Control and Accounting Information Systems

1. Control and Accounting Information Systems 7 UAA – ACCT 316 Accounting Information Systems Dr. Fred Barbee Chapter

2. Introduction to Internal Control

3. Internal Control . . . • Can an information system operate without internal controls? • Perhaps. • Will the organization attain its objectives? • Perhaps.

4. Why Internal Control?

5. Why Controls . . . To Ensure system goals are achieved To Lessen the risk of unwanted outcomes

6. Controls . . . What are the goals that internal control is designed to achieve? What are the typical business risks that the organization should try to avoid?

7. What are the goals that internal control is designed to help achieve? Question

8. Internal Control Goals • The National Commission on Fraudulent Financial Reporting • Appointed • The Committee of Sponsoring Organizations (COSO) • To study internal control

9. Internal Control Goals • COSO entity objectives . . . • Operations - relating to effective and efficient use of an entity’s resources. • Financial Reporting - relating to preparation of reliable financial reports. • Compliance - relating to the entity’s compliance with applicable laws and regulations.

10. What are the typical business risks that an organization should try to avoid? Question

11. What is Risk? • The dictionary defines risk as . . . Hazard; peril; exposure to loss or injury. • What is an exposure?

12. Exposure . . . . . . the potential financial effect of an event multiplied by its probability of occurrence. X =

13. Risk Analysis EXPECTEDLOSS * = * THREAT EXPOSURE RISK

14. Risk Analysis Internal Controls EXPECTEDLOSS THREAT * EXPOSURE RISK = *

15. Controls . . . An exposure consists of the potential financial effect of an event multiplied by its probability of occurrence. X = 5% $250,000 $5,000,000 X =

16. AQ X AP AQ X SP SQ X SP Rate Variance Quantity Variance Direct Material Variances • An example of a control system in accounting

17. Common Business Exposures

18. Erroneous Record Keeping Unacceptable Accounting Business Interruptions Erroneous Management Decisions Common Business Exposures Business Exposures

19. Fraud and Embezzlement Statutory Sanctions Excessive Costs Loss/Destruction Of Resources Competitive Disadvantage Common Business Exposures Business Exposures

20. What are the legal responsibilities of management? Or, what are we supposed to do?

21. The SEC . . . The establishment and maintenance of a system of internal controls is an important management obligation.

22. The SEC . . . A fundamental aspect of management’s stewardship responsibility is to provide shareholders with reasonableassurance that the business is adequately controlled.

23. The SEC . . . Additionally, management has a responsibility to furnish shareholders and potential investors with reliable financial information on a timely basis.

24. Legal Responsibilities • Management is legally responsible • for establishing and maintaining an adequate system of internal control.

25. The SEC . . . An adequate system of internal control is necessary to management’s discharge of these obligations.

26. OK, so what if management doesn’t do this. What then?

27. Enter . . . The Foreign Corrupt Practices Act

28. FCPA Legal Requirement Make and keep books, records, and accounts that, in reasonable detail, accurately and fairly reflect the transactions of the registrant and the disposition of its assets.

29. FCPA Legal Requirement Design and maintain • a system of internal accounting controls • sufficient to provide reasonableassurances that certain specified objectives are met.

30. The Internal Control Structure . . . What is Internal Control?

31. Standards of Field Work • The Field Work standards are so named because they pertain primarily to the conduct of the audit at the client’s place of business; that is, in the field.

32. Second Standard of Field Work • A sufficient understanding of the internal control structure is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed.

33. Defining Internal Control Reviewing the Literature

34. 1949 Committee on Auditing Procedure • A system of internal control should be designed to achieve objectives that are both • operational and • accounting in nature.

35. Defining Internal Control • The 1958 definition was the first to differentiate between • accounting controls and • administrative controls, • A distinction that is very important to independent auditors.

36. In 1963, chapter 5 of Statement on Auditing Procedure No. 33 attempted to clarify the distinction between administrative and accounting controls, stating that the independent auditor is primarily concerned with the latter when applying generally accepted auditing standards.

37. After 1963, there continued to be confusion concerning the scope of the auditor’s responsibility as it related to safeguarding of assets and the reliability of financial statements.

38. So . . . What is Internal Control?

39. Cohen Commission Report • Published annual reports should contain a report in which corporate management discloses the condition of the company’s internal control system.

40. Internal Control Some Recent Additions

41. Internal Control . . . Information Systems Audit and Control Foundation – Control Objectives for Information and Related Technology COBIT

42. COBIT

43. Internal Control Viewed as: • A set of processes including policies, procedures, practices, and organizational structure.

44. Internal Control Objectives • Effective & efficient operations • Confidentiality • Integrity & availability of information • Reliable financial reporting • Compliance with laws and regulations

45. Internal Control . . . Institute of Internal Auditors Research Foundation’s Systems Auditability and Control (SAC)

46. Systems Auditability and Control

47. Acct 316 Acct 316 Acct 316 Internal Control Viewed as . . . • Set of processes, subsystems, and people.

48. Acct 316 Acct 316 Acct 316 Internal Control Objectives • Effective & efficient operations • Reliable financial reporting • Compliance with laws and regulations

49. Internal Control . . . The Committee of Sponsoring Organizations of the Treadway Commission Internal Control – Integrated Framework

50. COSO