Transcript 6-1 Chapter Six Internal Control in a Financial Statement Audit McGraw-Hill/Irwin Copyright © 2006 by The McGraw-Hill Companies, Inc.

6-1
Chapter Six
Internal Control in a
Financial Statement Audit
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-2
Internal Control
Objectives
Reliability of
Financial
Reporting
McGraw-Hill/Irwin
Effectiveness
& Efficiency
of Operations
Compliance
with Laws &
Regulations
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-3
Controls Relevant to the Audit
Objectives
Reliability of
Financial
Reporting
Effectiveness
& Efficiency
of Operations
Compliance
with Laws &
Regulations
Generally, internal controls pertaining to
the preparation of financial statements for
external purposes are relevant to an audit.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-4
Controls Relevant to the Audit
Objectives
Reliability of
Financial
Reporting
Effectiveness
& Efficiency
of Operations
Compliance
with Laws &
Regulations
Controls relating to operations and compliance
objectives may be relevant when they relate to
data the auditor uses to apply auditing
procedures.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-5
Components of Internal Control
Entity’s Risk
Assessment
Process
Control
Environment
Information System and
Related Business Processes
Relevant to Financial
Reporting & Communication
Control
Activities
McGraw-Hill/Irwin
Monitoring of
Controls
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-6
Components of Internal Control
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-7
Components of Internal Control
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-8
The Effect of Information Technology
on Internal Control
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-9
Planning an Audit Strategy
Audit Risk Model
AR = IR × CR × DR
In applying the audit risk model, the auditor must
assess control risk. The figure on the next slide
presents a flowchart of the auditor’s decision
process when considering internal control in
planning an audit.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-10
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-11
Substantive Strategy
After obtaining an understanding of internal control, an
auditor may choose to follow a substantive strategy and set
control risk at the maximum for some or all assertions
because of one or all of the following factors:
Controls do
not pertain to
an assertion.
McGraw-Hill/Irwin
Controls are
assessed as
ineffective.
Testing the
effectiveness
of controls is
inefficient.
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-12
Reliance Strategy
Obtain
Understanding of
Internal Control
Plan to Rely on
Internal Control and
Assess Control Risk
Below Maximum
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-13
Assertions
Occurrence
Completeness
Authorization
Accuracy
Cutoff
Classification
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-14
Assertions
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-15
Assertions
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-16
Obtain an Understanding of Internal
Control
The auditor should obtain an understanding of each of
the five components of internal control in order to plan
the audit. This knowledge is used to:
McGraw-Hill/Irwin
Identify types of
potential
misstatements
Consider factors
that affect the risk
of material
misstatement
Design tests of
controls
Design substantive
procedures
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-17
Control Environment
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-18
The Entity’s Risk Assessment
Process
The risk assessment process should consider external
and internal events and circumstances that may arise and
adversely affect the entity’s ability to initiate, record,
process and report financial data consistent with the
assertions of management in the financial statements.
Client business risk can arise or change due to the following
circumstances:
Changes in the
operating
environment
Corporate
restructuring
McGraw-Hill/Irwin
New personnel
Rapid growth
New or revamped
information systems
New technology
Expanded
international growth
New accounting
pronouncements
New business
models, products,
or Companies,
activities
Copyright © 2006 by The McGraw-Hill
Inc. All rights reserved.
6-19
Information Systems and
Communication
An effective accounting system gives appropriate consideration
to establishing methods and records that will
1. Identify and record all valid transactions.
2. Describe on a timely basis the transactions in sufficient detail to
permit proper classification of transactions for financial reporting.
3. Measure the value of transactions in a manner that permits
recording their proper monetary value in the financial statements.
4. Determine the time period in which transactions occurred to permit
recording of transactions in the proper accounting period.
5. Properly present the transactions and related disclosures in the
financial statements.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-20
Control Activities
Control activities are the policies and procedures that help
ensure that management’s directives are carried out. Those
control activities that are relevant to the audit include
McGraw-Hill/Irwin
Performance
reviews
Information
processing
Physical
controls
Segregation
of duties
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-21
Monitoring of Controls
Monitoring of controls is a process that
assesses the quality of internal control
performance over time.
Internal
Auditors
McGraw-Hill/Irwin
An effective internal audit function
has clear lines of authority and
reporting, qualified personnel, and
adequate resources to enable these
personnel to carry out their assigned
duties.
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-22
The Effect of Entity Size on Internal
Control
While the basic concepts of the five
components should be present in all entities,
they are likely to be less formal in a small or
midsize entity than in a large entity.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-23
The Limitations of an Entity’s Internal
Control
Management
Override of
Internal
Control
Human Errors
or Mistakes
Collusion
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-24
Factors Contributing to Fraud
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-25
Documenting the Understanding of
Internal Control
Procedure Manuals
and Organizational
Charts
Narrative Description
Internal Control
Questionnaires
Flowcharts
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-26
Assessing Control Risk
Identify specific
controls that
will be relied
upon.
Perform tests of
controls
Conclude on
the achieved
level of control
risk.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-27
Documenting the Achieved Level of
Control Risk
The auditor’s documents the tests of controls, the
linkage of the tests with the assessed risks at the
assertion level, and the results of the tests assessment
of control risk by using a structured working paper, an
internal control questionnaire, or a memorandum.
Let’s look at an example from
EarthWear Clothiers to see
how the control risk for two
accounts that differ in terms of
their nature, size and
complexity is documented.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-28
Documenting the Assessed Level of
Control Risk
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-29
Substantive Procedures
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-30
Timing of Audit Procedures
Interim
Year End
Let’s look at the EarthWear Clothiers example
again to see the timing of their audit
procedures.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-31
Timing of Audit Procedures
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-32
Timing of Audit Procedures
Timing of Tests
of Controls
Timing of
Substantive
Procedures
McGraw-Hill/Irwin
1. Assertion being tested not significant
2. Control has been effective in prior audits
3. Efficient use of staff time
1. Assertion probably has low control risk
2. May increase the risk of material
misstatements
3. Still requires some year end testing
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-33
Use of Prior Period Evidence of Internal
Controls (ISA 330)
• If the auditor plans to use audit evidence about the operating
effectiveness of controls obtained in prior audits, obtain
evidence about whether changes in those specific controls have
occurred subsequent to the prior audit.
• If changes in the specific controls have occurred, test controls in
the current audit.
• If changes in the specific controls have not occurred, document
the conclusions reached with regard to reliance, and test controls
at least once in every third audit.
If the auditor plans to rely on controls to mitigate a significant
risk, however, test controls in the current audit.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-34
Auditing Accounting Applications
Processed by Service Organizations
In some instances, a client may have some or
all of its accounting transactions processed
by an outside service organization.
Because the client’s
transactions are subjected to
the controls of the service
organization, one of the
auditor’s concerns is the
internal control system in
place at the service
organization.
McGraw-Hill/Irwin
It is not uncommon for service
organizations to have an auditor
issue one of two types of reports
on their operations.
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-35
Auditing Accounting Applications
Processed by Service Organizations
Report #1
Describes the service organization’s
controls and assesses whether they
are suitably designed to achieve
specified internal control objectives.
An auditor may
Report #2
reduce control risk
Goes further by testing whether the
below the maximum
only on the basis of controls provide reasonable assurance
a service auditor’s that the related control objectives were
achieved during the period.
report that includes
tests of the controls.
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-36
Communication of Material Weaknesses
of Internal Control
Material
Weakness
Communication
McGraw-Hill/Irwin
ISAs define a material weakness in internal
control as one that could have a material
effect on the financial statements.
Auditing standards (ISA 315) require that
the auditor reports to those charged with
governance or the appropriate level of
management of material weaknesses in the
design or implementation of internal
control.
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-37
Types of Controls in an IT
Environment
General
Controls
1. Data center & network
operations
2. System software
acquisition, change and
maintenance
3. Access security
4. Application system
acquisition, development,
and maintenance
McGraw-Hill/Irwin
Application
Controls
1.
2.
3.
4.
5.
Data capture controls
Data validation controls
Processing controls
Output controls
Error controls
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-38
Types of Controls in an IT
Environment
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-39
Types of Controls in an IT
Environment
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-40
Types of Controls in an IT
Environment
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-41
Flowcharting Symbols
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.
6-42
End of Chapter 6
McGraw-Hill/Irwin
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved.