RTI, Nagpur1 Day 2- Session III Internal controls and risk assessment

RTI, Nagpur2 Session Overview Objectives of internal controls and their role in prevention and detection of fraud Scope and coverage of internal controls

RTI, Nagpur3 Learning objective The participant will be able to evaluate the reliability of internal control systems of the audited entity and determine audit risk that includes fraud audit risk

RTI, Nagpur4 Objectives of internal controls Ensures efficiency and effective fulfilment of goals of an organization Provides a mechanism for control and prevention of fraud or other irregularities Provides an assurance for safeguarding of assets of the entity. Provides an assurance in regard to timely, accurate and reliable financial reporting of the entity

RTI, Nagpur5 COSO (Committee of Sponsoring Organisations in US) study findings Typical fraudulent financial reporting involved o overstatement of revenues and assets o premature or fictitious recording of revenues o understatement of allowances for receivables o overstatement of tangible assets o recording of non-existent assets  Most frauds committed in smaller corporations ($100 million assets)

RTI, Nagpur6 COSO (Committee of Sponsoring Organisations in US) study findings (Contd.) Frequent involvement of top senior executives Boards of Directors of these companies dominated by insiders Few audit committees Companies were experiencing net losses before frauds were committed Above findings indicated: Significant lack of internal controls Controls overridden by management

RTI, Nagpur7 SAI India Auditing Standard Existence of adequate system of internal control minimizes risk of errors and irregularities Audited entity is responsible for developing effective control systems Auditor not relieved of responsibility of evaluation of internal control systems and recommendation of remedial measures for improvement

RTI, Nagpur8 Scope and coverage of internal controls Control environment  Authority delegation  Allocation of responsibilities- authorization, custody and recording  Management’s philosophy & operating style  Internal controls, including internal audit, personnel policies

RTI, Nagpur9 Scope and coverage of internal controls (Contd.) Control procedures  Reporting reconciliation  Arithmetical accuracy checks  Maintaining and review of control accounts  Approval of control documents  Cross-check of internal data with external sources of info.  Comparison of results of physical verification of inventories with accounting records  Internal check-to prevent errors and fraud early- through different persons assigned different tasks.  Restricted access to key assets and documents  Analyzing financial results with budgeted figures

RTI, Nagpur10 Limitations of internal control Collusion between officials performing different functions Abuse of authority Override of controls by mgt Errors of judgment Prescribed controls inadequate to cope with changes Unusual transactions escaping controls

RTI, Nagpur11 Why testing of controls To determine the degree of reliance that can be placed on financial information systems To obtain reasonable assurance in regard to the completeness of accuracy and completeness

RTI, Nagpur12 Audit procedure in evaluation Carry out a preliminary evaluation through trial testing of a few transactions Study of documentation in regard to controls for overall objectives and to prevent errors/omissions Compliance tests  When control procedures are found to exist  Random checking of records to ascertain compliance procedures as per manual/flow-chart  Intended to provide evidence in regard to existence, effectiveness and continuity

RTI, Nagpur13 Extent of testing by external auditor Depends on the degree of independence of internal audit Quality of personnel Scope and extent of testing by internal audit Availability of documented work of internal audit Compliance by management to internal audit reports  Above factors may increase or reduce extent of testing

RTI, Nagpur14 Important control failures in LOC scam Delegation of powers to lower level officers collusion between DDOs and TOs. Fake treasury bills  Absence of strategic control to prevent collusion Financial approval without ensuring physical implementation  failure of strategic control Excess drawal of funds  Absence of budgetary financial control Lack of control over documentation Accounts not submitted to the A.G  Lack of compliance controls

RTI, Nagpur15 Risk assessment and internal control Internal controls Risk analysis determines audit procedures  expression of audit opinion

RTI, Nagpur16 Risk assessment and internal control (Contd.) Efficient and effective audit approach is determined by: Risk assessment of audited entity having regard to:  Past record of entity  Management’s experience  Internal controls  Business environment To prevent under-auditing in high-risk and over-auditing in low-risk situations