Internal control over Financial reporting : An IS control perspective

1. Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID

2. Agenda • Check in • Financial Reporting & Regulation • Understanding Internal Control • IS Controls & Internal controls • Summary

3. What is common among them????

4. Financial Reporting & Regulation

5. Effects

6. Causes

7. Key Audit standards and IS controls • SA 300 - Planning an Audit of Financial Statements • SA 315- Identifying and assessing the risk of material misstatement through understanding the entity and its environment • SA 402 - Audit considerations relating to an entity using a service organization • SA

8. SA 300 • The effect of information technology on the audit procedures, including the availability of data and the expected use of computer assisted audit techniques. • Evidence of management’s commitment to the design, implementation and maintenance of sound internal control, including evidence of appropriate documentation of such internal control.

9. SA 315 : Para A50 • Controls in IT systems consist of a combination of automated controls (for example, controls embedded in computer programs) and manual controls. • Further, manual controls may be independent of IT, may use information produced by IT, or may be limited to monitoring the effective functioning of IT and of automated controls, and to handling exceptions. • When IT is used to initiate, record, process or report transactions, or other financial data for inclusion in financial statements, the systems and programs may include controls related to the corresponding assertions for material accounts or may be critical to the effective functioning of manual controls that depend on IT.

10. SA 315 : Para 52 • Information Technology also poses specific risks to an entity’s internal control, including, for example : • Reliance on systems or programs that are inaccurately processing data, processing inaccurate data, or both. • Unauthorized access to data that may result in destruction of data or improper changes to data, including the recording of unauthorized or nonexistent • Transactions, or inaccurate recording of transactions. Particular risks may arise where multiple users access a common database. • The possibility of IT personnel gaining access privileges beyond those necessary to perform their assigned duties thereby breaking down segregation of duties. • Unauthorized changes to data in master files. • Unauthorized changes to systems or programs. • Failure to make necessary changes to systems or programs. • Inappropriate manual intervention. • Potential loss of data or inability to access data as required.

11. SA 402 • Para 3: “ Services provided by a service organization are relevant to the audit of a user entity’s financial statements when those services, and the controls over them, are part of the user entity’s information system, including related business processes, relevant to financial reporting” • Para 5 : Information available on general controls and computer systems controls relevant to the client's applications

12. SA 265 - COMMUNICATING DEFICIENCIES IN INTERNAL CONTROL TO THOSE CHARGED WITH GOVERNANCE AND MANAGEMENT

13. SA 315 - IDENTIFYING AND ASSESSING THE RISK OF MATERIAL MISSTATEMENT THROUGH UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT

14. SA 330 - THE AUDITOR’S RESPONSES TO ASSESSED RISKS

15. IS Controls and CARO • Para 34 of SA 400

16. Clause 49 – CEO-CFO Certification • The CEO and the CFO certify that they: • accept the responsibility for establishing and maintaining internal controls; • have evaluated the effectiveness of internal control systems • have disclosed to the Auditors and the Audit Committee: • deficiencies in internal controls (in design & operation) and • remediation steps (taken or proposed to be taken) • They have indicated to the Auditors and Audit Committee significant changes in internal control during the year

17. Understanding Internal Controls

18. Internal Controls

19. Components of Internal Controls

20. Equation of Internal Control

21. IS Controls

22. Objective of IS Controls

23. Applications Controls • Application software is the software that processes business transactions. • The application software could be a payroll system, a retail banking system, an inventory system, a billing system or, possibly, an integrated ERP. • It is the application software that understands data with reference to their business context. The rules pertaining to the business processes are implemented in the application software.

24. Examples of Applications • General Ledger • Fixed Assets • Inventory Control • Enterprise Resource Planning • Human Resources • And, everyone’s favorite – Payroll…

25. Types of Application Controls

26. Examples for Application controls

27. Examples for Application Controls

28. General Controls • IT general controls (ITGC) are controls that apply to all systems components, processes, and data for a given organization or information technology (IT) environment. The objectives of ITGCs are to ensure the proper development and implementation of applications, as well as the integrity of programs, data files, and computer operations. • ITGCs may also be referred to as General Computer Controls which are defined as: Controls, other than application controls, which relate to the environment within which computer-based application systems are developed, maintained and operated, and which are therefore applicable to all applications. • These are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems.

29. Types of IT General Controls

30. Key areas which needs attention

31. Key areas which needs attention

32. Key areas which needs attention – IS Security

33. Summary • With the advent of IT in every sphere of business it have been evident that we Chartered Accountants need to rise and seize this opportunity.

34. Check out When are these opportunities?? Half our life is spent trying to find something to do with the time we have rushed through life trying to save. Will Rogers

35. Questions???

36. Thank You CA ANAND PRAKASH JANGID +91 9620233516 anand@quadrisk.com