2 Nature of an Integrated Audit Auditors of public companies should report on:Financial statements andInternal control over financial reportingBased on provisions of PCAOB Standard No. 5, the audits of internal control and financial reporting should be integrated
3 Sarbanes-Oxley Act of 2002 Section 404 404(a) – requires annual report filed with SEC to include an internal control reportManagement acknowledges responsibility for establishing and maintaining adequate internal controlProvides assessment of internal control effectiveness at end of fiscal year404(b) – requires CPA firm to audit internal control and express an opinion on effectiveness of internal control. (Required for companies with a capitalization in excess of $75,000,000)
4 Management’s Responsibility Accept responsibility for effectivenessEvaluate the effectiveness using suitable criteriaSupport the evaluation with sufficient evidenceProvide a report on internal control
5 Management’s Report on I/C Report must:State that it is management’s responsibility to establish and maintain adequate internal control.Identify management’s framework for evaluating internal control.Include management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the most recent fiscal period, including a statement as to whether internal control over financial reporting is effective.Include a statement that the company’s auditors have issued an attestation report on management’s assessment.
6 Management Assessment Management can be assisted by consultants but not by the CPA firm that conducts the audit of financial statementsMust understand definition of internal control adopted by the SECEvaluation must use an accepted “control framework” such as Internal Control-Integrated Framework created by COSO.Must understand concepts of control deficiency, significant deficiency and material weakness
8 Relationships Among Deficiencies Deficiency inInternal ControlLess than Significant MaterialSignificant Deficiency Weakness
9 Control concepts Control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of performing their functions, to prevent or detect misstatements on a timely basisLevels of severity of control deficienciesLess than a significant deficiencySignificant deficiency – less severe than material weakness yet important enough to merit attentionMaterial weakness – reasonable possibility that a material misstatement will not be prevented or detected
10 Objective of Management’s Evaluation of I/C Provide a reasonable basis for its annual assessmentProcessEvaluate design effectiveness of controlsEvaluate operating effectiveness of internal controlDocumentation of processReporting
11 Auditor’s ObjectivePlan and perform the audit to obtain reasonable assurance about whether material weaknesses exist to express an opinion on company’s internal control over financial reportingEvidence gathered as of date specified in management’s assessment – normally the last day of the company’s fiscal year
12 Audit Steps Plan the engagement Use a top-down approach to identify controls to testTest and evaluate design effectiveness of internal controlTest and evaluate operating effectiveness of internal controlForm an opinion on the effectiveness of internal control
14 Plan the EngagementEfficient planning requires coordination with financial statement auditConsider matters such as:Client’s industryRegulatory mattersClient’s businessRecent changes in client’s operations
15 Auditors’ Consideration of I/C Difference between audit of internal control and audit of financial statementsTime periodAudit of internal control –as of dateAudit of financial statements – entire financial statement periodDifferences between small and large clientsDegree of complexity of operations
17 Top-Down ApproachGoal is to focus on testing those controls that are most important to auditor’s conclusion on internal control, avoiding those that are less importantStarts at topEntity-level controls – those in control environment or monitoring components of internal controlEmphasize those relating to audit committee effectiveness, fraud, and period-end processDirect or indirect effect
19 Significant Accounts and Disclosures Account significant if reasonable possibility that it could contain a misstatement that individually or in aggregate has a material effect on financial statementsFactorsSize and composition.Susceptibility of loss due to errors or fraud.Volume of activity, complexity, and homogeneity of individual transactions.Nature of the account.Accounting and reporting complexity.Exposure to losses.Possibility of significant contingent liabilities.Existence of related party transactions.Changes from the prior period.
20 Identifying Relevant Assertions Those that have meaningful bearing on whether account is presented fairly(1) existence or occurrence;(2) completeness;(3) valuation or allocation;(4) rights and obligations; and/or(5) presentation and disclosure.
21 Design EffectivenessRoutine transactions are for recurring activities,Examples: sales, purchases, cash receipts and disbursements, and payroll.Nonroutine transactions occur only periodically; they generally are not part of the routine flow of transactionsExamples: transactions such as counting and pricing inventory, calculating depreciation expense, or determining prepaid expenses.Accounting estimates are activities involving management’s judgments or assumptions,Examples: determining the allowance for doubtful accounts, estimating warranty reserves and assessing assets for impairment
22 Likely Source of Misstatements Understand the flow of transactions;Verify points within the company’s processes at which a misstatement could arise that could be material;Identify the controls management has implemented to address these potential misstatements; andIdentify the controls management has implemented to prevent or detect on a timely basis unauthorized acquisition, use, or disposition of the company’s assets that could result in a material misstatement.
23 Selecting Controls Not necessary to design tests of all controls Redundant controlsDo not need to test if duplicate control is testedDesign tests for preventive and/or detective controlsComplementary controlsShould both be tested
24 Performing Walk-Throughs Tracing a transaction from its origination through the company’s information system until it is reflected in the company’s financial reportsProvide evidence to:Verify that they have identified points at which a significant risk of misstatement to a relevant assertion exists.Verify their understanding of the design of controls, including those related to the prevention or detection of fraud.Evaluate the effectiveness of the design of controls.Confirm whether controls have been placed in operation (implemented).
25 Tests of Operating Effectiveness NatureInquiries, inspections, observations and reperformanceVary exact tests when possibleTimingSufficient period of timePeriodic controls – wait to after report dateExtentDepend on frequency of control
27 Relationship Between Audits Tests of controlsSame for internal control audit and financial statement auditEvidence from internal control audit can be used for financial statement auditDifferences between auditsObjectives are differentIntegrated auditTesting should be spread through the year to satisfy both objectives
28 Effects of Internal Control Testing on Audit Substantive Procedures Integrated audit requires tests of controls for all major account and relevant assertionsWill lead to decreased scope of substantive proceduresHowever, significant deficiencies or material weaknesses could lead to more substantive proceduresNot acceptable to omit substantive procedures completely
29 Effect of Substantive Procedures on Audit of Internal Control Findings from substantive procedures may affect audit of internal controlCould provide evidence of effectiveness or ineffectiveness of internal control over financial reportingExample: Identification of material misstatement in financial statements is indicative of at least a significant deficiency in internal control
30 Form an opinion Evaluate: 1. The results of their evaluation of the design,2. The results of tests of the operating effectiveness of controls,3. Negative results of substantive procedures performed during the financial statement audit, and4. Any identified control deficiencies.
33 Other Communication Requirements Communicate in writing to managementAll control deficiencies regardless of severityTo audit committeeMaterial weaknesses, significant deficiencies and that all deficiencies have been communicated to managementTo board of directorsIf conclude oversight of financial reporting and internal control is ineffective
34 Other ReportReporting on Whether a Previously Reported Material Weakness Continues to ExistManagement believes material weakness has been eliminatedAuditor engaged to report on whether material weakness continues to existEngagement focused on evidence regarding material weakness
35 Integrated Audis for Nonpublic Companies A nonpublic company may choose to have an integrated audit of its financial statements and its internal control. While the service is very similar to that for public companies, it differs as follows: