1

Rittenberg/Schwieger/JohnstoneAuditing: A Business Risk Approach

Sixth Edition

Chapter 6

Internal Control over Financial Reporting

Copyright © 2008 Thomson South-Western, a part of the Thomson Corporation. Thomson, the Star logo, and South-Western are trademarks used herein under license.

2

Comment on the Quality of an Organization’s Internal Controls

The quality of an organization's internal controls affects the reliability of its financial reporting—and its ability to make good decisions and stay in business

Internal control processes must effectively address risks that are present in the industry and in the organization

Auditors gain an understanding of their client's control system in order to

Better understand the client, its risks, and how it manages those risks

Assess control risk and identify types of most likely misstatements

Plan extent of substantive testing needed Report on effectiveness of internal controls (publicly-held

companies)

3

Define Internal Controls

Internal controls is a process designed to provide reasonable assurance of achieving the following:

Generating reliable financial accounting information

Safeguarding assetsComplying with applicable laws and

regulationsOperating efficiently and effectively

4

Review the Need for Control

Control is part of corporate governance whereby the owners and creditors of an organization exert control and require accountability for its resources

Governance begins with stockholders, who delegate certain responsibilities to the board of directors and in turn to management

That delegation must occur within a framework of control and accountability

The control system exists to ensure that

Responsibilities are properly identified

Tasks are assigned in accordance with responsibilities and accountability

5

Who Is Interested in an Organization's Control System? Board of directors and the audit committeeManagementRegulatorsInternal and external auditorsSuppliers and customersInvestors and creditorsCustomers or others using the Web for

commerce

6

Review the Components of an Internal Control System

An internal control system consists of five components

Control environment: overall attitude, awareness, and actions of significant internal groups to maintain a well-controlled organization (tone at the top)

Risk assessment: process designed to identify and manage risks that may affect its ability to achieve its objectives

Control activities: policies and procedures established by management to help ensure that internal control objectives are achieved and risks mitigated

Information and communication: process of identifying, capturing, and exchanging information in a timely fashion to enable the organization to achieve its objectives

Monitoring: process that assesses the quality of internal controls over time

7

What are the components of an internal control system?

There is a logical loop to an organization's internal controls, starting with

1. Design of the control environment

2. Identification of organizational risks and controls to minimize those risks

3. Design and implementation of controls and a communication system

4. Monitoring of the effectiveness of the controls to mitigate risk

8

Discuss Understanding & Assessing the Control Environment

Factors an auditor should look at when evaluating an organization's control environment:

Management's philosophy and operating styleOrganizational structure, including assignment

of authority and responsibilityBoard of directors and audit committeeHuman resource policies and practicesIntegrity and ethical valuesCommitment to competenceCompensation and evaluation programsEffectiveness of the internal audit function

9

Reporting on Internal Control - Management Reports to External Parties

The Sarbanes-Oxley Act of 2002 requires publicly held companies to report on the effectiveness of their internal controls over financial reporting

The report must describe the following: Statement of management's responsibility for establishing and

maintaining effective internal controls over financial reporting Identify the framework used by management to evaluate

internal controls Assessment of the effectiveness of the company's internal

controls Description of any material deficiencies in internal control Statement that the report has been audited The external auditor must attest to management's report

10

Reporting on Internal Control: Internal Management Reports

Management often requests reports on the quality of its internal controls in order to ensure the company can achieve its major objectives and is not exposed to unnecessary risks

Management receives reports from three sources:

Ongoing monitoring reports from operations

Internal audit reports

External audit reports

11

Audit Reporting on Internal Control

External auditors of non-public companies must report significant internal control deficiencies to management

Such reports are for management's use

Not intended to be distributed to the public

External auditors of public companies must go beyond the report to management and also report on management's assertion regarding the effectiveness of internal controls over financial reporting

Includes an opinion on the client's internal controls

Included in the company's annual report

12

Audit Reporting on Internal Control

In performing an audit of controls, the auditor mustReview client documentation including how

controls are supposed to work (design)Review client testing of controls (operations)Determine which controls to test, sample

sizes, and how to judge whether a control is operating effectively

Reach conclusion about the effectiveness of client internal controls over financial reporting

13

Audit Reporting on Internal Control (continued)

The PCAOB's proposed report on internal controls would include a(n):

Description of internal control, its objectives, and inherent limitations

Definition of material deficiency in internal control

Description of all material deficiencies found

Opinion regarding effectiveness of company's internal controls

14

Audit Reporting on Internal Control (continued)

According to the Sarbanes-Oxley Act, if an auditor identifies significant or material deficiencies in internal control,Those deficiencies must be reported to both

management and the audit committeeDeficiencies must be reported to the audit committee

even if management has addressed the deficiency and implemented new controls

The stated intent of the Sarbanes-Oxley Act is to ensure boards of directors understand they have a responsibility to improve the governance of the organization

15

Discuss Relationship of Controls to Auditing

Minimum level of control is necessary for an entity to be auditable

The quality of internal controls affects the operating effectiveness and ultimately, the organization's ability to remain a going concern

The quality of internal controls drives the audit approach and amount of testing

Analysis of control deficiencies helps identify the types of likely misstatements

Inadequate controls may place an organization in violation of federal laws

Auditor is required to attest to management's assessment of the effectiveness of internal control over financial reporting for all public companies

16

Review Accounting Information Systems

Accounting systems capture, record, summarize, and report information

An accounting information system is typically not one big system, but a network of smaller accounting application/subsystem Each application processes a unique type of transaction

Examples: sales, accounts receivable, accounts payable, cash receipt cash disbursements, payroll, inventory, etc

Each application has its own unique source documents, processes, and controls

The quality of internal control can vary between applications The auditor develops understanding of how transactions are

entered and processed, and the controls for each significant accounting application

17

Discuss Internal Control & Financial Statement Account Balances

Auditor assesses control risk for each relevant assertion for each important class of transactions and account balance as a basis for planning the audit

Auditor needs to understand and evaluate the internal control design for all important accounting applications

Auditor needs to evaluate the effectiveness of internal control over financial reporting for accounting applications that process material transactions

18

Auditor has to evaluate controls in systems that Record revenue Deal with significant estimates Process journal entries near the end of the year to close the

books Deal with off-statement financing or related party transactions

Auditor needs to jointly assess organization's control environment and the specific accounting system controls to evaluate the risk of material deficiency in internal control

To conclude internal controls are effective, auditor must obtain evidence that the control structure is soundly designed AND operating effectively

Discuss Internal Control & Financial Statement Account Balances

19

Review Assessing the Effectiveness of Control Procedures

Management designs and implements specific control procedures to ensure that the company will achieve its control objectives - and if the control objectives are achieved, the management assertions are likely to be valid, and the account balance and transactions properly recorded

The auditor assesses the organization's control procedures within a framework of control objectives and management assertions

In order to perform this assessment, the auditor must understand the accounting processes within each system, the related accounts, and the risk associated with incorrect processes

With this knowledge, the auditor can identify which management assertions and control objectives are most likely to be violated

From this, the auditor can identify appropriate control procedures that can then be assessed for effectiveness in design and operation

20

Discuss Overview of Controls Testing - Pervasive Control Activities

Some control procedures are found in almost

all accounting systems:Segregation of incompatible duties

Authorization procedures

Documented transaction trail

Physical controls to limit access to assets

Independent reconciliation

Competent, trustworthy employees

21

Comment on Control Effectiveness and Control Risk Assessment

Process for evaluating controls:

Phase 1: Obtain an understanding of risks and internal controls

Phase 2: Make a preliminary assessment of control risk and decide whether to test operation of control procedures

Phase 3: Test operating effectiveness of controls

Phase 4: Based on the results of testing, determine whether to revise the assessment of control risk and incorporate this revision into the substantive testing

22

Phase One: Obtain an Understanding

Auditor needs to gain understanding of each significant accounting application operates and the control procedures used

The auditor gathers evidence Performing walkthroughs of the accounting system and

processing procedures Making inquires of management, and accounting and

operational employees Taking plant and operational tours Reviewing client documentation including accounting manuals

and program and system descriptions Reviewing prior year audit work papers

The auditor documents his/her understanding using flowcharts, questionnaires, and narratives

23

Phase Two: Make Preliminary Assessment of Control Risk

After gaining an understanding, the auditor makes a preliminary assessment of control risk - this assessment is crucial because it drives the planning for the rest of the audit

The relationship between the assessed level of control risk and the rigor of the subsequent substantive testing is inverse: If control risk is assessed as high,

No reliance is placed on the client's internal controlsThe amount and rigor of substantive testing must be increased

If control risk is assessed as lowThe auditor would like to rely on the client's internal controls The amount and rigor of substantive testing may not have to be

increasedHowever, the auditor must test the controls to make sure they are

operating effectively

24

Phase Three: Perform Testsof Controls

The preliminary assessment of control risk is based on the auditor's understanding of the control system and how it has operated in the past

When control risk is assessed low, and the auditor intends to rely on the client's controls, the auditor may reduce (or not increase) the amount of substantive testing

To ensure that the auditor's reliance on the client's control is warranted, the auditor must test the control to make sure it is operating effectively

Guidance on Sample Size for Testing Controls Testing Controls Across Multiple Locations Dual Purpose Tests Assessing Control Risk as Moderate

25

Phase Four: Update Assessment of Control Risk & Need for

Substantive Testing

If testing indicates the control is not operating effectively, the auditor will revise the preliminary assessment of control risk and incorporate this revision into the subsequent substantive testing