1. Internal Control Chapter 7

2. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-2 Summary of Internal Control Definition  A process...designed to provide reasonable assurance...regarding, achievement of (the entity’s) objectives on: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations

3. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-3 Components of Internal Control  The Control Environment  Risk Assessment  The Accounting Information and Communication System  Control Activities  Monitoring

4. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-4 Control Environment Factors  Integrity and ethical values  Commitment to competence  Board of directors or audit committee  Management philosophy and operating style  Organizational structure  Human resource policies and practices  Assignment of authority and responsibility

5. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-5 Risk Assessment--Factors Indicative of Increased Financial Reporting Risk  Changes in the regulatory or operating environment  Changes in personnel  Implementation of a new or modified information system  Rapid growth of the organization  Changes in technology affecting production processes or information systems  Introduction of new lines of business, products, or processes

6. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-6 Objectives of an Accounting System  Identify and record valid transactions  Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions  Measure the value of transactions appropriately  Determine the time period in which the transactions occurred to permit recording in the proper period  Present properly the transactions and related disclosures in the financial statements

7. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-7 Control Activities  Performance reviews  Information processing  Physical controls  Segregation of duties

8. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-8 Segregation of Duties

9. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-9 Monitoring  Ongoing monitoring activities  Separate evaluations

10. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-10 Limitations of Internal Control  Errors may arise from misunderstandings of instructions, mistakes of judgment, fatigue, etc.  Controls that depend on the segregation of duties may be circumvented by collusion  Management may override the structure  Compliance may deteriorate over time

11. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-11 Financial Statement Audits: The Role of Internal Control Second Field Work Standard A sufficient understanding of the entity and its environment, including its internal control, is to be obtained to assess the risk of material misstatement of the financial statements whether due to error or fraud, and to design the nature, timing, and extent of further audit procedures. [emphasis added]

12. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-12 Auditors’ Overall Approach with Internal Control  Overall approach of an audit 1. Plan the audit 2. Obtain an understanding of the client and its environment, including internal control 3. Assess the risks of material misstatement and design further audit procedures 4. Perform further audit procedures 5. Complete the audit 6. Form an opinion and issue the audit report  Steps 2-4 relate most directly to the role of internal control in financial statement audits

13. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-13 2. Obtain an understanding of the client and its environment, including internal control  The understanding of internal control is used to help the auditor to Identify types of potential misstatements Consider factors that affect the risks of material misstatement. Design tests of controls (when applicable) and substantive procedures.  Auditors must consider all five internal control components Control environment Accounting information system Risk assessment Control activities Monitoring

14. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-14 Documenting the Understanding of Internal Control  Questionnaires  Written Narratives  Flowcharts

15. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-15

16. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-16 3. Assess the risks of material misstatement and design further audit procedures General approach Identify risks while obtaining an understanding of the client and its environment, including its internal control Relate the identified risks to what can go wrong at the relevant assertion level Consider whether the risks are of a magnitude that could result in a material misstatement Consider the likelihood that the risks could result in a material misstatement

17. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-17 The nature of transactions  Consider the nature of the transactions Routine transactions—e.g., revenue, purchases, and cash receipts and disbursements Nonroutine transactions—e.g., taking of inventory, calculating depreciation expense Estimation transactions—e.g., determining the allowance for doubtful accounts  Generally routine transactions have the strongest controls

18. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-18 Assessing Risks at the Financial Statement Level  Examples Preparing the period-end financial statements, including the development of significant accounting estimate and preparation of the notes The selection and application of significant accounting policies IT general controls The control environment  Responses to high risks Assigning more experience staff or those with specialized skills Providing more supervision and emphasizing the need to maintain professional skepticism Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed Increasing the overall scope of audit procedures, including the nature, timing or extent

19. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-19 Assessing Risks at the Assertion Level  Examples Failure to recognize an impairment loss on a long-lived asset affects only the valuation assertion Inaccurate counting of inventory at year-end affect the valuation of inventory and the accuracy of cost of goods sold  Responses Decisions are made here as to the appropriate combination of tests of controls and substantive procedures

20. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-20 4. Perform audit procedures – test of controls  Approach: Identify controls likely to prevent or detect material misstatements Perform tests of controls to determine whether they are operating effectively  Tests of controls address: How controls were applied The consistency with which controls were applied By whom or by what means (e.g., electronically) the controls were applied 4. Perform further audit

21. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-21 4. Perform further audit procedures—tests of controls--II  Tests of controls include: Inquiries of appropriate client personnel Inspection of documents and reports Observation of the application of controls Reperformance of the controls  The results of the tests of controls are used to determine the nature, timing and extent of substantive procedures

22. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-22 Diagram of the Auditors’ Consideration of Internal Control

23. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-23 The Relationships Among Control Deficiencies Relationships among Control Deficiencies

24. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-24 Content of Management’s Report on Internal Control  Acknowledgment of responsibility for internal control  An assessment of internal control effectiveness as of the last day of the company’s fiscal year

25. McGraw-Hill/Irwin © 2008 The McGraw-Hill Companies, Inc., All Rights Reserved. 7-25 Approach to Audit of Internal Control  Plan the engagement  Use a top-down approach to decided the controls to test  Test and evaluate design effectiveness of internal control  Test and evaluate operating effectiveness of internal control  Form an opinion on control effectiveness