18- 1 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Chapter 18 Integrated Audits of Internal Control (For Public Companies Under Sarbanes-Oxley Section 404)

18- 2 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Management’s Responsibilities Accept Responsibility for the Effectiveness of internal control over financial reporting Evaluate/Test Internal Control Effectiveness Using Suitable Criteria (e.g., COSO)  Focus: Areas with high risk to reliable financial reporting  Considers both design & operating effectiveness  Uses top-down approach Support Its Evaluation with Sufficient Evidence Provide a Report on its Assessment of Internal Control Effectiveness (Effective if no material weaknesses exist at yearend.)

18- 3 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Classifying Deficiencies Material Weakness: Reasonable possibility (20+%) that a material misstatement will not be prevented/timely detected.

18- 4 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Indications of a Material Weakness Identification of any fraud by senior management. Restatement of previous F.S. to correct a material misstatement. Auditor-identified material misstatement that would not have been prevented or detected by client internal controls. Ineffective oversight of company’s external financial reporting and internal control by the company’s Audit Committee.

18- 5 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Management’s Assessment

18- 6 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Management’s Report on Internal Control

18- 7 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Auditor’s Overall Objective Express an opinion on the effectiveness of the client’s internal controls over financial reporting by providing reasonable assurance about whether material weaknesses exist as of the date specified in client management’s assessment. Audit Criteria: PCAOB Auditing Standard No. 5, “ An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statement”

18- 8 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Start with a representation from management.

18- 9 © 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Management Representations a.Acknowledging management's responsibility for establishing and maintaining effective internal control over financial reporting. b.Stating that management has performed an evaluation and made an assessment of the effectiveness of the company's internal control over financial reporting and specifying the control criteria. c.Stating that management did not use the auditor's procedures performed during the audits of internal control over financial reporting or the financial statements as part of the basis for management's assessment of the effectiveness of internal control over financial reporting. d.Stating management's conclusion, as set forth in its assessment, about the effectiveness of the company's internal control over financial reporting based on the control criteria as of a specified date. e.Stating that management has disclosed to the auditor all deficiencies in the design or operation of internal control over financial reporting identified as part of management's evaluation, including separately disclosing to the auditor all such deficiencies that it believes to be significant deficiencies or material weaknesses in internal control over financial reporting.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Management Representations f.Describing any fraud resulting in a material misstatement to the company's financial statements and any other fraud that does not result in a material misstatement to the company's financial statements but involves senior management or management or other employees who have a significant role in the company's internal control over financial reporting. g.Stating whether control deficiencies identified and communicated to the audit committee during previous engagements pursuant to paragraphs 78 and 80 have been resolved, and specifically identifying any that have not. h.Stating whether there were, subsequent to the date being reported on, any changes in internal control over financial reporting or other factors that might significantly affect internal control over financial reporting, including any corrective actions taken by management with regard to significant deficiencies and material weaknesses.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Emphasis is on: (1)Entity-level controls for audit committee effectiveness, fraud and yearend financial reporting processes and (2)Significant accounts & disclosures and related assertions. Control design is effective if it achieves control objective and mitigates the related risk for a material misstatement. Start with a representation from management.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Impact on the F.S. Audit For smaller clients, there will probably be more reliance on internal controls as more testing is required for the integrated audit of internal controls since assessing CR at max for efficiency is not an option. Some control testing can be shared, but auditors must confirm that key controls are still operating effectively at yearend. If significant deficiencies or material weaknesses are found, expanded substantive testing may be required to determine if a material misstatement resulted.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Auditor’s Separate Report Report of Independent Registered Public Accounting Firm [Introductory Paragraph] We have audited W Company's internal control over financial reporting as of December 31, 20X8, based on [Identify control criteria, for example, "criteria established in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)."]. W Company's management is responsible for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying [title of management's report]. Our responsibility is to express an opinion on the company's internal control over financial reporting based on our audit.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Auditor’s Separate Report (con’t) [Scope Paragraph] We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audit also included performing such other procedures as we considered necessary in the circumstances. We believe that our audit provide a reasonable basis for our opinion.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Auditor’s Separate Report (con’t) [Definition Paragraph] A company's internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company's internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company's assets that could have a material effect on the financial statements.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Auditor’s Separate Report (con’t) [Inherent Limitations Paragraph] Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Auditor’s Separate Report (con’t) [Opinion Paragraph] In our opinion, W Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 20X8, based on [Identify control criteria, for example, "criteria established in Internal Control – Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)."]. We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the [identify financial statements] of W Company and our report dated [date of report, which should be the same as the date of the report on the effectiveness of internal control over financial reporting] expressed [include nature of opinion]. Signature City and State or Country Date

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Circumstances Affecting the Auditors’ Opinion

Report Modifications - Material Weakness Definition of a material weakness Statement that a material weakness has been identified and that either (1) it is described in management's assessment or (2) it is not. Description of the material weakness and potential effect on the presentation of the company's F.S. issued during the existence of the weakness. If management’s disclosure of the material weakness is not fairly presented in all material respects, describe this conclusion as well as the information necessary to fairly describe the material weakness. Statement whether his or her opinion on the financial statements was affected by the adverse opinion on internal control over financial reporting. 18-8

Report Modifications - Other Disclaimer of opinion if scope restricted Sharing responsibility with other auditors [similar to report on F.S. audit, but principal auditor must be same for both reports (F.S. and internal control)] Disclaimer of opinion on any “other information” which is included in management’s report on internal control If appropriate, statement that management’s annual certification pursuant to Section 302 of SOX is misstated regarding internal control changes near yearend. 18-8

© 2006 The McGraw-Hill Companies, Inc., All Rights Reserved. Required Written Communications Top Management: All detected internal control deficiencies Audit Committee: Significant Control Deficiencies Material Weaknesses, and if any were not included in management’s assessment Fact of communication to management Board of Directors: Audit opinion that either management oversight of financial reporting or internal controls over financial reporting are ineffective.