Internal Control (COSOS framework)

A process, effected by the entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.

3 categories of objectives of internal control

reporting, operations, and compliance

reliability

Generally, the controls that are relevant to an audit are those that pertain to the of financial reporting—that is, those that affect the preparation of financial information for external reporting purposes. However, other controls may be relevant if they affect the reliability of data that the auditors use to perform auditing procedures.

The Foreign Corrupt Practices Act.

1977, Congress ordered an end to these practices. Payments to foreign officials for the purpose of securing business are specifically prohibited for all American businesses by the anti-bribery provisions of the act. To prevent top management from asserting that they were not aware of the payments, internal control provisions also were included in the act. The internal control provisions require all corporations under the jurisdiction of the SEC (regardless of whether the corporation has international operations) to maintain a system of internal control that will provide reasonable assurance that Transactions are executed with the knowledge and authorization of management. Transactions are recorded as necessary to permit the preparation of reliable financial statements and maintain accountability for assets. Access to assets is limited to authorized individuals. Accounting records of assets are compared to existing assets at reasonable intervals and appropriate action is taken with respect to any differences.

Preventive controls

are aimed at avoiding the occurrence of misstatements in the financial statements. Examples of preventive controls include segregation of duties and requiring approval of period-ending journal entries.

Detective controls

are designed to discover misstatements after they have occurred. A policy requiring the preparation of monthly bank reconciliations is an example of a control that could detect misstatements of cash receipts or disbursements

corrective control

When detective controls discover a misstatement, a is ordinarily needed to remedy the situation. Maintaining backup copies of key transactions and master files to allow the correction of data entry errors is a common example of a corrective control.

complementary

Controls may be in that they function together to achieve the same control objective. To illustrate, consider the control that requires all cash disbursements to be authorized and the complementary control of requiring reconciliations of bank statements. These controls work together to help ensure that unauthorized transactions are prevented or detected.

redundant

Controls are referred to as if they address the same financial statement assertion or control objective

compensating

Finally, a control reduces the risk that an existing or potential control weakness will result in a misstatement. As an example, a small business may not have enough personnel to allow for the adequate segregation of duties, but the owner-manager of the business may carefully review accounting records and reports to compensate for the weakness.

direct

A control is specifically designed and precise enough to prevent or detect on a timely basis a material misstatement of a particular assertion relating to a significant account, transaction or disclosure.

indirect

An control is a control that is not precise enough to detect material misstatements at the assertion level but instead may have an indirect effect on the detection of material misstatements. To illustrate, reconciliation of a company’s bank account, a direct control, may identify a variety of misstatements of cash with a high level of precision. An active audit committee, while supportive of such direct controls, is an indirect control that, in and of itself, is unlikely to identify a misstatement of a particular assertion due to its imprecision.

The Committee of Sponsoring Organizations report developed five components of internal control, which it saw as a suitable way for organizing the internal control of all organizations:

The control environment. The risk assessment process. Control activities. Information and communication (we will refer to this as the accounting information system). The monitoring activities.

3/5 components that are primarily composed of indirect controls

the control environment, risk assessment process, and monitoring activities components (1, 2, and 5 above) are primarily composed of indirect controls,

2/5 components that are primarily composed of direct controls

while the control activities and the accounting information system components (3 and 4) primarily include direct controls.

control environment

The may be viewed as the foundation for the other internal control components; it is defined by the standards, processes, and structures that guide individuals in carrying out their duties. The basic principles of the control environment include Page 299 Commitment to integrity and ethical values. Board of directors that demonstrates independence from management and exercises effective oversight of internal control. Establishment of effective structure, including reporting lines, and appropriate authorities and responsibilities. Commitment to attract, develop, and retain competent employees. Holding employees accountable for internal control responsibilities.

the appointment, compensation, and oversight of the work of the CPA firm (including resolution of any disagreements between management and the CPA firm).

. For SEC registrants, the Sarbanes-Oxley Act of 2002 requires the audit committee to be directly responsible for

Composure of audit committee

the audit committee should be composed of independent directors who are not officers or employees of the organization and who do not have other relationships that impair their independence. . In addition, the audit committee should have one or more members who have financial reporting expertise

organizational structure

Management should establish, with board of director oversight, an effective to properly separate authority, reporting lines, and responsibilities of the various positions within the organization. A well-designed organizational structure provides a basis for planning, directing, and controlling operations. It divides authority, responsibilities, and duties among members of an organization by dealing with such issues as centralized versus decentralized decision making and appropriate segregation of duties among the various departments

The organizational structure of an entity should separate responsibilities for

authorization of transactions, record keeping for transactions, and custody of assets. In addition, to the extent practical, execution of the transaction should be segregated from these other responsibilities.

. Risk assessment

is management’s process for identifying, analyzing, and responding to such risks. In performing effective risk assessment, organizations should Clearly specify objectives to allow the identification and assessment of risks related to those objectives. Identify and analyze risks to the achievement of its objectives to determine how they may be managed. Consider potential fraud relating to the achievement of objectives. Identify and assess changes that could impact internal control.

Risk tolerance

is the organization’s acceptable level of variation in performance relative to the achievement of objectives.

Entity-level

risks arise from external or internal factors, such as economic, regulatory, technology, and personnel factors.

Transaction-level

risks are found within divisions, operating units, or functions of the organization. Such risks generally relate directly to the financial statement assertions described in chap 6

Management assessing risk

involves evaluating the likelihood of occurrence and the magnitude of the potential impact. It also involves consideration of the velocity or speed of occurrence and duration of impact of the risk.

Risk responses fall in the following major categories:

Avoidance. This response involves exiting the activity that gives rise to the risk. Reduction. This response involves taking action to reduce risk likelihood or impact, or both. For example, risk reduction might involve managing the risk or adding additional controls to processes. Sharing. This response involves reducing risk likelihood or impact by transferring or sharing a portion of the risk. Techniques for sharing include insurance, hedging, and outsourcing. Acceptance. This response involves taking no action because the risk is consistent with the risk tolerance of the organization.

Control activities

are policies and procedures that management implements to help mitigate the risk that the organization’s objectives are not met. The basic principles are that management should Select and develop control activities that mitigate risks of the achievement of organization objectives to acceptable levels. Select and develop general control activities over technology to support organization objectives. Deploy control activities through policies that establish what is expected and procedures that put those policies into action.

While there are many different types of control activities performed in an organization, the following types are generally relevant to an audit of the organization’s financial statements:

performance reviews, transaction control activities, physical controls, and segregation of duties.

A variety of control activities are performed to check the accuracy, completeness, validity, and authorization of transactions. The major types

Include authorizations and approvals, verifications, physical controls, controls over standing data, reconciliations, and supervisory controls.

General

authorization occurs when management establishes criteria for acceptance of a certain type of transaction. For example, top management may establish general price lists and credit policies for new customers. Transactions with customers that meet these criteria can then be approved by the sales and credit departments.

Specific

authorization occurs when transactions are authorized on an individual basis. For example, top management may consider individually and authorize specifically any sales transaction in excess of a specified amount, say, $100,000.

General control activities and application controls

Transaction-level controls may be broken into two categories: general control activities

general

control activities that apply to all or multiple types of transactions

application

controls that apply to the processing of a single type of transaction

Physical

controls include those that provide physical security over both records and other assets. Activities that safeguard records may include maintaining control at all times over unissued prenumbered documents, as well as other journals and ledgers, and restricting access to computer programs and data files

supervisory

Management also should establish controls that assess whether other transaction control activities are operating properly. Usually controls are focused on high-risk transactions.

incompatible duties

In a similar manner, no one individual should perform more than one of the functions of authorizing transactions, recording transactions, and maintaining custody over assets. Also, to the extent possible, individuals executing the specific transaction should be segregated from these functions. The goal is to not allow individuals to have that would allow them to both perpetrate and conceal errors or fraud in the normal course of their duties.

Controls that should be established for accounting estimates include the following:

Control environment policies and procedures that encourage proper estimates. Risk assessment—including consideration of the risks that inaccurate accounting estimates may result in the issuance of misstated financial statements—and appropriate responses to these risks. Policies that ensure that qualified personnel are involved in developing the estimates. Policies and procedures that ensure that relevant, sufficient, and reliable data are considered in the development of the estimates and that the model used can produce estimates consistent with the financial reporting framework (e.g., generally accepted accounting principles). Management review of sources of data, processes used to develop the assumptions, changes in the methods used, and the reasonableness of assumptions and estimates. Policies to ensure use of the work of specialists when considered necessary. Policies to improve estimation processes by comparison of prior estimates with subsequent results.

Fidelity bonds

are a form of insurance in which a bonding company agrees to reimburse an employer, within limits, for losses attributable to theft or embezzlement by bonded employees. losses attributable to theft or embezzlement by bonded employees. Companies with only a few employees at risk may obtain individual fidelity bonds; larger concerns may prefer to obtain a blanket fidelity bond covering a number of employees. Before issuing fidelity bonds, underwriters investigate thoroughly the past records of the employees to be bonded. This service offers added protection by preventing the employment of persons with dubious records in positions of trust. Bonding companies are much more likely to prosecute fraud cases vigorously than are employers; general awareness of this fact is another deterrent against dishonesty on the part of bonded employees.

accounting information system

An organization’s consists of the methods and records established to initiate, authorize, record, process, summarize, and report an entity’s transactions and to maintain accountability for the related assets, liabilities, and equity. Accordingly, an accounting information system should Identify and record all valid transactions. Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions for financial reporting. Measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements. Determine the time period in which transactions occurred to permit recording of transactions in the proper accounting period. Present properly the transactions and related disclosures in the financial statements. should include a chart of accounts and a manual of accounting policies and procedures as aids for communicating policies and procedures.

A chart of accounts

is a classified listing of all accounts in use, accompanied by a detailed description of the purpose and content of each.

A manual of accounting policies

and procedures states clearly in writing the methods of treating transactions.

Monitoring of controls,

the last component of internal control, is a process to assess the quality of internal control performance over time. The basic principles are that the organization should Select, develop, and perform ongoing and separate monitoring evaluations to determine that the components of internal control are present and functioning. Evaluate and communicate internal control deficiencies in a timely manner to those responsible for taking corrective action, including senior management and the board of directors and its audit committee as appropriate.

Ongoing monitoring evaluations

include regularly performed supervisory and management activities, such as monitoring of customer complaints or reviewing the reasonableness of management reports. Increasingly, automated tools and technologies are being used to continuously monitor processes for errors and unusual items that might be indicative of a breakdown in other internal controls.

Separate evaluations

are monitoring activities that are performed on a nonroutine basis, such as periodic audits by the internal auditors.

Management review controls

are those that operate through management review of information for evidence of errors, fraud, or breakdowns in other controls. Documents reviewed often include various reconciliations, journal entries, and budget-to-actual variances. For example, management may review such documents for unusual and unexpected items such as on a monthly or quarterly basis reviewing recorded revenues in relation to forecasted revenues and gross profit margins and expenses as a percentage of sales

limitations of internal control

Internal control can do much to protect against both errors and fraud and to ensure the organization’s objectives are achieved. Still, it is important to recognize the existence of inherent limitations of internal control. Custom, culture, and the corporate governance system may inhibit fraud, but they are not absolute deterrents. The extent of the controls adopted by a business also is limited by cost considerations. It is not feasible from a cost standpoint to establish controls that provide absolute protection from errors, fraud, and waste; reasonable assurance in this regard is generally the best that can be achieved.

enterprise risk management

When an organization integrates throughout its operations, it may be able to improve decision making in areas such as governance, strategy, objective‑setting, and day-to-day operations. Potential benefits include Aligning the organization’s risk tolerance, strategy, and operations. Identifying and managing both single and multiple risks and entity-wide and lower-level risks. Reducing operational surprises and losses. Reducing performance variability. Identifying opportunities. Improving the deployment of capital.

The 2017 enterprise risk management framework has the following five components:

Governance and culture. Governance and culture together form a basis for all other components of enterprise risk management. Governance sets the entity’s tone, reinforcing the importance of enterprise risk management and establishing oversight responsibilities for it. Culture is reflected in decision making. Strategy and objective-setting. Enterprise risk management is integrated into the entity’s strategic plan through the process of setting strategy and business objectives. With an understanding of business context, the organization can gain insight into internal and external factors and their effect on risk. An organization sets its risk appetite in conjunction with strategy-setting. The business objectives allow strategy to be put into practice and shape the entity’s day-to-day operations and priorities. Performance. An organization identifies and assesses risks that may affect an entity’s ability to achieve its strategy and business objectives. As part of that pursuit, the organization identifies and assesses risks that may affect the achievement of that strategy and business objectives. It prioritizes risks according to their severity and considering the entity’s risk appetite. The organization then selects risk responses and monitors performance for change. In this way, it develops a portfolio view of the amount of risk the entity has assumed in the pursuit of its strategy and entity-level business objectives. Review and revision. By reviewing enterprise risk management capabilities and practices, and the entity’s performance relative to its targets, an organization can consider how well the enterprise risk management capabilities and practices have increased value over time and will continue to drive value in light of substantial changes. Information, communication, and reporting. Communication is the continual, iterative process of obtaining information and sharing it throughout the entity. Management uses relevant information from both internal and external sources to support enterprise risk management. The organization leverages information systems to capture, process, and manage data and information. By using information that applies to all components, the organization reports on risk, culture, and performance.

enterprise risk management system

It is not necessary for an organization to implement an that meets these criteria in order to have effective internal control or risk management.

corporate governance

is the set of rules, processes, and laws by which businesses are operated, regulated, and controlled. It includes the policies, procedures, and mechanism that are established to ensure that the company operates in the best interests of its major stakeholders, including owners, customers, suppliers, employees, and society as a whole. For a corporation, the major instruments of corporate governance include management compensation systems, the boards of directors (including major committees), external (independent) auditors, internal auditors, attorneys, regulators, creditors, securities analysts, and internal control systems.

the overall approach that auditors use in a financial statement audit includes

Plan the audit. Obtain an understanding of the client and its environment, including internal control. Assess the risks of misstatement and design further audit procedures. Perform further audit procedures. Complete the audit. Form an opinion and issue the audit report.

risk assessment procedures

The auditors use to obtain an understanding of internal control. The understanding obtained, combined with the auditors’ other evidence, allows them to assess the risk of material misstatement

inherent and control

Recall that at the assertion level, the risk of misstatement is composed of risk and risk as

nature, timing, and extent

Results of the risk assessment are used to design the of further audit procedures

tests of controls and substantive procedures.

Further audit procedures include: x and x The auditors make decisions about the proper combination of tests of controls (which allow a lower assessment of control risk) and substantive procedures (which restrict detection risk)

In auditing control activities (automated or manual), the auditors will particularly address the design and implementation of those that affect the risks of material misstatement, including:

Controls over journal entries recorded in the general ledger and other adjustments made in the preparation of the financial statements. Controls for which the auditor plans to test operating effectiveness in determining the nature, timing, and extent of substantive procedures. Controls that address a risk that is determined to be a significant risk. Other controls that will enable the auditor to assess the risks of material misstatement at the assertion level and to design further audit procedures. Page 313 Whether it is necessary for the auditors to devote additional attention to obtaining an understanding of the other control activities depends on the circumstances of the engagement.

Relevance and precision

The auditors evaluate the design effectiveness of management review controls by considering the of the controls. The controls are relevant if they address relevant financial statement assertions, and the precision of review controls is affected by The level of aggregation of the data (e.g., weekly versus monthly). The frequency and consistency with which the review is performed. The predictability of the expectations developed by management. The criteria used to determine when an item or relationship is investigated.

When determining whether an identified risk of misstatement is significant, requiring special audit consideration, the auditors consider factors such as the following:

Complexity of calculations involved. Risk of fraud. Selection and application of accounting policies. Internal and external circumstances giving rise to business risks (e.g., technological change in the industry). Recent developments in the industry and economy.

inquiring, observing, inspecting, and tracing

Procedures to obtain audit evidence about the design and implementation of relevant controls may include of entity personnel, the application of specific controls, documents and reports, and transactions through the information system relevant to financial reporting. One restriction exists, however, in that inquiry alone is not sufficient to evaluate the design of a control and to determine whether it has been implemented.

operating effectiveness.

To properly perform a financial statement audit, auditors are required to determine that the major controls have been implemented; they are not required to evaluate their If the auditors do not plan to test the operating effectiveness of controls, they should assess control risk at the maximum level for the related assertions.

no tests of controls were performed or an auditor finds controls to be ineffective either through the results of tests of controls or through consideration of other evidence.

Also, since the risk of material misstatement at the assertion level is based on inherent risk and control risk, when no tests of operating effectiveness are performed, the assessment of control risk at the maximum level results in a risk of material misstatement that is the same as the assessment of inherent risk. Finally, note that an assessment of control risk at the maximum level occurs in either of two situations:

internal control questionnaire.

A traditional method of describing internal control is to fill in a standardized . Many public accounting firms have developed their own questionnaires for this purpose. The usually contains a separate section for each major transaction cycle, enabling the work of completing the to be divided conveniently among several audit staff members.

Written narratives

of internal control are memoranda that describe the flow of transaction cycles, identifying the employees performing various tasks, the documents prepared, the records maintained, and the division of duties.

flowchart

A systems is a diagram—a symbolic representation of a system or a series of procedures with each procedure shown in sequence. To the experienced reader, a conveys a clear image of the system, showing the nature and sequence of procedures, division of responsibilities, sources and distribution of documents, and types and location of accounting records and files. A possible disadvantage of flowcharts is that internal control weaknesses are not identified as prominently as in questionnaires.

cash receipts flowchart

walk-through

The term refers to tracing one or two transactions through each step in the cycle. To perform a walk-through of the sales and collections cycle, for example, the auditors might begin by selecting several sales orders and following the related transactions through the client’s sequence of procedures. The auditors would determine whether such procedures as credit approval, shipment of merchandise, preparation of sales invoices, recording of the accounts receivable, and processing of the customers’ remittances were performed by appropriate client personnel and in the sequence indicated in the audit working papers.

the concept of assessing the risks of material misstatement at the financial statement and assertion levels, while in Chapter 6 we provided further details. The overall approach (summarized) is

Identify risks of material misstatement by performing risk assessment procedures. Assess identified risks of material misstatement at the financial statement level. Assess identified risks of material misstatement at the assertion level. Design further audit procedures (tests of controls and substantive procedures) in response to the identified risks of material misstatement.

The following are internal control–related examples of risks at the financial statement level:

Controls over the preparation of the financial statements, including the development of significant accounting estimates and the preparation of the notes. Selection and application of significant accounting policies. IT general controls (these controls are discussed in further detail in Chapter 8). The control environment.

Because of these characteristics of financial statement level risks, an overall response by the auditor is often required. As presented in Chapter 6, responses might include

Assigning more experienced staff or those with specialized skills. Providing more supervision and emphasizing the need to maintain professional skepticism. Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed. Increasing the overall scope of audit procedures, including their nature, timing, or extent.

substantive

Also, recall from Chapter 6 that the professional standards require the auditors to design and perform procedures for all relevant assertions.

The lower assessed level of control risk (and risk of material misstatement)

is appropriate only when the auditors have evidence on the operating effectiveness obtained by performing tests of controls.

planned assessed levels of control risk.

The preliminary assessments of control risk are often referred to as the auditors’

tests of controls

The auditors perform to obtain evidence about the operating effectiveness of controls. The approach is to identify the controls likely to prevent or detect material misstatements and perform tests of controls to determine whether they are operating effectively. address the following: How controls were applied. The consistency with which controls were applied. By whom or by what means (e.g., electronically) the controls were applied.

The audit procedures used to test the effectiveness of internal control include

Inquiries of appropriate client personnel. Inspection of documents and reports. Observation of the application of controls. Reperformance of the controls.

Tests of controls

focus on the operation of controls rather than on the accuracy of financial statement amounts.

The audit procedures used to test the effectiveness of internal control include

Inquiries of appropriate client personnel. Inspection of documents and reports. Observation of the application of controls. Reperformance of the controls.

COSO Cube

Design and perform substantive procedures

For assertions with a high risk of material misstatement, the auditors will plan substantial substantive procedures. On the other hand, when the assessments of the risk of material misstatement of an assertion are low, the substantive procedures will be restricted or in some circumstances eliminated for that assertion. [Whittington, Ray]

audit decision aid

. An is a checklist, standard form, or computer program that helps the auditors make a particular decision by ensuring that they consider all relevant information or by assisting them in combining the information to make the decision.

AICPA AU-C 610 and PCAOB AS 2605 indicate that the external (independent) auditors may use the work of internal auditors in the following two ways:

Obtaining audit evidence by using the internal auditors’ work performed as a part of their normal responsibilities and

user entities.

companies that decide to outsource a portion of their processing—these latter companies are referred to as

Service organizations

provide processing services

user entities.

to companies that decide to outsource a portion of their processing these latter companies are referred to as

System and Organization Controls (SOC)

Obtain and consider a audit report of the service auditor on the service organization’s controls AICPA AT-C 320 and PCAOB AS 2601 present guidance for performing SOC 1 examination engagements. These engagements are particularly relevant to financial statement audits in that they address a service organization’s internal control over financial reporting. The approach followed on such engagements involves management of the service organization providing a description of the service organization’s system and a written assertion on the suitability of the design of its controls. Then, the service auditor assesses the accuracy of the description and the assertion. In addition, management may choose to perform an assessment of the operating effectiveness of the controls within the system.

To respond to both of these options, the public accounting profession has developed engagements resulting in two different SOC 1 service auditors’ reports:

Report on controls placed in operation (Type 1 report)—A report on management’s description of the service organization’s system and the suitability of the design of controls as of a particular date. Report on controls placed in operation and tests of controls (Type 2 report)—A report on management’s description of the service organization’s system and the suitability of the design and operating effectiveness of controls throughout the period covered by the service auditor’s report.7

complementary subservice organization

When controls applied by the subservice organization are necessary to achieve the service organization’s control objectives, the controls are referred to as controls. In such situations, management of the service chooses one of two service auditor reporting options: the inclusive method, which involves including the subservice controls in the scope of the examination, or the carve-out method, which involves excluding the subservice controls from the scope of the examination.

complementary user entity controls

Occasionally, the effectiveness of the service organization’s controls depends on control procedures performed by the user entities. In these cases, management’s description of the service organization’s system should refer to the need for , and the service auditors’ reports should state that the service auditors have not evaluated the suitability of the design or operating effectiveness of complementary user entity controls and the control objectives stated in the description can be achieved only if complementary user entity controls are suitably designed and operating effectively, along with the controls at the service organization.

trust services

criteria developed by the public accounting profession: security, availability, processing integrity, confidentiality, and privacy.

SOC 2 reports,

which may be of either Type 1 or Type 2, have broader applicability as they are appropriate for use by the service organization itself and user stakeholders such as customers, regulators, business partners, suppliers, and directors. However, Type 2 reports are still restricted to specific parties.

 SOC 3 reports

must be of Type 2—that is, they must include an opinion on the fairness of management’s assertion that controls were effectively designed and operating effectively during the period. SOC 3 reports are general purpose reports that are not restricted as to their use. 

deficiency in internal control

A over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect material misstatements on a timely basis.

is a deficiency in internal control over financial reporting (or combination of deficiencies) that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.8