Internal Control Basics

Internal Control

• A system of internal control comprises policies and procedures designed to give management reasonable assurance the company achieves goals and objectives.
• These policies and procedures are known as controls, collectively forming the entity's Internal Control.

Internal Control Objectives

• Management has three primary goals in designing an effective internal control system:
  • Compliance with laws and regulations
  • Reliability of financial reporting
  • Efficiency and effectiveness of operations
• Auditors, unlike management, do not include efficiency and effectiveness of operations in their internal control objectives.

Responsibilities for Internal Control

• Management is responsible for establishing, maintaining, testing, and reporting on the operating effectiveness of the entity's internal control.
• Management's internal control design and implementation is based on reasonable assurance and inherent limitations.
• Auditors are responsible for understanding internal control, testing, and reporting on its operating effectiveness.
• Auditors assess control risk to design the nature, timing, and extent of further audit procedures.

Five Components of Internal Control (COSO Framework)

• Control Environment: Policies and procedures reflecting top management's attitude, directors', and owners' views about internal control and its value to the entity.
• Risk Assessment: Management's process for looking at how they assess material risks that may arise, evaluating their significance, and the likelihood of occurring, including rapid technological changes and new competitor entry.
• Control Activities: Policies and procedures to ensure necessary actions are taken to handle risks, including adequate separation of duties, proper authorization, appropriate documents/records, physical asset control, and independent checks on performance.
• Information and Communication: Purposeful accounting information and communication systems for initiating, recording, processing, reporting transactions and maintaining accountability for related assets.
• Monitoring: Ongoing and periodic assessment of internal control quality by management to ascertain whether controls work as intended and are modified if necessary.

Process for Understanding Internal Control and Assessing Control Risk

• Phase 1: Obtain and document an understanding of the internal control design and operation.
• Phase 2: Assess control risk.
• Phase 3: Design, perform, and evaluate tests of controls.
• Phase 4: Decide planned detection risk and design substantive tests.

Obtain and Document Understanding of Internal Control Design and Operation

• Auditing standards require auditors to obtain and document an understanding of internal control for each audit.
• Auditors must consider whether the designed controls are implemented in practice, in addition to the design.

Assess Control Risk

• Auditors evaluate if financial statements are auditable.
• Determine assessed control risk, assuming controls are operational.
• Use a control risk matrix to evaluate control risk.

Identification of Deficiencies and Material Weaknesses

• Auditors identify existing controls.
• Auditors identify the absence of key controls.
• Auditors consider compensating controls.
• Auditors decide whether there are significant deficiencies or material weaknesses.
• Auditors identify potential misstatements.

Tests of Controls

• Procedures to help test effectiveness of control in support of a reduced assessed control risk are called tests of controls.

Procedures for Tests of Controls

• Inquire of client personnel
• Reproform client procedures
• Examine documents, records, reports
• Observe control-related activities

Decide Planned Detection Risk and Design Substantive Tests

• The results of the control risk assessment process and tests of controls inform the planned detection risk and subsequent substantive tests.

Section 404 Reporting on Internal Control

• The scope of the auditor's report on internal controls is limited to obtaining reasonable assurance that material weaknesses in internal control are identified.

Types of Opinions

• Unqualified: No material weaknesses, no scope restrictions.
• Adverse: One or more material weaknesses.
• Qualified or Disclaimer: Scope limitation.

Communications to Those Charged with Governance

• Auditors must communicate significant deficiencies and material weaknesses in writing to the audit committee.
• Management letters from auditors contain less significant control weaknesses and ideas for operational improvements.