1. Internal Control in a Financial Statement Audit
Chapter 6
Internal Control in a Financial Statement Audit
McGraw-Hill/Irwin
Copyright © 2008 by The McGraw-Hill Companies, Inc. All rights reserved.

2. Internal Control
LO# 1
Internal control plays an important role in how management meets its stewardship or agency responsibilities. Management has the responsibility to maintain controls that provides reasonable assurance that adequate control exists over the entity’s assets and records. Proper internal control not only ensures that assets and records are safeguarded but also creates an environment in which efficiency and effectiveness are encouraged and monitored. Management also needs a control system that generates reliable information for decision making.
The auditor needs assurance about the reliability of the data generated by the information system in terms of how it affects the fairness of the financial statements and how well the assets and records of the entity are safeguarded.

3. Internal Control
LO# 1
The auditor uses risk assessment procedures to obtain an understanding of the entity’s internal control and uses this understanding to identify the types of potential misstatements, ascertain factors that affect the risk of material misstatement, and design tests of controls and substantive procedures.
The auditor’s understanding of the internal control is a major factor in determining the overall audit strategy. The auditor’s responsibilities for internal control are discussed under two major topics: (1) obtaining an understanding of internal control and (2) assessing control risk.

4. Internal Control Objectives Reliability of Financial Reporting
Effectiveness & Efficiency of Operations
Compliance with Laws & Regulations
Objectives

5. Controls Relevant to the Audit
LO# 3
Controls Relevant to the Audit
Reliability of Financial Reporting
Effectiveness & Efficiency of Operations
Compliance with Laws & Regulations
Objectives
Generally, internal controls pertaining to the preparation of financial statements for external purposes are relevant to an audit.

6. Controls Relevant to the Audit
LO# 3
Controls Relevant to the Audit
Objectives
Reliability of Financial Reporting
Effectiveness & Efficiency of Operations
Compliance with Laws & Regulations
Controls relating to operations and compliance objectives may be relevant when they relate to data the auditor uses to apply auditing procedures.

7. Components of Internal Control
LO# 4
Components of Internal Control
Control Environment
Entity’s Risk Assessment Process
Information System and Related Business Processes Relevant to Financial Reporting & Communication
Control Procedures
Monitoring of Controls

8. Components of Internal Control
LO# 4
Components of Internal Control

9. Components of Internal Control
LO# 4
Components of Internal Control

10. The Effect of Information Technology on Internal Control

11. Planning an Audit Strategy
LO# 6
Planning an Audit Strategy
Audit Risk Model
AR = IR × CR × DR
In applying the audit risk model, the auditor must assess control risk. The figure on the next slide presents a flowchart of the auditor’s decision process when considering internal control in planning an audit.

12. Planning an Audit Strategy
LO# 6
Planning an Audit Strategy

13. Substantive Strategy
LO# 6
After obtaining an understanding of internal control, an auditor may choose to follow a substantive strategy and set control risk at the maximum for some or all assertions because of one or all of the following factors:
Controls are assessed as ineffective.
Controls do not pertain to an assertion.
Testing the effectiveness of controls is inefficient.

14. Reliance Strategy Obtain Understanding of Internal Control
LO# 6
Reliance Strategy
Obtain Understanding of Internal Control
Plan to Rely on Internal Control and Assess Control Risk Below Maximum

15. Assertions Occurrence Completeness Authorization Accuracy Cutoff
LO# 6
Occurrence
Completeness
Authorization
Accuracy
Cutoff
Classification

16. LO# 6
Assertions

17. LO# 6
Assertions

18. Obtain an Understanding of Internal Control
LO# 7
Obtain an Understanding of Internal Control
The auditor should obtain an understanding of each of the five components of internal control in order to plan the audit. This knowledge is used to:
Identify types of potential misstatements
Pinpoint the factors that affect the risk of material misstatement
Design tests of controls and substantive procedures

19. LO# 7
Control Environment

20. The Entity’s Risk Assessment Process
LO# 7
The Entity’s Risk Assessment Process
The risk assessment process should consider external and internal events and circumstances that may arise and adversely affect the entity’s ability to initiate, record, process and report financial data consistent with the assertions of management in the financial statements.
Changes in the operating environment
New personnel
New or revamped information systems
Rapid growth
New technology
New business models, products, or activities
Corporate restructuring
Expanded international growth
New accounting pronouncements
Client business risk can arise or change due to the following circumstances:

21. Information Systems and Communication
LO# 7
Information Systems and Communication
An effective accounting system gives appropriate consideration to establishing methods and records that will
Identify and record all valid transactions.
Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions for financial reporting.
Measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements.
Determine the time period in which transactions occurred to permit recording of transactions in the proper accounting period.
Properly present the transactions and related disclosures in the financial statements.

22. Information processing
LO# 7
Control Activities
Control activities are the policies and procedures that help ensure that management’s directives are carried out. Those control procedures that are relevant to the audit include
Performance reviews
Information processing
Physical controls
Segregation of duties

23. Monitoring of Controls
LO# 7
Monitoring of Controls
Monitoring of controls is a process that assesses the quality of internal control performance over time.
Internal Auditors
An effective internal audit function has clear lines of authority and reporting, qualified personnel, and adequate resources to enable these personnel to carry out their assigned duties.

24. The Effect of Entity Size on Internal Control
LO# 7
The Effect of Entity Size on Internal Control
While the basic concepts of the five components should be present in all entities, they are likely to be less formal in a small or midsize entity than in a large entity.

25. The Limitations of an Entity’s Internal Control
LO# 7
The Limitations of an Entity’s Internal Control
Management Override of Internal Control
Human Errors or Mistakes
Collusion

26. Factors Contributing to Fraud
LO# 7
Factors Contributing to Fraud

27. Documenting the Understanding of Internal Control
LO# 8
Documenting the Understanding of Internal Control
Procedure Manuals and Organizational Charts
Narrative Description
Internal Control Questionnaires
Flowcharts

28. Assessing Control Risk
LO# 9
Identify specific controls that will be relied upon.
Perform tests of controls
Conclude on the achieved level of control risk.

29. Documenting the Assessed Level of Control Risk
The auditor’s assessment of control risk and the basis for the achieved level can be documented using a structured working paper, an internal control questionnaire, or a memorandum.
Let’s look at an example from EarthWear Clothiers to see how the control risk for two accounts that differ in terms of their nature, size and complexity is documented.

30. Documenting the Assessed Level of Control Risk

31. Substantive Procedures
LO# 11
Substantive Procedures

32. Timing of Audit Procedures
LO# 12
Timing of Audit Procedures
Interim
Year End
Let’s look at the EarthWear Clothiers example again to see the timing of their audit procedures.

33. Timing of Audit Procedures
LO# 12
Timing of Audit Procedures

34. Interim Audit Procedures
LO# 12
Interim Audit Procedures
Interim Tests of Controls
Assertion being tested not significant
Control has been effective in prior audits
Efficient use of staff time
Interim Substantive Procedures
Assertion probably has low control risk
May increase the risk of material misstatements
Still requires some year end testing

35. Auditing Accounting Applications Processed by Service Organizations
LO# 13
Auditing Accounting Applications Processed by Service Organizations
In some instances, a client may have some or all of its accounting transactions processed by an outside service organization.
Because the client’s transactions are subjected to the controls of the service organization, one of the auditor’s concerns is the internal control system in place at the service organization.
It is not uncommon for service organizations to have an auditor issue one of two types of reports on their operations.

36. Auditing Accounting Applications Processed by Service Organizations
LO# 13
Auditing Accounting Applications Processed by Service Organizations
Report #1
Describes the service organization’s controls and assesses whether they are suitably designed to achieve specified internal control objectives.
Report #2
Goes further by testing whether the controls provide reasonable assurance that the related control objectives were achieved during the period.
An auditor may reduce control risk below the maximum only on the basis of a service auditor’s report that includes tests of the controls.

37. Communication of Internal Control-Related Matters
LO# 14
Communication of Internal Control-Related Matters
Significant deficiencies in the design or operation of internal control that could adversely affect the organization’s ability to initiate, record, process, and report financial data consistent with management’s assertions.
Reportable Conditions
A material weakness is a significant deficiency, or combination of significant deficiency that results in more than a remote likelihood that a material misstatement of the financial statements will not be prevented or detected.
Material Weakness

38. Examples of Reportable Conditions
LO# 14
Examples of Reportable Conditions

39. Types of Controls in an IT Environment
LO# 15
Types of Controls in an IT Environment
General Controls
Data center & network operations
System software acquisition, change and maintenance
Access security
Application system acquisition, development, and maintenance
Application Controls
Data capture controls
Data validation controls
Processing controls
Output controls
Error controls

40. Types of Controls in an IT Environment
LO# 15
Types of Controls in an IT Environment

41. Types of Controls in an IT Environment
LO# 15
Types of Controls in an IT Environment

42. Types of Controls in an IT Environment
LO# 15
Types of Controls in an IT Environment

43. Flowcharting Symbols
LO# 16

44. End of Chapter 6