Topic 7

SOX created two provisions that relate to a public companies' system of internal controls:

(1) a company's management team must regularly report to investors regarding the quality of the company's internal controls governing the financial reporting process, (2) the external auditor must perform a full audit of the public company clients' internal controls and report to investors on the quality of those controls as part of the client's annual filing with the SEC.

When are the two aspects of a client's internal control system that must be evaluated?

(1) design effectiveness, (2) operating effectiveness

In what ways can an internal control procedure be monitored?

(1) people-based monitoring, (2) technology-based monitoring.

What characteristics are included in the control environment?

(1) the 'tone at the top' set by management and the board of directors, (2) management's integrity, goals and objectives, and (3) attitudes toward the role of internal control within the organization.

Each of the following is an example of control activities except? (a) Monitoring (b) Physical controls (c) Reconciliations (d) Authorizations and approvals

(a) Monitoring

The primary objectives achieved by a high-quality system of internal control are: (a) Operations, reporting, and compliance (b) Reporting and accuracy (c) Accuracy and compliance (d) Operations and compliance

(a) Operations, reporting, and compliance

Which of the following best describes the Risk Assessment component of internal control as outlined in the COSO framework? (a) The auditor performs high quality risk assessment procedures to identify risky areas in the client's internal control systems (b) The company maintains a robust risk assessment process which helps identify risks that might keep them from achieving the objectives of operations, reporting, and compliance (c) The auditor performs regular fraud risk assessments of the client to identify client fraud (d) Each of the above describes the Risk Assessment component of internal control as outlined in the COSO framework

(b) The company maintains a robust risk assessment process which helps identify risks that might keep them from achieving the objectives of operations, reporting, and compliance

The auditor's report on internal control quality can express which of the following opinions regarding the quality of internal control? (a) Unqualified or Qualified only (b) Unqualified or Adverse only (c) Unqualified, Qualified, or Adverse (d) Qualified or Adverse only

(b) Unqualified or Adverse only

Which of the following is the correct sequence with regards to the auditor's reliance on the client's internal controls? (a) Assess design and implementation of controls, testing controls, decision to rely on controls (b) Decision to rely on controls, assess design and implementation of controls, testing controls (c) Assess design and implementation of controls, decision to rely on controls, testing controls

(c) Assess design and implementation of controls, decision to rely on controls, testing controls

The principles outlined by COSO for the control environment component are:

1. Demonstrate commitment to integrity and ethical values 2. The Board of Directors demonstrates independence from management and exercises oversight of the development and performance of internal controls 3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in pursuit of objectives 4. Commitment to attract, develop, and retain competent individuals in alignment with objectives 5. Holds individuals accountable for their internal control responsibilities

The principles outlined by COSO for the information and communication component are:

1. The organization obtains or generates and uses relevant, quality information to support the functioning of internal control. 2. The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of the internal control. 3. The organization communicates with external parties regarding matters affecting the functioning of internal controls.

The principles outlined by COSO for the control activities component are:

1. The organization selects and develops control activities that contribute to the mitigation of risks to acceptable levels. 2. The organization selects and develops general control activities over technology to support the achievement of objectives. 3. The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

The principles outlined by COSO for the monitoring component are:

1. The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. 2. The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

The principles outlined by COSO for the risk assessment component are:

1. The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives. 2. The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. 3. The organization considers the potential for fraud in assessing risks to the achievement of objectives 4. The organization identifies and assesses changes that could significantly impact the system of internal control.

Make a decision whether or not the Audit Team can Rely on Internal Controls

Can the audit team rely on the I/C for financial statement audit evidence? Why? yes/no? - document results

Reconciliations

Comparison of 2 or more data elements Ex. Bank Reconciliations

Verifications

Comparison of two items ex. shipment date should precede the invoice date

(T/F) The Control Environment component of internal control relates to client integrity, proper board oversight and reporting channels, commitment to hiring competent employees, and proper accountability for internal control related actions.

True

(T/F) The auditor can issue either combined or separate audit reports when reporting on both the audit of financial statements and the audit of internal control.

True

(T/F) The internal audit function at the client often plays a significant role in evaluating the company's internal controls.

True

What is the COSO definition of internal control?

"a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance."

What are the three primary objections achieved by a high-quality system of internal control?

1) operations 2) reporting 3) compliance

FIVE COMPONENTS OF AN EFFECTIVE INTERNAL CONTROL SYSTEM

1. Control Environment 2. Risk Assessment 3. Control Activities 4. Information and Communication 5. Monitoring

Significant Deficiency

A deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting.

Material Weakness

A deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis.

What is an integrated audit?

A full audit of and opinion on the client's internal control over financial reporting (ICFR) that accompanies the audit of and opinion on the client's financial statements.

Auditor's Report over I/C Governance

AS 2201 states that the "auditor's objective in an audit of internal control over financial reporting is to express an opinion on the effectiveness of the company's internal control over financial reporting."

Authorizations and Approvals

Affirmation that a transaction is valid ex. authorization of credit

The officers of the company who sign these certifications also must certify that they have disclosed the following matters to the external auditors and to the audit committee:

All significant deficiencies in the design or operation of internal controls (material weaknesses in internal controls); Any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's internal controls; and Management also must certify that it has indicated in the report filed with the SEC whether there have been significant changes in internal controls from the prior period as well as any corrective action taken to respond to previous internal control weaknesses.

What five professional organizations joined forces to create COSO in 1985?

American Accounting Association (AAA) American Institute of CPAs (AICPA) Financial Executives International (FEI) Institute of Management Accountants (IMA) Institute of Internal Auditors (IIA)

What is a control deficiency?

An observed instance where the design or operation of a control causes a failure to prevent or detect misstatements in a timely manner.

Supervisory Controls

Assess whether control activities are being properly performed Ex. Monitoring that controls are performed

Examples of Control Activities

Authorizations and approvals Verifications Physical Controls Controls over Standing Data Reconciliations Supervisory Controls

Examples of Substantive Procedures

Bank confirmation Accounts receivable confirmation Observe a physical inventory count Confirm inventories not on-site Observe fixed assets Match purchase orders and supplier invoices to fixed asset records Confirm accounts payable Confirm debt Analytical analysis of assets, liabilities, revenue, and expenses

How should the auditor evaluate the internal control?

Based on the likelihood of misstatements remaining undetected by the I/C and the magnitude of the potential misstatement.

Audit Report for Internal Controls

Can be either combined or separate reports. The auditor can report on the F/S and the I/C in the same report or two separate reports.

Weaknesses in the client's system of I/C can be categorized into three types:

Deficiency Significant Deficiency Material Weakness

Preventive Controls

Designed to ensure that negative events don't happen. For example, locks on doors and passwords on computers are examples of preventive controls that ensure unauthorized access doesn't happen.

Detective Controls

Designed to identify events that have already occurred. For example, the practice of performing a bank reconciliation at the end of each month is a control activity designed to identify errors or fraud that may have occurred during the period.

If the auditor chooses to issue two separate reports, he must include additional disclosures:

Disclosures indicating that the other audit was also conducted, The date of the other audit report, Summary of the opinion expressed in the other audit report.

Public & Private Company Auditor Responsibilities:

Ensure that controls are properly functioning when performing an audit of a client's financial statements, particularly if the auditor expects to use the effectiveness of internal controls as indirect evidence regarding the fair presentation of the financial statements.

Assess the design and implementation of the Internal Controls

Evaluate design (design effectiveness) If design is adequate, assess the implementation of the I/C

Deficiency

Exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

(T/F) A significant deficiency is more serious than a material weakness.

False

(T/F) The auditor has primary responsibility for the proper functioning of their client's internal control.

False

(T/F) The materiality threshold used for the audit of financial statements is different from the materiality threshold used for determining whether a control deficiency is a material weakness or a significant deficiency.

False

(T/F) Using the COSO internal control framework as a benchmark for quality is mandatory for the audit of internal control over financial reporting.

False

Documenting an Understanding of Internal Controls

Flowcharts Questionnaires Written Narratives Documented Observations of Control Practices

What was one of the purposes of the Sarbanes-Oxley Act of 2002 (SOX)?

Help restore investor confidence in capital markets by requiring companies to improve the quality of their internal controls governing the financial accounting and reporting process.

Test the Internal Controls

If yes, test controls (operating effectiveness) After testing I/C, determine the level of substantive testing that needs to be performed. Note: Even with reliance on I/C - some level of substantive testing should be done. If no, perform extensive substantive audit testing since I/C cannot be relied upon. The auditor will not test I/C.

Public Company ONLY Auditor Responsibilities

In order to comply with SOX, the external auditor must perform a full audit of the public company clients' internal controls and report to investors on the quality of those controls as part of the client's annual filing with the SEC.

Auditor's Responsibility for Controls - Standard Audit Procedures on I/C

Inquiries of key personnel, Observations of control processes in action, Inspections of documents, Walk-throughs (i.e., observing sample transactions as they are processed through the system of controls)

What is the relationship between internal control quality & financial statement reporting quality?

Internal control quality and financial statement reporting quality go hand in hand.

Is risk assessment a process or a one-time event?

It is an ongoing process in which risks are continually being assessed and re-assessed as additional information arises.

What is required under SOX?

Large public companies must obtain both an audit of financial statements as well as an audit of internal controls.

Only required for accelerated filers with market capitalization > $75 million (doesn't apply to "small filers")

Market Capitalization: The value of a company that is traded on the stock market, calculated by multiplying the total number of shares by the present share price.

Auditor's Responsibility for Controls - SOX

Must be an Integrated Approach Purpose of Integrated Approach Only required for accelerated filers with market capitalization > $75 million (doesn't apply to "small filers")

Is use of the COSO framework mandatory?

No, but it has become the most widely used internal control framework in the U.S. and around the world.

Auditor's Responsibility for Controls:

Obtain an Understanding of the I/C to Determine the Audit Team's Reliance on the I/C

Objectives of Internal Control - Top of COSO Cube

Operations Reporting Compliance

Controls over Standing Data

Process of populating, updating, or maintaining accuracy of data Ex. Master Price Lists

Purpose of Integrated Approach

Provide investors with the auditor's opinion regarding the effectiveness of the client's internal controls over financial reporting. The I/C Audit is designed to identify Material Weaknesses that could lead to misstatements in the F/S.

Information and Communication

Relates to the processes and systems in place for recording and sharing information throughout the organization.

When auditing I/C, what is the auditor responsible for?

Reporting all deficiencies discovered in the course of the audit, regardless of their level of significance.

Section 404(a): Annual Report on Internal Controls

Requires that public company management provide a report detailing their evaluation of their company's system of internal control as part of the company's annual report (10-K). The internal control report should contain a statement by management taking responsibility for establishing and maintaining effective internal control as well as an assessment of the effectiveness of internal controls as of the end of the most recent fiscal year.

SOX Requirements Related to Management

Section 302: Management Certification of Responsibility Section 404(a): Annual Report on Internal Controls

Physical Controls

Securing assets by limiting access ex. locks, gates, etc.

Must be an Integrated Approach

The "audit" of internal controls should not be the subject of a separate engagement, but should be conducted by the same auditor that performs the financial statement audit.

What is the COSO Framework?

The 'established criteria' and benchmark to use when evaluating the effectiveness of internal controls.

What is COSO?

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a joint initiative to combat corporate fraud. COSO has established a common internal control model against which companies and organizations may assess their control systems.

Who is responsible for most of the work involved in assessing and evaluating internal controls?

The Internal Audit Department

What is the PCAOB's position on the COSO framework?

The PCAOB has stated that the COSO framework is an acceptable framework for evaluating the effectiveness of a company's ICFR (internal controls over financial reporting).

What are the auditor's responsibilities?

The auditor is required to understand and evaluate the client's system of internal control.

Adverse Opinion

The auditor's opinion that the I/C are NOT effective in both design and operation. Material Weaknesses Exist

Unqualified Opinion

The auditor's opinion that the I/C are effective in both design and operation.

Who has the primary responsibility for establishing and maintaining the internal control system?

The client

Where are the five components of an effective internal control system show on the cube?

The front panel

What is the focus of the internal control audit?

The identification of a Material Weakness

What is the primary concern of auditors in regards to their internal controls?

The impact of internal controls on financial reporting.

What is the primary determinant as to whether a control deficiency is a significant deficiency or a material weakness?

The size of the potential misstatement that could go undetected

Congress enacted Section 302 of The Sarbanes-Oxley Act of 2002 (SOX) to require that a public company's CEO and CFO provide the following written certifications in the annual (10-K) and quarterly (10-Q) filings:

They are responsible for establishing and maintaining internal controls; Have designed internal controls to ensure that material information is made known to such officers by others; Have evaluated the effectiveness of the issuer's internal controls as of a date within 90 days prior to the report; and Have presented in the report their conclusions about the effectiveness of their internal controls based on their evaluation as of that date.

What is the focus of Information and Communications?

This component focuses on the information systems used within an organization to ensure that decision makers have access to timely and relevant information when making important decisions.

What is the focus of the monitoring component of an internal control system?

This component relates to procedures put in place that are designed to ensure that internal control procedures are implemented effectively.

What is the purpose of the audit of I/C over financial reporting?

To ensure that controls related to financial reporting objectives are designed and implemented effectively.

Auditor must communicate in writing the following matters:

To management—All deficiencies identified during the audit (AS 2201). To audit committee— (1) The extent to which they plan to use the work of internal auditors, company management, or third parties under the direction of management (AS 1301). (2) All significant deficiencies and material weaknesses identified during the audit. (AS 2201) To Board—If auditor concludes that oversight by audit committee is ineffective. (AS 2201) To the Public—The identification of any material weaknesses.

What is the purpose of I/C over financial reporting?

To prevent or detect misstatements from appearing in the financial statements.

(T/F) If the auditor uses a pure substantive approach, he or she will typically not test the client's controls.

True

(T/F) The approach to documenting the auditor's understanding of internal control varies depending on the complexity of the system of internal control.

True

Only Two Opinions on Internal Controls

Unqualified Opinion Adverse Opinion

Why is risk assessment so important?

You cannot fix what you do not know is broken.

Why is the control environment important?

a system of internal control functions better in an environment that is conducive to and supportive of the proper functioning of those controls.

Substantive testing

an audit procedure that examines the financial statements and supporting documentation to see if they contain errors.

Risk assessment

an ongoing process that involves the identification and assessment of the probability and magnitude of potential risks faced by the entity.

During the risk assessment stage, auditors perform

assessments of the client's control risk.

COSO was originally founded by ______ organizations, including the AICPA. a) Three b) Five c) Seven d) Two

b) Five

With the release of its 1992 framework, COSO introduced a

graphic design to help users understand the relationship between the various components of effective internal control.

Operations Objectives

includes a focus on achieving effective and efficient business operations and the safeguarding of company assets

Compliance Objectives

includes adherence to applicable laws and regulations

Reporting Objectives

includes both internal and external reporting of financial and nonfinancial information.

A well-designed internal control activity that is not implemented well or operating appropriately

is also ineffective.

Substantive tests

needed as evidence to support the assertion that the financial records of an entity are complete, valid, and accurate.

A poorly-designed internal control activity that is implemented perfectly will

not have the desired effect.

Control Activities

relates to the specific actions (e.g., personnel, policies, procedures) put into place to address the threats identified through the risk assessment process.

Control Environment

the setting in which the system of control is meant to function.

What is the purpose of the COSO Framework?

to outline the committee's collective guidance regarding best practices for designing and implementing strong internal control systems.