Corporate Governance and Entity-Level Controls

1. Corporate Governance and Entity-Level Controls

2. Escalating Role of Board Members • Corporate Fraud • Qualifications of directors and management

4. Organizational Structure and Corporate Governance • What has an effect on corporate governance? • For example, an entrepreneurial structure • What type of structure would a public company probably have?

5. Enterprise Risk Management (ERM) • What is ERM • Risk management framework

6. Auditor Evaluation of Corporate Governance • What is the auditor’s goal? • Typical tools used to understand the components of corporate governance

7. IT Governance • IT governance is crucial to the evaluation of corporate governance • Definition of IT governance • IT governance is a crucial subset of

8. Evaluation of IT Governance by the Auditor • Evaluation of IT governance • What does the auditor look at next?

9. Continuous assessment • Value Management methodologies

10. Impact of General Information Systems Controls on the Audit There are three general control categories: • organization and management controls • systems acquisition, development, and maintenance controls • operations and information systems support.

11. Organization and Management Controls • Auditors consider • Key question - Who are the super-users?

12. Systems Acquisition, Development, and Maintenance Controls • Auditors focus • Typical types of software • Providing user interfaces • Providing security • Managing hardware and software • Information communication

13. Operations and Information Systems Support • A number of things canb affect the types of controls • Hardware confirguration • Auditor needs to determine • Operating system

14. Internal vs outsourced support • What is outsourcing? • Internal

15. Advanced Information Systems • Advanced IS results in high complexity. • Such systems have one or more of the following characteristics: • Strategic information systems • Custom software • Multiple information processing locations • Database management systems • Paperless systems • Integrated computing

16. Strategic Information Systems • Such systems provide a competitive advantage or improve efficiency within an entity. • The problems? • Such systems can be extremely strategic

17. Custom Software • Custom software is unique software designed for the entity. • How can it be developed? • The key reasons why such software is chosen by entities

18. Risks Associated with Custom Software • Such systems are usually very costly • Rigorous testing is required

19. Audit Impact of Custom Software • Systems development process • Risk of errors or unauthorized programs

20. Multiple Information Processing Locations • Problems with data processed in multiple locations • Programs could be inaccurate or unauthorized • Access to programs and data • Data sent from one location to another

21. Databases and Database Management Systems (DBMS) • Many software packages use a database as an underlying file structure. • Key concept of a DBMS • The DBMS

22. Effects of a DBMS on Internal Controls • Existence of a DBMS • Typical general controls that are affected • Organization and management controls • Systems acquisition, development, and maintenance controls • Operations and information systems support

23. Organization and Management Controls • The database administrator • Auditor documentation

24. Systems Acquisition, Development and Maintenance Added controls should exist to ensure that: • Database development • Programs

25. Operations and Information Systems Support • Data security • Each application cycle needs to be examined for controls over:

26. Paperless Systems • A wide variety of paperless systems exist. • Typical business data communications • EDI (electronic data interchange) • EFT (electronic funds transfer)

27. Impact of Paperless Systems on the Audit Engagement • Where there is no paper trail • Without a paper trail

28. Integrated Computing • Increased leve of complexity • Typical examples • Enterprise Resource Planning (ERP) • Relational databases • The objective of such systems

29. Some Common Entity-Level Controls Controls related to the control environment Controls over management override The company's risk assessment process Controls to monitor other controls, including activities of the internal audit function, the audit committee, and self-assessment programs Controls over the period-end financial reporting process Policies that address significant business control and risk management practices Whistle-blower hotline Code of conduct IT environment and organizations Self-assessment Oversight by the Board of Senior Management Policies & procedures manual Variance analysis reporting Management triggers embedded within IT systems Internal communication and performance reporting Tone setting Board/audit committee reporting External communication Segregation of duties Accounts reconciliations System balancing and exception reporting Governance Assignment of authority and responsibility Hiring and retention practices Fraud prevention/detection controls and analytical procedures

30. The Effects of Entity-Level Controls • What can be affected? • Any one of the control levels being absent or not properly implemented

31. Relationship between Entity-Level Controls and Specific Audit Objectives Entity-level controls can affect

32. Problem 10-21, Canadian 11th. Edition, Page 342 Friggle Corp. is a leasing and property management company located in Alberta. It provides financing to organizations wishing to purchase equipment or property and manages apartments and condominium properties. The company decided that it was time to upgrade its local area network. It decided to also purchase new accounting software but wanted to retain its old unit maintenance software, which, although 10 years old, had an easy-to-use interface that allowed maintenance personnel to track the maintenance work that they did in each unit. The controller, Joe, decided that the company should purchase the software from Midland Computers, which was owned by his brother-in-law, Tom. The prices were comparable with those of other computer networks that he priced, and Midland happened to be close by. Using materials from industry magazines, Joe decided that the best property management software to buy would be from Quebec; the software had received rave reviews about being easy to use. The implementation was scheduled for the weekend after the June month-end close so that systems could be up and running by the following Monday. To Joe’s horror, when he arrived at work on Monday, computers were still being unpacked and installed. Tom had difficulty following the installation instructions for the accounting software, which was not up and running until the end of the week. General ledger details had to be manually entered, since the software could not handle the structure of the old accounts. At the end of two weeks, Joe had the old system put back up so that Friggle could catch up on transactions and get some work out the door. It took three months of 12-hour days for all accounting staff to get the new system operational. Unfortunately, the old maintenance systems would not work with the new operating system, and a new maintenance system had to be evaluated and purchased. Required Assess the IT governance at Friggle Corp. For weaknesses that you identify, provide recommendations for improvement.

33. Problem 10-22, Canadian 11th. Edition. Page 342 Turner Valley Hospital plans to install a database management system, Hosp Info, that will maintain patient histories, including tests performed and their results , vital statistics, and medical diagnoses. The system will also manage personnel and payroll, medical and non-medical supplies, and patient and provincial health-care billings. The decision was taken by the board of the hospital on the advice of a consultant who was a former employee of Medical Data Services Inc., the developer of Hosp Info. Turner Valley Hospital’s chief information officer has come to your accounting firm to ask for advice on what general controls she should ask Medical Data Services Inc. to install to preserve the integrity of the information in the system and to deal with privacy issues. The system would permit data about patients to be entered by doctors, nurses, and medical technologists. Required • Describe in general terms the controls you would suggest for the system as a whole. • Considering the nature of Turner Valley Hospital, describe the potential risks the hospital should be concerned about with respect to Hosp Info. • What are the advantages of such a database management system? • How would the quality of general controls at the hospital affect your audit?