Chapter 8 - Understanding the Internal Controls System

Question 1

What is a system of internal controls?

Answer 1

It is the policies and procedures designed, implemented, and maintained by management to provide reasonable assurance that:
1. There is reliable financial information
2. Effectiveness and efficiency in operations
3. Compliance with relevant laws and regulations

Question 2

What are policies

Answer 2

Statements of what should or should not be done in an organization to affect controls.

Question 3

What are procedures? How are procedures created?

Answer 3

Actions done to implement the policies. They may be created through formal documentation mandates or the result of behaviors that are not mandated but conditioned

Question 4

What are the 4 broad objectives of management implementing internal controls

Answer 4

1. Provide a strategic high level goals that support the mission of the entity
2. Reliable financial reporting
3. Efficiency and effectiveness of operations
4. Compliance with laws and regulations

Question 5

For public companies in Canada, what do they have to report on? What are the three levels of control that should exist?

Answer 5

They report on the effectiveness of internal controls over the financial reporting.

1. Entity
2. Information technology
3. Business Process.

Question 6

Describe the following control parts:
1. Entity Controls
2. Information Technology
3. Business Process

Answer 6

Entity - Controls that have a pervasive effect on the achievement of the organizations objectives for internal control, like the governance structure

Information Technology and General Controls - Controls that relate to the operating system, applications, and databases supporting the operation of information systems and forms the foundation of the information technology environment. , system access controls

Business Process - Controls embedded within a specific key financial business process like payroll.

Question 7

What are the two key concepts that underlie managements design and implementation of controls

Answer 7

1. Reasonable Assurance - Provides reasonable assurance that financial statements are fairly presented, includes a cost and benefits analysis, low level of control risk.
2. Inherent Limitations - Effectiveness of the system depends on the competence and dependability of the people using it even if the technology was perfect and ideal.

Question 8

What is management override?

Answer 8

The ability of management and / or those charged with governance to manipulate accounting records and prepare misleading and / or fraudulent financial statements by overriding internal controls, even where the controls may otherwise appear to be operating effectively.

Question 9

What is collusion?

Answer 9

A cooperative effort among employees or management to defraud a business of cash, inventory, or other assets.

Question 10

What are the responsibilities of management for public companies in Canada for reporting?
Which framework do they use?
What is COSO
What are management two parts of the assessment of internal control over financial reporting

Answer 10

Publicly report on the operating effectiveness of internal controls

Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control - Integrated Framework

COSO is the GAAP equivalent for internal controls, the framework used to assess the effectiveness of internal controls

1. Evaluate and design of internal controls over financial reporting
2. Management must test the operating effectiveness of those controls

Question 11

What is the auditors main responsibility in assessment of the clients internal controls? Why? Is this responsibility always necessary?

Answer 11

Understand, identify, and evaluate the internal controls that are relevant to the audit -

Identify the risk of material misstatement at the financial statement level and assertion level.

Yes this responsibility is always necessary even if we do not intend to rely on the controls as we must understand the organizations circumstances and situation

Question 12

What are relevant controls? Provide an example of a control that may not be relevant in general but may be relevant in a specific circumstance.

Answer 12

Controls that relate to reliability of financial reporting like compliance with laws and the safeguarding of assets.

Operation controls / Internal management information may not be relevant except where the information produced is used to develop analytical procedures or the information is required for the disclosure of the financial statement.

Question 13

What are direct controls?

Answer 13

Controls that are precise enough to address RMM at the assertion level. Address the risk of the integrity of the information.

Question 14

What are indirect controls?

Answer 14

Controls that are not sufficiently precise to prevent, detect, or correct misstatements at the assertion level but which support direct controls and therefore, have an indirect effect on the likelihood that a misstatement will be detected or prevented on a timely basis.

Question 15

What preceeds the understanding of internal controls? What are the three parts of internal controls on the pervasive level and why are they important / briefly describe them

Answer 15

Identifying RMM at the financial statement level and assertion level.

Three parts include risk assessment, monitoring, and the control environment. They are indirect controls however they have direct control aspects, if they are deficient it could have a pervasive risk on the overall financial statement risk.

Question 16

How does the auditor assess RMM at the financial statement level and inherently the assertion level?

How does the auditor assess RMM at the assertion level specifically?

Answer 16

Three parts include risk assessment, monitoring, and the control environment.

Understanding how the information is processed (the IS) and identification /evaluation of controls in the controls in the control activities components.

Question 17

What are control activities?

Answer 17

These are controls to ensure the proper application of policies in all components of internal control and can be direct or indirect

Question 18

What are the five components of internal controls?

Answer 18

1. Control environment
2. Risk Assessment
3. Control Activities
4. Monitoring
5. Information and communication

Question 19

What is the control environment?

Answer 19

Actions, policies, procedures that are set in place by management and those in charge of governance to provide an overall tone of the perspective on control creating a pervasive effect on identifying risk and implementing good controls., they provide the foundation for all other components

Question 20

Describe how the control environment works?

Answer 20

If the management and governance seem to care about the controls, policies, and procedures than others will follow their lead and also care, improving the control environment. If management ignores it then the staff will also likely ignore it.

Question 21

Describe integrity and ethical values - Control environment

Answer 21

The ethical values demonstrated by the tone of management and the board of directors provide signals to the employees of what is most important.

There should be a clear code of conduct and ethics to describe the position of the firm to the employees and to outsiders.

There should be processes to evaluate performance of individuals and teams, in addition to addressing deviations in a timely manner.

Question 22

Describe the board of directors - Control environment

Answer 22

They have appropriate background, expertise, independent and scrutinize management behaviors.

North American exchanges have the creation of the audit committee who financially literate, independent.

Question 23

What is the role of the audit committee?

Answer 23

1. Consider the potential for management override of internal controls
2. Oversee management fraud risk assessment process and anti fraud programs and controls
3. Maintain ongoing communications with both internal and external auditors.
4. Approves audit and non audit services
5. Safeguards to the potential threats to auditors independence

Question 24

Describe the structure, authority, and responsibility

Answer 24

It has an organizational structure that is appropriate for its size and operating activities, with clear defining lines of responsibility and authority.

Question 25

Describe commitment to competence?

Answer 25

If employees are competent and trustworthy, than other controls can be absent, and reliable financial statements still result. Relevant standards for HR such as hiring, training, motivating, evaluating, promotion, compensating, transferring, and termination of employments are indicators of this principle. We also assess whether the firm provides sufficient accounting and financial personnel to keep pace with complexity of the business.

Question 26

Describe accountability

Answer 26

A firm should have a structure and a tone the establishes and enforces individual accountability for internal control, there should be rewards, incentives, and measures.W

Question 27

What is risk assessment?

Answer 27

It is the process of identifying and analyzing the risk and its impact on the financial statements in accordance to GAAP, risks that prevent the firm from reaching its objectives.

Question 28

What are the four underlying principles to risk assessment?

Answer 28

1. Have clear objectives in order to identify and assess the risks relating to its objectives. 2. How the risks should be managed 3. Organizations consideration for potential fraud behavior. 4. Monitor changes that could impact internal control.

Question 29

How do we ensure that organizations meet its objective of reliable external financial reporting?

Answer 29

Management should consider whether the reporting objectives are consistent with relevant financial reporting framework and its appropriate circumstances, looking at both internal and external risks, and involve levels of management with the necessary expertise.

Question 30

What are control features that could reduce fraud risks?

Answer 30

1. Management and board promotion of a culture of honesty and high ethics. 2. Audit committee oversight of management and internal auditors 3. Specific management responsibilities for managing risks and fraud \ 4. Articulated and effective fraud risk management process 5. Effective general, application control activities that address specific risks of fraud such as segregation of duties.

Question 31

What is the impact of change on risk

Answer 31

Management should have processes that identify and evaluate changes in the external and external environment that could impact the system of control. New business models or frameworks may make control useless, thus assessment is required.

Question 32

What is monitoring?

Answer 32

Monitoring is the process of assessing whether the controls have worked and refining it and making it better as necessary, with any issues being identified, reported, and fixed.

Question 33

What is the frequency of monitoring? What is the role of internal audit functions? How do they know when to make adjustments to the system?

Answer 33

Monitoring should contain both a real time on going basis, and also periodic separate evaluations. The role of internal audit functions is essential for monitoring internal controls, and often they perform the periodic reviews. Studies of internal controls, exceptions, as well as internal audit reports.

Question 34

Describe evaluation and communication of deficiencies - Monitoring

Answer 34

Reported in a timely manner to those responsible for corrective action, and the internal control assessed and fixed within a short time frame.

Question 35

What is the purpose of the accounting information system and communication?

Answer 35

1. Initiate, record, process, and report the entity's transaction and to maintain accountability for the related asset, includes both the business process and the accounting system (accounting software, spreadsheets, etc)

Question 36

What are the 4 parts of the accounting information system. Briefly describe them

Answer 36

1. Inputs - Transactions, events, conditions 2. Business process - Initiate, record, process, and report/ resolve errors/ process overrides 3. Accounting system - Transfer info from TP to GL, capture information not transaction based, accumulate, record, process, summarize info ton be disclosed in f/s/ post standard and other JE 4. Outputs - Financial statements `

Question 37

What items should controls be developed and implemented for?

Answer 37

1. Completeness and accuracy of data 2. Capture of data at the necessary frequency 3. Provision of information when needed 4. Protection of sensitive data 5. Retention of data to comply with the relevant business, audit, and regulatory needs.

Question 38

What is effective internal and external communications `

Answer 38

Internally: - Training orientation for new employees starting a new position and discussing the nature of the positions responsibilities. - Whistleblowing also implemented for employees to feel safe and to be anonymous when reporting information they deem to be unethical and management should take actions Externally: - Processes to discuss information to external parties in a relevant and timely manner - Two way street and process that tracks the communications with customers, vendors, regulators, and other relevant stakeholders.

Question 39

What are control activities?

Answer 39

Activities that includes the policies and procedures that allow the organization to reach its goals and financial reporting goals. They ensure the proper application of the policies in all the other components of the entity's system of internal control.

Question 40

What are manual controls? Are they effective?

Answer 40

Application controls done by people. They are only effective if the people are competent and they exercise care.

Question 41

What are automated controls? Are they effective

Answer 41

Application controls done by computers. Performed on data within the IT application and have embedded checks on data validity, accuracy, and completeness. If it is properly designed it is effective

Question 42

What are 3 ways to assess whether the risks have been addressed?

Answer 42

1. If the relevant business processes, IT, and locations have control activities are needed. 2. Control activities related to the integrity of information sent to and received from outsourced service providers. 3. Controls performed by outsourced service providers are adequate.

Question 43

What are the focused controls for control activities in the auditors identification and evaluation?

Answer 43

Processing controls for specific business processes, like processing sales or cash. It should be a combination of preventive and detective controls.

Question 44

What are preventive controls? What are detective controls? Which one is more effective?

Answer 44

They are designed to stop errors or fraud from occurring. They identify errors or irregularities after they have occurred so that corrective actions can be taken. Preventive controls are more effective.

Question 45

What are the three types of preventive/detective controls?

Answer 45

1. Input controls - Ensure completeness, accuracy, and validity of the reference data in the processing 2. Processing - Prevent and detect errors while transactions are being processed. 3. Output - Focus on detecting errors after processing

Question 46

What is a business process/application system?

Answer 46

It is a structured set of activities designed to produce specific output.

Question 47

What are 5 controls for business processes?

Answer 47

1. Proper authorization and approval 2. Adequate documents and records. 3. Physical and logical control over assets and records 4. Segregation of duties 5. Independence checksW

Question 48

What is general authorization? What is specific authorization? What is authorization?

Answer 48

Policies set by management allow subordinates or the automated process to approve all transactions within the limits set by the policy. Polices set by management allow subordinates or the automated process to approve specific individual transactions within the limits set by the policy. Affirming that a transaction is valid

Question 49

What are 4 principles of adequate documents and records? Why is each one important

Answer 49

1. Prenumbered, or automatically numbered consecutively - Help to control missing records and aid in locating records when they are needed at a later date. 2. Prepared at the time a transaction takes place, or as soon as possible thereafter. Minimize cutoff errors. 3. Design for multiple use, when possible, to minimize the number of different forms - Minimizes input errors and increase efficiency. 4. Designed to encourage correct preparation - Minimizes input errors, done by providing internal checks

Question 50

What is a chart of accounts? Why is it useful?

Answer 50

Classifies transactions into individual balance sheet and income statement accounts. It prevents classification errors if it accurately describes which type of transaction should be in each account.

Question 51

What are physical / logical controls?

Answer 51

Most important protective measure for safeguarding physical assets and records is the use of a physical or a logical control.

Question 52

What is the segregation of duties?

Answer 52

The assignment of various steps in a process to different people. Reduce the opportunity for a person to be in a position to perpetuate fraud.

Question 53

What is the main principle of the segregation of duties?

Answer 53

Split it among the different people such that: 1. One has control of the physical asset 2. The other records it 3. Authorization to acquire or dispose.

Question 54

What are the 4 types of segregation of duties to prevent fraud? What do they prevent?

Answer 54

1. Separate custody of assets - Prevents theft 2. Separate authorization of transactions from custody of related assets - Prevents embezzlement 3. Separate operational responsibility from record keeping - Prevent biased estimates and / or fraudulent financial reporting 4. Separate reconciliation from data entry. - Prevent theft and fraud

Question 55

What are verifications? What assertions does verification confirm?

Answer 55

Compare two or more items with each other: or compare a follow up action to an original action or to a policy when the two items do not match or the item is not consistent with policy. Verification confirms the completeness and accuracy assertions.

Question 56

What is a vital step if it is a manual review?

Answer 56

They perform internal verification procedures are independent of the individual preparing the original data.

Question 57

What is a performance review?

Answer 57

Important means of highlighting unexpected variations that should be investigated and if necessary, corrected. It relates different sets of data.

Question 58

What is general controls?

Answer 58

Apply to all aspects of the IT function. This includes access controls, system change, and IT operations management. It is customized to the system in use.

Question 59

What are application controls?

Answer 59

Apply to business process level and apply to the processing transactions, such as controls over the processing of sales or cash receipts

Question 60

What are the implications of IT controls being different across classes of transactions and accounts / related disclosures?

Answer 60

They have to evaluate the application control for each class of transaction or account in which the auditor plans to reduce assessed control risk. Application controls tend to only be effective if general controls are effective.

Question 61

What are the three general controls for IT

Answer 61

1. Access management - Access to hardware restricted, passwords and user ID's limit access to software and data files 2. System development and change - Teams of users, programmers, analysts develop and thoroughly test software 3. IT operations management - Written backup plans are prepared

Question 62

What is cybersecurity?

Answer 62

The information technology and internal control processes an organization has in place to protect computers, networks, programs, and data from unauthorized access.

Question 63

What are physical controls

Answer 63

These are controls such as badges to enter a building, keypads, security gates, etc. They are physical controls over the computer equipment

Question 64

What are online access controls?

Answer 64

These are controls such as user ID< password, MMFA, reducing the likelihood that unauthorized changes are made to software applications and data files.

Question 65

What are the three parts of the systems development and change and development management?

Answer 65

1. Software is developed in house or purchased externally on organizations needs. The firm will involve both IT and non IOT, key users, ensuring all information is accounted for, and concerns addressed. 2. Test the software to ensure it is compatible with existing hardware and software to see if it can handle the volume of transactions. 3. Proper documentation with testing done in non production environments approved by independent individuals

Question 66

What is pilot testing What is parallel testing?

Answer 66

A new system is implemented in one part of the organization while another location continues to rely on the old system The old and new systems operate simultaneously in all locations. This is costly, therefore rarely used except where the cost of an error is sufficiently large to justify the cost of testing.

Question 67

What are the different parts of the IT operations management?

Answer 67

1. Managing data and systems backup 2. Interfacing between programs 3. Management of data security.

Question 68

What are hardware controls?

Answer 68

Built into computer equipment by manufacturers to detect and report equipment failures.

Question 69

What are backups? What are disaster recovery plans?

Answer 69

- Copies of systems and data that can be used to bring failed systems back online - DRP planning for potential IT disruptions. The purpose of the DRP is to enable the business to continue operations in the event of a failure of information systems.

Question 70

What are typical controls for input manual systems - Application controls?

Answer 70

1. Managements authorization of transactions 2. Adequate preparation of input source documents 3. Competent personnel.

Question 71

What are typical controls for input automatic systems - Application Controls?

Answer 71

1. Adequately designed input screens with preformatted prompts. 2. Pull down menu lists 3. Computer validation tests 4. Online based input controls, customers and suppliers perform the inputs 5. Immediate error correction procedures 6. Accumulation of errors in an error file

Question 72

What is financial total

Answer 72

Summary total of field amounts for all records in a batch that represent a meaningful total, such as dollar amounts.

Question 73

What is hash total

Answer 73

Summary total of codes from all records in a batch that do not represent a meaningful total

Question 74

What is record count

Answer 74

Summary total of physical records in a batch.

Question 75

What is validation testing? What is sequence testing?

Answer 75

- Ensures that a particular type of transaction is appropriate for processing - Determines that data submitted for processing are in the correct order

Question 76

What is arithmetic accuracy test? What is data reasonableness test?

Answer 76

- Checks for accuracy of processed data - Determines whether data exceed prespecified amounts

Question 77

What is completeness test

Answer 77

Determines that every field in a record has been completed.

Question 78

What is the most important type of output control What are the 4 common controls for output?

Answer 78

- The most important output control is the review of data for reasonableness by someone knowledgeable with the output 1. Reconcile computer produced output to manual controls total 2. Compare the number of units processed to the number of units submitted for processing 3. Compare a sample of transaction output to input source documents. 4. Verify dates and times of processing to identify any out of sequence processing.

Question 79

What are the four aspects of the organizations of the IT function.

Answer 79

- As the level of complexity in IT systems increase, separation of authorization, record keeping, and custody often become blurred. We separate IT related functions IT Management -Oversight of the IT function ensure activities carried out consistent with IT plan Systems Development - Design the application system, coordinate development, acquisition, and changes to IT systems, and primary users outside IT Operations - Day to day operations of the computer, following the schedule established by the CIO, look for efficiency and malfunctions Data Control - independently asses the quality of input and reasonableness of output. They use databases to store information shared by accounting and other functions.

Question 80

What are the 4 components of the IT System? Why does the auditor care about these aspects?

Answer 80

1. IT Infrastructure - Servers, network, internet 2. Personal Computing - Use of cellphones and laptops 3. Outsourced IT - Cloud based solutions 4, IT governance - How IT is managed It allows them to get a better understanding of the entity.

Question 81

What are the 3 factors that make IT systems complex?

Answer 81

1. Type of IT applications and data management systems 2. The complexity of the infrastructure 3. Degree to which the organization relies on third parties for outsourcing

Question 82

Describe the reliabilityt of the IT if purchased internally vs externally

Answer 82

Those purchased outside will have fewer programming errors and are more reliable Those complex ones internally are more likely to have errors and bugs

Question 83

What are database management systems?

Answer 83

Allows clients to create databases that include information that can be shared across multiple applications. Many applications share files, rather than each application having its own file.

Question 84

What is Enterprise Resource Planning (ERP)

Answer 84

Integrate numerous aspects of an organizations activities into one accounting system. Share data across accounting and non accounting functions

Question 85

What are Virtual Private Networks (VPN's)

Answer 85

Encrypted connection over the internet from a device to a network.

Question 86

What are virtual desktops?

Answer 86

Preconfigured images of operating systems and applications. Users access it through laptop or device, and they are granted right to access

Question 87

What are Local Access Networks

Answer 87

Link equipment within a single or small cluster of buildings and are used only within a company. They transfer data and programs from one computer or workstation using network system software.

Question 88

What are wide area networks?

Answer 88

Link equipment in large geographic regions, including global operations.

Question 89

What are encryption techniques?

Answer 89

Protect the security of electronic communication when information is transmitted and when it is stored. It turns the data file into a code, The receiver or use must have a decryption program to decode the message or data.

Question 90

What is a public key and private key?

Answer 90

Encryption technique, where one key (the public key) is used for encoding the message and another key (private key) is used for decoding the message. Public key is distributed to all approved users of the e-commerce system. Private key is only provided to internal users with the authority to decode the message

Question 91

What are digital signatures? Who gives it? What does it consist of? What does it have to provide authenticity

Answer 91

Electronic certificates that are used to authenticate the validity of individuals and companies conducting business electronically. It is given by certification authorities. Contains the holders name, public key, certification authority, certificate expiration. It has a private key with the signature of the one with authority.

Question 92

What is a firewall?

Answer 92

A system of hardware and software that monitors and controls the flow of e-commerce communications by channeling all network connections through controls that verify external users, grant access to authorized users, deny access to unauthorized users, direct authorized users to request programs or data

Question 93

What are the 4 characteristics of a firewall?

Answer 93

1. Hides the structure of the network 2. Provides an audit trail of communication with public parties 3. Generates alarms when suspicious activity is suspected 4. Defend itself and / or the organization against attacks.

Question 94

What are service centers?

Answer 94

An organization that provides IT service for companies on an outsourcing basis.

Question 95

What are application service providers?

Answer 95

Third party entities that manage and supply software applications or software related services to customers through the internet.

Question 96

What are cloud computing environments?

Answer 96

A computer resource deployment and procurement model that enables an organization to obtain IT resources and applications at an IT service center shared with other organizations from any location via an internet connection. It may be on the site or it may be somewhere else.

Question 97

What is the best control for a small business?

Answer 97

1. Knowledge and concern of the top operating person, who is the owner manager. Having close relationships allows for good assessments and competence of the employees 2. Monitor the budget to the actual revenues and expenses. 3. Improves efficiency if the owner performs duties like signing cheques, assessing records, bank recs, examining AR, approving credit, etc.