …important controls….that address significant risks…associated with management’s assertions Assess whether the controls are designed effectively so that, if operating effectively, they can prevent or detect material misstatements Test operating effectiveness of controls Perform substantive procedures
Assertions defined… Assertions are representations by management, explicit or otherwise, that are embodied in the financial statements, as used by the auditor to consider the different types of potential misstatements that may occur. ISA 315
Management’s Assertions PCAOB uses 5 AICPA and IAASB use 13 Auditors have to cover the important concepts in the assertions, but otherwise can express them however they choose …it is easy to see how both sets of assertions cover the same concepts….
PCAOB Assertions: AS 15, Audit Evidence Existence or occurrence – Assets or liabilities of the company exist at a given date, and recorded transactions have occurred during a given period. Completeness – All transactions and accounts that should be presented in the financial statements are included. Valuation or allocation – Asset, liability, equity, revenue, and expense components have been included in the financial statements at appropriate amounts. Rights and obligations – The company holds or controls rights to the assets, and liabilities are obligations of the company at a given date. Presentation and disclosure – The components of the financial statements are properly classified, described, and disclosed.
AICPA and IAASB, 13 Assertions Classes of Transactions and Events Occurrence Completeness Accuracy Cutoff Classification Account Balances Existence Rights and Obligations Completeness Valuation and Allocation Presentation and Disclosure Occurrence, Rights, Obligations Completeness Classification and Understandability Accuracy and Valuation
Difference between 5 and 13… The AICPA and IAASB use additional terms: Accuracy, Cutoff, Classification, Understandability Explanations to consider: If an item posted is not accurate – including being posted in the wrong period or to the wrong account --it either did not occur as shown or the balance is incomplete If a disclosure is not accurate it cannot meet the requirements for the presentation and disclosure assertion Proper classification is a part of the presentation and disclosure assertion If an item is not understandable it cannot be properly described under the presentation and disclosure assertion
Reminder: Use of Management Assertions Auditor identifies Significant accounts and disclosures Relevant assertions for those accounts and disclosures Auditor considers risks that might cause the assertions to be wrong Auditor looks for ICFR controls in place to prevent or detect any misstatements resulting from the risks Auditor assesses whether controls are designed so that they can be effective if they operate properly Audit continues with Selecting controls to test; considering whether to always rely on controls in financial statement audit Deciding how controls tests should be performed Deciding on substantive procedures needed
Time Periods Covered by Audit Procedures For an audit opinion that ICFR is effective it must be effective at fiscal year end ICFR must be effective at and for a period of time prior to fiscal year end so that the auditor has confidence in the conclusion To rely on ICFR in the financial statement audit, the auditor must test ICFR for the entire period of reliance If ICFR was not effective throughout the entire financial period, this affects the financial statement audit procedures Even in an integrated audit, the auditor may choose not to rely on ICFR for an account, and consequently only test related controls at fiscal year end
Evidence Related to ICFR Making inquiries of appropriate management, supervisory, and staff personnel Inspecting company documents Observing the application of specific controls Tracing transactions through the information system relevant to financial reporting Walkthroughs – a set of procedures performed together; an efficient way to understand ICFR and assess design effectiveness
Walkthroughs Tracing a transaction from origination until it is reflected in the company’s financial records Includes inquiry and observation steps Information from a walkthrough: Who performs the control? Or, if automated, what system What is performed and why? What is the management assertion? When is the activity performed, including how often? What evidence is produced showing that the control occurred? How are problems or exceptions investigated and resolved?
Examples of Walkthrough Inquiries What do you do when you find an error? What are you looking for to determine if there is an error? What kinds of errors have you found? What happens as a result of finding errors? How are errors resolved? Have you ever been asked to override the process or controls? Is so, what happened and why did it occur?
Audit Documentation Audit documentation is the written record of the auditor’s work. Information included in documentation: Planning and performance of the work Procedures performed Evidence obtained Conclusions reached Professional judgment is used to decide how extensive audit documentation must be
AS 3 Documentation Requirements Demonstrate that the engagement complied with the standards of the PCAOB Support the auditor’s conclusions concerning every relevant financial statement assertion Nature, timing, extent and results of procedures performed – means: what was done, when, by whom, outcomes, reviewer, date of review Demonstrate that the underlying accounting records agreed or reconciled with the financial statements
Characteristics that Cause More Documentation An audit task that is difficult to understand or interpret An audit task that requires a lot of judgment An audit task that is very important to the audit A management assertion that has a lot of risk
Required Documentation of Contradicting Issues AS 3.8: In addition to the documentation necessary to support the auditor’s final conclusions, audit documentation must include information the auditor has identified relating to significant findings or issues that is inconsistent with or contradicts the auditor’s final conclusions. The relevant records to be retained include, but are not limited to, procedures performed in response to the information, and records, documentation, consultations on, or resolutions of, differences in professional judgment among members of the engagement team or between the engagement team and others consulted.
Documentation of the Company’s ICFR SEC requires management to have significant documentation to support its conclusions about ICFR Form of documentation varies depending on company characteristics (size, complexity, etc.) Management can rely on documents it uses day-to- day or develop specific ICFR documentation Auditor may use company’s documentation to advance understanding of the company and ICFR assessment
ICFR Documentation Techniques Used Flowcharts Process models Narrative descriptions Job descriptions Samples of transaction documents and forms, procedures manuals, organization charts Questionnaires and checklists
Information in Management’s ICFR Documentation The design of controls over relevant assertions related to all significant accounts and disclosures in the financial statements Information about how significant transactions are initiated, authorized, recorded, processed, and reported Information about the flow of transactions to identify the points at which material misstatements due to error or fraud could occur Controls designed to prevent or detect fraud, including who performs the controls and the related segregation of duties Controls over the safeguarding of assets The results of management’s testing and evaluation of ICFR
Entity Level Controls Pervasive controls; those that exist at the organization or company level, but have an impact on controls at the process, transaction, or application level Examples Controls related to the control environment Controls over management override The company’s risk assessment process Centralized processing and controls Controls over shared service environments Controls to monitor other controls Period-end financial reporting process controls Policies that address significant business control and risk management practices
Three Categories of Entity-Level Controls 1. Have an important, but indirect effect on the likelihood that a misstatement will be detected or prevented on a timely basis 2. Monitor the effectiveness of other controls; might identify breakdowns in lower-level controls but not at a level of precision that would sufficiently address the risk of material misstatements 3. Operate at a level of precision that would adequately prevent or detect on a timely basis misstatements to one or more relevant assertions
Indicators of Audit Committee Function Oversight of external financial reporting Oversight of internal control over financial reporting Independence of audit committee members from management Clarity of responsibilities Interaction with independent and internal auditors Interaction with chief financial officer, chief accounting officer Interaction with other key members of financial management Questions asked of management and the auditor Understanding of critical accounting policies Understanding of accounting estimate judgments Responsiveness to issues raised by the auditor (AS 2.57-58)
Anti-Fraud Controls Must be included in design of ICFR Discussed previously related to Fraud Triang le Controls that prevent, deter, and detect fraud Controls restraining misappropriation of assets Risk assessment processes Codes of ethics or conduct Adequacy of internal audit Adequacy of procedures for handling complaints and accepting confidential communications on accounting and auditing matters Auditor evaluates all controls specifically directed at the risk of fraud Inquiries of management, audit committee, internal auditors is an important audit procedure
IT Impact on the Company and Auditor AS 12 identifies need for auditors to consider manual and automated systems when understanding the company and assessing risks Nature and extent of IT affects the risks and therefore controls needed and audit steps IT might affect initiation, recording, processing and reporting of financial information Alternatively, manual steps might affect approvals, reviews of transactions, reconciliations and follow up of reconciling items
IT Impact on Controls Needed Benefits of IT to Internal Control Consistent application of rules and complex calculations Timeliness, availability and accuracy of information Facilitates additional analysis of information Enhances monitoring ability Reduces risk that controls will be circumvented Controls are used for applications, databases and operating systems Risks of IT to Internal Control Possibility of consistently incorrect processing Possibility of processing the wrong data Unauthorized access and changes to data and programs Failure to change systems or programs as intended Inappropriate manual intervention Potential loss of data
Period End Financial Reporting Process Must be considered in every ICFR audit Is always considered a significant process so the auditor must consider controls Procedures that are a part of the period end financial reporting process that the auditor evaluates Entering transaction totals into the general ledger Selecting and applying accounting policies Initiating, authorizing, recording and processing journal entries into the general ledger Recording recurring and nonrecurring adjustments to the financial statements Preparing financial statements and related disclosures
Timing of Period End ICFR Audit Procedures Audit tests of ICFR are performed while the process is occurring. The client closes its books and prepares its financial statements after fiscal year end. Period end financial reporting procedures occur and are tested after fiscal year end, even though the management report and auditor’s opinion are as of fiscal year end.
Auditor must determine what amount is material to the financial statements; qualitative characteristics also impact materiality Auditor can then identify significant accounts and the relevant assertions for the accounts Relevant assertions are those that have a reasonable possibility of containing a misstatement that would cause the financial statements to be materially misstated PCAOB Risk Assessment standards (2010) states that relevance stems from inherent risk Significant Accounts and Disclosures
Classes of Transactions One account may have different major classes of transactions and relevant assertions may differ for the classes For example, cash sales and sales on account include different relevant assertions Another approach for identifying and understanding major classes of transactions is grouping them: Routine transactions Non-routine transactions Estimating transactions
Understanding Likely Sources of Misstatement After identifying material accounts and disclosures, any major classes of transactions and relevant assertions the auditor must understand likely sources of misstatement From AS 2.74: Understand the flow of transactions, including how transactions are initiated, authorized, recorded, processed, and reported Identify the points with the process at which a misstatement – including a misstatement due to fraud – could arise
Last Steps of Understanding After identifying likely sources of misstatement… Auditor identifies controls management has implemented in the system that are intended to prevent each type of potential misstatement Auditor also identifies controls specifically intended to prevent or detect unauthorized acquisition, use or disposal of assets that could cause a material financial statement misstatement IT is an integral part of the analysis – not a separate audit step
IT Related to Likely Sources of Misstatement Learning Objective #5 Chapter 7-42 Factors that impact the need for specialized IT knowledge include:
Appendix A: Specifics of IT General Controls IT general controls (ITGC): IT policies and procedures that apply throughout the entire company Application controls are usually programmed controls that are specific to a single process or activity Entity-level vs. transaction-level controls are not the same as IT general controls and IT application controls
Relationship Among Different Control Types
Big Picture: Organization of ITGC Internal control environment Software acquisition Hardware acquisition Network technology acquisition Program development Program changes Computer operations Access to programs and data Software and interface controls Contingency controls Human resources Physical facilities controls
IT Control Environment Policies Licensing agreements Passwords Use of company resources, Internet, and e-mail Physical control over portable resources Social engineering issues Control breakdowns Use of third-party providers Segregation of Duties Monitoring
Acquisitions and Changes Software: plans, approval, company strategy, compatibility, cost effectiveness Hardware and Network Technology: authorization and approval, fit with needs, security Program Development and Changes: project initiation, analyses and design, construction, testing and quality assurance, data conversion, documentation and training
Computer Operations Policies and procedures, includes organizational structure Batch processing and end user computing Batch: scheduling and planning functions “End user: authorized access Backup management, sophistication varies Data center controls Physical access, climate controls, lock up, passwords Capacity planning and performance issue management Short and long term planning, expected service level Recovery Appropriate plan, tested and updated as needed
Access and Interface Access to Programs and Data Password complexity and security Privacy policies Security in place and tested Security measures monitored Software and Interface Controls Denial of service attacks Intrusion detection controls Cookie policies and detection
Contingency Controls Backup Procedures Procedures for control breakdowns: incident detection, reaction, damage limitation, analysis, recovery, future monitoring Data backup procedures: full backups, incremental backups, storage mediums – physical or electronic, reconstruction of data Service interruption, disaster and recovery Backup or alternate power source Redundant computer processing system Identified responsible individual
Human Resources Hiring policies: recruiting, verifying information, testing, interviewing Should address candidate ability and integrity Training: cross training, job rotations, mandatory vacations, ongoing training Termination policies and controls Immediately revoking computer access and physical access Change passwords and codes Send files to another manager
Physical Facilities Protected environment Climate control Fire suppression and evacuation Inconspicuous location Limited access Limited access to network administration offices Lock up of critical equipment Physically secure portable equipment, programming to limit unauthorized access Store least possible amount of data on portable equipment
Appendix B: Enterprise Risk Management Enterprise Risk Management (ERM) framework September 2004, COSO ERM: a process, effected by an entity’s board of directors, management and other personnel, applied in a strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives
ERM and Internal Control ERM addresses the environment within which controls function Internal control is encompassed within and an integral part of enterprise risk management. Enterprise risk management is broader than internal control, expanding and elaborating on internal control to form a more robust conceptualization focusing more fully on risk.
Components of ERM Internal Environment Objective Setting Event Identification Risk Assessment Risk Response Control Activities Information and Communication Monitoring
Appendix C: ICFR in Smaller Public Companies Dodd Frank Act (2010) removed the requirement for smaller public companies to have ICFR audited, but management must still perform the assessment and issue the report required by SOX 404 Guidance on ICFR geared to smaller companies COSO, 2006 Guidance for Smaller Public Companies COSO, 2009 Guidance on Monitoring Internal Control Systems SEC Interpretive Release (Release 33-8810) AS 5 (replaced AS 2) PCAOB Staff Views, Guidance for Auditors of Smaller Public Companies
Common Characteristics of Smaller Companies Fewer business lines Less complex business processes Less complex financial reporting system More centralized accounting functions Extensive involvement by senior management Fewer levels of management with wide spans of control
SEC Interpretive Release Fundamentals required of management to assess ICFR effectiveness are not different for smaller companies Identify risks Determine whether controls are in place that address the risks Evaluate the operating effectiveness of the controls How the ICFR assessment activities are accomplished may differ
Differences in Process Management can judge whether all aspects of ITGC are relevant to financial reporting risks Only evaluate those that are important Documentation of controls and evidence selected can vary based on management’s’ judgment of importance Limited documentation may be created just for assessment Emphasis placed on role of on-going monitoring
PCAOB Guidance Directed toward auditors not companies Includes characteristics of smaller companies that are important considerations for auditors Use of entity-level controls to achieve control objectives Risk of management override Implementation of segregation of duties and alternative controls Use of information technology (IT) Maintenance of financial reporting competencies Nature and extent of documentation