9 - 1 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Internal Control and Control Risk Chapter 9

9 - 2 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Learning Objective 1 Contrast management’s need for internal control with the auditor’s need to consider internal control when designing an audit.

9 - 3 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Inherent Limitations Reasonable Assurance Management’s Responsibility Key Concepts

9 - 4 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Client’s Concerns Compliance with applicable laws and regulations Reliability of financial reporting Efficiency and effectiveness of operations

9 - 5 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Auditor Concerns Controls over classes of transactions Controls related to reliability of financial reporting

9 - 6 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Sales Transaction-Related Audit Objectives Objective – General FormRelated Audit Objectives Recorded transactions exist (existence). Sales are for shipments to existing customers. Existing transactions are recorded (completeness). Existing sales transactions are recorded. Transactions are stated correctly (accuracy). Sales for goods shipped are correctly billed.

9 - 7 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Sales Transaction-Related Audit Objectives Objective – General FormRelated Audit Objectives Transactions are properly classified (classification). Sales transactions are properly classified. Transactions are recorded on correct dates (timing). Sales are recorded on the correct dates. Transactions are properly filed (posting and summarization). Sales transactions are properly included in the master files.

9 - 8 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley How Frauds Have Been Discovered Notification by employee Internal controls Internal auditor Customer notification Accidental discovery Management investigation 58% 51% 43% 41% 37% 35%

9 - 9 ©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley How Frauds Have Been Discovered Anonymous reporting Hot line notification Employee investigation Government notification External auditor Other sources 35% 25% 21% 16% 4% 20%

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Learning Objective 2 Describe how information technology affects internal control.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Effect of Information Technology on Internal Control Information Technology IT can improve the effectiveness and efficiency of internal controls. IT also enhances the timeliness and accuracy of information.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Risks Associated With the Use of Information Technology Programmed errors Processing incorrect data Unauthorized access

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Learning Objective 3 Explain the five components of internal control.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Control Environment Five Components of Internal Control Risk Assessment Control Activities Information and Communication Monitoring

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley The Control Environment Integrity and ethical values Commitment to competence Board of directors or audit committee participation Management’s philosophy and operating style

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley The Control Environment Organizational structure Assignment of authority and responsibility Human resources policies and practices

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Risk Assessment Identify factors affecting risk. Assess significance of risks and likelihood of occurrence. Determine actions necessary to manage risk.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Control Activities 1. Adequate separation of duties 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Physical control over assets and records 5. Independent checks on performance

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Adequate Separation of Duties Custody of assetsAccountingAuthorization of transactions The custody of related assets Operational responsibility Record-keeping responsibility IT DutiesUser departments

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Proper Authorization of Transactions and Activities General authorization Specific authorization

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Adequate Documents and Records Prenumbered consecutively Prepared at the time of transaction Designed for multiple uses Constructed to encourage correct preparation Simple enough to ensure understanding

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Physical Control over Assets and Records Physical precautions Controls related to IT equipment, programs, and data files Physical controls Access controls Backup and recovery procedures

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Independent Checks on Performance The need for independent checks arise because internal control tends to change over time unless there is a mechanism for frequent review.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Information and Communication The purpose of an accounting information and communication system is to… initiate, record, process, and report the transactions and to maintain accountability for the related assets.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Monitoring Management’s ongoing and periodic assessment of the quality of internal control performance … to determine whether controls are operating as intended and modified when needed.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Learning Objective 4 Explain methods used to obtain an understanding of internal control.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Understanding Internal Control and Assessing Control Risk Obtain Understanding of Internal Control: Design and Operation Assess Control Risk Test Controls Decide Planned Detection Risk and Substantive Tests

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Reasons for Sufficiently Understanding Internal Control SAS 55 (as amended by SAS 78 and 594 plus AU319) requires the auditor to obtain an understanding of internal control for every audit. Minimum audit planning matters Auditability Potential material misstatements Detection risk Design of test

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Procedures to Determine Design and Placement Update and evaluate auditor’s previous experience with the entity. Make inquires of client personnel. Read client’s policy and systems manuals. Examine documents and records. Observe entity activities and operations.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Documentation of the Understanding Narrative Flowchart Internal control questionnaire Internal control questionnaire

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Learning Objective 5 Assess control risk by linking strengths and weaknesses of internal control to transaction- related audit objectives.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Assess Control Risk Obtain sufficient understanding for planning. Assess whether the entity is auditable. Determine assessed control risk. Assess if a lower control risk could be supported. Determine the appropriate assessed control risk.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Assess Control Risk Identify transaction-related audit objectives. Identify specific controls. Identify and evaluate weaknesses.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Identify and Evaluate Weaknesses Identify existing controls. Identify the absence of key controls. Determine misstatements that could result. Consider compensating controls.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley The Control Risk Matrix Auditors use the control risk matrix to identify both controls and weaknesses and to asses control risk.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Communication Reportable conditions letter Management letters Audit committee communications

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Learning Objective 6 Describe the process of designing and performing tests of controls.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Tests of Controls The procedures to test effectiveness of controls in support of a reduced assessed control risk are called tests of controls.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Procedures for Tests of Controls Make inquiries of client personnel. Examine documents, records, and reports. Observe control-related activities. Reperform client procedures.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Extent of Procedures Reliance on evidence from prior year’s audit Testing less than the entire audit period

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Relationship of Assessed Control Risk and Extend of Procedures Assessed Control Risk High Level:Lower Level: Obtaining anTests of Type of ProcedureUnderstanding OnlyControls InquiryYes – extensiveYes – some DocumentationYes – with transactionYes – using walk-through sample ObservationYes – with transactionYes – multiple walk-through times ReperformanceNoYes – sampling

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley Decide Planned Detection Risk and Design Substantive Tests The auditor uses the results of the control risk assessment process and tests of controls to determine the planned detection risk and related substantive tests. The auditor links the control risk assessments to the balance-related audit objectives.

©2003 Prentice Hall Business Publishing, Essentials of Auditing 1/e, Arens/Elder/Beasley End of Chapter 9