Assessment of Internal Control

An Overview of Internal Control

A. Internal Control Defined

B. Reasonable Assurance
C. Reporting Requirements for Management
D. Key Components of Managements’ Assessment of Internal Control
E. Auditor Responsibilities for Understanding Internal Control
F. Importance of Internal Control

Internal Control Defined

An entity’s system of internal control consists of policies and procedures designed to

provide management with reasonable assurance that the company achieves its
objectives and goals including:
 Reliability of financial reporting
 Compliance with applicable laws and regulations
 Effectiveness and efficiency of operations

Internal Control, Integrated Framework

• Most widely used internal control framework
• Published by COSO (Committee of Sponsoring Organizations)
• COSO’s updated Internal Control, Integrated Framework
– Comprehensive framework of internal control
– Used to assess effectiveness of:
• Internal control over financial reporting
• Controls over operational and compliance objectives
• COSO defines internal control as a process:
– Effected by an entity’s board of directors, management, and other
personnel
– Designed to provide reasonable assurance regarding achievement of
objectives relating to operations, reporting, and compliance

COSO Framework for Internal Control

B. Reasonable Assurance
Reasonable assurance involves two considerations:
 The cost of the entity’s internal control should not exceed the expected benefits.
 Limitations exist in any entity’s internal control.

C. Reporting Requirements for Management
Section 404 of Sarbanes-Oxley requires the management of public companies to issue an
internal control report that includes:
 A statement that management is responsible for establishing and maintaining an
adequate internal control structure and procedures for financial reporting.
 An assessment of the effectiveness of the internal control structure and procedures for
financial reporting as of the end of the company’s fiscal year.

D. Key Components of Managements’ Assessment of Internal Control

 Management must evaluate the design of internal control over financial reporting.
 Management must test the operating effectiveness of those controls.

E. Auditor Responsibilities for Understanding Internal Control

 Public and private companies – A sufficient understanding of internal control is to be
obtained to plan the audit and to determine the nature, timing, and extent of tests to be
nd
performed. (2 standard of fieldwork)
 Public companies – Section 404 requires effort beyond that stated above so that the
auditor can provide a report on internal controls that contains the following two
opinions:
 Whether management’s assessment of the effectiveness of internal control
over financial reporting as of the end of the fiscal period is fairly stated in all
material respects.
 Whether the company maintained, in all material respects, effective internal
control over financial reporting as of the specified date.
Importance of Internal Control Over Financial Reporting
Internal control helps:
A. Mitigate risks of not achieving organizational objectives
B. Provide confidence regarding reliability of financial information
C. Reduce occurrence of unforeseen circumstances
D. Improve quality of information

Importance of Internal Control to the External Audit

• Auditors are required to identify and assess risks of material misstatement due to
fraud or error
– For this, the auditor needs to understand the company’s internal controls to
determine appropriate audit procedures
• Integrated audit: Occurs when an auditor provides an opinion on:
– The effectiveness of the client’s internal control over financial reporting and
– The financial statements
The Components of Internal Control
1. The Control Environment
2. Risk Assessment
3. Control Activities
4. Information and Communication
5. Monitoring
A. The Control Environment
The control environment is concerned with the actions, policies, and procedures
that reflect the overall attitude of the client’s top management, directors, and
owners of an entity about internal control and its importance.
• It is the foundation for all other components of internal control
• A strong control environment protects against risks related to reliability of financial
statements
• Examples of control environment deficiencies
– Low level of control consciousness within an organization
– Audit committee not having independent members
– Absence of an ethics policy within an organization

Control Environment Principles

1. Integrity and ethical values
Management actions to remove incentives that prompt a person to behave improperly.
Communication of behavioral standards by codes of conduct and example.

2. Commitment to competence
Management’s consideration of the competence levels for specific jobs and how those
translate into requisite skills and knowledge

3. Board of directors and audit committee

 Board delegates responsibility for internal control to management and is
charged with regular independent assessments of management-established
internal control.
 The major stock exchanges require listed companies to have an audit
committee composed of entirely independent directors who are financially
literate.

4. Management’s philosophy and operating style

Management, through its activities, provides clear signals to employees about the
importance of internal control. For example, are sales and earnings targets unrealistic,
and are employees encouraged to take aggressive actions to meet those targets.

5. Organizational structure
Understanding the client’s organizational structure provides the auditor with an
understanding of how the client’s business functions and implements controls.

6. Assignment of authority and responsibility

Formal methods of communication including:
 Top management memoranda concerning internal control
 Organizational operating plans
 Employee job descriptions
 7. Human resource policies and practices
 If employees are honest and trustworthy, other controls can be absent and
reliable financial statements will still result.
 Methods by which persons are hired, trained, promoted, and compensated are
important elements of internal control.

B. Risk Assessment
Client management’s identification and analysis of risks relevant to the preparation
of the financial statements in accordance with GAAP.
 Client Management’s Risk Assessment
Client management assesses risk as part of designing and operating
internal controls to minimize errors and fraud. Three steps involve:
i. Identify factors that may increase risk
ii. Determine significance of risk and likelihood of occurrence
iii. Develop specific actions to reduce risk to an acceptable level.

 Auditor Risk Assessment

The auditor obtains knowledge about management’s risk assessment process by:
 Determining how management identifies risks relevant to financial reporting
 Evaluating their significance and likelihood of occurrence
 Deciding the actions needed to address the risks.

Sources of Risks
Internal sources of risk
• Changes in management responsibilities
• Changes in internal information technology
• Poorly conceived business model
External sources of risks
• Economic recessions decrease product or service demand
• Increase in competition
• Changes in regulation that make the business model unsustainable
• Changes in the reliability of source goods that reduce profitability

C. Control Activities
Policies and procedures that client management has established to
meet its objectives for financial reporting.
The Control Activities:
• Ensure that management’s directives regarding controls are accomplished
• Performed within processes
• Performed at all levels of an organization

1. Adequate segregation of duties

 Separation of the functions of authorization, recordkeeping, and custody.
 Separating IT duties from User Departments
2. Proper authorization of transactions and activities
 General authorization is permissible for routine events for which there are
policies to follow.
 For some transactions specific authorization is needed on a case-by-case basis

3. Adequate documents and records

 Prenumbered consecutive documents so missing items are noticed
 Prepared as near to transaction time as possible
 Good design with instructions and appropriate spaces

4. Physical control over assets and records

 Deterrents to prevent physical access.
 Access controls to prevent getting into computer system.
 Backup and recovery procedures

5. Independent checks on performance

 Personnel are likely to forget or intentionally fail to follow procedures, or they
may become careless unless someone observes and evaluates their
performance.

D. Information and Communication

Methods used to initiate, record, process, and report an entity’s transactions and
to maintain accountability for related assets
• Information - Required by an organization from internal and external sources to carry
out its internal control responsibilities
• Communication
– Process of providing, sharing, and obtaining information internally
– Requires two-way communication with external parties
• For a small company with active involvement by the owner, a simple
computerized accounting system that involves one honest, competent accountant
may provide an adequate accounting system.
• A larger company requires a more complex system that includes carefully
defined responsibilities and written procedures.

E. Monitoring
Client management’s ongoing and periodic assessment of the quality of internal
control performance to determine whether controls are operating as intended
and modified when needed.
• Process that provides feedback on effectiveness of each of the five components of
internal control
• For its accomplishment, managers select either of the following or a combination
of both
– Mix of ongoing evaluations
– Separate evaluations
• Requires that identified deficiencies in internal control be communicated to the
personnel concerned with follow-up action taken
• For many companies, especially larger ones, an internal audit department is
essential for effective monitoring.
 • To maintain internal audit independence, it is imperative that they be
independent of operating and accounting departments; and that they report to a
high level of authority, preferably the audit committee of the board of directors.
Entity-Wide Controls
 Operate across an entity and affect multiple processes, transactions,
accounts, and assertions
 Controls related to control environment
 Controls over management override
 Organizations’ risk assessment process
 Centralized processing and controls
 Controls to monitor results of operations
 Controls over period-end financial reporting process
 Policies that address business control and risk management practices

Transaction Controls
 Control activities implemented to mitigate transaction processing risk
 Affect certain processes, transactions, accounts, and assertions
 Do not have an entity-wide effect

COSO: Internal Control Components and Principles

Process for Understanding Internal Control and Assessing Control Risk
A.
B. Phase 1: Obtain and Document Understanding of Internal Control: Design and
Operation
 Three methods commonly used by auditors to obtain and document their
understanding of the design of internal control are narratives, flowcharts, and
internal control questionnaires .
 The auditor must also evaluate whether the designed controls are actually placed
in operation.
 The auditor should perform at least one walkthrough for each major class of
transactions. In a walkthrough, the auditor selects one or a few documents for the
initiation of a transaction type and traces them through the entire accounting
process

C. Phase 2: Assess Control Risk
 Two specific assessments must be made to arrive at the preliminary assessment:
 The first assessment is whether the entity is auditable. This is determined by
considering the integrity of management and the adequacy of the accounting records.
 Determine assessed control risk supported by the understanding obtained assuming
the controls are being followed.
D.
E. Phase 3: Design, Perform, and Evaluate Tests of Controls
 If the results of tests of controls support the design and operating of controls as
expected, the auditor uses the same assessed control risk as the preliminary
assessment. Otherwise, assessed control risk must be reconsidered.
 If the auditor wants a lower assessed control risk, more extensive tests of controls are
applied.
 PCAOB Standard 2 requires the auditor to determine whether controls are operating
effectively at year end. The auditor may test at an interim date and later determine if
changes have occurred.
F.
G. Phase 4: Decide Planned Detection Risk and Substantive Tests
 The greater the control risk (weak internal controls) the lower the detection risk the
auditor can accept.
 To lower detection risk, the auditor performs more substantive testing.