Chapter 7
The more frequently a control operates, the _____ it should be tested, and controls that are more critical should be tested ______.
1. More often 2. More extensively
A company's commitment to integrity and ethical values are communicated through ____ and emphasized through ____
1. The organization's standards of conduct 2. Directives, actions, and behavior
Fidelity Bonds
A form of insurance in which a bonding company agrees to reimburse an employer, within limits, for losses attributable to theft or embezzlement by bonded employees
Monitoring controls
A process to assess the quality of internal control performance over time
Systems Flowchart
A symbolic representation of a system or a series of procedures with each procedure shown in sequence
Corporate governance is primarily concerned with
Controlling management and providing incentives for appropriate management behavior
Redundant Controls
Controls that address the same financial statement assertion or control objective
Transaction-level risks
Found within divisions, operating units, or functions of the organization
Payroll Cycle
Hiring, terminating and determining pay rates; timekeeping; computing gross payroll, payroll taxes, and amounts withheld from gross pay; maintaining payroll records; and preparing and distributing paychecks
Disadvantage of flowcharts
Internal control weaknesses are not identified as prominently as in questionnaires
Examples of work that should not be assigned to internal auditors
Making inquires of management related to the identification of fraud risks and determining the procedures to respond to such risks
Written narratives of internal control
Memoranda that describe the flow of transaction cycles, identifying the employees performing various tasks, the documents prepared, the records maintained, and the division of duties
Revenue Cycle
Obtaining orders from customers, approving credit, shipping merchandise, preparing sales invoices, recording revenue and accounts receivable, and handling and recording cash
The Foreign Corrupt Practices Act prohibits what?
Payments to foreign officials for the purpose of securing business
Control activities
Policies and procedures that help mitigate the risk that the organization's objectives are not met
Avoidance
Response involves exiting the activity that gives rise to the risk
Sharing
Response involves reducing risk likelihood or impact by transferring or sharing a portion of the risk. Techniques include: insurance, hedging, and outsourcing
Management should establish, with the board of director oversight, an effective organizational structure to properly
Separate authority, reporting lines, and responsibilities of the various positions within the organization
Conversion Cycle
Storing materials, placing materials into production, assigning production costs to inventories, and accounting for the cost of goods sold
For assertions with a high risk of material misstatement, the auditors will plan _______ procedures.
Substantial substantive
Timing of the performance of tests of controls depends on
The auditor's objectives
Who should hold the CEO accountable regarding a company's internal control policies and achievements
The board of directors
Tests of controls focus on
the operation of controls rather than on the accuracy of financial statement amounts
In performing effective risk assessment, organizations should
1. Clearly specify objectives to allow the identification and assessment of risks related to those objectives 2. Identify and analyze risks to the achievement of its objectives to determine how they may be managed 3. Consider potential fraud relating to the achievement of objectives 4. Identify and assess changes that could impact internal control
Finance Department
1. Under the direction of the treasurer 2. Responsible for financial operations and custody of liquid assets 3. Activities include: planning future cash requirements, establishing customer credit policies, and arranging to meet the short and long term financing needs of the business 4. Has custody of bank accounts and other liquid assets, invests idle cash, handles cash receipts, and makes cash disbursements
Investing Cycle
Authorizing, executing, and recording transactions involving investments in fixed assets and securities
Auditor's risk assessment is primarily concerned with
Evaluating the likelihood of material misstatements in the financial statements
Acceptance
Response involves taking no action because the risk is consistent with the risk tolerance of the organization
Types of reports that service auditors may provide
1. A report on a management's description of a service organization's systems and the suitability of the design of controls 2. A report on a management's description of a service organization's system and the suitability of the design AND operating effectiveness of controls
Preventive Controls
1. Aimed at avoiding the occurrence of misstatements in the financial statements 2. Ex: Segregation of duties and requiring approval of period-ending journal entries
Potential benefits of an Enterprise Risk Management System include
1. Aligning the organization's risk tolerance, strategy, and its operations 2. Identifying and managing both single and multiple risks, entity-wide and lower level risks 3. Reducing operational surprises and losses 4. Reducing performance variability 5. Identifying opportunities 6. Improving the deployment of capital
Control objectives, regarding sales transactions, established by COSO
1. All sales transactions that occur are recorded on a timely basis 2. Sales transactions are recorded at correct amounts in the right accounts 3. Sales transactions are accurately and completely summarized in the company's books and records 4. Presentation and disclosures relating to sales are properly described, sorted, and classified
If external auditors decide the work of the internal auditors' is relevant and that it would be efficient to use they should
1. Assess the competence and objectivity of the internal audit function 2. Determine whether the internal auditors apply a systematic and disciplined approach to performing the work
Responses to financial statement risks
1. Assigning more experienced staff or those with specialized skills 2. Providing more supervision and emphasizing the need to maintain professional skepticism 3. Incorporating additional elements of unpredictability in the selection of further audit procedures to be performed 4. Increasing the overall scope of audit procedures, including their nature, timing, or extent
The organizational structure of an entity should separate the responsibilities for
1. Authorization of transactions 2. Record keeping for transactions 3. Custody of assets
Risk responses include
1. Avoidance 2. Reduction 3. Sharing 4. Acceptance
Factors indicative of increased financial reporting risk
1. Changes in the organization's regulatory or operating environment 2. Changes in personnel 3. New or revamped information systems 4. Rapid growth of the organization 5. Changes in technology affecting production processes or information systems 6. New business models, products, or activities 7. Corporate restructurings 8. Expansion or acquisition of foreign operations 9. Adoption of new accounting principles or changing accounting principles
Basic principles of the control environment
1. Commitment to integrity and ethical values 2. Board of directors that demonstrates independence from management and exercises effective oversight of internal control 3. Establishment of effective structure, including reporting lines, and appropriate authorities and responsibilities 4. Commitment to attract, develop, and retain competent employees 5. Holding employees accountable for internal control responsibilities
When determining whether an identified risk of misstatement is significant, requiring special audit consideration, the auditors consider factors such as
1. Complexity of calculations involved 2. Risk of fraud 3. Selection and application of accounting policies 4. Internal and external circumstances giving rise to business risks 5. Recent developments in the industry and economy
If auditors are unable to obtain a sufficient understanding from the user entity regarding the services provided by a service organization, they should
1. Contact the service organization to obtain specific information 2. Visit the service organization and perform necessary procedures about the relevant controls at the service organization 3. Obtain and consider the report of a service auditor on the service organization's controls
Detective Controls
1. Designed to discover misstatements after they have occurred 2. Ex: requiring the preparation of monthly bank reconciliations
The Enterprise Risk Management Framework has what five components?
1. Governance and Culture 2. Strategy and Objective-Setting 3. Performance 4. Review and Revision 5. Information, Communication, and Reporting
What do tests of controls address?
1. How controls were applied 2. The consistency with which controls were applied 3. By whom or by what means the controls were applied
An accounting information system should
1. Identify and record all valid transactions 2. Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions for financial reporting 3. Measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements 4. Determine the time period in which transactions occurred to permit recording of transactions in the proper accounting period 5. Present properly the transactions and related disclosures in the financial statements
Audit procedures used to test the effectiveness of internal control include
1. Inquiries of appropriate client personnel 2. Inspection of documents and reports 3. Observation of the application of controls 4. Re-performance of the controls
External auditors may use the work of internal auditors in what ways?
1. Obtaining audit evidence by using the internal auditors' work performed as a part of their normal responsibilities 2. Using internal auditors to provide direct assistance on the external audit
Stages of an internal control audit
1. Plan the engagement 2. Use a top-down approach to identify controls to test 3. Test and evaluate design effectiveness of internal control 4. Test and evaluate operating effectiveness of internal control 5. Form an opinion on the effectiveness of internal control over financial reporting
Risks at the financial statement level
1. Preparation of the financial statements, including the development of significant accounting estimates and the preparation of the notes 2. Selection and application of significant accounting policies 3. IT general controls 4. The control environment
Service Organizations
1. Provide processing services to companies that decide to outsource a portion of their processing 2. Ex: A company that outsources their payroll function
Examples of internal control practices that are almost always capable of use in small businesses
1. Record all cash receipts immediately 2. Deposit all cash receipts intact daily 3. Make all payments by serially numbered checks 4. Reconcile bank accounts monthly and retain copies of the reconciliations in the files 5. Use serially numbered sales invoices, purchase orders, and receiving reports 6. Issue checks to vendors only in payment of approved invoices that have been matched with purchase orders and receiving reports 7. Balance subsidiary ledger with control accounts at regular intervals and prepare and mail customers' statements monthly 8. Prepare comparative financial statements monthly in sufficient detail to disclose significant variations in any category of revenue or expense
Basic principles of control activities are that management should
1. Select and develop control activities that mitigate risks of the achievement of organization objectives to acceptable levels 2. Select and develop general control activities over technology to support organization objectives 3. Deploy control activities through policies that establish what is expected and in procedures that put policies into action
Basic principles of monitoring controls
1. Select, develop, and perform ongoing and separate monitoring evaluations to determine that the components of internal control are present and functioning 2. Evaluate and communicate internal control deficiencies in a timely manner to those responsible for taking corrective action
Five components of the internal control of an organization
1. The control environment 2. The risk assessment process 3. Control activities 4. The information system relevant to financial reporting and communication (the accounting information system) 5. The monitoring activities
In addition to documenting their overall understanding of internal control, the auditors should document
1. The overall responses to address the assessed risks of material misstatement at the financial statement level 2. The nature, timing, and extent of the further audit procedures 3. The linkage of those procedures with the assessed risks at the relevant assertion level 4. The results of the audit procedures 5. The conclusions reached with regard to the use of the current audit evidence about the operating effectiveness of controls that were obtained in a prior audit
The SEC requires that all corporations under their jurisdiction maintain a system of internal control that will provide reasonable assurance that
1. Transactions are executed with the knowledge and authorization of management 2. Transactions are recorded as necessary to permit the preparation of reliable financial statements and maintain accountability for assets 3. Access to assets is limited to authorized individuals 4. Accounting records of assets are compared to existing assets at reasonable intervals and appropriate action is taken with respect to any differences
Accounting Department
1. Under the direction of the controller 2. Responsible for all accounting functions and often, the design and implementation of internal control
Corrective Control
1. Used to remedy a situation when detective controls discover a misstatement 2. Ex: maintaining backup copies of key transactions and master files to allow the correction of date entry errors
Audit Decision Aid
A checklist, standard form, or computer program that helps the auditors make a particular decision by ensuring that they consider all relevant information or by assisting them in combining the information to make the decision
Material Weakness
A deficiency in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company's financial statements will not be prevented or detected on a timely basis
Significant Deficiency
A deficiency in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company's financial reporting
The Committee of Sponsoring Organizations (COSO) defines internal control as
A process, effected by the entity's board of director, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance
Entity-level risks
Arise from external or internal factors such as economic, regulatory, technology, and personnel factors
Supervisory Controls
Assess whether other transaction control activities are operating properly. Typically aimed at high-risk transactions
Financing Cycle
Authorizing, executing, and recording transactions involving bank loans, leases, bonds payable, and capital stock
Difference between control objectives and assertions
Control objectives are broader in that they relate not only to financial reporting but also to operations and compliance
Section 404(a) of SOX requires
Each annual report filed with the SEC include a report in which management 1. Acknowledges its responsibility for establishing and maintaining adequate internal control over financial reporting 2. Provides an assessment of internal control effectiveness as of the end of the most recent fiscal year
Acquisition Cycle
Initiating purchases of inventory, other assets, and services; placing purchase orders, inspecting good upon receipt, and preparing receiving reports; recording liabilities to vendors; authorizing payment; and making and recording cash disbursements
Internal auditors investigate and appraise
Internal control and the efficiency with which the various units of the organization are performing their assigned functions, and they report their findings and recommendations to management and the audit committee
Major instruments of corporate governance
Management compensation systems, board of directors, external auditors, internal auditors, attorneys, regulators, creditors, securities analysts, and internal control systems
Separate evaluations
Monitoring activities that are performed on a non-routine basis, such as periodical audits by the internal auditors
Internal controls vary from organization to organization based on factors like
Organization size, nature of operations, and objectives
Compensating Control
Reduces the risk that an existing or potential control weakness will result in a misstatement
Ongoing monitoring evaluations include
Regularly performed supervisory and management activities, such as continuous monitoring of customer complaints, or reviewing the reasonableness of management reports
Reduction
Response involves taking action to reduce risk likelihood or impact or both. May involve managing the risk or adding additional controls to process
For assertions with a low risk of material misstatement, the auditors will _____ for that assertion.
Restrict or possibly eliminate substantive procedures
The cost of an organization's internal control __________ exceed the benefits expected to be obtained
Should not
Risk Tolerance
The acceptable level of variation in performance relative to the achievement of objectives
Management's risk assessment is primarily concerned with
The areas of operations and compliance and internal reporting
Section 404(b) of SOX requires
The company's auditors to attest to, and report on, internal control over financial reporting
Auditors' understanding of internal control should encompass
The control environment, risk assessment, control activities, the accounting information and communication system, and monitoring
Transaction Cycle
The policies and the sequences of procedures for processing a particular type of transaction
Planned assessed level of control risk
The preliminary assessments of control risk
Corporate Governance
The set of rules, processes, and laws by which businesses are operated, regulated, and controlled
The old definition of internal control
The steps taken by a business to prevent fraud - both the misappropriation of assets and fraudulent financial reporting
How must auditors respond when a client uses the service of a service organization?
They must obtain an understanding of how the entity uses the services of the service organization, including the nature and significance of the services and the effect on internal control
If internal auditors provide direct assistance to external auditors, how should the external auditors respond?
They should direct, supervise, review, and test the work that they perform
Management review controls
Those that operate through management review of information for evidence of errors, fraud, or breakdowns in other controls
Walk-through
Tracing one or two transactions through each step in the cycle
Risk Assessment Procedures
Used to obtain an understanding of internal control and to design the nature, timing, and extent of further audit procedures
General authorization
When management establishes criteria for acceptance of a certain type of transaction
Deficiency in Internal Control
When the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect material misstatements on a timely basis
Specific authorization
When transactions are authorized on an individual basis
Internal auditors are interested in determining
Whether each branch or department has a clear understanding of its assignment; is adequately staffed; maintains good records; properly safeguards cash, inventories, and other assets; and cooperates harmoniously with other departments