Standar Pekerjaan Lapangan: Pemahaman Memadai atas Pengendalian Intern Pertemuan 5

Learning Objectives 1. Management’s need for internal control vs. the Auditor’s need to consider internal control in designing an audit 2. How IT affects internal control 3. Explain the five components of internal control 4. Explain methods used to obtain an understanding of internal control 5. Assess control risk 6. Describe the process of designing and performing tests of controls

Client and Auditor Concern about Internal Control System Internal Control consists of policies and procedures designed to provide management with reasonable assurance that the company achieves its objectives and goals 3 key concepts underlie the study of IC and assessment control risk 1. Management Responsibility 2. Reasonable Assurance 3. Inherent Limitations

Client Concerns about Internal Control (COSO Report) 3 (three) concerns of management in designing an effective control system 1. Reliability of Financial Reporting 2. Efficiency and Effectiveness of Operation 3. Compliance with Applicable Laws and Regulation

Auditor Concerns about Internal Control 1. Controls related to the Reliability of Financial Reporting 2. Control over Classes of Transactions

Effect of IT on Internal Control Advantages Able to process large volume of transactions Processes transactions with highly accuracy No human judgment. Disadvantages Program error - GIGO Unauthorized persons accessing the system (data and program) System (data or program) corruption because of virus.

Components of Internal Control 5 Categories of Controls (=PSA69 – SA Seksi 319 = COSO) The control environment Risk assessment Control activities Information and Communication Monitoring

Control Environment Integrity and ethical Value Commitment to Competence Board of Directors or Audit Committee Management’s Philosophy and Operating Style Organization Structure Assignment of Authority and Responsibility Human Resource a Policies and Practices

Risk Assessment All entities regardless of size, structure, nature, or industry, face a variety of risks from external and internal sources that must be managed, as they are constantly change The important first step is to identify factors that may increase risks. Mgt assesses risks as a part of designing and operating internal control to minimize errors and fraud

Risk Assessment Risk occur because of : Changes in Operating Environment New Personnel New or Repaired Information System New Technology New Product Lines, Products, or Activities Corporate Restructuring Foreign Operation New Accounting standard

Control Activities (1) Control Activities (SAS 94 and COSO Report) – generally relate to policies and procedures; 1. Segregation of Duties 2. Information Processing 3. Physical Control 4. Performance Review

Control Activities (2) 5 Specific Control Activities related to policies and procedures; 1. Adequate separation of Duties 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Physical Control over assets and records 5. Independent check on performance

Information and Communication Information system relevant with the objective of Financial Reporting consisted of the methods and records established to record, process, summarize, and report the transactions of the entity, and also to maintain the accountability of assets, liabilities and equities of the entity Communication consists of providing understanding about individual’s roles and responsibilities related to internal control on financial reporting

Information and Communication (2) Auditor should get reasonable understanding about: Group of transactions significant in the financial statements How does a transaction begin ? Accounting record, supporting information, and certain accounts in the financial statements Accounting process from transaction till financial reports.

Monitoring Management is responsible to establish and maintain internal control. For that management should monitor to consider whether the IC works properly and what needed to be justified (up- dated) as the environment changes

Adequate Documents and Records Relevant principles dictate the proper design and use of documents and Records 1. Pre-numbered 2. Prepare at the time a transaction takes place 3. Sufficiently simple 4. Designed for multiple use 5. Constructed in a manner that encourage correct preparation

Procedures to Obtain an Understanding of Internal Control  Reasons: 1.Auditability 2.Potential Material misstatement 3.Detection Risk 4.Design of tests  Procedures to Determine Design and Placement in Operation (see p.284)  Documentation of the Understanding (see p. 285)

Assess Control Risk Four specific assessments must be made:  Assess whether the Financial Statements are auditable  Determine assessed control risks supported by understanding obtained  Assess whether it likely that a lower assessed control risk could be supported  Determine the appropriate assessed control risk

Assess Control Risk (2)  Identify Transaction-Related Audit Objectives  Identify Specific Controls  Identify and evaluate Weaknesses (see Figure 10 – 4 on p. 290)  The Control Risk Matrix (see Figure 10 – 5 on p. 291)  Assess Control Risk  Communicate Reportable Conditions and Related Matters

Test of Control Procedures for Test of Controls  Make inquires of appropriate client personnel  Examine documents, records, and reports  Observe Control-Related activities  Reperform Client Procedures