CH 09

CHAPTER 9
The Study of the

Internal Control
and Assessment of
Control Risk
Copyright 2003 Pearson Education Canada Inc. 9-1
What is internal
control?

What is internal
control?
Internal control consists of the policies &
procedures established & maintained by
management to assist in orderly &
efficient conduct of business.

Internal control is a process designed to
provide reasonable assurance regarding
the achievement of managements ob-
jectives regarding:
- reliability of controls
Accounting Our records
Records are reliable!

the achievement of managements
objectives regarding:
- optimizing use of resources
Waste
jectives regarding:
- safeguarding of assets

jectives regarding:
- safeguarding of assets
- preventing & detecting fraud & error

Steps in audit planning
obtain
information perform
obtain
about preliminary
preplan background
clients legal analytical
information
obligations procedures
set
materiality, and understand
assess acceptable internal control
audit risk and and assess
inherent risk control risk

Steps in audit planning
obtain
information perform
obtain
about preliminary
preplan background
clients legal analytical
information
obligations procedures
Why is an
set understand-
materiality, and understand
internal control ing of internal
assess acceptable control im-
audit risk and and assess
inherent risk control risk portant?

Why is an
understanding
of internal
control
important?
Second Examination Standard:

A sufficient understanding of internal
control should be obtained to plan the audit.
Copyright 2003 Pearson Education Canada Inc. 9 - 10

Audit Risk has 3 components
which combine to make the
audit risk model:
audit inherent control detection
= x x
risk risk risk risk
the
risk that material
misstatements will not be
prevented or
detected by
internal controls

Key Internal Control Concepts
- internal control is the clients respon-
sibility and should be designed to help
the client attain goals

- internal control should provide rea-
sonable but not absolute assurance;
cost/benefit must be considered

- internal control should provide rea-
sonable but not absolute assurance;
cost/benefit must be considered
- internal control has inherent limita-
tions (e.g., misunderstandings, mis-
takes, fatigue, carelessness, collusion,
management override) Copyright 2003 Pearson Education Canada Inc. 9 - 14
What are the components of
internal control?

What are the elements of
internal control?
the control
environment

The control environment is the
actions, policies, and procedures that
reflect managements attitude regard-
ing controls and their importance.
All of these controls are unnecessary!

Factors related to the Control
Environment:

Factors related to the Control Environment:
- managements philosophy and operating style

Consider the following:
- their approach to taking and monitoring
business risk

- their attitude and actions toward financial
reporting

- their emphasis on meeting financial and
operating goals
...our bonuses
are based on net income.
We all want fat bonuses!
What can we do?

- board of directors & committees
The audit committee maintains communication
between the Board of Directors and internal and
external auditors.
internal BOARD OF
auditors DIRECTORS
audit
committee
external
auditors

- organizational structure
The auditor should consider lines of
responsibility and authority.

- assignment of authority and responsibility
What are the
formal methods that
management uses to communicate
internal controls to
employees?
Job
Description
Company Employee
Memo: Policies Handbook

- managements control methods
Do managements
methods send a clear
message about the
importance of
control?

- managements control methods
Do managements Do manage-
methods send a ments methods
clear message serve to detect
about the misstatements?
importance of
control?

- systems development methodology
Does management have a

methodology for developing
and modifying systems and
procedures?

- personnel policies and practices
Management should ensure that compe-
tent, trustworthy, motivated personnel are
employed to meet
client goals and
objectives.
Employees are the critical component of

effective internal control.
Employees are the critical com-
ponent of effective internal control.
With competent, trustworthy, motivated per-

sonnel, even a poorly designed system of
internal control may function adequately.
With competent, trustworthy, motivated per-
sonnel, even a poorly designed system of
internal control may function adequately.
Without such personnel, even a well-

designed system will probably fail.
- managements reaction to external

influences
Is management aware of external

influences such as changes in the
economy and technology?

- internal audit
Does an internal audit
department exist? Does
it effectively monitor
control policies
and procedures,
and enhance
operational
effectiveness
and efficiency?

- internal audit
Does an internal audit Does internal

department exist? audit assist the
Does it? external auditors
and reduce audit
fees?

internal control?
control
systems

internal control?
accounting
systems
Accounting systems have several

subcomponents - classes of
transactions
What are the components of
internal control?
control
procedures

control
procedures
Control procedures are policies and pro-

cedures, in addition to those related to
other components, established to enable
the entity to address risks in the
achievement of their objectives.
Categories of Control
Procedures

Procedures
1. Adequate segregation of duties
- separate custody of assets from
accounting
The Controller

Procedures
- separate custody of assets from
authorization of transactions
As custodian of
the corporate auto
fleet, I hereby
#43 authorize retire-
ment of auto #43
because of obso-
lescence. Joe

Procedures
- separate operational responsibility
from record keeping responsibility
Example: Ace company has two plants; one in

Great Britain and one in Canada. Manage-
ment is deciding whether the plant controllers
should report directly to the plant managers
or the corporate vice president of finance.
V.P.- V.P.-
production finance
plant plant
manager manager
plant plant
controller controller
Which arrangement creates a potential conflict of interest?
V.P.- V.P.-
production finance
plant
plant manager
manager
plant
plant
plant controller
controller
controller Copyright 2003 Pearson Education Canada Inc. 9 - 43
V.P.- V.P.-
production finance
plant plant
manager manager
plant plant
controller controller
Which arrangement creates a potential conflict of interest?
If the plant controller reports directly to the

plant manager, a potential conflict of interest
exists. In an effort to make that plants results
appear favourable, the plant manager may at-
tempt to influence the plant controller.
Procedures
- separate duties within EDP

What kind of company typically has
difficulty accomplishing adequate
segregation of duties?

What kind of company typically has
difficulty accomplishing adequate
segregation of duties?
Small companies frequently have diffi-

culty with segregation of duties because
of fewer employees and cost constraints.

What is collusion?

What is collusion?
Collusion is the defeat of adequate
separation of duties wherein
Employees cooperate to perpetrate fraud.
...were agreed.
Well be rich be-
yond our wildest
dreams!
What is the most effective way to
prevent collusion?

What is the most effective way to
prevent collusion?
Hire competent, trustworthy,
motivated personnel.

Why is collusion particularly
troublesome for auditors?

Why is collusion particularly
troublesome for auditors?
Competent, untrustworthy, motivated
personnel often
know how to
conceal their
fraud.

Procedures
2. Proper authorization of transactions
and activities

Procedures
and activities
- general authorization - management
establishes authorization policies
accounts
cash personnel
payable
receipts policies &
policies & policies & procedures
procedures procedures

Procedures
and activities
- specific authorization - management
makes authorizations on a case-by-
case basis. Im the
president and
I want to
approve
every cash
payment!
Procedures
and activities
3. Adequate documents and records
should provide reasonable assurance
that all assets are properly controlled
and all transactions are correctly
recorded.

PURCHASE ORDER 32494
WAIT FOREST Date:
MUa n
N uI f Va cEt R
u rSi nI gT Y Vendor:
234 Reynolds Rd.
Winnipeg, MB R2V 4E3
Purchasing agent: Document
Quantity Description Price
Guidelines
Documents
should be:
total cost of order
Est. shipment date:
prenumbered
Terms of sale (including discounts and freight and
costs):
Carrier: accounted
for
Internal Use Only: (routing instructions)
1.PO made in purchasing 3. receiving notes ship
2.Copies to vendor, receiv. 4. acctg. reconciles
WAIT FOREST Date:
M
U aNnu
I fVa E
ct ur
R iSnIg T Y Vendor:
234 Reynolds Rd.
Document
Purchasing agent:
Guidelines
Documents
should be:
prepared
total cost of order
during or
Est. shipment date:
Terms of sale (including discounts and freight soon after the
costs):
Carrier:
related
transaction
WAIT FOREST Date: Document
M
U a
N nI uVf E
a cR t Su Ir iT nYg Vendor:
234 Reynolds Rd.
Guidelines
Purchasing agent: Documents
should be:
understand-
able and
total cost of order correctly
Est. shipment date:
Terms of sale (including discounts and freight designed
costs): (including
Carrier:
routing and
authorization)
b a PURCHASE ORDER 32494
c WAIT FOREST Date:
M
U aNn Iu V
f aEc tRu Sr iInTg Y Vendor:
234 Reynolds Rd.
Winnipeg, MB R2V 4E3 Document
Purchasing agent: Guidelines
Documents
should be:
designed
total cost of order for
Est. shipment date: multiple
Terms of sale (including discounts and freight
costs):
purposes
Carrier:

Procedures
and activities
4. Adequate safeguards over assets and
records - physical: locking rooms,
fenced areas, fireproof safes, safe
deposit boxes, security guards;
access; backup files and recovery

Procedures
and activities
4. Adequate safeguards over assets and
records
5. Independent, continuous checks on
performance - those reviewing
performance should be independent
of those performing a task
Procedures
5. Independent checks on performance
Segregation of duties is the least

expensive method of performing
independent checks.
The accounting information and
communication system should be
designed to satisfy audit objectives.

designed to satisfy audit objectives:
- existence - the system should ensure
that recorded transactions exist - no
fictitious transactions

- existence
- completeness - the system should en-
sure that all existing transactions are
recorded

- existence
- completeness
How do the existence and completeness

objectives differ?

objectives differ?
Existence con-
cerns the existence of
fictitious data; i.e., overstatement.

objectives differ?
Completeness concerns omission

of information; i.e., under-
Existence con-
statement.
cerns the existence of
fictitious data; i.e., overstatement.

- existence
- completeness
- accuracy - the system should ensure
that recorded transactions are stated
at the correct amounts

- existence
- completeness
- accuracy
- classification - the system should en-
sure that transactions are properly
classified, possibly through use of a
chart of accounts.

- existence
- completeness
- accuracy
- classification
- timing - the system should ensure that
transactions are recorded on the cor-
rect dates. Generally, transactions
should be recorded during or shortly
after their occurrence.
designed to satisfy audit
- existence objectives:
- completeness
- accuracy
- classification
- timing
- posting and summarization -the system
should ensure that transactions are
included in the accounting records and
accurately summarized.
Monitoring activities deal with
ongoing or periodic assessment
of internal control.
Internal auditing departments
frequently perform monitoring
activities.

internal control?
the control accounting

environment systems
control procedures
Control
Examina-
tion
Overview Obtain an understanding
of internal control.
HOW?
Control Obtain an understanding
Examina- of internal control.
tion - review prior years
Overview working papers
- interview prior year
auditors
- interview client
personnel
- study client policies and
procedures
- study client documents,
records, information and
communication system

Control
Examina-
tion
Overview
How do auditors
document their under-
standing of internal
control?

Control
How do auditors
Examina-
document their under-
tion
standing of internal
Overview
control?
- narratives
- flowcharts
- internal control
questionnaires

How do auditors
Control document their under-
Examina- standing of internal
tion control?
Overview
- narratives
- flowcharts
- internal control
questionnaires
What is an
internal control
questionnaire?

Internal Control Questionnaire
- a series of questions about internal
controls and their application to groups
of accounts and cycles

Internal Control
Questionnaire
- generally, a no answer indicates an
internal control weakness

- generally, a no answer indicates an
internal control weakness
What are the

advantages provided by
an IC questionnaire?
What are the
advantages provided by
- can be designed to cover most aspects
of internal control
- is relatively applicable from one en-
gagement to another
- when complete, can be quickly re-
viewed for weaknesses
What are the

disadvantages of using

What are the
disadvantages of using
- concentrates on pieces of internal con-
trol rather than the system as a whole
- has questionable reliability; oral cli-
ent responses should be supported
by other evidence
- may be too standardized for some
clients, especially smaller clients
Control
Examina-
tion Are
Overview financial statements
auditable?

Control
Examina-
tion Are
auditable?
When would the

answer be NO?

Control
Examina-
tion Are
auditable?
When would the

answer be NO?
- management lacks
integrity
- significantly deficient
accounting records or
internal controls
Control
Examina-
tion
Overview
Assess control risk, based
on understanding.

Control
Examina-
tion Assess the cost/benefit of
Overview further enhancing under-
standing of internal control.

Control
Examina-
tion
Overview
Assess
control
max. support low risk.

Control
Examina-
tion
Overview
Assess
control
max. support low risk.
- maximum:
poor controls indicate
a very risky situation
or more efficient to do
100% substantive audit

Control Assess
Examina-
tion
control
Overview risk.
- maximum:
poor controls indicate
a very risky situation or
max. support low not efficient
- supportable:
risk is at a level
supported by
understanding obtained

Control Assess
Examina-
tion
control
Overview risk.
- supportable:
max. support low risk is at a level
supported by
understanding obtained
- low:
effective controls indi-
cate a lower level of risk
that could be supported

Control
Examina-
tion
Overview
Plan & perform tests of controls.

Control
Examina-
tion
Overview
Decide
whether the initial
internal control assessment
was appropriate.

Control
Examina-
tion
Overview
Based on appropriate
level of detection risk,
perform substantive tests.
When should weaknesses be
reported to the client?

When should weaknesses be
reported to the client?
When there are significant
deficiencies in the design or
operation of internal control.

Significant deficiencies
in the design or operation of
internal control.
GAAS requires the

auditor to communicate
(oral or written) with the
audit committee
regarding the significant
deficiencies.

CH 09

Enviado por

Dados do documento

Título original

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

CH 09

Enviado por

Direitos autorais:

Formatos disponíveis

CHAPTER 9

The Study of the

Copyright 2003 Pearson Education Canada Inc. 9-2

Copyright 2003 Pearson Education Canada Inc. 9-3

Copyright 2003 Pearson Education Canada Inc. 9-4

Copyright 2003 Pearson Education Canada Inc. 9-6

Copyright 2003 Pearson Education Canada Inc. 9-7

Copyright 2003 Pearson Education Canada Inc. 9-8

Copyright 2003 Pearson Education Canada Inc. 9-9

Second Examination Standard:

Copyright 2003 Pearson Education Canada Inc. 9 - 10

Copyright 2003 Pearson Education Canada Inc. 9 - 11

Copyright 2003 Pearson Education Canada Inc. 9 - 12

Copyright 2003 Pearson Education Canada Inc. 9 - 13

Copyright 2003 Pearson Education Canada Inc. 9 - 15

Copyright 2003 Pearson Education Canada Inc. 9 - 16

All of these controls are unnecessary!

Copyright 2003 Pearson Education Canada Inc. 9 - 17

Copyright 2003 Pearson Education Canada Inc. 9 - 18

Copyright 2003 Pearson Education Canada Inc. 9 - 19

Copyright 2003 Pearson Education Canada Inc. 9 - 20

Copyright 2003 Pearson Education Canada Inc. 9 - 21

Copyright 2003 Pearson Education Canada Inc. 9 - 22

Copyright 2003 Pearson Education Canada Inc. 9 - 23

Copyright 2003 Pearson Education Canada Inc. 9 - 24

Copyright 2003 Pearson Education Canada Inc. 9 - 25

Copyright 2003 Pearson Education Canada Inc. 9 - 26

Copyright 2003 Pearson Education Canada Inc. 9 - 27

- systems development methodology

Does management have a

Copyright 2003 Pearson Education Canada Inc. 9 - 28

Employees are the critical component of

With competent, trustworthy, motivated per-

Without such personnel, even a well-

- managements reaction to external

Is management aware of external

Copyright 2003 Pearson Education Canada Inc. 9 - 32

Copyright 2003 Pearson Education Canada Inc. 9 - 33

Does an internal audit Does internal

Copyright 2003 Pearson Education Canada Inc. 9 - 34

Copyright 2003 Pearson Education Canada Inc. 9 - 35

Accounting systems have several

Copyright 2003 Pearson Education Canada Inc. 9 - 37

Control procedures are policies and pro-

Copyright 2003 Pearson Education Canada Inc. 9 - 39

Copyright 2003 Pearson Education Canada Inc. 9 - 40

Copyright 2003 Pearson Education Canada Inc. 9 - 41

Example: Ace company has two plants; one in

Which arrangement creates a potential conflict of interest?

If the plant controller reports directly to the

Copyright 2003 Pearson Education Canada Inc. 9 - 45

Copyright 2003 Pearson Education Canada Inc. 9 - 46

Small companies frequently have diffi-

Copyright 2003 Pearson Education Canada Inc. 9 - 47

Copyright 2003 Pearson Education Canada Inc. 9 - 48

Copyright 2003 Pearson Education Canada Inc. 9 - 50

Copyright 2003 Pearson Education Canada Inc. 9 - 51

Copyright 2003 Pearson Education Canada Inc. 9 - 52

Copyright 2003 Pearson Education Canada Inc. 9 - 53

Copyright 2003 Pearson Education Canada Inc. 9 - 54

Copyright 2003 Pearson Education Canada Inc. 9 - 55

Copyright 2003 Pearson Education Canada Inc. 9 - 57

Internal Use Only: (routing instructions)