1. Learning Objectives LO5 Illustrate how business risk analysis is used to assess the risk of material misstatement at the financial statement level and at the assertion level. LO6 Describe the five components of the internal control framework: the control environment, management’s risk assessment process, information systems and communication, control activities, and monitoring. LO7 Explain how the auditor’s understanding of an organization’s internal control helps the auditor to assess and respond to the risk that its financial statements are misstated. 1

2. Internal Control Components Internal control is defined as the process designed, implemented, and maintained by management to provide reasonable assurance about:  the reliability of financial reporting,  effectiveness and efficiency of operations, and  compliance with applicable laws and regulations. LO6 2

3. Internal Control Components Internal control consists of the following: a. the control environment, b. the entity’s risk assessment process, c. the information system and business processes relevant to financial reporting and communication, d. control activities, and e. the monitoring of controls. LO6 3

4. Control Environment Elements of control environment:  management philosophy and operating style,  organizational structure,  operation of the board of directors, particularly the audit committee,  methods of assigning authority and responsibility,  management monitoring methods,  internal audit,  personnel policies and practices,  external influences, and  computerized systems (preventive controls). LO6 4

5. Risk Assessment Process The risk assessment process is how management identifies risks related to misstatements in the financial statements.  Management will also evaluate the significance and likelihood of those risks, and decide how to manage those risks efficiently and effectively. LO6 5

6. Information System, Business Processes and Communication An information system has procedures to:  identify and record all valid transactions,  describe transactions in a manner that permits proper classification,  measure the value of transactions,  determine the time period in which transactions should be reported, and  present the transactions properly in the financial statements. LO6 6

7. Control Activities Controls are policies and procedures that ensure the achievement of the entity’s goals, including financial reporting goals.  Controls can be categorized as either general controls or as application controls.  General controls relevant to the audit include performance reviews.  Application controls include checks on accuracy, completeness, and authorization of transaction processing. LO6 7

8. Monitoring of Controls Management’s monitoring of controls includes considering whether they are operating as intended.  Monitoring may include reviews of reconciliations, internal audit evaluations, and legal department evaluations of compliance.  Controls are modified as required to accommodate changes in business conditions. LO6 8