Exam 2 - Chapter 10 - Internal control risk

Question 1

What are internal control systems?

• What three objectives do they ensure?

Answer 1

Policies and procedures designed to provide management with reasonable assurance of three objectives:

• Reliability of financial reporting
• Efficiency and effectiveness of operations
• Compliance with laws and regulations

Question 2

What are the responsibilities of managers for internal controls?

Answer 2

Management

• Establish and maintain internal control
• Section 404 requires management to publicly report on operating effectiveness

Question 3

What are the two key decisions (and their components) that alter maangement’s decisions in establishing internal controls?

Answer 3

Reasonable assurance

Company should develop I.C. that provide reasonable assurance for financial statements

Inherent limitations

• Size of entity (and acct staff)
• Collusion
• Management override

Question 4

What is collusion?

What is maangement override?

Answer 4

Collusion

An act of two or more employees work together to commit fraud.

Management override

management does not enforce internal controls and overrides system causing failure

Question 5

What are the responsibilities of auditors in regards to internal controls?

Answer 5

• Evaluate internal controls to assess risk and designing procedures (all companies)
• Evaluate effectiveness of internal controls (required for public; optional for private)
• Report on the internal control systems (public companies only

Question 6

What are the auditor’s objectives for understanding internal control?

Answer 6

Controls over reliability of financial reporting

Evaluate controls to maintain compliance to accounting methods

Controls over classes of transactions

prioritize internal controls on maintaining correct transaction types over maintaining correct balances

Question 7

What are the five Coso components of internal control?

Answer 7

Coso components: internal control framework put in place by management to increase assurance

1. Control environment
2. Risk assessment
3. Control activites
4. information and communication
5. Monitoring

Question 8

What is the control enviroment component of Coso framework?

Answer 8

Actions, policies, and procedures that reflect attitudes of top members of company on the importance of maintaining internal controls.

Question 9

What are the 6 subcomponents of the control environment of a company?

Answer 9

• Integrity and ethical values
• Commitment to competence (adequate staff)
• Board of director or audit committee participation
• Mangement’s philosphy and operating style
• Organizational structure
• Human resource policies and practices
  *

Question 10

Why are the board of directors important in maintaining adequate control environement?

Answer 10

• Separate from management and has responsibility to ensure mgmt. implements proper I.C.
• Regularly assess control
• Board should create audit committe to oversee financial reporting

Question 11

What is risk assessment component of COSO?

Answer 11

Management’s identification of areas of greater risk relevant to prep of financial statements.

steps:

1. MGMT identifies risk
2. assess significance (what accts of more likely) of possible risk
3. Assess likelihood of risk occuring
4. Develop actions to reduce risk

Question 12

What are the control activities factor of the COSO framework?

What are the five ‘general’ types of control activities?

Answer 12

Implementation of detailed policies and procedures to address and minimize risk.

Activity groups:

• Separation of duties
• Proper authorization of transactions/activities
• Adequate documents/records
• Physical control over assets and records
• Independent checks on performance

Question 13

What are some examples of adequate documentation and recordkeeping (control activites factor)?

Answer 13

• Prenumbered documents and records (like a check)
• Prepared at transaction time
• One form for multiple info
• Forms that encourage correct prep

Question 14

What is the information and communication factor of COSO framework?

Answer 14

Effective accounting and management information systems to record, process, and report transactions to maintain transaction-related objectives

• Controls integrated into system like firewalls,

Question 15

What is the monitoring factor of the COSO framework?

Who often performs this function?

Answer 15

Ongoing and periodic assessment of their controls system?

This function is often performed by the internal audit department of large companies.

Question 16

What is the process (four phases) for understanding internal control and assessing control risk?

Answer 16

For all companies

Phase 1 - obtain/document understanding of internal controls

Phase 2 - Assess control risk

For public companies

Phase 3 - Design and perform tests of controls

Phase 4 - Decide planned detection risk and substantive tests

Question 17

How do auditors go about gaining an understanding (phase I) of internal controls?

Answer 17

• Run a walkthrough with staff of how they go about recording transactions (usually done with specific transaction)

Obtain documentation:

• Narrative: written description of internal controls
• Flowchart: Sequential flow in organization
• Internal control questionnaire: Attempt to identify internal control deficiencies

Question 18

What is a control risk matrix and how does it work?

Answer 18

Organization tool to find deficiencies in controls:

• Identify audit objectives/risk as columns
• List all controls and deficiencies as rows

mark which controls and deficiencies affect audit objectives

Question 19

Control risk matrix identify control deficiencies.

• What are they?
• what are the types of deficiencies?

Answer 19

Key controls that are absent to mitigate risk and meet audit objectives

Types:

• Control deficiency: Design of control does not allow personnel to detect misstatements
• Significant deficiency: Important not material weakness
• Material weakness: Reasonable assurance that control will not prevent or detect material misstatement

Question 20

What are the five steps to identify control deficiencies?

Answer 20

1. Identify existing controls
2. Identify absence of key controls
3. Consider possibility of compensating controls
4. Decide whether significant or material
5. Determine potential misstatements that could arise

Question 21

What are compensating controls?

Answer 21

Less obvious control procedure that offsets risk in later process

Question 22

What are the procedures for tests of controls?

Answer 22

Not as significant

• Inquire of client personnel

Significant

• Examine documents, records, reports
• Reperform client procedures
• Observe control-related activities