UNIVERSITY OF SOUTHERN MINDANAO

RISK ASSESSMENT-PART III

Consideration of the Internal Control in a
Financial Statement Audit
 Intended Learning Outcomes

Understand the nature and purpose of internal control.

Explain the elements of internal control as follows:
- Control Environment
- Risk Assessment Process
- Information System
- Control Activities
- Monitoring of Controls
 Intended Learning Outcomes

Know the objective of studying an entity’s internal

control.

Describe the stages in studying and evaluating

internal control.

Describe the different methods of documenting the

study of internal control.
 Intended Learning Outcomes

Understand the relationship between effectiveness of

internal control and substantive test.

Know how to communicate reportable conditions to

management.
 Nature and Purpose of Internal Control

Internal Control
the process designed and effected by those charged
with governance, management, and other personnel to
provide reasonable assurance about the achievement of
the entity’s objectives with regard to reliability of financial
reporting, effectiveness and efficiency of operations and
compliance with applicable laws and regulations.
Designed and implemented to address identified business
risk that threaten the achievement of the objectives.
Insert Running Title 5
 Internal Control System

means all the policies and procedures adopted by

the management of an entity to assist in achieving
management’s objective of ensuring, as far as
practicable, the orderly and efficient conduct of its
business, including adherence to management
policies, the safeguarding of assets, the prevention
and detection of fraud and error, the accuracy and
completeness of the accounting records, and the
timely preparation of reliable information.
Insert Running Title 6
Components and Principles of Internal Control

Control Environment

Risk Assessment

Control Activities

Information and
Communication

Monitoring Insert Running Title 7

 A. Control Environment
Control Environment – the overall attitude, awareness and actions of
directors and management regarding the internal control system and
its importance in the entity.
Factors reflected in the control environment include:
 The function of the board of directors and its committees
 Management’s philosophy and operating style
 The entity’s organizational structure and methods of assigning
authority and responsibility
 Management’s control system including the internal audit function,
personal policies and procedures and segregation of duties.

Insert Running Title 8

 A. Control Environment

Factors comprise the control environment:

1. Communication and Enforcement of Integrity and Ethical Values
2. Commitment to Competence
3. Participation by those Charged with governance
4. Management’s Philosophy and operating style
5. Organizational Structure
6. Assignment of authority and responsibility
7. Human Resources Policies and Procedures

Insert Running Title 9

 B. Entity’s Risk Assessment Process
Entity’s Risk Assessment - the identification, analysis, and
management of risks pertaining to the preparation of financial
statements.
Risk can arise or change due to circumstances such as the following:
 Change in regulatory or operating environment
 New personnel
 New or revamped information system; New technology
 Rapid growth
 New business models, products or activities

Insert Running Title 10

 B. Entity’s Risk Assessment Process
Risk can arise or change due to circumstances such as the following:
 Corporate restructuring; Expanded foreign operations
 Expanded foreign operations
 New accounting pronouncements

Insert Running Title 11

 C. Information System
D. Control Activities
Control Activities – the policies and procedures that help ensure that
management directives are carried out.
Major Categories of Control Procedures:
a. Performance Review
b. Information Processing Controls
c. Physical Control

E. Monitoring of Controls
Insert Running Title 12
 Objective of the Study of Internal Control
The auditor should obtain an understanding of the accounting and internal
control systems sufficient to plan the audit and develop an effective audit
approach
The auditor’s understanding of their client’s internal control provides a basis
for both to plan the audit and assess control risk.
In assessing control risk, an auditor consider the designs of controls,
whether they have been placed in operation, and, if they are in use, their
effectiveness.
1. To assess control risk below maximum
2. To evaluate the effectiveness of controls that have been placed in operation

Insert Running Title 13

 Documentation of Understanding

The auditor should document the understanding of the entity’s

internal control structure elements obtained to plan the audit.
The form and extent of this documentation is influenced by the:
1. Size and complexity of the entity
2. Nature of the entity’s internal control structure

Insert Running Title 14

Insert Running Title 15
 Methods of Documenting the Understanding of
Internal Control 

1. Internal Accounting Control Questionnaire

2.Flowcharts
3.Narrative Description
4.Internal Control Checklist
5.Decision Tables

Insert Running Title 16

 Internal Accounting Control Questionnaire
It contains a series of questions designed to detect control
weaknesses
Most questionnaires are designed to yield “yes”, “no”, or
“not applicable”.
When negative answers do indicate a weakness in a control,
they should be completed on a separate weakness
investigation worksheet.
If the weakness is material, then it should be reported to a
senior management, board of directors, and audit
committee.
17
Insert Running Title
 Internal Accounting Control Questionnaire
Material weakness – the procedures or degree of compliance with
the procedures fail to provide reasonable assurance that material
errors or irregularities would be prevented or promptly detected
during the accounting process
The auditor should consider the following critical aspects:
1. Is the system of internal control sound?
2. If it is not reliable, what errors might occur?
3. What alternative audit procedures should be adopted if system is
unreliable?

Insert Running Title 18

 Internal Accounting Control Questionnaire

Advantages
1. Attention is given to presence or absence of all controls
listed
2. Provide means of obtaining uniform documentation of
internal control system
3. Provide inexperienced audit staff members with guidance
4.Facilitate early detection of potential weaknesses in the
system

Insert Running Title 19

 Internal Accounting Control Questionnaire

Disadvantages
1. Auditor may view the questionnaire device for
accomplishing an automatic evaluation of internal control
2. Controls listed on questionnaires may not suit the particular
circumstances of a specific audit
3. Auditor may overlook pertinent control not included in the
questionnaires

Insert Running Title 20

 Flowcharts
A symbolic diagram of a specific part of an internal accounting
control system indicating the sequential flow of data and/or
authority
It uses standardized symbols, interconnecting lines, and annotations
to represent information, documents, and document flow
A properly prepared flowchart should reflect all the operations,
movement, delays and filling procedures associated with whatever is
being charted and should indicate the conversion of source
document into accounting information

Insert Running Title 21

 Flowcharts
The following questions should be answered before a flowchart is
prepared:
1. Who performs the various functions routine?
2. Why are these functions performed?
3. What work is performed, and is the work considered input or output?
4. When are the functions performed and in what sequence?
5. How are the functions performed and in what sequence?
The primary purpose of internal control flowchart is to communicate
effectively.

Insert Running Title 22

 Flowcharts

The following techniques should assist in meeting

this goal:
1. Standardized symbols
2.Flowlines
3.Documents
4.Processing
5.Annotations

Insert Running Title 23

 Flowcharts
Advantages:
1. Easily understood
2. Better overall picture or complex system
3. Parallels EDP documentation
4.Easy to update

Disadvantages:
1. Higher level of knowledge and training are required
2. Take more time to prepare and require more knowledge
3. More difficult to spot internal control weakness

Insert Running Title 24

 Narrative Description
It is a written description of a particular phase or phases of a control system.

Advantages:
1. Flexible and may be tailor-made for engagement
2. Requires a detailed analysis

Disadvantages:
1. Auditor may not have the ability to describe the system correctly and concisely
2. Requires more time and careful study
3. Auditor may overlook important portions of internal control system
4. Poorly written internal accounting control narrative can lead to misunderstanding
of the system
Insert Running Title 25
 Internal Control Checklist
Contains a detailed enumeration of the methods and practices
which characterize good internal control or of item to be considered
in reviewing internal control.

Decision Tables
It is used to represent conditional logic by creating a list of tasks
depicting business-level rules
This can be used when there is a consistent number of conditions
that must be evaluated and assigned a specific set of actions to be
used when the conditions are finally met
Insert Running Title 26
 HOW ADEQUACY OR INADEQUACY OF AN INTERNAL CONTROL AFFECTS AUDIT PROCEDURES

To provide a basis for relying upon the system and for
determining the extent of your and substantive tests to be
performed.
There is an inverse relationship between the effectiveness of
internal control and the extent of detailed audit procedures.
The audit is not specifically designed to seek search for errors
or irregularities.
Insert Running Title 27
 HOW ADEQUACY OR INADEQUACY OF AN INTERNAL CONTROL AFFECTS AUDIT PROCEDURES

 Furthermore , if additional evidence indicates that seem or

irregularities which may materially affect the financial statements , it
may be appropriate for the auditor to:
1.) Qualified opinion or this game an opinion based on an uncertainty
conditions and/or
2.) Consider withdrawing from the engagement and a defying the board
of directors in writing the reason for the withdrawal.

Insert Running Title 28

Insert Running Title 29
 COMMUNICATION OF PERFORMANCE COMMAND
PROVEMENT AND OBSERVATIONS IN INTERNAL CONTROL
TO MANAGEMENT

Auditor become aware of weaknesses in the systems

The auditor should make management aware that Have come
to their attention.
The communication to management of material weaknesses
would ordinarily be in writing. It can also be in the form of oral
communication and would be documented in the audit working
papers.
Insert Running Title 35
 Reportable Conditions

Specifically , these are the matter is coming to the

auditor’s and attention that , in his judgment , should be
communicated to the audit committee because they
represent significant deficiencies in the design or
operation of the internal control structure , which could
adversely affect organization's ability to record , process ,
summarize , and report financial data consistent with
assertions of management in the financial statements.
Insert Running Title 36
 Reportable Conditions

Examples of Reportable conditions are as follows:

Deficiencies in internal control structure design.
Inadequate overall internal control structure design
Absence of appropriate segregation of duties consistent with
appropriate control objectives
Absence of appropriate reviews and approvals of transactions ,
accounting and trees , or systems output

Insert Running Title 37

 Reportable Conditions

Inadequate procedures for appropriately assessing and

applying accounting principles
Failures and operation of the internal control structure
Evidence of failure of identified controls and preventing or
detecting the statements of accounting information
Evidence that a system fails to provide complete and accurate
consistent with ended his control objectives because of the
application of control procedures
Insert Running Title 38
 Reportable Conditions

Evidence of failure to safeguard assets from loss , damage of

misappropriation
Others
Absence of a sufficient level of control consciousness within
the organization
Failure to follow up and correct previously identified internal
control structure deficiencies

Insert Running Title 39

 Reporting- Form and Content

The report should state that communication is intended solely for the
information and the use of audit committee , management , and
others within the organization.
Any report issued on reportable conditions should---
Indicated the purpose of the auditor’s report and the financial
statement and not provide assurance on the internal control structure.
Include the definition of reportable conditions.
Include the restriction on distribution as discussed in the previous
paragraph
Insert Running Title 40