Internal Control Flashcards
What does Vouching test?
- Tests Existence
- Starts with a record entry to source document that support the entry
- Backwards
With respect to signing checks - how are duties segregated?
Employees who prepare vouchers/invoices should not also have the authority to SIGN CHECKS
Tip - Remember this as an underlying theme with Segregation of Duties. The authority to make a payment should not also lie in the hands of those creating invoices/vouchers. Why? People commit fraud by setting up fake companies and basically paying themselves
With respect to custody of assets - how should duties be segregated?
Employees who have CUSTODY of assets should NOT also RECORD those assets
- Someone in charge of petty cash should not also control the petty cash records
- Treasury Department (custodians) should NOT have record keeping duties
- They control assets and should not be able to adjust any recording of those assets
What is required if a Material Weakness is identified?
- A written report to management is required
- Should be reported no later than 60 days after audit report release date
- If one or more material weaknesses is uncorrected at year-end- an Adverse Opinion on Internal Control must be given
- PCAOB Standard 4 is one in which management gathers evidence, including documentation that the material weakness no longer exists, and then prepares a written report so indicating. The auditors then plan and perform an engagement emphasizing the controls over the material weakness. The report issued indicates the auditor’s opinion that the material weakness “no longer exists” or “exists” as of the date of management’s assertion.
What is a Significant Deficiency?
- A significant deficiency is a deficientcy in IC that is less severe than a material weakness yet important engouh to merit attention by those in charge of governance
- More than a remote likelihood of material misstatement by more than an inconsequential amount
- A significant deficiency adversely affects a company’s ability to report in the financial statements according to GAAP
What must occur if a Significant Deficiency is identified?
- If a Significant Deficiency is identified- a written report to management required
- Report declaring that no significant deficiencies exist is not allowed
- Previous deficiencies reported that still exist should be reported again
- Should be reported no later than 60 days after the audit report release date
What is a Control Deficiency?
A control is not operating as intended
What must an auditor ask if using the work of third parties?
Are they competent?
Are they objective?
What must an auditor understand with respect to internal auditors?
- Internal auditors have two primary effects on the audit:
- (1) their existence and work may affect the nature, timing, and extent of audit procedures, and
- (2) CPAs may use internal auditors to provide direct assistance in performing procedures.
- The CPA should assess both the competence (auditors consider the quality of internal auditors’ working paper documentation, as well as educational level, professional experience, professional certification, audit policies, and practices regarding assignment, supervision and performance) and objectivity (assessed by considering organizational status within the company, and policies for assuring that internal auditors are objective with respect to the areas being audited; the recommendations made in the reports of internal auditors is an important method of judging the objectivity of internal audit)* *of internal auditors
- Responsibility for judgments about materiality or appropriateness of entries or estimates CAN NOT be shared with third parties like Internal Auditors
What is required in an examination of Internal Control under Sarbanes-Oxley?
- CEO/CFO must disclose deficiencies
- Management must provide assessment of Internal Controls
- Management must certify Financial Statements
What is the relationship between Internal Control and Substantive Testing?
- Has inverse relationship
- Stronger Internal Control results in LESS substantive testing
- Weaker Internal Control leads to MORE substantive testing
Revenue Cycles
- Assume that the firm’s sales personnel prepare sales orders for potential sales (many other possibilities, such as the customer filling out the sales order, are found in practice).
- The sale is approved by the credit department,
- the goods are shipped, and
- the billing department (a part of accounting) prepares a sales invoice (a copy of which becomes the customer’s “bill”).
- After the sales invoice is prepared, the sales journal, the general ledger, and the accounts receivable subsidiary ledger are posted.
- The customer pays the account with a check, and a remittance advice is enclosed to describe which invoice the check is paying. As a preventive control, two individuals open the mail which includes these customer remittances.
- The checks are listed and sent to the cashier who daily deposits them in the bank (recall that the checks should not go to the accounting department, as that would give the accounting department custody of assets [checks in this case] as well as recordkeeping responsibility).
- Another copy of the list of checks and the remittance advices is sent to accounting to be used to post the cash receipts journal, which is subsequently posted to the general and accounts receivable subsidiary ledgers.
Spending Cycle
- Assume that the purchase requisition is an internal document sent by the department in need of the supplies to the purchasing department.
- The purchasing department determines the proper quantity and vendor for the purchase and prepares a purchase order. One copy of the purchase order is sent to the vendor. Another copy is sent to the receiving department to allow receiving personnel to know that items received have been ordered; however, the copy of the purchase order sent to receiving will not have a quantity of items on it so as to encourage personnel to count the goods when they are received.
- When the goods are received, a receiving report is prepared by the receiving department and forwarded to the accounting department.
- A vendor’s invoice or “bill” is received by the accounting department from the vendor.
- When the accounting department has the purchase order, receiving report, and vendor’s invoice, the payment is approved and then recorded in the purchases journal since evidence exists that the item was ordered, received, and billed.
- A check and remittance advice is subsequently sent to the vendor in accordance with the terms of the sale.
- The purchase order, receiving report, and vendor’s invoice are stamped paid to prevent duplicate payments.
Spending Cycle
Which documents need to be present before payment is approved?
Purchase order, receiving report, vendor’s invoice.
The agreement of the vendor’s invoice with the receiving report and purchase order → indicate that the goods were ordered (purchase order), received (receiving report), and the company has been billed (vendor’s invoice)
IC report for FS Audit
Nonissuer/Non public
AU-C 265
Objective is to Communicate to those in charge with governance and management deficiencies in IC that in the auditor’s judgment, are sufficiently important to merit attention
- communication should be no later than 60 days after the report release date
- Test only the control you rely on
- Limited use statement
- No opinion - Disclaimer
- No need to communicate control deficiency to those charge with governance
- Definition of Material weakness
- Written report of NO material Weakness identified
- NO Written report of NO Significant deficiency identified
