1. 1 CHAPTER 6 Internal Control: Concepts

2. 2 What is internal control? Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding:

3. 3 - reliability of financial reporting - operational effectiveness and efficiency - compliance with laws and regulations Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding: The Foreign Corrupt Practices Act requires “proper recordkeeping systems” of SEC companies; i.e., reliable financial statements and ac- counting records.

4. 4 perform preliminary analytical procedures Steps in audit planning preplan understand internal control and assess control risk set materiality, and assess acceptable audit risk and inherent risk obtain background information obtain information about client’s legal obligations

5. 5 perform preliminary analytical procedures Steps in audit planning preplan Why is an understand- ing of internal control im- portant? set materiality, and assess acceptable audit risk and inherent risk understand internal control and assess control risk obtain background information obtain information about client’s legal obligations

6. 6 Second Fieldwork Standard: A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, tim- ing, and extent of tests to be performed. Why is an understanding of internal control important?

7. 7 Audit Risk has 3 components which combine to make the audit risk model: (AU 312) = xx audit risk inherent risk control risk detection risk the risk that material misstatements will not be prevented or detected by internal controls

8. 8 - internal control is the client’s respon- sibility and should be designed to help the client attain goals - internal control should provide rea- sonable but not absolute assurance; cost/benefit must be considered - internal control has inherent limita- tions (e.g., misunderstandings, mis- takes, fatigue, carelessness, collusion, management override) Key Internal Control Concepts

9. 9 What are the components of internal control?

10. 10 the control environment What are the components of internal control?

11. 11 The control environment is the actions, policies, and procedures that reflect management’s attitude regard- ing controls and their importance. All these controls are unnecessary!

12. 12 Factors related to the Control Environment: - integrity and ethical values Does man- agement com- municate com- pany values and behavioral stan- dards to personnel through policy state- ments, codes of con- duct, and by example? Does management remove or reduce incentives or temp- tations that might prompt personnel to engage in dis- honest, illegal, or unethical acts?

13. 13 Factors related to the Control Environment: - commitment to competence Does management consider com- petence levels for specific jobs and how those levels translate into requisite skills and knowledge?

14. 14 Factors related to the Control Environment: - board of directors or audit committee The audit committee maintains communication between the Board of Directors and internal and external auditors. The committee is composed of outside members of the board. SEC companies are required to have an audit committee. BOARD OF DIRECTORS audit committee internal auditors external auditors

15. 15 Factors related to the Control Environment: - management’s philosophy and operating style

16. 16 Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their approach to taking and monitoring business risk

17. 17 Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their attitude and actions toward financial reporting

18. 18 Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their emphasis on meeting financial and operating goals...our bonuses are based on net income. We all want fat bonuses! What can we do?

19. 19 Factors related to the Control Environment: - organizational structure The auditor should consider lines of responsibility and authority.

20. 20 What are the formal methods that management uses to communicate internal controls to employees? Factors related to the Control Environment: - assignment of authority and responsibility Employee Handbook Company Policies Job Description Memo:

21. 21 Factors related to the Control Environment: - human resource policies and practices Management should ensure that compe- tent, trustworthy, motivated personnel are employed to meet client goals and objectives. Employees are the critical com- ponent of effective internal control.

22. 22 With competent, trustworthy, motivated per- sonnel, even a poorly designed system of internal control may function adequately. Employees are the critical com- ponent of effective internal control.

23. 23 Without such personnel, even a well- designed system will probably fail. With competent, trustworthy, motivated per- sonnel, even a poorly designed system of internal control may function adequately.

24. 24 Risk assessment for financial reporting is management’s identification and anal- ysis of risks relevant to financial state- ment preparation in conformity with GAAP. risk assessment What are the components of internal control?

25. 25 control activities Control activities are policies and pro- cedures, in addition to those related to other components, established to enable the entity to address risks in the achievement of their objectives.

26. 26 1. Adequate separation of duties - separate custody of assets from accounting Mr. Controller Categories of Control Activities

27. 27 1. Adequate separation of duties - separate custody of assets from authorization of transactions As custodian of the corporate auto fleet, I hearby authorize retire- ment of auto #43 because of obso- lescence. #43 joe Categories of Control Activities

28. 28 1. Adequate separation of duties - separate operational responsibility from record keeping responsibility Categories of Control Activities Example: Ace company has two plants; one in Great Britain and one in the U.S.A. Manage- ment is deciding whether the plant controllers should report directly to the plant managers or the corporate vice president of finance.

29. 29 plant controller V.P.- production V.P.- finance plant manager plant controller plant manager plant controller V.P.- production V.P.- finance plant manager plant controller plant manager plant controller plant manager Which arrangement creates a potential conflict of interest?

30. 30 plant controller V.P.- production V.P.- finance plant manager plant controller plant manager Which arrangement creates a potential conflict of interest? If the plant controller reports directly to the plant manager, a potential conflict of interest exists. In an effort to make that plant’s results appear favorable, the plant manager may at- tempt to influence the plant controller.

31. 31 1. Adequate separation of duties - separate duties within EDP Categories of Control Activities

32. 32 What kind of company typically has difficulty accomplishing adequate segregation of duties?

33. 33 What kind of company typically has difficulty accomplishing adequate segregation of duties? Small companies frequently have diffi- culty with segregation of duties because of fewer employees.

34. 34 Collusion is the defeat of adequate sep- aration of duties wherein employees cooperate to perpetrate fraud....we’re agreed. We’ll be rich be- yond our wildest dreams! collusion? What is collusion?

35. 35 What is the most effective way to prevent collusion?

36. 36 hire competent, trustworthy, motivated personnel What is the most effective way to prevent collusion?

37. 37 Competent, untrustworthy, motivated personnel often know how to conceal their fraud. Why is collusion particularly troublesome for auditors?

38. 38 1. Adequate separation of duties 2. Proper authorization of transactions and activities Categories of Control Activities

39. 39 1. Adequate separation of duties 2. Proper authorization of transactions and activities - general authorization - management establishes authorization policies Categories of Control Activities accounts payable policies & procedures cash receipts policies & procedures human resources policies & procedures

40. 40 I’m the president and I want to approve every cash payment! Categories of Control Activities 1. Adequate separation of duties 2. Proper authorization of transactions and activities - specific authorization - management makes authorizations on a case-by- case basis.

41. 41 1. Adequate separation of duties 2. Proper authorization of transactions and activities 3. Adequate documents and records should provide reasonable assurance that all assets are properly controlled and all transactions are correctly recorded. Categories of Control Activities

42. 42 DocumentGuidelines Documents should be: prenumbered and accounted for PURCHASE ORDER 32494 Date: Vendor: 234 Reynolda Rd. Winston-Salem, NC27109 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles U N I V E R S I T Y

43. 43 DocumentGuidelines Documents should be: prepared during or soon after the related transaction PURCHASE ORDER 32494 Date: Vendor: 234 Reynolda Rd. Winston-Salem, NC27109 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles U N I V E R S I T Y

44. 44 DocumentGuidelines Documents should be: understand- able and correctly designed (including routing and authorization) PURCHASE ORDER 32494 Date: Vendor: 234 Reynolda Rd. Winston-Salem, NC27109 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles U N I V E R S I T Y

45. 45 DocumentGuidelines Documents should be: designed for multiple purposes b c PURCHASE ORDER 32494 Date: Vendor: 234 Reynolda Rd. Winston-Salem, NC27109 Purchasing agent: Quantity Description Price WAIT FOREST U N I V E R S I T Y total cost of order Est. shipment date: Terms of sale (including discounts and freight costs): Carrier: Internal Use Only: (routing instructions) 1.PO made in purchasing 3. receiving notes ship 2.Copies to vendor, receiv. 4. acctg. reconciles U N I V E R S I T Y a

46. 46 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Physical control over assets and records - locking rooms, fenced areas, fireproof safes, safe deposit boxes, security guards, backup files Categories of Control Activities

47. 47 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Physical control over assets and records 5. Independent checks on performance - those reviewing performance should be independent of those performing a task Categories of Control Activities

48. 48 5. Independent checks on performance Categories of Control Activities Separation of duties is the least expensive method of performing independent checks.

49. 49 information and communication What are the components of internal control?

50. 50 The accounting information and communication system should be designed to satisfy audit objectives. information and communication

51. 51 - existence - the system should ensure that recorded transactions exist - no fictitious transactions The accounting information and communication system should be designed to satisfy audit objectives:

52. 52 - existence - completeness - the system should en- sure that all existing transactions are recorded The accounting information and communication system should be designed to satisfy audit objectives:

53. 53 How do the existence and completeness objectives differ? The accounting information and communication system should be designed to satisfy audit objectives: - existence - completeness

54. 54 How do the existence and completeness objectives differ? Existence con- cerns the existence of fictitious data; i.e., overstatement.

55. 55 How do the existence and completeness objectives differ? Existence con- cerns the existence of fictitious data; i.e., overstatement. Completeness concerns omission of information; i.e., under- statement.

56. 56 - existence - completeness - accuracy - the system should ensure that recorded transactions are stated at the correct amounts The accounting information and communication system should be designed to satisfy audit objectives:

57. 57 - existence - completeness - accuracy - classification - the system should en- sure that transactions are properly classified, possibly through use of a chart of accounts. The accounting information and communication system should be designed to satisfy audit objectives:

58. 58 - existence - completeness - accuracy - classification - timing - the system should ensure that transactions are recorded on the cor- rect dates. Generally, transactions should be recorded during or shortly after their occurrence. The accounting information and communication system should be designed to satisfy audit objectives:

59. 59 - existence - completeness - accuracy - classification - timing - posting and summarization -the system should ensure that transactions are included in the accounting records and accurately summarized. The accounting information and communication system should be designed to satisfy audit objectives:

60. 60 monitoring What are the components of internal control?

61. 61 monitoring Monitoring activities deal with ongoing or periodic assessment of internal control.

62. 62 Internal auditing departments frequently perform monitoring activities.