Chapter 06 - Internal Control In a Financial Statement Audit

CHAPTER 6 INTERNAL CONTROL IN A FINANCIAL STATEMENT AUDIT

Answers to Review Questions
6-1 From management's perspective, the internal control provides a way to meet its stewardship or agency responsibilities !anagement also needs a control system that generates reliable in"ormation "or decision-ma#ing purposes $he importance o" internal control to the auditor is rooted in the second standard o" "ieldwor# $he controls that are relevant to the entity's ability to initiate, record, process, and report "inancial data consistent with management's assertions are the auditor's main concern $he auditor needs assurances about the reliability o" the data generated within the entity's internal control system in terms o" how it a""ects the "airness o" the "inancial statements and how well the assets and records o" the entity are sa"eguarded $he auditor uses this understanding o" internal control to identi"y the types o" potential misstatements, ascertain "actors that a""ect the ris# o" material misstatement, and design tests o" controls and substantive procedures

6- $he potential bene"its and ris#s to an entity%s internal control "rom in"ormation technology include &see $able 6-'() *ene"its) Consistent application o" prede"ined business rules and per"ormance o" comple+ calculations in processing large volumes o" transactions or data ,nhancement o" the timeliness, availability, and accuracy o" in"ormation Facilitation o" additional analysis o" in"ormation ,nhancement o" the ability to monitor the per"ormance o" the entity's activities and its policies and procedures -eduction in the ris# that controls will be circumvented ,nhancement o" the ability to achieve e""ective segregation o" duties by implementing security controls in applications, databases, and operating systems -is#s) -eliance on systems or programs that inaccurately process data, process inaccurate data, or both .nauthori/ed access to data that may result in destruction o" data or improper changes to data, including the recording o" unauthori/ed or none+istent transactions or inaccurate recording o" transactions .nauthori/ed changes to data in master "iles .nauthori/ed changes to systems or programs Failure to ma#e necessary changes to systems or programs

6-'

Chapter 06 - Internal Control In a Financial Statement Audit

Inappropriate manual intervention

6-0

Chapter 06 - Internal Control In a Financial Statement Audit

6-!

1otential loss o" data

Internal control is composed o" "ive components) ' Control ,nvironment) $he control environment sets the tone o" the organi/ation, in"luencing the control consciousness o" its people It is the "oundation o" all other components o" internal control, providing discipline and structure 0 $he ,ntity%s -is# Assessment 1rocess) $he process "or identi"ying and responding to business ris#s and the results thereo" For "inancial reporting purposes, the entity%s ris# assessment process includes how management identi"ies ris#s relevant to the preparation o" "inancial statements that are "airly presented in con"ormity with generally accepted accounting principles, estimates their signi"icance, assesses the li#elihood o" their occurrence, and decides upon actions to manage them 2 $he In"ormation System and -elated *usiness 1rocesses -elevant to Financial -eporting and Communication) An in"ormation system consists o" in"rastructure &physical and hardware components(, so"tware, people, procedures &manual and automated(, and data $he in"ormation system relevant to the "inancial reporting ob3ective includes the accounting system and consists o" the procedures &whether automated or manual( and records established to initiate, authori/e, record, process, and report an entity%s transactions and to maintain accountability "or the related assets and liabilities Communication involves providing an understanding o" individual roles and responsibilities pertaining to internal control over "inancial reporting 4 Control Activities) Control activities are the policies and procedures that help ensure that management directives are carried out, "or e+ample, that necessary actions are ta#en to address ris#s to achievement o" the entity's ob3ectives Control activities, whether automated or manual, have various ob3ectives and are applied at various organi/ational and "unctional levels 5 !onitoring o" Controls) $he monitoring o" controls is a process used to assess the 6uality o" internal control per"ormance over time It involves assessing the design and operation o" controls on a timely basis and ta#ing necessary corrective actions Factors that a""ect the control environment include &see $able 6-2() Communication and en"orcement o" integrity and ethical values A commitment to competence 1articipation o" those charged with governance &i e , board o" directors or audit committee( !anagement's philosophy and operating style 7rgani/ational structure Assignment o" authority and responsibility 8uman resource policies and practices

6-"

6-2

Chapter 06 - Internal Control In a Financial Statement Audit

6-#

A substantive audit strategy means that the auditor has made a decision not to rely on the entity's controls and to audit the related "inancial statement accounts directly Control ris# is set at the ma+imum when a substantive audit strategy is "ollowed 9ith a reliance strategy, the auditor relies on the entity's controls and sets control ris# below the ma+imum A reliance strategy re6uires a more detailed understanding and documentation o" internal control than does a substantive strategy $he auditor also plans and per"orms tests o" controls to support the lower assessed level o" control ris# In addition to planning the audit o" the "inancial statements, the auditor's understanding o" the entity's internal control is used to &'( identi"y the types o" potential misstatements, &0( pinpoint "actors that a""ect the ris# o" material misstatement, and &2( design tests o" controls and substantive procedures

6-6

6-$ $he concept o" reasonable assurance recogni/es that the cost o" an entity's internal control system should not e+ceed the bene"its that are e+pected to be derived "rom the system $hus, an internal control system will not detect every error that might occur because it would be too costly to design such a system !anagement override o" internal control, personnel errors or mista#es, and collusion are inherent limitations o" internal control 6-% In addition to planning the audit o" the "inancial statements, the auditor's understanding o" the entity's internal control is used to &'( identi"y the types o" potential misstatements, &0( pinpoint "actors that a""ect the ris# o" material misstatement, and &2( design tests o" controls and substantive procedures 6-& $he concept o" reasonable assurance recogni/es that the cost o" an entity's internal control system should not e+ceed the bene"its that are e+pected to be derived "rom the system $hus, an internal control system will not detect every error that might occur because it would be too costly to design such a system !anagement override o" internal control, personnel errors or mista#es, and collusion are inherent limitations o" internal control 6-1' A number o" tools are available to the auditor "or documenting the understanding o" the internal control, including copies o" the entity's procedures manuals and organi/ational charts, internal control 6uestionnaires, "lowcharts, and narrative descriptions 6-11 $he auditor should document the achieved level o" control ris# "or the controls evaluated 6-1 $he auditor might consider conducting substantive tests at an interim date "or a number o" reasons For e+ample, the client may want the auditor to con"irm accounts receivable be"ore year-end because o" demands on the client%s sta"" at year-end Alternatively, the auditor may wish to conduct substantive tests at an interim date to minimi/e sta"" overtime at year-end $he auditor should consider the "ollowing "actors when substantive tests are to be completed at an interim date) $he control environment and other relevant controls $he availability o" in"ormation at a later date that is necessary "or the auditor%s procedures &e g , in"ormation stored electronically "or a limited period o" time(

6-4

Chapter 06 - Internal Control In a Financial Statement Audit

$he purpose o" the substantive procedure $he assessed ris# o" material misstatement $he nature o" the class o" transactions or account balance and relevant assertions $he ability o" the auditor to per"orm appropriate substantive procedures or substantive procedures combined with tests o" controls to cover the remaining period in order to reduce the ris# that misstatement may e+ist at the period-end will not be detected 9hen the auditor conducts substantive tests o" an account at an interim date, additional substantive tests might include comparing the year-end account balance with the interim account balance, conducting some analytical procedures, and:or reviewing related 3ournals and ledgers "or large or unusual transactions during the remaining period 6-1! For private companies, auditing standards re6uire that the auditor report to those charged with governance &e g , audit committee( any control de"iciencies discovered by the auditor that are serious enough to be considered a signi"icant de"iciency or a material wea#ness See Chapter ; "or the auditor%s reporting responsibility "or reporting on internal control 6-1" 7ver reporting "or public companies

Answers to Mu(ti)(e-C*oi+e Questions

6-1 6-1! 6-1" 6-1# 6-16 6-1$ 6-1% d d d d a c b 6-1& 6- ' 6- 1 66- ! 6- " * * < C * <

So(utions to Pro,(e-s
6- # a $he C7S7 de"inition is) =Internal control is designed and e""ected by an entity%s board o" directors, management, and other personnel to provide reasonable assurance about the achievement o" the entity%s ob3ectives in the "ollowing categories) &'( reliability o" "inancial reporting, &0( e""ectiveness and e""iciency o" operations, and &2( compliance with applicable laws and regulations > In Chapter ;, you will "ind a somewhat similar de"inition "or internal control that is included in the 1CA7*%s AS5 $he auditor should obtain an understanding o" each o" the "ive components o" internal control in order to plan the audit $his understanding includes #nowledge about the design o" relevant controls and whether they have been placed in operation by the entity $he auditor uses this #nowledge to &'( identi"y the types o" potential misstatements, &0( pinpoint "actors that a""ect the ris# o" material misstatement, and &2( design tests o" controls and substantive procedures

6-5

Chapter 06 - Internal Control In a Financial Statement Audit

An auditor should document the understanding o" the internal control components obtained to plan the audit $he auditor should also document the assessed &achieved( level o" control ris#

6- $ a $he auditor should consider a reliance strategy i" evidence is available only in electronic "orm 8owever, a"ter developing an understanding o" the new system, the auditor would need to test the system to determine whether it is wor#ing as intended I" the system is wor#ing e""ectively, the auditor is more li#ely to use a reliance strategy $he auditor should also consider whether the "irm%s #nowledge o" I$ systems is su""icient to allow it to use a reliance strategy? i" not, a substantive strategy may be more appropriate 9hen deciding whether to hire a specialist, the auditor in this case should consider "actors such as the comple+ity o" the new system, whether the implementation o" the system allows the company to engage in electronic commerce and the e+tent to which audit evidence is available only in electronic "orm $he auditor should as# the I$ specialist to communicate in"ormation including how I$ controls are designed and how data and transactions are initiated, recorded, processed, and reported $he control environment li#ely is not a""ected to a great e+tent by the switch to an automated system e+cept inasmuch as the switch might signal management%s commitment to competence and willingness to improve its controls $he entity%s ris# assessment is a""ected because the e+istence o" an automated system creates a new set o" ris#s, such as ris#s involving the design o" the control system In terms o" the in"ormation system and communication, the auditor will have to veri"y that the new system identi"ies and records all valid transactions and provides in"ormation su""icient "or preparing accurate and complete "inancial statements Control activities are important because new controls regarding the in"ormation system will have to be designed and implemented !onitoring o" controls is important because the monitors &including the internal and e+ternal auditors( will have to have su""icient #nowledge o" the system to be able to e""ectively monitor the use o" the system and its outputs *e"ore applying principal substantive procedures to balance sheet accounts at April 20, 00'', the interim date, Coo# should assess the di""iculty in controlling incremental audit ris# Coo# should consider whether Coo#'s e+perience with the reliability o" the accounting records and management's integrity has been good -apidly changing business conditions or circumstances may predispose @eneral's management to misstate the "inancial statements in the remaining period $he year-end balances o" accounts selected "or interim testing will be predictable @eneral's procedures "or analy/ing and ad3usting its interim balances and "or

6-!' a

6-6

Chapter 06 - Internal Control In a Financial Statement Audit

establishing proper accounting cuto""s will be appropriate @eneral%s accounting system will provide su""icient in"ormation about year-end balances and transactions in the "inal two months o" the year to permit investigation o" unusual transactions, signi"icant "luctuations, and changes in balance compositions that may occur between the interim and balance sheet dates $he cost o" the substantive tests necessary to cover the "inal two months o" the year and provide the appropriate audit assurance at year-end is substantial Assessing control ris# at below the ma+imum would not be re6uired to e+tend the audit conclusions "rom the interim date to year-end 8owever, i" Coo# assesses control ris# at the ma+imum during the "inal two months, Coo# should consider whether the e""ectiveness o" the substantive tests to cover that period will be impaired b Coo# should design the substantive procedures so that the assurance "rom those tests and the tests to be applied as o" the interim date, and any assurance provided "rom the assessed level o" control ris#, will achieve the audit ob3ectives at year-end Such tests should include the comparison o" year-end in"ormation with comparable interim in"ormation to identi"y and investigate unusual amounts 7ther analytical procedures and:or substantive procedures should be per"ormed to e+tend Coo#'s conclusions relative to the assertions tested at the interim date to the balance sheet date

So(ution to Dis+ussion C.se

6-! a 1review Company's control environment has the "ollowing strengths) Corporate management has high integrity 1review has a code o" conduct 1review hires competent people !anagement is conservative in its use o" accounting principles and practices $he e+ternal auditors review controls at each division $he control environment has the "ollowing wea#nesses) <ivisions operate autonomously with limited monitoring &management intervenes only when planned results are not obtained( $he board o" directors and audit committee are not very active $here is limited monitoring o" employee compliance with the corporate code o" conduct ,mployee compensation is dependent on per"ormance $his in and o" itsel" is not a wea#ness 8owever, with the presence o" the other wea#nesses, it represents a source o" concern "or the auditor 1review does not have an internal audit department

6-;

Chapter 06 - Internal Control In a Financial Statement Audit

$he "ollowing "actors lead to and "acilitate 8arris's manipulation o" inventory) As a general manager, 8arris has a high incentive to Aloo# good A 8is division has had seven years o" increasing pro"its, and his salary and bonus depend on the division's per"ormance Competition in the industry is "ierce, and sales prices are declining Inventory represents a large portion o" the balance sheet, and controls over inventory are wea# $here is limited monitoring by corporate management, and there is no internal audit department

6-B