1. Acct 316 Acct 316 Acct 316 Control and Accounting Information Systems 7 UAA – ACCT 316 Accounting Information Systems Dr. Fred Barbee Chapter

2. Acct 316 Acct 316 Acct 316 Introduction to Internal Control

3. Acct 316 Acct 316 Acct 316 Internal Control... Can an information system operate without internal controls? Perhaps. Will the organization attain its objectives? Perhaps.

4. Acct 316 Acct 316 Acct 316 Why Internal Control?

5. Acct 316 Acct 316 Acct 316 Why Controls... To Ensure system goals are achieved To Lessen the risk of unwanted outcomes

6. Acct 316 Acct 316 Acct 316 Controls... What are the goals that internal control is designed to achieve? What are the typical business risks that the organization should try to avoid?

7. Acct 316 Acct 316 Acct 316 What are the goals that internal control is designed to help achieve? Question

8. Acct 316 Acct 316 Acct 316 Internal Control Goals The National Commission on Fraudulent Financial Reporting Appointed The Committee of Sponsoring Organizations (COSO) To study internal control

9. Acct 316 Acct 316 Acct 316 Internal Control Goals COSO entity objectives...  Operations - relating to effective and efficient use of an entity’s resources.  Financial Reporting - relating to preparation of reliable financial reports.  Compliance - relating to the entity’s compliance with applicable laws and regulations.

10. Acct 316 Acct 316 Acct 316 What are the typical business risks that an organization should try to avoid? Question

11. Acct 316 Acct 316 Acct 316 What is Risk? The dictionary defines risk as... What is an exposure? Hazard; peril; exposure to loss or injury.

12. Exposure...... the potential financial effect of an event multiplied by its probability of occurrence. Potential Financial Effect of an Event Probability of Occurrence Exposure

13. Risk Analysis THREATEXPOSURERISK EXPECTED LOSS * * =

14. THREATEXPOSURERISK EXPECTED LOSS * * = Internal Controls

15. Controls... An exposure consists of the potential financial effect of an event multiplied by its probability of occurrence. $5,000,000X 5% = $250,000 Potential Financial Effect of an Event Probability of Occurrence Exposure

16. Direct Material Variances An example of a control system in accounting AQ X AP Rate Variance AQ X SPSQ X SP Quantity Variance

17. Acct 316 Acct 316 Acct 316 Common Business Exposures

18. Erroneous Record Keeping Unacceptable Accounting Unacceptable Accounting Business Interruptions Business Interruptions Erroneous Management Decisions Erroneous Management Decisions Business Exposures Business Exposures

19. Common Business Exposures Fraud and Embezzlement Fraud and Embezzlement Statutory Sanctions Statutory Sanctions Excessive Costs Excessive Costs Loss/Destruction Of Resources Loss/Destruction Of Resources Competitive Disadvantage Competitive Disadvantage Business Exposures Business Exposures

20. Acct 316 Acct 316 Acct 316 What are the legal responsibilities of management? Or, what are we supposed to do?

21. Acct 316 Acct 316 Acct 316 The establishment and maintenance of a system of internal controls is an important management obligation. The SEC...

22. Acct 316 Acct 316 Acct 316 A fundamental aspect of management’s stewardship responsibility is to provide shareholders with reasonable assurance that the business is adequately controlled. The SEC...

23. Acct 316 Acct 316 Acct 316 Additionally, management has a responsibility to furnish shareholders and potential investors with reliable financial information on a timely basis. The SEC...

24. Acct 316 Acct 316 Acct 316 Legal Responsibilities Management is legally responsible for establishing and maintaining an adequate system of internal control.

25. Acct 316 Acct 316 Acct 316 An adequate system of internal control is necessary to management’s discharge of these obligations. The SEC...

26. Acct 316 Acct 316 Acct 316 OK, so what if management doesn’t do this. What then?

27. Enter... The Foreign Corrupt Practices Act

28. Acct 316 Acct 316 Acct 316 FCPA Legal Requirement Make and keep books, records, and accounts that, in reasonable detail, accurately and fairly reflect the transactions of the registrant and the disposition of its assets.

29. Acct 316 Acct 316 Acct 316 FCPA Legal Requirement Design and maintain a system of internal accounting controls sufficient to provide reasonable assurances that certain specified objectives are met.

30. Acct 316 Acct 316 Acct 316 The Internal Control Structure... What is Internal Control?

31. Acct 316 Acct 316 Acct 316 Standards of Field Work The Field Work standards are so named because they pertain primarily to the conduct of the audit at the client’s place of business; that is, in the field.

32. Acct 316 Acct 316 Acct 316 Second Standard of Field Work A sufficient understanding of the internal control structure is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed.

33. Acct 316 Acct 316 Acct 316 Defining Internal Control Reviewing the Literature

34. Acct 316 Acct 316 Acct 316 1949 Committee on Auditing Procedure A system of internal control should be designed to achieve objectives that are both operational and accounting in nature.

35. Acct 316 Acct 316 Acct 316 Defining Internal Control The 1958 definition was the first to differentiate between accounting controls and administrative controls, A distinction that is very important to independent auditors.

36. In 1963, chapter 5 of Statement on Auditing Procedure No. 33 attempted to clarify the distinction between administrative and accounting controls, stating that the independent auditor is primarily concerned with the latter when applying generally accepted auditing standards.

37. After 1963, there continued to be confusion concerning the scope of the auditor’s responsibility as it related to safeguarding of assets and the reliability of financial statements.

38. Acct 316 Acct 316 Acct 316 So... What is Internal Control?

39. Acct 316 Acct 316 Acct 316 Cohen Commission Report Published annual reports should contain a report in which corporate management discloses the condition of the company’s internal control system.

40. Acct 316 Acct 316 Acct 316 Internal Control Some Recent Additions

41. Acct 316 Acct 316 Acct 316 Internal Control... Information Systems Audit and Control Foundation – Control Objectives for Information and Related Technology COBIT

42. Audience:Management; Users; IS Auditors Focus:Information Technology Responsibility:Management Size:187 Pages – 4 Documents COBIT

43. Acct 316 Acct 316 Acct 316 A set of processes including policies, procedures, practices, and organizational structure. www.isaca.org/bkr_cbt3.htm Internal Control Viewed as:

44. Acct 316 Acct 316 Acct 316 Effective & efficient operations Confidentiality Integrity & availability of information Reliable financial reporting Compliance with laws and regulations Internal Control Objectives

45. Acct 316 Acct 316 Acct 316 Internal Control... Institute of Internal Auditors Research Foundation’s Systems Auditability and Control (SAC)

46. Audience:Internal Auditors Focus:Information Technology Responsibility:Management Size:1,193 pages in 12 modules Systems Auditability and Control

47. Set of processes, subsystems, and people. www.theiia.org Internal Control Viewed as... Acct 316 Acct 316 Acct 316

48. Effective & efficient operations Reliable financial reporting Compliance with laws and regulations Internal Control Objectives Acct 316 Acct 316 Acct 316

49. Internal Control... The Committee of Sponsoring Organizations of the Treadway Commission Internal Control – Integrated Framework

50. Audience:Management Focus:Overall Entity Responsibility:Management Size:353 pages in 4 volumes COSO

51. Acct 316 Acct 316 Acct 316 Internal control viewed as a process. www.coso.org COSO

52. Acct 316 Acct 316 Acct 316 Internal control objectives: Effective and efficient operations Reliable financial reporting Compliance with laws and regulations COSO

53. Acct 316 Acct 316 Acct 316 Internal Control... American Institute of Certified Public Accountants – Consideration of the Internal Control Structure in a Financial Statement Audit (SAS 55)

54. Audience:External Auditors Focus:Financial Statement Responsibility:Management Size:63 pages in 2 documents SAS 55 & SAS 78

55. Acct 316 Acct 316 Acct 316 SAS 55/78 Internal control viewed as a process. www.aicpa.org

56. Acct 316 Acct 316 Acct 316 SAS 55/78 Internal control objectives: Effective and efficient operations Reliable financial reporting Compliance with laws and regulations

57. Acct 316 Acct 316 Acct 316 National Commission on Fraudulent Financial Reporting The Treadway Commission

58. Acct 316 Acct 316 Acct 316 Treadway Commission Emphasized the importance of internal control. Specifically... The control environment; Codes of conduct; Audit committees; and The internal audit function

59. Acct 316 Acct 316 Acct 316 Treadway Commission The commission reaffirmed the Cohen Commission’s call for management reports on the effectiveness of its internal controls.

60. Acct 316 Acct 316 Acct 316 COSO Report... COSO’s final report “Internal Control – Integrated Framework” was issued in September 1992 4 volumes 453 pages Thousands of hours of work

61. Acct 316 Acct 316 Acct 316 COSO Report... Provides a common definition of internal control to meet the needs of diverse users. Provides a framework against which entities can assess and improve their internal control systems.

62. Acct 316 Acct 316 Acct 316 Internal Control... The COSO Definition

63. Internal control is a process, effected by an entity’s board of directors, management, and other personnel, COSO

64. designed to provide reasonable assurance regarding the achievement of objectives in the following categories: COSO

65. Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations. COSO

66. Key Concepts Internal control is a process. It is a means to an end, not an end in itself. Internal control is effected by people. It’s not merely policy manuals and forms, but people at every level of an organization. COSO

67. Key Concepts Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board. Internal control is geared to the achievement of objectives in one or more overlapping categories. COSO

68. It consists of several interrelated components, with integrity, ethical values; competence, and the control environment, serving as the foundation for the other components. COSO

69. Coso’s Components  Control Environment  Risk Assessment  Control Activities  Information & Communication  Monitoring COSO

70. Acct 316 Acct 316 Acct 316 COSO Integrated Framework

71. Acct 316 Acct 316 Acct 316 Control Environment Commitment to integrity and ethical values; Management’s philosophy and operating style; Organizational structure The audit committee of the board of directors.

72. Acct 316 Acct 316 Acct 316 Control Environment Methods of assigning authority and responsibility. Human resources policies and practices External influences

73. Acct 316 Acct 316 Acct 316 COSO Integrated Framework

74. Acct 316 Acct 316 Acct 316 Risk Assessment Identification of risks Analysis of risks Management of risks

75. Acct 316 Acct 316 Acct 316 Typical Sources of Risk Clerical and Operational employees Computer programmers Managers and Accountants Former Employees Customers and Suppliers

76. Acct 316 Acct 316 Acct 316 Typical Sources of Risk Competitors Outside persons Acts of Nature

77. Acct 316 Acct 316 Acct 316 Types of Risks Unintentional Errors Deliberate Errors (Fraud) Unintentional Losses of Assets Thefts of Assets Breaches of Security Acts of violence and Natural Disasters

78. Acct 316 Acct 316 Acct 316 Factors That Increase Risk Exposure Frequency Vulnerability Size of the potential loss

79. Acct 316 Acct 316 Acct 316 Problem Conditions Affecting Risk Exposures Collusion Computer Crime Lack of Enforcement

80. Acct 316 Acct 316 Acct 316 COSO Integrated Framework

81. Acct 316 Acct 316 Acct 316 Control Activities Proper authorization of transactions and activities

82. Acct 316 Acct 316 Acct 316 Control Activities Proper authorization of transactions and activities Segregation of duties

83. Segregation of Duties AuthorizationRecordingCustody Must Be Separate

84. Acct 316 Acct 316 Acct 316 Control Activities Proper authorization of transactions and activities Segregation of duties Design and use of adequate documents and records

85. Acct 316 Acct 316 Acct 316 Control Activities Proper authorization of transactions and activities Segregation of duties Design and use of adequate documents and records Adequate safeguards of assets & records

86. Acct 316 Acct 316 Acct 316 Control Activities Proper authorization of transactions and activities Segregation of duties Design and use of adequate documents and records Adequate safeguards of assets & records Independent checks on performance.

87. Acct 316 Acct 316 Acct 316 COSO Integrated Framework

88. Acct 316 Acct 316 Acct 316 Information and Communication Identify, assemble, analyze, classify, record and report transactions Maintain accountability for assets and liabilities Open and well-defined lines of communication

89. Acct 316 Acct 316 Acct 316 COSO Integrated Framework

90. Acct 316 Acct 316 Acct 316 Monitoring Effective supervision Responsibility accounting Internal auditing

91. COSO Integrated Framework

92. Acct 316 Acct 316 Acct 316 Internal Control... Classifications

93. Input Process Output Sensor Bench- mark Detective and Corrective Controls Corrective Controls Preventive, Detective, and Corrective Controls

94. Control Classifications By ObjectivesBy SettingsBy Risk Aversion Administrative Accounting General Application Input Processing Output Corrective Preventive Detective By System Architectures Manual Systems Computer Based Systems Batch Processing Online Processing Data Base

95. Acct 316 Acct 316 Acct 316 Internal Control... Some Common Grounds

96. Acct 316 Acct 316 Acct 316 Some Common Ground  A system of internal control is not an end in itself. It is, rather, a means to an end.  Internal control is a system Clearly defined goals Interrelated components acting in concert to achieve those goals.

97. Acct 316 Acct 316 Acct 316 Some Common Ground  Establishing a viable internal control system in management’s responsibility.  The strength of any internal control system is largely a function of the people who operate it.

98. Acct 316 Acct 316 Acct 316 Some Common Ground  Internal control cannot be expected to provide 100% assurance that the organization will reach its objectives. ‘Internal control is not “free;” it has a cost associated with it.