Internal Control Flashcards
Control risk increases with poor Internal Controls and sloppy accounting practices.
Internal Control
Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.
Internal Control
Internal control provides reasonable assurance that
Material misstatements will be prevented
Reliability/integrity of financial statements will be preserved
Assets are protected against misuse
Internal Control
CEO/CFO must disclose Internal Control deficiencies
Management must provide assessment of Internal Control
Management must certify Financial Statements
Internal Control
Inverse Relationship
Stronger Internal Controls - Less Testing Needed
Weaker Internal Controls - More Testing Needed
Internal Control
Reliability of Financial Reporting
Operational Efficiency/Effectiveness
Compliance with Law and Regulations
Internal Control
Control Environment
Risk Assessment
Information and Communication
Monitoring
Control Activities
Internal Control
Sets tone for the entire company
Internal Control
Integrity/Ethics of Management
Competence of Management
Organizational Structure
Human Resource Policies
Assignment of Authority/Responsibility
Management’s Style (riskier with a dominant/aggressive individual)
Board/Audit Committee involvement
Internal Control
Detection Risk determines nature- timing- and extent of audit procedures.
Internal Control
Risk of material misstatement determines acceptable level of Detection Risk
Internal Control
Rapid growth in the company.
The methods management uses to identify risk- estimate its significance and assess the likelihood of occurrence
Major changes to operations- personnel- systems- IT- products- corporate organization- and foreign operations.
Internal Control
No Internal Control testing is performed.
All audit procedures are increased in intensity to compensate for increased risk.
Internal Control
Auditor tests Internal Controls.
Auditor evaluates Control Risk based on tests
Auditor adjusts substantive tests accordingly
Weaker Internal Control - More substantive tests
Stronger Internal Control - Less substantive tests
Internal Control
Performance Reviews
Information Processing
Physical Controls
Segregation of Duties
Internal Control
Understand Client’s
Major transaction classes
Transaction initiation
Support records/documents
Transaction processing
Financial Statement internal reporting process
Financial Statement external reporting process
Internal Control
Through written documentation such as Internal Control memos- flowcharts- and questionnaires
Internal Control
Were all transactions recorded?
Were they timely?
Measured appropriately?
Recorded in correct period?
Presented and disclosed properly?
Did Management communicate their responsibilities?
Internal Control
Auditor needs reasonable assurance that controls are functioning as designed and effective
Internal Control Testing should be strong as (IRON) so that nothing gets past them
Inquiry - Interview company personnel
Re-performance - Can it be replicated?
Observation - Watch the control be applied
INspection - Dig into the details/documents
If results are as expected- substantive procedures do not need to be adjusted
Internal Control
Controls tested by auditor in a prior year can be used in the current year’s audit assuming they are re-tested every third year
Exception If the control has changed since the last audit
Internal Control
Control Risk increases
Scope of substantive procedures increases
Detection Risk decreases
Material Weakness - Reasonable possibility that a material misstatement in Financial Statements would not be found- more than a remote chance of occurrence
Internal Control
Reasonable possibility exists that a material misstatement in Financial Statements would not be found- and has more than a remote chance of occurrence.
Internal Control
Tests Completeness
Starts with source document and traces forward to the journal entry.
Internal Control
Tests Existence.
Starts with a journal entry and searches for a voucher or source document to support the entry.
Internal Control
Non-compatible duties performed by separate individuals- such as
Authorization of asset disbursement vs. Recording of Assets vs. Custody of assets
If supporting audit evidence doesn’t exit - use Observation and Inquiry
Accounting should be segregated from Production
Internal Control
Employees who prepare vouchers/invoices should not also have the authority to SIGN CHECKS
Tip - Remember this as an underlying theme with Segregation of Duties. The authority to make a payment should not also lie in the hands of those creating invoices/vouchers. Why? People commit fraud by setting up fake companies and basically paying themselves
Internal Control
Employees who have custody of assets should not also RECORD those assets
Someone in charge of petty cash should not also control the petty cash records
Treasury Department (custodians) should NOT have record keeping duties
They control assets and should not be able to adjust any recording of those assets
Internal Control
Controls can’t stop collusion or bad judgment
Management can override controls
Cost vs. Benefit relationship of Internal Control
Internal Control
A written report to management is required.
Report declaring that no material weaknesses were found is allowed
Previous weaknesses reported that still exist should be reported again
Should be reported no later than 60 days after audit report release date
If one or more material weaknesses is uncorrected at year-end- an Adverse Opinion on Internal Control must be given
Internal Control
A significant deficiency adversely affects a company’s ability to report in the financial statements according to GAAP.
A significant deficiency is a more than a remote likelihood of material misstatement by more than an inconsequential amount
Internal Control
If a Significant Deficiency is identified- a written report to management required
Report declaring that no significant deficiencies exist is not allowed
Previous deficiencies reported that still exist should be reported again
Should be reported no later than 60 days after the audit report release date
Internal Control
A control is not operating as intended.
Internal Control
Are they competent?
Are they objective?
Internal Control
Auditor needs to understand the role of Internal Auditors within the organization because their work affects the audit plan
Responsibility for judgments about materiality or appropriateness of entries or estimates cannot be shared with third parties like Internal Auditors
Internal Auditors should be asked to do some of the legwork like preparing schedules or running reports
They should not be asked to make any decisions or judgments
Internal Control
CEO/CFO must disclose deficiencies
Management must provide assessment of Internal Controls
Management must certify Financial Statements
Internal Control
Has inverse relationship
Stronger Internal Control results in LESS substantive testing
Weaker Internal Control leads to MORE substantive testing
Internal Control
Reliability of Financial Reporting
Operational Efficiency/Effectiveness
Compliance with Law and Regulations
Internal Control
Control Activities
Risk Assessment
Information and Communications
Monitoring
Control Environment
Internal Control
Integrity/Ethics of Management
Competence of Management
Organizational Structure
Human Resources Policies
Assignment of Authority/Responsibility
Management’s Style (riskier with a dominant/aggressive individual)
Board/Audit Committee involvement
Internal Control
Auditor tests Internal Controls.
Auditor evaluates Control Risk based on tests
Auditor adjusts substantive tests accordingly
Weaker Internal Control - More substantive tests
Stronger Internal Control - Less substantive tests
Internal Control
Understand Client’s
Major transaction classes
Transaction initiation
Support records/documents
Transaction processing
Financial Statement internal reporting process
Financial Statement external communication process
Internal Control
Auditor must document understanding of Internal Control via Memos - Flowcharts - Questionnaires
Internal Control
Auditor needs reasonable assurance that controls are functioning as designed and effective
Internal Control Testing should be strong as (IRON) so that nothing gets past them
Inquiry - Interview company personnel
Re-performance - Can it be replicated?
Observation - Watch the control be applied
INspection - Dig into the details/documents
If results are as expected - substantive procedures do not need to be adjusted
Internal Control
