Week 6

Question 1

Internal control defined

Answer 1

Internal control encompasses the entity’s resources, systems, processes, culture, structure and tasks.
When controls are effective, the entity is more likely to achieve its strategic and operating objectives.
The auditor focuses on controls with a direct impact on the entity’s financial reporting, compliance and asset safeguarding (ASA 315; ISA 315).

Question 2

AUASB Glossary

Internal Control

Answer 2

‘Internal control is the process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations’

Question 3

Objectives of internal controls

Answer 3

Real

Recorded

Valued

Classified

Summarised

Posted

Timely

Question 4

Real

Answer 4

Real – that is no fictitious or duplicated transactions

Assertions tested – occurrence, rights and obligations and existence.

Question 5

Recorded

Answer 5

Recorded – that is to prevent or detect omissions of transactions.
Assertions tested – accuracy, completeness, valuation and allocation.

Question 6

Valued

Answer 6

Valued – that is correct amounts assigned to transactions.

Assertions tested – accuracy, valuation and allocation.

Question 7

Classified

Answer 7

Classified – that is transaction are charged to the correct account.
Assertions tested – accuracy, valuation and allocation, classification.

Question 8

Summarised

Answer 8

Summarised – that is transactions must be summarised and totalled correctly.
Assertions tested – accuracy, valuation and allocation.

Question 9

Posted

Answer 9

Posted – accumulated totals in transaction file are correctly transferred to general and subsidiary ledgers.
Assertions tested – accuracy, classification, valuation and allocation.

Question 10

Timely

Answer 10

Timely – that is transactions are recorded in the correct accounting period.
Assertions tested – cut-off and completeness.

Question 11

3 auditor Objectives of internal controls

Answer 11

Auditor aims to gain an understanding of how the client uses internal controls to meet these objectives.
Focusing on these objectives helps auditor select controls for testing to gain greatest assurance that controls are operating effectively.
Failure of an entity’s controls to meet any of these objectives is a weakness in internal control.

Question 12

All internal control systems have inherent limitations:

Answer 12

Human error that results in control breakdown.
Ineffective understanding of control’s purpose.
Collusion by two or more individuals to avoid control.
Software program control being overridden, disabled.
Management decisions about nature and extent of controls being implemented.

Question 13

Entity level internal controls potentially impact all entity processes.
Comprises:

Answer 13

1. control environment
2. entity’s risk assessment process
3. IT and communications systems
4. control activities
5. monitoring of controls.

Question 14

The control environment

Answer 14

Culture, structure and discipline of an entity.
Communication and enforcement of integrity and ethical values.
Commitment to competence.
Participation by those charged with governance.
Management’s philosophy and operating style.
Organisational structure, including IT.
Assignment of authority and responsibility.
Human resource policies and practices.

Question 15

The entity’s risk assessment process:

Answer 15

How does the entity identify and respond to business risks?
Auditor is interested in how management identify, analyse and manage risks relevant to financial reporting, and how the risks might impact the audit

Question 16

Information systems and communication:

Answer 16

Designed to capture and provide information to conduct, manage and control entity’s operations.
Includes manual and automated systems.
Auditor is interested in systems relevant to financial reporting.

Question 17

Control activities:

Answer 17

Policies and procedures that help make sure management’s directives are carried out.
Performance review: actual vs budget and investigation of differences.
Information processing: manual or automated, to check accuracy, etc.
Physical control: security of assets and records.

Segregation of incompatible duties:
No one employee/group should be in position both to perpetrate a fraud and to cover it up.
Separate authorisation/custody/recording.

Question 18

When understanding client’s control activities, auditor considers:

Answer 18

Extent of reliance on IT.
Existence of necessary policies and procedures.
Extent to which control policies are being applied.
Clarity of management objectives for controls.
Existence of planning and reporting systems for performance and investigation of variance, and management action to follow-up.
Extent of segregation of duties.
Software controls over data and programs.
Periodic comparison between records and assets.
Safeguards over access to documents, records, assets.

Question 19

Monitoring of controls:

Answer 19

Does management monitor controls and modify as required when conditions change?
Ongoing monitoring procedures should be part of regular activities, e.g. internal audit function.
Auditor considers:
Are there periodical evaluations of internal controls?
Do client staff regularly obtain evidence of control functioning?
Extent to which information from external parties corroborate, or contradict, internal information.
Management act on audit recommendations, or respond to control difficulties on timely basis.

Question 20

Internal control in small entities:

Answer 20

Difficult to implement formal controls, segregate duties in small entities.
Reliance on owner-manager, heavily involved in daily business.
Auditor could increase substantive procedures to compensate for weaker controls.
Auditor must make overall assessment of effectiveness of entity-level controls.

Question 21

Transaction-level internal controls

Answer 21

These controls impact a particular transaction, or group of transactions.
They are aimed at preventing an error from entering the records, or detecting errors that do enter the records.
Controls are considered for transaction processes or flows, for example:
sales process
cost of sales process.

Question 22

When gaining an understanding of the transaction processes, the auditor:

Answer 22

Identifies major events and transactions in the process.
Identifies risks to correct processing of the transactions:
What Can Go Wrong? (WCGWs).
For each WCGW, auditor identifies one or more controls.
This understanding is documented and used to guide evaluation and testing of internal controls.

Question 23

Common forms of documenting controls:

Answer 23

Narratives

Flowcharts

Combination of flowchart and narrative:

Checklists and preformatted questionnaires:

Question 24

Narratives

Answer 24

Very useful when controls simple, straightforward.

Auditor uses words to describe each step of transaction from start to finish.

Question 25

Flowcharts

Answer 25

Useful for more complex controls – keep chart simple.

Conveys information visually.

Question 26

Combination of flowchart and narrative:

Answer 26

Use both techniques side-by-side.

Narrative used to explain details.

Question 27

Checklists and preformatted questionnaires:

Answer 27

Helps identify most common controls that should be present.

Useful for less experienced auditors.

Question 28

After documentation, auditor must assess control system:

Answer 28

Identify weaknesses that have financial reporting impact.
Draw conclusions about control risk.
Significant levels of professional judgement are required when deciding whether an internal control observation (individually or in combination with others) is relevant to the audit and should be tested.

Question 29

ASA260

Answer 29

ASA260 requires auditors to provide those charged with governance with timely observations arising from the audit that are significant and relevant to their responsibility to oversee the financial reporting process, and to promote effective two-way communication between the auditor and those charged with governance.

Question 30

Management letters

Answer 30

The auditor needs to communicate issues of governance interest as soon as practicable, and at an appropriate level of responsibility, including significant (or material) weaknesses in the design or implementation of internal control.
It is for these key reasons that the auditor prepares what is often called a management letter.
Letter from the auditor to the client, recommendations based on internal control assessment findings and other matters (ASA 260; ISA 260, and ASA 265; ISA 265).
Professional judgment required about which matters to include in letter.
Allows management to document their actions in response, and inform those charged with governance.
Often use interim and final management letters.