Internal Controls: Purpose, Responsibilities & Audit

Internal Control

• A process effected by an entity's board, management, and personnel.
• The goal is providing assurance about achieving objectives in three categories.
• These categories include financial reporting reliability, operational effectiveness/efficiency, and compliance with laws/regulations.

Responsibilities for Internal Control

• Management is responsible for establishing and maintaining internal control over financial reporting.
• It must assess and report on the effectiveness of internal control over financial reporting.
• Auditors must audit and provide an opinion about the effectiveness of internal control over financial reporting (ICFR) for public companies.
• They must also evaluate if controls are in place to mitigate fraud risks, and must assess control risk.
• Control risk helps determine nature, timing, and extent of substantive audit procedures.

Relationship Between Internal Control Reliance and Audit Procedures

• Less reliance on internal control (higher control risk) means more effective tests, testing at year-end, and higher sample size.
• More reliance on IC (lower control risk) allows less effective tests, interim testing, and lower sample size.

Committee of Sponsoring Organizations (COSO)

• COSO was from the National Commission of Fraudulent Financial Reporting, aka the Treadway Commission.
• The organization looks to improve financial reporting.
• COSO member representatives include Financial Executives Institute (FEI), American Accounting Association (AAA), Institute of Internal Auditors (IIA).
• Other member representatives include Institute of Management Accountants (IMA), and American Institute of Certified Public Accountants (AICPA).
• The COSO website is www.coso.org.

Internal Control Components - COSO

• The framework features five components
• Identifies aspects like control environment (5 principles), risk assessment (4 principles), and control activities (3 principles).
• Also included are information and communication (2 principles), and monitoring (3 principles).
• This results in 17 principles associated with the components that affect internal control.

Control Environment

• Sets "tone at the top" and influences control consciousness.
• It acts as the foundation for all other components.
• Auditors need to obtain a detailed understanding and document it.

Principles of Control Environment - according to COSO Framework:

• Commitment to integrity and ethical values.
• Board demonstrates independence from management.
• Management establishes structure and appropriate authorities in pursuit of objectives.
• Commitment to competent individuals.
• Individuals held accountable for their internal control responsibilities.

Audit Committee

• A subcommittee of the board of directors with 3-6 members.
• Acts as a buffer between the audit team and operating management.
• All members must be financially literate.
• At least one member must be a financial expert.

Audit Committee Duties

• Appoints, compensates, and oversees the public accounting firm for entity's audit.
• Resolves disagreements between management and audit team.
• Oversees the entity's internal audit function.
• Approves any nonaudit services provided by the public accounting firm.
• Oversees the anonymous fraud hotline.
• Has authority to engage legal counsel in the event of management fraud.

Risk Assessment

• Management identifies, analyzes, and manages relevant risks to achieve its objectives.
• It also sets objectives and identifies success factors.
• Auditors focus on risk of material misstatement, especially due to fraud.

Principles of Risk Assessment - according to COSO Framework:

• Organization identifies and assesses changes that could significantly impact the internal control system.
• Organization considers the potential for fraud, with clear objectives to manage risks.

Control Activities

• Policies and procedures help ensure management directives are carried out by physical controls to secure assets, separation of duties and information processing.
• Information processing includes having approvals, authorization, verifications and reconciliations
• Management Review Controls are also used
• Includes preventative vs. detective controls.

Principles of Control Activities - according to COSO Framework:

• The organization deploys control activities through policies establishing expectations and procedures.
• The organization selects and develops control activities contributing to risk mitigation, and general control activities, using technology

Separation of Duties

• Functions should be performed by different people/departments.
• Four types are: authorization, recording, custody, and reconciliation.
• Incompatible responsibilities are combinations of responsibilities creating opportunity to create/conceal misstatements.
• Separating duties makes fraud more difficult, requiring collusion.

Information and Communication

• Auditors must understand the data systems used in areas related to financial reporting.
• Auditors can never fully rely on data provided until investigation.
• Information systems create an "audit trail" of activities.

Principles of Information and Communication - according to COSO Framework:

• Organization uses relevant information, in quality, for supporting effective control
• Organization internally communicates control responsibilities and objectives, while communicating with external parties about effective control.

Monitoring

• A well functioning monitoring system is characterized by these philosophies: ongoing/separate evaluations and reporting deficiencies.
• Management evaluates of the controls, including periodic evaluation by internal auditing, supervisory reviews of controls, and f/u on customer complaints.

Principles of Monitoring Activities - according to COSO Framework

• Organization selects, develops, and performs reviews to ascertain if control components function.
• Organization communicates control deficiencies to those responsible for action, senior management and the board alike

Limitations of Internal Control

• Human error, collusion, and management override.
• Cost/benefit analysis.
• Trade off between cost and effectiveness.
• The concept of reasonable assurance recognizes that the cost of IC should not outweigh related benefits.

Internal Control Evaluation Phases:

• Phase 1: Understand and document client's internal control.
• Phase 2: Assess control risk (preliminary).
• Phase 3: Identify controls to test and perform tests of controls.

Phase 1:

• Obtain understanding and document it.
• Documentation can be performed top-down.
• Top down manner includes:
  • Identify accounts that are significant, and their related assertions.
  • Determine significance using inherent risk

Identifying Entity-Level Controls

• Pervasive to internal control system and reliability of the financial statements.

Identifying Transaction-Level Controls

• Relate to specific classes of transactions, account balances, and disclosures.
• Auditors obtain through walkthroughs, to determine design effectiveness.

Document Internal Control Understanding

• Must be able to document its understanding of an internal control system.
• Includes Narrative Description (common), questionnaires or Flowcharts

Key Decision: Deciding Whether to Test Controls

• Too ineffective at preventing, therefore, they test substantive evidence
• For non-issuers, it may take more time to test the controls.

Phase 2: Assess the Control Risk (Preliminary)

• Identify internal control activities designed to support financial reporting.
• Consider cost effectiveness of reliance/testing,
• Determine if controls are preventative/detective, automated/manual, and how often the control is preformed
• This phase is often with phase 1

Phase 3: Identify Controls to Test and Perform Test of Controls

• Two common approaches are by nature
  • test items from population: Automated R/R analysis for amount owed with credit limit
  • testing sample: audit sampling

Tests of Controls

• Testing specific controls will reduce substantive testing.
• A hierarchy of tests exists, with least persuasive being inquiry, and most, reperformance.
• These tests are followed by Observation of control and review and the test directions do matter.

Evaluating ICFR Effectiveness - phases of engagement

• Planning, Using a top-down approach, Testing controls, Evaluating deficiencies, Wrapping up and Reporting on internal control

Step 1: Planning the Engagement

• Significant accounts, locations, and assertions must be identified.
• Inherent risk should be used to determine nature, timing, and extent of tests.
• All relevant assertions should be present on evaluating controls

Step 2: Using a Top-Down Approach

• Integrates integrity from financial process
• Identifies entity-level controls that is highly impactful
• Significant accounts and disclosures should be identified as well as their relevant assertions; a perform assessment is required to maintain.

Step 3: Testing Controls

• Auditors test and decide controls
• Tests of operating effectiveness like inquiry, observation,.inspection etc
• If design isn't effective testing is skipped

Step 4: Evaluating Identified Deficiencies

• A deficiency exists when a control design or operation cannot prevent misstatements.
• Two main groups:
  • Material weaknesses -Significant deficiencies

Evaluating Identified - Material Weaknesses

• A deficiency, or combination of deficiencies, resulting in a reasonable possibility that a misstatement would not be prevented/detected on time.
• Indicators of possible material weakness: restatement of issued statements., misstatements evidence, ineffective oversight and fraud indication

Step 5: Wrapping Up

• Can issue 3 opinions after audit -Unqualified: No weaknesses, Disclaimer: team cannot perform -Adverse: weaknesses are detected

Step 6: Reporting on Internal Control

• Reporting has 2 separate report options
• Report details overall, and then details fairness of financial statements, and internal of controls.
• Or, auditors may include reports of fairness, as well as of internal controls

Explore the primary purpose, responsibilities, and auditing of internal controls. Understand management's role, auditor's responsibilities regarding fraud risks, and the impact of control risk assessment on audit procedures. Learn about improving operational efficiency through internal controls.