Internal Control

Internal Control

Internal Control System Definition A process...designed to provide reasonable assurance regarding, achievement of (the entity’s) objectives in the following categories: • Effectiveness and efficiency of operations • Reliability of financial reporting • Compliance with applicable laws and regulations Source: Committee of Sponsoring Organizations

Components of Internal Control • The Control Environment • Risk Assessment • The Accounting Information and Communication System • Control Activities • Monitoring

Control Environment(Internal) • Integrity and ethical values • Commitment to competence • Board of directors or audit committee • Management philosophy and operating style • Organizational structure • Human resource policies and practices • Assignment of authority and responsibility

Control Environment (External) Reviews by Governmental Agencies: • OSHA, FDA, IRS, GAO, EPA, DCAA, Bank Examiners, Bd of Equalization, State Franchise Tax Bd Reviews by Non-Governmental Agencies: • ISO, Industry Associations

Client Risk Assessment Clients must constantly reassess its ICS because of: • Changes in regulatory or operating environment • Changes in key personnel • Implementation of new/modified information system • Rapid growth of the organization • Changes in technology affecting production processes or information systems • Introduction of new lines of business, products, or processes

Primary Objectives of Accounting & Information Systems • Identify & record all, but only, valid transactions • Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions • Measure the value of transactions appropriately • Determine time period in which the transactions occurred to permit recording in the proper period • Present properly the transactions and related disclosures in the financial statements

Types of Control Activities • Performance Reviews (Usually Detection) (Reconcile, Analyze & Approve) • IT General & Application Controls (Ch 8) • Physical Security Controls • Segregation of Duties • Recording Transactions • Authorizing Transactions • Custody of Related Asset

Monitoring Monitoring ICS Effectiveness & Compliance • Ongoing Monitoring Activities (Management review & follow-up) • Separate Evaluations (Internal Audits or Self Compliance) • Public Companies: SOX Section 404 Monitoring and Assessment

Monitoring Internal ControlsDo Public Companies do More? • Section 404 of Sarbanes-Oxley requires at least quarterly monitoring & assessment of financial reporting internal control effectiveness. Comment required on any material change during a fiscal quarter. • CFO normally leads, generally with Internal Audit involvement.

Limitations of Even A Good (Well Designed) ICS • Errors may arise from misunderstandings of instructions, mistakes of judgment, fatigue, etc. • Controls that depend on the segregation of duties may be circumvented by collusion. • Management may override the structure • Compliance may deteriorate over time

Auditor’s Basic Requirements Regarding Client’s Internal Controls • Obtain an understanding and • Document the understanding

Documenting Internal Control

Sources of ICS Information • Client Policies & Procedures • Client Inquiry • Inspection of Documents • Observations

The Auditors’ Consideration of Client’s Internal Controls • Obtain an understanding • Document the understanding • Determine planned (initial) assessed level of control risk

Assessing Control Risk

Assessing Control Risk • At the F.S. Statement/Overall Level • Preparation of F.S., incl. estimates & disclosures • Selection of Significant Accounting Policies • The Control Environment • General IT Controls (chapter 8) • At the Assertion/Account Level • Relates to specific assertions about specific accounts. (Transactions)

To Test or Not to Test Controls We Test Controls When We Expect That: • We Will Be Able Rely on the Client’s Internal Controls to Set Control Risk Below Maximum AND • Estimated Time Spent to Test Controls Will Be < the Reduction in Substantive Testing Time IF We Find the Controls to be Operating Effectively.

The Auditors’ Consideration of Client’s Internal Controls • Obtain an understanding • Document the understanding • Determine planned assessed level of control risk • Design additional tests of control (Testing procedures include: review of documents, observations, questioning client employees, re-performing the controls, review of error detection & correction reports.)

Relying on PreviousTests of Controls • Auditors should obtain evidence of changes in internal controls/business processes since the last audit and must test any changed controls/processes for which reliance is desired. • For controls/process that haven’t changed, reliance can be placed on testing for operating effectiveness in prior years’ audits if the control tested every 3rd year.

The Auditors’ Consideration of Client’s Internal Controls • Obtain an understanding • Document the understanding • Determine planned assessed level of control risk • Design additional tests of control • Perform test of controls likely to prevent or detect material misstatements and Reassess control risk

The Auditors’ Consideration of Client’s Internal Controls • Obtain an understanding • Document the understanding • Determine planned assessed level of control risk • Design additional tests of control • Test Controls and Reassess control risk • Design nature, timing and extent of substantive tests

Documentation Requirements • Understanding of Internal Controls • Assessed Level of Control Risk and the Combined Level of the Risk of Material Misstatements (IR + CR) • Basis for the Risk Assessment • Auditor’s Response to the Risks and Link to Audit Procedures Performed • Use of Prior Years’ Tests of Controls

ICS in a Small Client • Adequate segregation of duties impossible. • Owner may have to be more active. • But, this could foster fraudulent F.S. • Therefore, we usually apply the “substantive” rather than the “reliance” audit approach.

IA as Part of the ICS • Some of their work may “overlap” what CPA would do. • We may be able to rely on (1) their work to reduce our work, just like any other part of client’s ICS, or (2) use of their auditors to perform on the F.S. audit. • To rely, we must assess: 1. Objectivity 2. Competency 3. Quality Source: SAS 128

Communicating ICS Weaknesses • Report to Mgmt and Those Charged with Governance (Board of Directors) • Must Communicate: • Significant Deficiencies • Material Weaknesses • Previously Reported, But Not Remediated • Potential Effects of the Deficiencies/Weaknesses • In Writing & Within 60 Days of Release Date of Audit Report on Financial Statements

Classifying ICS Weaknesses A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented, or detected and corrected on a timely basis. Source: AU 325 with SAS 115 (eff. 2009) and 99

Classifying ICS Weaknesses (con’t) Indicators of material weaknesses include: • Identification of fraud, whether or not material, on the part of senior management; • Restatement of previously issued financial statements to reflect the correction of a material misstatement due to error or fraud; • Identification by the auditor of a material misstatement of the financial statements under audit in circumstances that indicate that the misstatement would not have been detected by the entity’s internal control; and • Ineffective oversight of the entity’s financial reporting and internal control by those charged with governance Source: AU 325 with SAS 115

Classifying ICS Weaknesses (con’t)

Summary • Why do we consider a client’s ICS? 1. Assess Control Risk 2. To plan the audit (nature, timing & extent of tests) • What must we do before we set Control Risk below maximum? Test the controls we want to rely on. • Why Wouldn’t We Test Controls? 1. Appear Very Weak - Reliance Unlikely 2. Time to Test> Savings in Reduced Sub. Tests

Internal Control