1. Internal Control in a Financial Statement Audit
Chapter 6
Internal Control in a Financial Statement Audit
McGraw-Hill/Irwin
Copyright © 2012 by The McGraw-Hill Companies, Inc. All rights reserved.

2. Internal Control
LO# 1
Management has the responsibility to maintain controls that provides reasonable assurance that adequate control exists over the entity’s assets and records.
The Internal Control System should:
-ensure that assets and records are safeguarded
-generate reliable information for decision making
The auditor needs assurance about the reliability of the data generated by the information system.
6-2

3. Internal Control The auditor uses risk assessment procedures to
LO# 1
The auditor uses risk assessment procedures to
-obtain an understanding of the entity’s internal control
-identify the types of potential misstatements
-ascertain factors that affect the risk of material misstatement
-design tests of controls and substantive procedures
The auditor’s understanding of the internal control is a major factor in determining the overall audit strategy. The auditor has a responsibility to:
(1) obtain an understanding of internal control and
(2) assess control risk.
6-3

4. COSO’s Internal Control – Integrated Framework
LO# 2
COSO’s Internal Control – Integrated Framework
Reliability of Financial Reporting
Effectiveness and Efficiency of Operations
Compliance with Laws and Regulations
Objectives
6-4

5. Controls Relevant to the Audit
LO# 3
Controls Relevant to the Audit
Reliability of Financial Reporting
Effectiveness and Efficiency of Operations
Compliance with Laws and Regulations
Objectives
Generally, internal controls pertaining to the preparation of financial statements for external purposes are relevant to an audit.
6-5

6. Controls Relevant to the Audit
LO# 3
Controls Relevant to the Audit
Objectives
Reliability of Financial Reporting
Effectiveness and Efficiency of Operations
Compliance with Laws and Regulations
Controls relating to operations and compliance objectives may be relevant when they relate to data the auditor uses to apply auditing procedures.
6-6

7. Components of Internal Control
LO# 5
Components of Internal Control
Control Environment
Entity’s Risk Assessment Process
Information System and Related Business Processes Relevant to Financial Reporting and Communication
Control Activities
Monitoring of Controls
6-7

8. Components of Internal Control
LO# 5
Components of Internal Control
6-8

9. Control Environment
LO# 5
Principle 1: The organization demonstrates a commitment to integrity and ethical values.
Principle 2: The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
Principle 4: The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
Principle 5: The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
6-9

10. The Entity’s Risk Assessment Process
LO# 5
The Entity’s Risk Assessment Process
The risk assessment process should consider external and internal events and circumstances that may arise and adversely affect the entity’s ability to initiate, record, process, and report financial data consistent with management’s financial statement assertions.
Changes in the operating environment
New personnel
New or revamped information systems
Rapid growth
New technology
New business models, products, or activities
Corporate restructuring
International growth
New accounting pronouncements
Business risk can arise or change due to the following circumstances:
6-10

11. The Entity’s Risk Assessment Process
LO# 5
The Entity’s Risk Assessment Process
Principle 6: The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
Principle 7: The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.
Principle 8 The organization considers the potential for fraud in assessing risks to the achievement of objectives.
Principle 9: The organization identifies and assesses changes that could significantly impact the system of internal control.
6-11

12. LO# 5
Control Activities
Principle 10: The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
- Performance Reviews
- Physical Controls
- Segregation of Duties
- Information Processing Controls
Principle 11: The organization selects and develops general control activities over technology to support the achievement of objectives.
Principle 12: The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.
6-12

13. Information and Communication
LO# 5
Information and Communication
Principle 13: The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.
- Identify and record all valid transactions
- Classify transactions properly
- Measure the value of transactions properly
- Record transactions in the proper period
- Properly present transactions and disclosures
Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
Principle 15: The organization communicates with external parties regarding matters affecting the functioning of internal control.
6-13

14. Monitoring of Controls
LO# 5
Monitoring of Controls
Monitoring of controls is a process that assesses the quality of internal control performance over time.
Principle 16: The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
Principle 17: The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
6-14

15. Planning an Audit Strategy
LO# 6
Planning an Audit Strategy
Audit Risk Model
AR = IR × CR × DR
In applying the audit risk model, the auditor must assess control risk. The figure on the next slide presents a flowchart of the auditor’s decision process when considering internal control in planning an audit.
6-15

16. LO# 6
Planning an Audit Strategy Figure 6-3 Flowchart of the Auditor’s Consideration of Internal Control and Its Relation to Substantive Procedures
6-16

17. Substantive Strategy
LO# 6
After obtaining an understanding of internal control, an auditor may choose to follow a substantive strategy and set control risk at the maximum for some or all assertions because of one or all of the following factors:
Controls are assessed as ineffective.
Controls do not pertain to an assertion.
Testing the effectiveness of controls is inefficient.
6-17

18. LO# 6
Assertions
6-18

19. Obtain an Understanding of Internal Control
LO# 7
Obtain an Understanding of Internal Control
The auditor should obtain an understanding of each of the five components of internal control in order to plan the audit. This knowledge is used to:
Identify types of potential misstatement
Pinpoint the factors that affect the risk of material misstatement
Design tests of controls and substantive procedures
6-19

20. Documenting the Understanding of Internal Control
LO# 8
Documenting the Understanding of Internal Control
Procedure Manuals and Organizational Charts
Flowcharts
Internal Control Questionnaires
Narrative Description
6-20

21. Example Information & Documentation
LO# 7
Example Information & Documentation
6-21

22. The Limitations of an Entity’s Internal Control
LO# 8
The Limitations of an Entity’s Internal Control
Override of Internal Control by Management
Human Errors or Mistakes
Collusion
6-22

23. Assessing Control Risk
LO# 9
Identify specific controls that will be relied upon.
Perform tests of controls.
Conclude on the achieved level of control risk.
6-23

24. Performing Substantive Procedures
LO# 11
Performing Substantive Procedures
6-24

25. Timing of Audit Procedures
LO# 12
Timing of Audit Procedures
Interim
Year End
Let’s look at the EarthWear Clothiers example again to see the timing of their audit procedures.
6-25

26. LO# 12
Timing of Audit Procedures A Timeline for Planning and Performing the Audit of EarthWear Clothiers
6-26

27. Interim Audit Procedures
LO# 12
Interim Audit Procedures
Interim Tests of Controls
Assertion being tested not significant
Control has been effective in prior audits
Efficient use of staff time
Interim Substantive Procedures
Assertion probably has low control risk
May increase the risk of material misstatements
Still requires some year-end testing
6-27