CHAPTER 9 The Study of the Internal Control and Assessment of Control Risk

1. CHAPTER 9The Study of theInternal Control and Assessment of Control Risk

2. What is internal control?

3. What is internal control? Internal control consists of the policies & procedures established & maintained by management to assist in orderly & efficient conduct of business.

4. Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding: - reliability of controls Our records are reliable! Accounting Records

5. Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s objectives regarding: - reliability of controls - optimizing use of resources Waste

6. Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding: - reliability of controls - optimizing use of resources - safeguarding of assets

7. Internal control is a process designed to provide reasonable assurance regarding the achievement of management’s ob- jectives regarding: - reliability of controls - optimizing use of resources - safeguarding of assets - preventing & detecting fraud & error

8. obtain information about client’s legal obligations obtain background information preplan set materiality, and assess acceptable audit risk and inherent risk understand internal control and assess control risk Steps in audit planning perform preliminary analytical procedures

9. obtain information about client’s legal obligations obtain background information preplan understand internal control and assess control risk Steps in audit planning perform preliminary analytical procedures Why is an understand- ing of internal control im- portant? set materiality, and assess acceptable audit risk and inherent risk

10. Why is an understanding of internal control important? Second Examination Standard: A sufficient understanding of internal control should be obtained to plan the audit.

11. audit risk inherent risk control risk detection risk = x x the risk that material misstatements will not be prevented or detected by internal controls Audit Risk has 3 components which combine to make the audit risk model:

12. Key Internal Control Concepts - internal control is the client’s respon- sibility and should be designed to help the client attain goals

13. Key Internal Control Concepts - internal control is the client’s respon- sibility and should be designed to help the client attain goals - internal control should provide rea- sonable but not absolute assurance; cost/benefit must be considered

14. Key Internal Control Concepts - internal control is the client’s respon- sibility and should be designed to help the client attain goals - internal control should provide rea- sonable but not absolute assurance; cost/benefit must be considered - internal control has inherent limita- tions (e.g., misunderstandings, mis- takes, fatigue, carelessness, collusion, management override)

15. What are the components of internal control?

16. What are the elements ofinternal control? the control environment

17. All of these controls are unnecessary! The control environment is the actions, policies, and procedures that reflect management’s attitude regard- ing controls and their importance.

18. Factors related to the Control Environment:

19. Factors related to the Control Environment: - management’s philosophy and operating style

20. Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their approach to taking and monitoring business risk

21. - management’s philosophy and operating style Consider the following: - their attitude and actions toward financial reporting Factors related to the Control Environment:

22. Factors related to the Control Environment: - management’s philosophy and operating style Consider the following: - their emphasis on meeting financial and operating goals ...our bonuses are based on net income. We all want fat bonuses! What can we do?

23. Factors related to the Control Environment: - board of directors & committees The audit committee maintains communication between the Board of Directors and internal and external auditors. BOARD OF DIRECTORS internal auditors audit committee external auditors

24. Factors related to the Control Environment: - organizational structure The auditor should consider lines of responsibility and authority.

25. Job Description Memo: - assignment of authority and responsibility Factors related to the Control Environment: What are the formal methods that management uses to communicate internal controls to employees? Employee Handbook Company Policies

26. Do management’s methods send a clear message about the importance of control? - management’s control methods Factors related to the Control Environment:

27. - management’s control methods Factors related to the Control Environment: Do management’s methods send a clear message about the importance of control? Do manage- ment’s methods serve to detect misstatements?

28. Factors related to the Control Environment: - systems development methodology Does management have a methodology for developing and modifying systems and procedures?

29. - personnel policies and practices Management should ensure that compe- tent, trustworthy, motivated personnel are employed to meet client goals and objectives. Factors related to the Control Environment: Employees are the critical component of effective internal control.

30. Employees are the critical com-ponent of effective internal control. With competent, trustworthy, motivated per- sonnel, even a poorly designed system of internal control may function adequately.

31. With competent, trustworthy, motivated per- sonnel, even a poorly designed system of internal control may function adequately. Without such personnel, even a well- designed system will probably fail.

32. Factors related to the Control Environment: • management’s reaction to external influences Is management aware of external influences such as changes in the economy and technology?

33. Factors related to the Control Environment: - internal audit Does an internal audit department exist? Doesit effectively monitorcontrol policies and procedures, and enhance operational effectiveness and efficiency?

34. Factors related to the Control Environment: - internal audit Does an internal audit department exist? Does it…? Does internal audit assist the external auditors and reduce audit fees?

35. control systems What are the elements ofinternal control?

36. accounting systems What are the elements ofinternal control? Accounting systems have several subcomponents - classes of transactions

37. What are the components of internal control? control procedures

38. control procedures Control procedures are policies and pro- cedures, in addition to those related to other components, established to enable the entity to address risks in the achievement of their objectives.

39. Categories of Control Procedures

40. Categories of Control Procedures 1. Adequate segregation of duties - separate custody of assets from accounting The Controller

41. Categories of Control Procedures 1. Adequate segregation of duties - separate custody of assets from authorization of transactions As custodian of the corporate auto fleet, I hereby authorize retire- ment of auto #43 because of obso- lescence. #43 Joe

42. Categories of Control Procedures 1. Adequate segregation of duties - separate operational responsibility from record keeping responsibility Example: Ace company has two plants; one in Great Britain and one in Canada. Manage- ment is deciding whether the plant controllers should report directly to the plant managers or the corporate vice president of finance.

43. V.P.- production V.P.- finance plant manager plant controller V.P.- production V.P.- finance plant manager plant manager plant controller plant controller Which arrangement creates a potential conflict of interest? plant manager plant controller plant controller plant controller

44. Which arrangement creates a potential conflict of interest? V.P.- production V.P.- finance plant manager plant manager plant controller plant controller If the plant controller reports directly to the plant manager, a potential conflict of interest exists. In an effort to make that plant’s results appear favourable, the plant manager may at- tempt to influence the plant controller.

45. Categories of Control Procedures 1. Adequate segregation of duties - separate duties within EDP

46. What kind of company typically has difficulty accomplishing adequate segregation of duties?

47. What kind of company typically has difficulty accomplishing adequate segregation of duties? Small companies frequently have diffi- culty with segregation of duties because of fewer employees and cost constraints.

48. What is collusion?

49. What is collusion? Collusion is the defeat of adequate separation of duties wherein Employees cooperate to perpetrate fraud. ...we’re agreed. We’ll be rich be- yond our wildest dreams!

50. What is the most effective way to prevent collusion?