Addthis Arens Chapter10

(1)

Section 404 Audits of Internal

Control and Control Risk

(2)

Learning Objective 1

Describe the three primary

objectives of effective

(3)

3. Compliance with laws and regulations

2. Efficiency and effectiveness of operations 1. Reliability of financial reporting

Internal Control Objectives

(4)

Learning Objective 2

Contrast management’s

responsibilities for maintaining

and reporting on internal controls

with the auditor’s responsibilities

for understanding, testing, and

(5)

Management and Auditor

Responsibilities Related

to Internal Control

_{Management’s responsibility}

for establishing internal control

_{Reasonable assurance}

(6)

_{Management’s Section 404}

reporting responsibilities

_{Design of internal control}

_{Operating effectiveness of controls}

Management and Auditor

Responsibilities Related

to Internal Control

(7)

Management and Auditor

Responsibilities Related

to Internal Control

_{Auditor responsibilities for}

understanding internal control

_{Control over classes of transactions} _{Controls over the reliability}

(8)

Sales Transaction-related Audit

Objectives

Sales Transaction-related Audit Objectives

Sales are for shipments to existing customers

Transaction-related Audit Objective – General form

Recorded transactions exist (occurrence)

Existing sales transactions are recorded

Existing transactions are recorded (completeness)

(9)

Sales Transaction-related Audit

Objectives

Transactions are correctly classified (classification)

Sales transactions are correctly classified

Transactions are recorded Sales are recorded on

Sales Transaction-related Audit Objectives

Transaction-related Audit Objective – General form

Transactions are correctly filed (posting and

summarization)

(10)

Learning Objective 3

Explain the five components

of the COSO internal

(11)

Five Components of Internal

Control

Risk

(12)

The Control Environment

_{Integrity and ethical values}

_{Commitment to competence}

_{Board of directors or audit}

(13)

The Control Environment

_{Management’s philosophy and operating style}

_{Organizational structure}

(14)

Risk Assessment

_{Identify factors that may increase risk}

_{Assess the likelihood of the risk occurring}

(15)

Control Activities

1. Adequate separation of duties

2. Proper authorization of transactions and activities

3. Adequate documents and records

(16)

Adequate Separation of Duties

Custody of assets Accounting

Authorization of transactions

The custody of related assets

(17)

Proper Authorization of

Transactions and Activities

_{General authorization}

(18)

Adequate Documents and

Records

_{Prenumbered consecutively}

_{Prepared at the time of transaction}

_{Designed for multiple use}

(19)

Physical Control Over Assets

and Records

The most important type of protective measure for safeguarding assets and

(20)

Independent Checks on

Performance

(21)

Information and Communication

The purpose of an accounting information and communication system is to…

initiate, record, process, and report

(22)

Monitoring

Monitoring activities deal with management’s ongoing and periodic assessment of the

quality of internal control performance…

(23)

SEC and COSO Focus on

Smaller Public Companies

The SEC has extended the deadline for small public companies compliance

with Section 404 requirements.

COSO issued guidance in Internal Control Over Financial Reporting for Smaller

(24)

Learning Objective 4

Obtain and document an

(25)

Process for Understanding Internal

Control and Assessing Control Risk

Obtain an

understanding of internal control: design

and operation

Assess control risk

Design, perform, and evaluate tests of

controls Phase 1

Phase 2

(26)

Obtain and Document Understanding

of Internal Control

Auditing standards require auditors to obtain an understanding of internal control for every audit.

Procedures to obtain an understanding:

(27)

Methods Used

Narrative

Flowchart

Internal control

(28)

Narrative

1. The origin of every document and record in the system

2. All processing that takes place

3. The disposition of every document and record in the system

(29)

Evaluating Internal Control

Operation

_{Update and evaluate auditor’s previous}

experience with the entity

_{Make inquiries of client personnel}

_{Examine documents and records}

_{Observe entity activities and operations}

(30)

Learning Objective 5

Assess control risk by linking key

controls, significant deficiencies,

and material weaknesses to

transaction-related audit

(31)

Assess Control Risk

Assess whether the financial statements are auditable.

Determine assessed control risk supported by the understanding obtained assuming the controls are being followed.

(32)

Control Risk Matrix

Many auditors use the control risk matrix

(33)

Control Risk Matrix

_{Identify audit objectives}

_{Identify existing controls}

_{Associate controls with related audit objectives}

_{Identify and evaluate control deficiencies,}

(34)

Evaluating Significant Control

(35)

Identify Deficiencies and

Weakness

_{Identify existing controls}

_{Identify the absence of key controls}

_{Consider the possibility of compensating controls}

_{Decide whether there is a significant deficiency}

(36)

Communications

_{Management letters}

_{Communications to those}

(37)

Learning Objective 6

Describe the process of designing

(38)

Tests of Controls

The procedures to test effectiveness of controls in support of a reduced assessed control

(39)

Procedures for Tests of Controls

1. Make inquiries of client personnel

2. Examine documents, records, and reports

3. Observe control-related activities

(40)

Extent of Procedures

_{Reliance on evidence from prior year’s audit}

_{Testing of controls related to significant risks}

(41)

Relationship of Assessed Control

Risk and Extent of Procedures

Inquiry

Documentation

Observation

Yes–extensive

Yes–with transaction walk-through Yes–with transaction

walk-through

Yes–some

Yes–using sampling

Yes–at multiple times Type of

procedure

High level:

Procedures to obtain an understanding

(42)

Decide Planned Detection Risk and

Design Substantive Tests

The auditor uses the results of the control risk assessment process and tests of controls to determine the planned detection risk and

related substantive tests.

(43)

Learning Objective 7

Understand Section 404

requirements for auditor

(44)

Section 404 Reporting on

Internal Control

1. The auditor’s opinion on whether the company maintained, in all material respects, effective

(45)

Types of Opinions

_Unqualified

_Adverse

(46)

Learning Objective 8

Describe the differences in

evaluating, reporting, and

testing internal control for

(47)

Evaluating, Reporting, and Testing

Internal Control for Nonpublic

Companies

1. Reporting requirements

2. Extent of required internal controls

4. Assessing control risk

(48)

Differences in Scope of Controls

Tested

Internal controls over financial reporting Internal controls over financial reporting

(49)