Assurance - Internal Control Flashcards
Provide the five components of internal control that are interrelated
The five controls that are interrelated rate
1. Control environment
2. Entity risk assessment process
3. Entity process to monitor the system of internal control
4. Information system and communication
5. Control activities
1 -3 - Indirect controls
4 -5 Direct controls
CAS 315 - a system of internal control
Key internal control - may be tested when the combined approach is taken.
Who is responsible for incorporating internal controls? In addition, what are the objectives of internal control?
The responsibility is on management to design & implement internal control.
- Control system enables an entity to meet objectives, maximizing shareholder wealth
The objective of internal control:
1. Effectiveness & efficiency of operation
2. Reliability of financial reporting
3. Compliance with applicable laws and regulations
Provide the two types of controls
Indirect controls - Controls that are not sufficiently precise to prevent, detect, or correct misstatement at the assertion level but support other controls and may have an indirect effect
Direct control - Are precise enough to address RMM at the assertion level.
Explain the table used for indirect control
- Control environment
- Sets tone at the entity and reflects overall attitude, awareness, and response
Elements: Oversight of management responsibilities
-Control environment has an appropriate foundation
- Control deficiencies have been identified - Entity risk assessment process
- Identification analysis of management relevant risk to proportion
Elements: Identifying business risks relevant to the objective
- Assessing the significance of those risks - Monitoring control
Provide the table for direct control
Direct control - information system and communication as well as control activities components are typically
Information system and communication
- Process to manage access
- Authentication
- Authorization
- Provisioning
- Deprovisioning access
- User access
- Change management process
- Need to understand entity information process activities data, information
- Accounting records, specific accounts in financial statement
- Financial reporting process user to prepare entity F/S
-Understanding how an entity communicates significant matters that support the preparation of F/S
What are the five types of control activities
P - Physical or logical control Ex. Access to warehouse key card
A - Authorization and approval. H/R must approve hiring a new employee
I - Independent verification - A/P clerk compares CEO authorization signature
R - Reconciliation Ex. Bank reconciliation prepared monthly
S - Segregation of duties - Ex. Individual open mail & prepare list cheques
Provide the two types of control objective
- Preventive control - Those designed to prevent a material misstatement
- Detective controls - Are those designed to detect, report, and correct material misstatement
Provide and explain the four types of direct controls
- Manual controls - These are those that affect individual accounts or classes of transaction
- Management approved individual transactions, approved time cards for employees, physical backup - Automated control - Computerized control - Authorization. Batch control, edit check, change control
- Combination - These are both manual and automotive. Help to select to mitigate risk with processes
- Information technology general control -
- Access to the program data
- Program change and development
- Business Continuity
- Computer operations
What is needed to understand internal controls
- Documenting internal control
- All significant transaction account balances, and disclosures sufficient to assess RMM
- All significant risks identified
Example of control that may be in place
1. Review the assumption used in the estimate
2. Use of experts for complex issues
3. Formal procedures for estimate
4. Approval of estimate by TCWG
What is for auditors to do under CAS 315
Under CAS 315 - Auditors are to document the following about internal control in the audit
1. Key element of the auditor’s understanding of the entity system of internal control including the source of information
2. The evaluation of the design of the identified control, and determination of whether such control has been implemented
For the updated risk assessment process
1. Documentation is key for internal control and underlying business processes may unveil
2. There is an increased risk profile of the transaction (such as the risk of cash sales being misappropriated)
What are the walkthrough and limitations of control
The walkthrough is a test that should be completed to confirm whether the auditor’s understanding of the control system is correct
Limitation of control - Human error, override, collusion, relevance, and obsolescence, cost
