Internal Control Flashcards
If Internal Control is poor and a company’s accounting practices are sloppy - which risk is higher?
Control risk increases with poor Internal Controls and sloppy accounting practices.
If Internal Control is poor - what is the effect on the audit?
Auditor will need to perform more testing and dig deeper into accounts in order to arrive at an opinion regarding the financial statements.
What does Internal Control provide reasonable assurance for?
Internal control provides reasonable assurance that:
Material misstatements will be prevented or detected
Reliability/integrity of financial statements will be preserved
Assets are protected against misuse
What is required in an audit of Internal Control under Sarbanes-Oxley?
Management must provide its assessment of Internal Control
auditor is required to audit internal control and express an opinion on the effectiveness of IC
What are the 3 objectives of Internal Control?
Reliability of Financial Reporting
Operational Efficiency/Effectiveness
Compliance with Law and Regulations
What are the 5 components of Internal Control?
Control Activties
Risk Assessment
Information and Communication
Monitoring
Control Environment
What is the purpose for a Control Environment assessment?
Sets tone for the entire company
Establishes the overall attitude, awareness and actions
What are the components of the Control Environment?
Philisophy of Mgt Humaran resources Reporting capabilities/competencies Authoirity and responsibility Structure of the organization Ethical values and integrity Directors (Board of) participation
What happens when Control Risk is assessed to be at the maximum level?
Controls not operating effectively
RMM is increased
Internal Control not tested
Extensive substantive testing at year end
What happens when Control Risk is below the maximum level?
Auditor tests Internal Controls.
Auditor evaluates Control Risk based on tests
Auditor adjusts substantive tests accordingly
Weaker Internal Control - More substantive tests
Stronger Internal Control - Less substantive tests
Describe some common examples of Control Activities.
Performance Reviews
Information Processing
Physical Controls
Segregation of Duties
What should an auditor understand with respect to Information and Communication on an audit?
How the company records, processes, summarizes, and reports financial data through:
- effective information systems
- identify and record all valid transactions
- in the proper time period
- at the proper amounts
How must an auditor document understanding of Internal Control?
Through written documentation such as Internal Control memos- flowcharts- and questionnaires
What is the purpose of testing Internal Controls?
Auditor needs reasonable assurance that controls are functioning as designed and are effective
How often should controls be tested?
Controls should be tested at least every 3 years, if there have been no changes
If a control has changed from prior year, it should be tested in the current year audit
Controls mitigating significant risk should be tested annually
PCAOB does not permit rotational testing