1. 9 - 1 Copyright  2003 Pearson Education Canada Inc. CHAPTER 9 The Study of the Internal Control and Assessment of Control Risk

2. 9 - 2 Copyright  2003 Pearson Education Canada Inc. What is internal control?

3. 9 - 3 Copyright  2003 Pearson Education Canada Inc. What is internal control? Internal control consists of the policies & procedures established & maintained by management to assist in orderly & efficient conduct of business.

4. 9 - 4 Copyright  2003 Pearson Education Canada Inc. - reliability of controls Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding: Accounting Records Our records are reliable!

5. 9 - 5 Copyright  2003 Pearson Education Canada Inc. - reliability of controls - optimizing use of resources Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s objectives regarding: Waste

6. 9 - 6 Copyright  2003 Pearson Education Canada Inc. - reliability of controls - optimizing use of resources - safeguarding of assets Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding:

7. 9 - 7 Copyright  2003 Pearson Education Canada Inc. - reliability of controls - optimizing use of resources - safeguarding of assets - preventing & detecting fraud & error Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding:

8. 9 - 8 Copyright  2003 Pearson Education Canada Inc. perform preliminary analytical procedures Steps in audit planning preplan understand internal control and assess control risk set materiality, and assess acceptable audit risk and inherent risk obtain background information obtain information about client’s legal obligations

9. 9 - 9 Copyright  2003 Pearson Education Canada Inc. perform preliminary analytical procedures Steps in audit planning preplan Why is an understand- ing of internal control im- portant? set materiality, and assess acceptable audit risk and inherent risk understand internal control and assess control risk obtain background information obtain information about client’s legal obligations

10. 9 - 10 Copyright  2003 Pearson Education Canada Inc. Second Examination Standard: A sufficient understanding of internal control should be obtained to plan the audit. Why is an understanding of internal control important?

11. 9 - 11 Copyright  2003 Pearson Education Canada Inc. Audit Risk has 3 components which combine to make the audit risk model: = xx audit risk inherent risk control risk detection risk the risk that material misstatements will not be prevented or detected by internal controls

12. 9 - 12 Copyright  2003 Pearson Education Canada Inc. Key Internal Control Concepts - internal control is the client’s respon- sibility and should be designed to help the client attain goals

13. 9 - 13 Copyright  2003 Pearson Education Canada Inc. - internal control is the client’s respon- sibility and should be designed to help the client attain goals - internal control should provide rea- sonable but not absolute assurance; cost/benefit must be considered Key Internal Control Concepts

14. 9 - 14 Copyright  2003 Pearson Education Canada Inc. - internal control is the client’s respon- sibility and should be designed to help the client attain goals - internal control should provide rea- sonable but not absolute assurance; cost/benefit must be considered - internal control has inherent limita- tions (e.g., misunderstandings, mis- takes, fatigue, carelessness, collusion, management override) Key Internal Control Concepts

15. 9 - 15 Copyright  2003 Pearson Education Canada Inc. What are the components of internal control?

16. 9 - 16 Copyright  2003 Pearson Education Canada Inc. the control environment What are the elements of internal control?

17. 9 - 17 Copyright  2003 Pearson Education Canada Inc. The control environment is the actions, policies, and procedures that reflect management’s attitude regard- ing controls and their importance. All of these controls are unnecessary!

18. 9 - 18 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment:

19. 9 - 19 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - management’s philosophy and operating style

20. 9 - 20 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their approach to taking and monitoring business risk

21. 9 - 21 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their attitude and actions toward financial reporting

22. 9 - 22 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their emphasis on meeting financial and operating goals...our bonuses are based on net income. We all want fat bonuses! What can we do?

23. 9 - 23 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - board of directors & committees The audit committee maintains communication between the Board of Directors and internal and external auditors. BOARD OF DIRECTORS audit committee internal auditors external auditors

24. 9 - 24 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - organizational structure The auditor should consider lines of responsibility and authority.

25. 9 - 25 Copyright  2003 Pearson Education Canada Inc. What are the formal methods that management uses to communicate internal controls to employees? Factors related to the Control Environment: - assignment of authority and responsibility Employee Handbook Company Policies Job Description Memo:

26. 9 - 26 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - management’s control methods Do management’s methods send a clear message about the importance of control?

27. 9 - 27 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - management’s control methods Do manage- ment’s methods serve to detect misstatements? Do management’s methods send a clear message about the importance of control?

28. 9 - 28 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - systems development methodology Does management have a methodology for developing and modifying systems and procedures?

29. 9 - 29 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - personnel policies and practices Management should ensure that compe- tent, trustworthy, motivated personnel are employed to meet client goals and objectives. Employees are the critical component of effective internal control.

30. 9 - 30 Copyright  2003 Pearson Education Canada Inc. With competent, trustworthy, motivated per- sonnel, even a poorly designed system of internal control may function adequately. Employees are the critical com- ponent of effective internal control.

31. 9 - 31 Copyright  2003 Pearson Education Canada Inc. Without such personnel, even a well- designed system will probably fail. With competent, trustworthy, motivated per- sonnel, even a poorly designed system of internal control may function adequately.

32. 9 - 32 Copyright  2003 Pearson Education Canada Inc. -management’s reaction to external influences Factors related to the Control Environment: Is management aware of external influences such as changes in the economy and technology?

33. 9 - 33 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - internal audit Does an internal audit department exist? Does it effectively monitor control policies and procedures, and enhance operational effectiveness and efficiency?

34. 9 - 34 Copyright  2003 Pearson Education Canada Inc. Factors related to the Control Environment: - internal audit Does internal audit assist the external auditors and reduce audit fees? Does an internal audit department exist? Does it…?

35. 9 - 35 Copyright  2003 Pearson Education Canada Inc. control systems What are the elements of internal control?

36. 9 - 36 Copyright  2003 Pearson Education Canada Inc. Accounting systems have several subcomponents - classes of transactions accounting systems What are the elements of internal control?

37. 9 - 37 Copyright  2003 Pearson Education Canada Inc. control procedures What are the components of internal control?

38. 9 - 38 Copyright  2003 Pearson Education Canada Inc. control procedures Control procedures are policies and pro- cedures, in addition to those related to other components, established to enable the entity to address risks in the achievement of their objectives.

39. 9 - 39 Copyright  2003 Pearson Education Canada Inc. Categories of Control Procedures

40. 9 - 40 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties - separate custody of assets from accounting The Controller Categories of Control Procedures

41. 9 - 41 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties - separate custody of assets from authorization of transactions As custodian of the corporate auto fleet, I hereby authorize retire- ment of auto #43 because of obso- lescence. #43 Joe Categories of Control Procedures

42. 9 - 42 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties - separate operational responsibility from record keeping responsibility Categories of Control Procedures Example: Ace company has two plants; one in Great Britain and one in Canada. Manage- ment is deciding whether the plant controllers should report directly to the plant managers or the corporate vice president of finance.

43. 9 - 43 Copyright  2003 Pearson Education Canada Inc. plant controller V.P.- production V.P.- finance plant manager plant controller V.P.- production V.P.- finance plant manager plant controller plant manager plant controller plant manager Which arrangement creates a potential conflict of interest? plant controller plant controller

44. 9 - 44 Copyright  2003 Pearson Education Canada Inc. plant controller V.P.- production V.P.- finance plant manager plant controller plant manager Which arrangement creates a potential conflict of interest? If the plant controller reports directly to the plant manager, a potential conflict of interest exists. In an effort to make that plant’s results appear favourable, the plant manager may at- tempt to influence the plant controller.

45. 9 - 45 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties - separate duties within EDP Categories of Control Procedures

46. 9 - 46 Copyright  2003 Pearson Education Canada Inc. What kind of company typically has difficulty accomplishing adequate segregation of duties?

47. 9 - 47 Copyright  2003 Pearson Education Canada Inc. What kind of company typically has difficulty accomplishing adequate segregation of duties? Small companies frequently have diffi- culty with segregation of duties because of fewer employees and cost constraints.

48. 9 - 48 Copyright  2003 Pearson Education Canada Inc. collusion? What is collusion?

49. 9 - 49 Copyright  2003 Pearson Education Canada Inc. Collusion is the defeat of adequate separation of duties wherein Employees cooperate to perpetrate fraud....we’re agreed. We’ll be rich be- yond our wildest dreams! collusion? What is collusion?

50. 9 - 50 Copyright  2003 Pearson Education Canada Inc. What is the most effective way to prevent collusion?

51. 9 - 51 Copyright  2003 Pearson Education Canada Inc. Hire competent, trustworthy, motivated personnel. What is the most effective way to prevent collusion?

52. 9 - 52 Copyright  2003 Pearson Education Canada Inc. Why is collusion particularly troublesome for auditors?

53. 9 - 53 Copyright  2003 Pearson Education Canada Inc. Competent, untrustworthy, motivated personnel often know how to conceal their fraud. Why is collusion particularly troublesome for auditors?

54. 9 - 54 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties 2. Proper authorization of transactions and activities Categories of Control Procedures

55. 9 - 55 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties 2. Proper authorization of transactions and activities - general authorization - management establishes authorization policies Categories of Control Procedures accounts payable policies & procedures cash receipts policies & procedures personnel policies & procedures

56. 9 - 56 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties 2. Proper authorization of transactions and activities - specific authorization - management makes authorizations on a case-by- case basis. I’m the president and I want to approve every cash payment! Categories of Control Procedures

57. 9 - 57 Copyright  2003 Pearson Education Canada Inc. 1. Adequate segregation of duties 2. Proper authorization of transactions and activities 3. Adequate documents and records should provide reasonable assurance that all assets are properly controlled and all transactions are correctly recorded. Categories of Control Procedures

58. 9 - 58 Copyright  2003 Pearson Education Canada Inc. DocumentGuidelines Documents should be: prenumbered and accounted for PURCHASE ORDER 32494 Date: Vendor: 234 Reynolds Rd. Winnipeg, MB R2V 4E3 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles M a n u f a c t u r i n g

59. 9 - 59 Copyright  2003 Pearson Education Canada Inc. DocumentGuidelines Documents should be: prepared during or soon after the related transaction PURCHASE ORDER 32494 Date: Vendor: 234 Reynolds Rd. Winnipeg, MB R2V 4E3 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles M a nu f a ct ur i n g

60. 9 - 60 Copyright  2003 Pearson Education Canada Inc. DocumentGuidelines Documents should be: understand- able and correctly designed (including routing and authorization) PURCHASE ORDER 32494 Date: Vendor: 234 Reynolds Rd. Winnipeg, MB R2V 4E3 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles M a n u f a c t u r i n g

61. 9 - 61 Copyright  2003 Pearson Education Canada Inc. DocumentGuidelines Documents should be: designed for multiple purposes b c PURCHASE ORDER 32494 Date: Vendor: 234 Reynolds Rd. Winnipeg, MB R2V 4E3 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles M a n u f a c t u r i n g a

62. 9 - 62 Copyright  2003 Pearson Education Canada Inc. 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Adequate safeguards over assets and records - physical: locking rooms, fenced areas, fireproof safes, safe deposit boxes, security guards; access; backup files and recovery Categories of Control Procedures

63. 9 - 63 Copyright  2003 Pearson Education Canada Inc. 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Adequate safeguards over assets and records 5. Independent, continuous checks on performance - those reviewing performance should be independent of those performing a task Categories of Control Procedures

64. 9 - 64 Copyright  2003 Pearson Education Canada Inc. 5. Independent checks on performance Categories of Control Procedures Segregation of duties is the least expensive method of performing independent checks.

65. 9 - 65 Copyright  2003 Pearson Education Canada Inc. The accounting information and communication system should be designed to satisfy audit objectives.

66. 9 - 66 Copyright  2003 Pearson Education Canada Inc. - existence - the system should ensure that recorded transactions exist - no fictitious transactions The accounting information and communication system should be designed to satisfy audit objectives:

67. 9 - 67 Copyright  2003 Pearson Education Canada Inc. - existence - completeness - the system should en- sure that all existing transactions are recorded The accounting information and communication system should be designed to satisfy audit objectives:

68. 9 - 68 Copyright  2003 Pearson Education Canada Inc. How do the existence and completeness objectives differ? The accounting information and communication system should be designed to satisfy audit objectives: - existence - completeness

69. 9 - 69 Copyright  2003 Pearson Education Canada Inc. How do the existence and completeness objectives differ? Existence con- cerns the existence of fictitious data; i.e., overstatement.

70. 9 - 70 Copyright  2003 Pearson Education Canada Inc. How do the existence and completeness objectives differ? Existence con- cerns the existence of fictitious data; i.e., overstatement. Completeness concerns omission of information; i.e., under- statement.

71. 9 - 71 Copyright  2003 Pearson Education Canada Inc. - existence - completeness - accuracy - the system should ensure that recorded transactions are stated at the correct amounts The accounting information and communication system should be designed to satisfy audit objectives:

72. 9 - 72 Copyright  2003 Pearson Education Canada Inc. - existence - completeness - accuracy - classification - the system should en- sure that transactions are properly classified, possibly through use of a chart of accounts. The accounting information and communication system should be designed to satisfy audit objectives:

73. 9 - 73 Copyright  2003 Pearson Education Canada Inc. - existence - completeness - accuracy - classification - timing - the system should ensure that transactions are recorded on the cor- rect dates. Generally, transactions should be recorded during or shortly after their occurrence. The accounting information and communication system should be designed to satisfy audit objectives:

74. 9 - 74 Copyright  2003 Pearson Education Canada Inc. - existence - completeness - accuracy - classification - timing - posting and summarization -the system should ensure that transactions are included in the accounting records and accurately summarized. The accounting information and communication system should be designed to satisfy audit objectives:

75. 9 - 75 Copyright  2003 Pearson Education Canada Inc. Monitoring activities deal with ongoing or periodic assessment of internal control.

76. 9 - 76 Copyright  2003 Pearson Education Canada Inc. Internal auditing departments frequently perform monitoring activities.

77. 9 - 77 Copyright  2003 Pearson Education Canada Inc. accounting systems the control environment control procedures What are the elements of internal control?

78. 9 - 78 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview Obtain an understanding of internal control. HOW?

79. 9 - 79 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview - review prior year’s working papers - interview prior year auditors - interview client personnel - study client policies and procedures - study client documents, records, information and communication system Obtain an understanding of internal control.

80. 9 - 80 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview How do auditors document their under- standing of internal control?

81. 9 - 81 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview - narratives - flowcharts - internal control questionnaires How do auditors document their under- standing of internal control?

82. 9 - 82 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview - narratives - flowcharts - internal control questionnaires What is an internal control questionnaire? How do auditors document their under- standing of internal control?

83. 9 - 83 Copyright  2003 Pearson Education Canada Inc. Internal Control Questionnaire - a series of questions about internal controls and their application to groups of accounts and cycles

84. 9 - 84 Copyright  2003 Pearson Education Canada Inc. Internal Control Questionnaire - a series of questions about internal controls and their application to groups of accounts and cycles - generally, a “no” answer indicates an internal control weakness

85. 9 - 85 Copyright  2003 Pearson Education Canada Inc. Internal Control Questionnaire What are the advantages provided by an IC questionnaire? - a series of questions about internal controls and their application to groups of accounts and cycles - generally, a “no” answer indicates an internal control weakness

86. 9 - 86 Copyright  2003 Pearson Education Canada Inc. What are the advantages provided by an IC questionnaire? Internal Control Questionnaire - can be designed to cover most aspects of internal control - is relatively applicable from one en- gagement to another - when complete, can be quickly re- viewed for weaknesses

87. 9 - 87 Copyright  2003 Pearson Education Canada Inc. Internal Control Questionnaire What are the disadvantages of using an IC questionnaire?

88. 9 - 88 Copyright  2003 Pearson Education Canada Inc. Internal Control Questionnaire - concentrates on pieces of internal con- trol rather than the system as a whole - has questionable reliability; oral cli- ent responses should be supported by other evidence - may be too standardized for some clients, especially smaller clients What are the disadvantages of using an IC questionnaire?

89. 9 - 89 Copyright  2003 Pearson Education Canada Inc. Are financial statements auditable? Control Examina- tion Overview

90. 9 - 90 Copyright  2003 Pearson Education Canada Inc. Are financial statements auditable? Control Examina- tion Overview When would the answer be NO?

91. 9 - 91 Copyright  2003 Pearson Education Canada Inc. Are financial statements auditable? Control Examina- tion Overview - management lacks integrity - significantly deficient accounting records or internal controls When would the answer be NO?

92. 9 - 92 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview Assess control risk, based on understanding.

93. 9 - 93 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview Assess the cost/benefit of further enhancing under- standing of internal control.

94. 9 - 94 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview max.supportlow Assess control risk.

95. 9 - 95 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview - maximum: poor controls indicate a very risky situation or more efficient to do 100% substantive audit max.supportlow Assess control risk.

96. 9 - 96 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview - maximum: poor controls indicate a very risky situation or not efficient - supportable: risk is at a level supported by understanding obtained max.supportlow Assess control risk.

97. 9 - 97 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview - supportable: risk is at a level supported by understanding obtained - low: effective controls indi- cate a lower level of risk that could be supported max.supportlow Assess control risk.

98. 9 - 98 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview Plan & perform tests of controls.

99. 9 - 99 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview Decide whether the initial internal control assessment was appropriate.

100. 9 - 100 Copyright  2003 Pearson Education Canada Inc. Control Examina- tion Overview Based on appropriate level of detection risk, perform substantive tests.

101. 9 - 101 Copyright  2003 Pearson Education Canada Inc. When should weaknesses be reported to the client?

102. 9 - 102 Copyright  2003 Pearson Education Canada Inc. When should weaknesses be reported to the client? When there are significant deficiencies in the design or operation of internal control.

103. 9 - 103 Copyright  2003 Pearson Education Canada Inc. GAAS requires the auditor to communicate (oral or written) with the audit committee regarding the significant deficiencies. Significant deficiencies in the design or operation of internal control.