1

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y

y r ig h t U n i ve rs
MODULE 3 ity o f Te c h n ol

Cop i v e rs
h t Un
yr i g
Cop
Topic 3 – The role of internal
controls in preventing/detecting Syd n ey
g y
errors ty o
f Te ch n o lo

e rsi
ni v
ht U
y r i g
Cop
© Dr Amanda White - University of Technology Sydney
 2

ne y
yd
In this Topic gy S
h n o lo y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
1. Why U n we need to understand internal controls? f Te
do c
ig h t yo
y r s i t
Cop Systems of Internal Controls (SIC)
2. n i ve r
h t U
y ri g
3. Gathering evidence of SICs Co p
4. Documenting our understanding of SICs
5. Assessing the design of SICs ey
d n
6. Preliminary assessment of CR g y Sy
n o lo
7. Impact on audit strategy Te ch
y of s it
v e r
U ni
r i g ht
y
Cop
© Dr Amanda White - University of Technology Sydney
 3

ne y
yd
Abbreviations gy S
h n o lo y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
• Systems U n of Internal Control (SIC) Te c
ig h t o f
p y r
e rs ity
•CoInternal Control (IC) Un i v
i g h t
yr
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 4

ne y
yd
Context lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 5

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
Cop Topic 3.1 - Why do we need to
y r

yr i g h t Un i v e rs ity

understand the internal Cop

controls? gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 6

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 7

ne y
yd
Why we need gy S
h n oloto understand SICs y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
U n tells us we must Te c
• ASA
ig h
315
t o f
y r rs ity
Cop i v e
• It is part of the audit risk model h t Un
yr i g
Cop
• A weakness in the SICs – a gap or poorly operating control
– can allow in errors or misstatements
ne y
• This increases the ROMMs yd
o gy S
h n ol
Te c
• → adjust our audit strategy o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 8

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Topic 3.2 – Systems of Cop

internal control (SIC) gy S

yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 9
y
Are we interested in every internal gy S
yd ne
o lo
control?ty of Tec h n
gy S
yd ne y

e rsi n ol o
v h
• ASA315.21 h t –Uni
just the ones related to preparing the o f Te c
p y r ig rs i ty
Cofinancial report ve
Uni h t
yr i g
op
• In reality – this means most internal Ccontrols related to
every business function

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 10

ne y
yd
Reminder of gy S
h n oSICs
lo • Read ASA315.21 to 26
y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 11

ne y
yd
A note on Control Activities gy S
h n o lo y
ec d ne
y o fT gy S
y
• Optionsnwhen e rsit you have a risk n ol o
U iv Te c h
i g ht o f
y r rs ity
Cop• Prevent the risk from occurring i v e
h t Un
• Detect the risk when it does occur yr i g
Cop
• Insure against the risk occurring
• Avoid the risk
ne y
yd
o gy S
h n ol
Te c
• Auditors are looking for controls that _________ or o f
e rs ity
i v
___________ t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 12

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
Cop Topic 3.3 - Gathering
y r

yr i g h t Un i v e rs ity

evidence on systems of Cop

internal control gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 13

ne y
yd
How do weechgather
o the evidence? gy S
nol ne y
T yd
i t y of o gy S
i ve r
s
h n ol
U n Te c
ig h t o f
1. p r
yInterviewing the client e rs ity
C o i v
h t Un
yr i g
Cop
2. Go for a tour

3. Observe a process flow ne y

yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 14

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
Cop Topic 3.4 - Documenting our
y r

yr i g h t Un i v e rs ity

understanding of systems of Cop

internal control gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 15
y
Remember ASA 230 requires us to gy S
yd ne
o lo
document
ty o f Teour
c h n
work gy S
yd ne y

e rsi n ol o
v h
ht Uni o f Te c
r i g ity
•Co3pymain methods to document our understanding
i ve r
s of SICs
t U n
y r ig h
• 1. Narrative Cop

• 2. Flowchart
ne y
yd
o gy S
• 3. Checklist h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 16

ne y
yd
Which method gy S
h n olo to choose? y
ec T yd ne
i t y of o gy S
i ve r
s Advantage DisadvantageTe h n ol
U n c
ig h t yo f
Co pyr iv ers i t
t U n
Narrative y r ig h
Cop

Flowchart d ne y
y
o gy S
h n ol
Te c
o f
e rs ity
Checklist i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 17

ne y
yd
Flowcharting gy S
h n olo– the symbols y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
Start/end U n Process Manual processe c
gh t i of T ty
p yr rs i
C o
U n i ve
ig h t
y r
Cop
File Decision Process

ne y
yd
o gy S
h n ol
Database (or cloud) f Te c
ity o
i v e rs
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 18
Felix’s Fresh Fruits provides contactless delivery of fresh fruits and vegetables in Sydney.
ne y
Orders are received when customers place their order and pay on a secure website. Felix prints
yd
An example gy S
out the order and prepares the delivery box with the customer’s order. At this point, a journal
o lo
entry is made to recognise unearned revenue. A label is placed on the box and the order is given
h n to the delivery driver. Felix updates the computer system to mark the order as “in transit”. Once
ne y
ec T yd
the driver delivers the item – they use their mobile device to update the system to mark the item
i t y of as “delivered”. This automatically triggers a journal entry to record the sale.
o gy S
i ve r
s
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 19

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Topic 3.5 - Assessing the Cop

design of the internal controls gy S

yd ne y
ol o
Will they prevent or detect misstatements? c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 20

ne y
yd
Once we have gy S
h n olo our flowchart y
ec d ne
y o fT gy S
y
• What are e rsit internal control
the activities? Will they prevent n o
orlo
U n iv ch Te
detecti g ht misstatements? o f
y r rs ity
Cop i v e
• Look for the glaring weaknesses first –ygaps h t or controls Un
r i g
C o p
that you don’t think will work?
• Then work from the assertions for the process
• Is there a control for each? ne y
yd
o gy S
• Could controls be circumvented? h n ol
Te c
o f
• If there is a weakness – is there a mitigating control further e rsity on in
U n iv
the process? ht
y r i g
Cop
© Dr Amanda White - University of Technology Sydney
 21

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
Cop Topic 3.6 - Making the
y r

yr i g h t Un i v e rs ity

preliminary assessment of Cop

Control Risk gy S
yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 22

ne y
yd
Low, Medium gy S
h n oloor High? y
ec T yd ne
i t y of o gy S
i ve r
s
h n ol
U n each of the ratings mean? Te c
• What
ig h t do o f
y r rs ity
Cop i v e
• Strong internal controls, no weaknessesig=ht Un
y r
Cop
• Very poor internal controls, many weaknesses =
• Some internal controls + some weaknesses = y
yd ne
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 23

ne y
yd
lo gy S
c h no ne y
e d
i ty of T o gy S
y
i ve rs
h n ol
U n Te c
ig h t o f
y r rs ity
Cop i v e
h t Un
yr i g
Topic 3.7 CR, the AR model Cop

and audit strategy gy S

yd ne y
ol o
c h n
o f Te
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 24

ne y
yd
Rememberecthe lo AR model? gy S
hno d ne y
of T y
i t y o gy S
i ve r
s
h n ol
• DRg=ht Un Te c
i o f
p yr e rs ity
C o i v
h t Un
yr i g
• Where there CR is low – is there a lower
Cop or higher
ROMMs?

ne y
• What should our response be on the audit? More work or yd
lo gy S
less? n o
e ch f T
ity o
i v e rs
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 25

ne y
yd
Think backechto gy S
nol my diagram from earlier ney
o
o fT y Syd
it y lo g
i v e rs hn o
Un Te c
ig h t yo f
y r s i t
Co p
n iv er
t U
y r ig h
Cop

ne y
yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney

 26

ne y
yd
Things youechshould
o be able to do gy S
nol ne y
T yd
i t y of o gy S
i ve r
s
h n ol
• Identify U nthe components in the Systems of Internal f Te c
ig h t yo
y r s i t
CoControls
p
n i ve r
h t U
• Document a business process y ri g
Co p
• Identify control activities and control weaknesses
• Make an assessment of CR
ne y
• Explain how that will impact your audit strategy yd
o gy S
h n ol
Te c
o f
e rs ity
i v
t Un
y r ig h
Co p

© Dr Amanda White - University of Technology Sydney