1. Electronic Presentations in Microsoft ® PowerPoint ® Prepared by Brad MacDonald SIAST © 2009 McGraw-Hill Ryerson Limited

2. Learning Objectives Chapter Overview Chapter 9 Control Assessment and Testing Tous droits réservés McGraw Hill Ryerson.

3. Learning Objectives Chapter Overview Slide 3 1.Distinguish between management and the auditor’s responsibility regarding an auditee organization’s internal controls. 2.Explain why the auditor evaluates and auditee’s internal controls. 3.Define seven internal control objectives, relating them to the assertions in management’s financial statements. Learning Objectives Tous droits réservés McGraw Hill Ryerson.

4. Learning Objectives Chapter Overview Slide 4 4.Describe general and application control activities, document accounting systems, identify key controls and weaknesses, and write key control tests for an audit program. (3 phases) 5.Outline the auditor’s responsibility when internal control evaluation work detects or indicates a high risk of fraudulent misstatement. 6.Explain reasonable assurance and cost- benefit in the context of control risk assessment and development of the audit approach. 7.Apply and integrate the chapter topics to analyze a practical auditing situation case scenario. Learning Objectives Tous droits réservés McGraw Hill Ryerson.

5. Learning Objectives Chapter Overview Slide 5 Management Versus Auditor Responsibility for Control Reasons for Control Evaluation Control Objectives and Procedures Phases of a Control Evaluation Auditor’s Responsibility to Report Internal Control Deficiencies and Fraud Risks Control Evaluation, Further Audit Procedures and Reasonable Assurance Chapter Overview Tous droits réservés McGraw Hill Ryerson.

6. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 6 Management Versus Auditor Responsibility for Control Management responsibility: –Management is responsible for its control environment, accounting system, and for establishing and maintaining a system of internal control procedures. Cost of controls is balanced with the benefit of risk reduction. Tous droits réservés McGraw Hill Ryerson.

7. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 7 Internal Control Internal control is defined as: –the process designed and effected by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations and compliance with applicable laws and regulations. Tous droits réservés McGraw Hill Ryerson.

8. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 8 Management Versus Auditor Responsibility for Control External auditor’s responsibility: –Evaluating existing internal controls and assessing the risk of material misstatement related to them. Find out what an organization does to avoid potential errors and irregularities in seven categories. Tous droits réservés McGraw Hill Ryerson.

9. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 9 General Categories of Misstatements 1.Invalid transactions are recorded. 2.Valid transactions are omitted. 3.Unauthorized transactions are executed. 4.Transaction amounts are inaccurate. 5.Transactions are classified incorrectly. 6.Transaction accounting is incomplete. 7.Transactions are recorded in incorrect period. Tous droits réservés McGraw Hill Ryerson.

10. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 10 Reasons for Control Evaluation The primary reason for conducting an evaluation of internal control is to give the auditors a basis for determining the nature, timing and extent of the balance audit program. –Examining the business processes provides a structure for the auditor in designing procedures to test controls and financial statement transactions and balances. Tous droits réservés McGraw Hill Ryerson.

11. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 11 Control Risk The risk that the client’s internal control will not prevent or detect material misstatement. –The auditor does not control this risk. –The auditor’s task is to assess the risk. High control risk leads to low detection risk. –Requires the auditor to increase substantive testing in order that misstatements are caught. Tous droits réservés McGraw Hill Ryerson.

12. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 12 Extent of IT Use The extent of IT use needs to be considered in planning the nature, extent and timing of audit procedures. –IT skills may be needed to understand the flow of some transactions. –Nature, timing and extent are all affected by the extent of IT use. Tous droits réservés McGraw Hill Ryerson.

13. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 13 Need for Specialized Skills All aspects of a client’s computer processing should be considered in determining the need for specialized IT skills. –Audit team members should possess sufficient IT knowledge to know when to call on specialists. Tous droits réservés McGraw Hill Ryerson.

14. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 14 How Control Risk Assessment Affects the Audit Program The control risk assessment will affect the procedures included in the audit program. –Each procedure should have identifiable characteristics of nature, timing and extent. Nature refers to audit techniques to be used; timing is a matter of when they are to be performed; and extent is the amount of work to be done. Tous droits réservés McGraw Hill Ryerson.

15. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 15 How Control Risk Assessment Affects the Audit Program For an entity with poor controls as compared to an entity with good controls: –The nature of tests will have to provide more reliable evidence. This can be more costly. –More testing will take place at year-end than at an interim date. This can delay the audit report, or can prove more costly. –More evidence will have to be gathered, which is much more costly. Tous droits réservés McGraw Hill Ryerson.

16. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 16 Control Objectives There are seven control objectives. –Each control objective is intended to prevent a class of errors that may lead to material misstatement. Tous droits réservés McGraw Hill Ryerson.

17. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 17 Control Objectives ObjectiveNature Validity Recorded transactions are valid and documented Completeness All valid transactions are recorded, and none are omitted Authorization Transactions are authorized according to company policy Accuracy Transaction dollar amounts are properly recorded Classification Transactions are properly classified in the accounts Accounting Transaction accounting is complete Proper period Transactions are recorded in the proper period Tous droits réservés McGraw Hill Ryerson.

18. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 18 Control Objectives and Financial Statement Assertions Control objectives are closely associated with management’s assertions. Tous droits réservés McGraw Hill Ryerson.

19. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 19 Control Objectives and Financial Statement Assertions An auditor may determine that not all of the control objectives are met for a particular account balance. –More substantive work will be required in those areas. This can be seen in the audit risk model AR = IR X CR X DR. Tous droits réservés McGraw Hill Ryerson.

20. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 20 Phases of a Control Evaluation The process of control evaluation takes place in three phases: –Understanding control –Assessing control risk –Testing Controls A major audit goal is to be efficient. This means performing work in minimum time and cost while still doing high quality work. Tous droits réservés McGraw Hill Ryerson.

21. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 21 Audit Cost Trade-off Generally, the more auditors can rely on good internal controls, the less substantive work they need to do. –Auditor can opt not to rely on controls, and do extensive substantive procedures. –Auditor can perform a complete evaluation of control, assess control risk to be low, and minimize the substantive procedures. –Auditor needs to determine the most efficient mix of control and substantive procedures. Tous droits réservés McGraw Hill Ryerson.

22. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 22 Audit Cost Trade-off Tous droits réservés McGraw Hill Ryerson.

23. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 23 Phase 1 – Understanding the Internal Control Understanding the internal controls: –Needs to be done early in the audit. –Obtain overall acquaintance with: Control environment, Flow of transactions, and Effectiveness of key control procedures. Tous droits réservés McGraw Hill Ryerson.

24. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 24 General Controls and Application Control Procedures General controls are those activities that have an overall impact on accounting processes. –Application controls address the control objectives relating to input, processing and output of data in each accounting process. Tous droits réservés McGraw Hill Ryerson.

25. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 25 Control Activities General ControlsApplications System Functions Control Objectives Capable Personnel Performan ce reviews Segregation of responsibilities Supervision Controlled Access Periodic comparison IT controls Revenues/ receivables/ Receipts Purchases/ Payables/ Payments Production and Payroll Investment and Finance Other applications Transaction input Transaction processing Transactions, balances and disclosure output Specific procedures to ensure: Validity Completeness Authorization Accuracy Classification Accounting Proper period Tous droits réservés McGraw Hill Ryerson.

26. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 26 General Control Procedures Several particular general control procedures are always important in a company’s internal controls. –These controls were listed in the control activity summary. –General controls are preventative in nature, and have a pervasive impact on the various business cycles. –Effective general controls are required in order to have effective application controls. Tous droits réservés McGraw Hill Ryerson.

27. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 27 Capable personnel The most important feature of control is the people who make the system work. –High turnover in the business means that inexperienced people are performing control functions. –New accounting officers and managers may not have sufficient experience to make technical and judgment decisions. Tous droits réservés McGraw Hill Ryerson.

28. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 28 Performance Review Management reviews of reported performance to expectations is an effective control. –Compare actual to budget, and follow up any noted discrepancies. Tous droits réservés McGraw Hill Ryerson.

29. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 29 Segregation of Responsibilities Proper segregation of responsibilities is a necessary condition for making detailed controls effective. –Proper segregation of responsibilities provides two main benefits: innocent errors are more likely to be found, as more people are looking at a transaction, and irregularities are made more difficult to conceal as this would require collusion of two or more people. Tous droits réservés McGraw Hill Ryerson.

30. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 30 Segregation of Responsibilities The responsibilities that should be segregated are: authorization to execute transactions, recording of transactions, custody of assets involved in the transactions, and periodic reconciliation of existing assets to recorded amounts. Tous droits réservés McGraw Hill Ryerson.

31. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 31 Supervision Supervision is important as management’s means of monitoring and maintaining a system of internal control. –Management must oversee the performance of general duties, including the performance of control activities. Tous droits réservés McGraw Hill Ryerson.

32. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 32 Controlled Access Physical access to assets and important records, documents, and forms should be limited to authorized persons. –Assets such as cash, inventory, or securities should not be available to persons who have no need to handle them. –In addition, access to forms, such as sales forms or blank cheques, needs to be restricted. Tous droits réservés McGraw Hill Ryerson.

33. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 33 Periodic Comparison Periodic comparison of recorded amounts to independent evidence needs to take place on a regular basis. –Periodic comparison may include petty cash counts, bank reconciliations, sub-ledger reconciliations, or counts of securities. –The comparison should be completed by someone who does not have the responsibilities for authorization, custody or record keeping for the assets. Tous droits réservés McGraw Hill Ryerson.

34. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 34 Information Technology Controls General IT controls are policies and procedures that relate to the IT environment. –Good general IT controls are required before there can be good IT application controls. –These controls apply to all types of IT environments. Tous droits réservés McGraw Hill Ryerson.

35. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 35 Information Technology Controls General IT controls commonly include: a)operating system and application software acquisition, development and maintenance, b)access security, c)controls over data centre and network operations, d)system and application development and maintenance, e)routine data and system backup procedures, f)disaster recovery plans, and g)physical security of IT assets. Tous droits réservés McGraw Hill Ryerson.

36. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 36 Application Control Activities Specific procedures used in each accounting process to meet the relevant control objectives. Tous droits réservés McGraw Hill Ryerson.

37. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 37 Documentation of Control Elements Documentation of the control structure shows the audit team’s understanding of internal controls and the basis of decisions reached. –A number of tools are available to the auditor for documentation: internal control questionnaires, –formal interview using a checklist, narratives, and flowcharts. Tous droits réservés McGraw Hill Ryerson.

38. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 38 Internal Control Questionnaire (ICQ) and Narrative The most efficient means of gathering evidence about internal control is to conduct a formal interview with knowledgeable managers. –The ICQ is a form of checklist covering the control objectives. Use of an ICQ assists the auditor in covering all the important points. An ICQ is designed so that a response of “no” typically indicates a control weakness. Tous droits réservés McGraw Hill Ryerson.

39. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 39 Accounting and Control System Flowcharts A picture is worth a thousand words. –Flowcharts can enhance auditors’ evaluations and updating a flow chart is relatively easy. Initial preparation of a flow chart is time consuming. In some cases, control conscious businesses will have already prepared the flow charts. Tous droits réservés McGraw Hill Ryerson.

40. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 40 Flowchart Guidelines –Standardized flow chart symbols should be used. –Flowcharts should be drawn with a ruler and template, or by computer software. –The flowchart should progress from top to bottom, from left to right wherever possible. –All relevant information should be on the flowchart, including explanations. –Columns can be used for the various departments to demonstrate segregation of responsibilities. Tous droits réservés McGraw Hill Ryerson.

41. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 41 Stopping Risk Assessment Work Auditors may decide to stop evaluation work in Phase 1 for two reasons: –Control is too poor to justify reliance. Control risk is set at maximum. Goal is audit effectiveness. –Cost/benefit of reliance is not justified, although control is good. Goal is audit efficiency. Tous droits réservés McGraw Hill Ryerson.

42. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 42 Phase 2 – Assessing the Control Risk Following Phase 1, the auditor should make a preliminary assessment of control risk. This involves: –identifying specific control objectives, –identifying points in the flow of transactions where misstatements could occur, –identifying specific control procedures in place, –identifying the control procedures that must function to prevent or detect the misstatements, and –evaluating the design of control procedures to determine if it will be effective to test these controls. Tous droits réservés McGraw Hill Ryerson.

43. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 43 Assessing the Control Risk A useful assessment technique is to analyze control strengths and weaknesses. –Strengths are controls that should prevent, detect, or correct errors. Control strengths will be further tested. –Weaknesses are the lack of controls that would allow material misstatements to get by undetected. –A bridge working paper can be used to connect the control evaluation to subsequent procedures. Tous droits réservés McGraw Hill Ryerson.

44. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 44 Control Risk in Complex IT and Ecommerce Environments Business Internet and IT use have an impact on control risk. –Many business models incorporate the Internet. –Auditors are concerned with the security of IT processing Tous droits réservés McGraw Hill Ryerson.

45. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 45 Ecommerce Control Aspects For an auditee that engages in ecommerce, the following aspects of internal control are particularly relevant: –Security –Transaction integrity –Process alignment Tous droits réservés McGraw Hill Ryerson.

46. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 46 Security External access to the auditee’s information system though the internet creates security risks. –Control environment should address this increased risk. Tous droits réservés McGraw Hill Ryerson.

47. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 47 Transaction Integrity Risks related to the recording and processing of ecommerce transactions include the completeness, accuracy, timeliness, and authorization of information in the financial records. –Control activities related to transaction integrity are required. Tous droits réservés McGraw Hill Ryerson.

48. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 48 Process Alignment Process alignment refers to the integration of IT systems so that they operate as one system. –Control objectives for manual and IT-based systems are the same. –The points in the system where misstatements might occur are at input, processing, and output. Tous droits réservés McGraw Hill Ryerson.

49. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 49 Input Inputs include: –Activities related to source data preparation. –Manual procedures applied to source data. –Source data are converted into computer- readable form. –Input files are identified for use in processing. Tous droits réservés McGraw Hill Ryerson.

50. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 50 Processing Processing activities include: –Information being transferred from one program to another. –Computer –readable files are used to supply additional information. –Transactions are initiated by the computer. Tous droits réservés McGraw Hill Ryerson.

51. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 51 Output Output activities include: –Output files are created / master files are updated. –Master files are changed outside the normal flow of transactions. –Output reports or files are produced. –Errors identified by control procedures are corrected. Tous droits réservés McGraw Hill Ryerson.

52. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 52 Manual and IT Controls over Information Processing Use of IT systems for financial reporting will include manual elements. –Controls over manual processed also need to be considered. Tous droits réservés McGraw Hill Ryerson.

53. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 53 Assessing the Control Risk The information gathered about the client’s control environment, the accounting system and the control procedures should enable the auditor to reach one of three conclusions. –The auditor is required to make the control evaluation for classes of transactions and account balances at the assertion level. Control risk for some assertions regarding a given balance might be low, and for other assertions regarding the same balance, the control risk might be high. Tous droits réservés McGraw Hill Ryerson.

54. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 54 Phase 2 - Conclusions 1.Control risk may be assessed low, and it seems efficient and cost-effective to test controls leading to a combined approach. 2.Control risk may be assessed low, but it would not be cost-effective or efficient to test those controls. Substantive procedures will provide evidence cheaper than a combined approach. 3.Control risk is assessed high, the auditor will concentrate on substantive procedures and not test controls. Tous droits réservés McGraw Hill Ryerson.

55. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 55 Phase 3 – Testing Controls To reduce final assessment of control risk to a low level and rely on controls, the auditor will: –Determine the required degree of compliance. 100% compliance is not expected. The auditor determines a level of compliance required for adequate control. –Determine how well the control actually functioned during the period under audit. I.E. Perform tests of control. Tous droits réservés McGraw Hill Ryerson.

56. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 56 Test of Controls Procedures A test of controls audit procedure is a two- part statement. 1.Identify the data population from which the sample will be drawn. 2.Express an action to be taken to produce relevant evidence. Selected item corresponds with a standard, or selected item agrees with information in another population. Tous droits réservés McGraw Hill Ryerson.

57. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 57 Direction of the Test of Controls Audit Procedures In order to test for completeness or for existence, the right population must be selected. Population of relevant source documents Financial statements, or other summarizing report Validity Vouch to shipping documents Completeness Trace to statements Tous droits réservés McGraw Hill Ryerson.

58. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 58 Testing Controls Testing may involve reperformance, for example recalculating a discount, or inspection, for example looking for a managers initial on a document. Some tests will rely on documentary evidence, for example a shipping document, some control elements, such as segregation leave no documentation. Control tests should be applied to samples that cover the entire period under audit. Tous droits réservés McGraw Hill Ryerson.

59. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 59 Communicating Internal Control Deficiencies Audit standards require the auditor to report weaknesses in controls to an appropriate level of management. –Nontrivial misstatements, fraud, and consequential illegal or possibly illegal acts must also be reported. –These matters are usually communicated to the client in a management letter. Tous droits réservés McGraw Hill Ryerson.

60. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 60 Communicating Internal Control Weaknesses For some regulators, the auditor will also prepare a well-being report. –Reportable conditions include: absence of appropriate segregation of duties, absence of appropriate reviews and approvals of transactions, or evidence of failure of control procedures. Tous droits réservés McGraw Hill Ryerson.

61. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 61 Communicating Internal Control Weaknesses For some regulators, the auditor will also prepare a well-being report. –Reportable conditions include: evidence of intentional management override, or evidence of willful wrongdoing by employees or management, including manipulation, falsification, or alteration of accounting records. Tous droits réservés McGraw Hill Ryerson.

62. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 62 Control Objectives and Procedures The overriding objective of control procedures is to process transactions correctly. –This produces correct account balances, which produce correct financial statements. Control objectives are established to ensure transactions are properly recorded. Tous droits réservés McGraw Hill Ryerson.

63. Learning Objectives Chapter Overview Learning objective 1 2 3 4 5 6 Slide 63 Control Evaluation and Reasonable Assurance Control tests and substantive tests are covered as if they are easily distinguishable. –In practice, a single procedure may produce both substantive and control evidence. –These dual purpose tests can help lower the cost of the audit while maintaining effectiveness. Tous droits réservés McGraw Hill Ryerson.