INTERNAL CONTROL

Elements and Basic

Considerations

NATURE OF INTERNAL CONTROL

Internal control is the (1) process designed and
(2) effected by those charged with governance,
management, and other personnel to (3) provide
reasonable assurance about the (4) achievement of
the entitys objectives with regard to reliability of
financial reporting, effectiveness and efficiency of
operations and compliance with applicable laws and
regulations.

COMPONENTS OF INTERNAL
CONTROL
1. Control Environment
2. Risk Assessment
3. Information and Communication
System
4. Control Activities
5. Monitoring

THE CONTROL ENVIRONMENT

Factors reflected in the control environment
include:
Integrity and ethical values
Active participation of those charged with
governance
Commitment to competence
Personnel policies and procedures
Organizational Structure

RISK ASSESSMENT
The auditor should obtain an understanding of the
entitys process for identifying business risks
relevant to financial reporting objectives and
deciding about actions to address those risks, and
the results thereof.

THE INFORMATION AND

COMMUNICATION SYSTEM

The information system relevant to financial

reporting objectives, which includes the
accounting system, consists of the procedures
and records established to initiate, record,
process, and report entity transactions (as well
as events and conditions) and to maintain
accountability for the related assets, liabilities,
and equity.

CONTROL ACTIVITIES
The auditor should obtain a sufficient understanding of
control activities to assess the risks of material
misstatement at the assertion level and to design
further audit procedures responsive to assessed risks.
Examples of specific control activities include those
relating to the following:
1. Performance reviews.
2. Information processing.
3. Physical controls.
4. Segregation of duties.

MONITORING
The auditor should obtain an understanding of the
major types of activities that the entity uses to
monitor internal control over financial reporting,
including those related to those control activities
relevant to the audit, and how the entity initiates
corrective actions to its controls.

INTERNAL CONTROL FOR A

SMALL BUSINESS
Smaller entities ordinarily do not have formal
processes to measure and review the entitys
financial performance.

CONSIDERATION OF INTERNAL
CONTROL
Consideration of the entitys internal control system
involves:
1. Obtaining an understanding of the internal control
2. Document the understanding of accounting and
internal control systems
3. Assess the level of control risk
4. Perform test of controls
5. Document the assessed level of control risks

OBTAINING AN UNDERSTANDING OF
THE INTERNAL CONTROL
Obtaining an understanding of internal control
involves evaluating the design of a control and
determining whether it has been implemented.

DOCUMENT THE UNDERSTANDING OF

ACCOUNTING AND INTERNAL CONTROL
SYSTEMS
The form and extent of this documentation is influenced
by the nature, size and complexity of the entity and its
internal control, availability of information from the entity
and the specific audit methodology and technology used
in the course of the audit.

ASSESS THE LEVEL OF

CONTROL RISK
The auditors assessment of the identified risks at the
assertion level provides a basis for considering the appropriate
audit approach for designing and performing further audit
procedures.
The auditors selection of audit procedures is based on the
assessment of risk. The higher the auditors assessment of
risk, the more reliable and relevant is the audit evidence
sought by the auditor from substantive procedures.

PERFORM TEST OF CONTROLS

The auditor is required to perform tests of controls when the auditors
risk assessment includes an expectation of the operating effectiveness
of controls or when substantive procedures alone do not provide
sufficient appropriate audit evidence at the assertion level.
Generally consists:
Inquiry
Observation
Inspection
Reperformance

o Timing of Test of Controls

The timing of tests of controls depends on the auditors
objective and determines the period of reliance on those
controls.
o Extent of Test of Controls
The auditor designs tests of controls to obtain sufficient
appropriate audit evidence that the controls operated effectively
throughout the period of reliance.

DOCUMENT THE ASSESSED

LEVEL OF CONTROL RISKS
The auditor should document the overall responses to
address the assessed risks of material misstatement at
the financial statement level and the nature, timing, and
extent of the further audit procedures, the linkage of
those procedures with the assessed risks at the assertion
level, and the results of the audit procedures.

COMMUNICATION OF INTERNAL
CONTROL WEAKNESSES
The auditor should make those charged with
governance or management aware, as soon as
practicable, and at an appropriate level of
responsibility, of material weaknesses in the design or
implementation of internal control which have come to
the auditors attention.