Internal Control Notes

INTERNAL CONTROL I. SOME GENERAL COMMENTS ON INTERNAL CONTROL ♦ Companies establish internal control (IC) to aid the company in more effectively meeting its goals. ♦ It is management’s responsibility to maintain adequate internal controls. ♦ Since 1977, the Foreign Corrupt Practices Act (FCPA) requires companies to maintain an adequate system of internal control. ♦ Companies rely on I/C to ensure material errors and irregularities do not occur or, if they do occur, to ensure that they are discovered promptly by the company. II. DEFINITION OF INTERNAL CONTROL The Committee of Sponsoring Organizations of the Treadway Commission (called the COSO committee) has defined internal control as a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of OBJECTIVES in the following categories: ∗ ∗ ∗ Reliability of financial reporting Operational effectiveness and efficiency Compliance with applicable laws and regulations The internal control OBJECTIVES are achieved through five COMPONENTS, which are: CONTROL ENVIRONMENT Sets the tone of the organization toward control consciousness. INFORMATION SYSTEM AND COMMUNICATION Establishment of an information system to manage and communicate the organization’s activities and prepare financial statements. RISK ASSESSMENT Identification, analysis and management of risks affecting the organization. CONTROL ACTIVITIES Policies and control procedures to address risks and accomplish management objectives. MONITORING Mechanisms to provide feedback on whether internal control is operating effectively. 1 A. CONTROL ENVIRONMENT - which reflects the overall attitude, awareness and actions of the board of directors, management, owners and others concerning the importance of control and its emphasis in the entity. The seven factors which collectively affect the control environment are 1. 2. 3. 4. 5. 6. 7. Integrity and ethical values - code of conduct; use of appropriate incentive schemes Audit committee and Board of Directors - oversee accounting policies and practices Philosophy of management and operating style - attitude toward financial reporting, approach to risk Assignment of authority and responsibility Commitment to competence - ensuring competence, requisite skills, knowledge for particular jobs Human resource policies and procedures - sufficient, competent personnel with adequate resources Organizational structure - assigns authority and responsibility Note: The auditor considers the collective effect of these various factors on the control environment. B. INFORMATION SYSTEM AND COMMUNICATION The information and communication component includes the accounting system. The accounting system consists of the methods and records established to record, process, summarize and report an entity’s transactions and to maintain accountability for the related assets and liabilities. ♦ ♦ ♦ ♦ ♦ Identify and record all valid transactions. This objective concerns the financial statement assertions of existence or occurrence and completeness. Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions for financial reporting. This objective concerns the financial statement assertion of presentation and disclosure. Measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements. This objective concerns the financial statement assertion of valuation or allocation. Determine the time period in which transactions occurred to permit recording of transactions in the proper accounting period. This objective concerns the financial statement assertions of existence or occurrence and completeness. Present properly the transactions and related disclosures in the financial statements. This objective concerns the financial statement assertions of rights and obligations and presentation and disclosure. 2 Communication involves providing a clear understanding of individuals’ responsibilities for internal control over financial reporting, including reporting exceptions to an appropriate higher level within the entity. Communication takes such forms as policy manuals, accounting and financial reporting manuals, and memoranda. Communication can also be made orally and through the actions of management. C. RISK ASSESSMENT The purpose of an entity’s risk assessment is to IDENTIFY, ASSESS, AND MANAGE RISKS that affect the entity’s ability to accomplish its major objectives. Once risks are identified, management considers their significance, the likelihood of their occurrence, and how they should be managed. Management may initiate plans, programs, or actions to address specific risks or it may decide to accept a risk because of cost or other considerations. Risks can arise or change due to change in regulatory or operating environment, personnel, or information systems; rapid growth, and new technology, lines of business, products, or activities. D. 1. 2. 3. 4. 5. Rapid growth Corporate restructuring Accounting pronouncements New lines, products, or activities New technology 6. 7. 8. 9. New information systems New personnel Changes in the operating environment (e.g., increased competition) Foreign operations CONTROL ACTIVITIES (SAME AS CONTROL PROCEDURES) Control activities are the policies and procedures that help ensure that necessary actions are taken to address risks and achieve management’s objectives. Control activities can be thought of as: 1. Segregation of duties - the assignment of duties such that no one person is in a position to both perpetrate and conceal errors or irregularities in the normal course of processing information or data. Separate custody, authorization, recordkeeping. 2. Information processing - 1) general controls; 2) application controls to check accuracy, completeness; 3) authorization controls over transactions and 4) document controls. 3 a) E. Documents and records that are adequate to ensure proper recording (1) prenumbered (2) multiple copies (3) proper records for detail - control (4) exceptions investigated 3. Performance reviews, such as comparing actual with expected performance. 4. Physical controls, including those designed to 1) restrict access to computerized systems, 2) independent reconciliation of accounting records and the underlying physical assets and 3) safeguard assets. MONITORING The design and operation of internal control should be monitored by management to consider whether it is operating as intended and that it is modified on a timely basis for changes in conditions. Monitoring is a process that assesses the quality of the internal control system’s performance over time. Monitoring can be done through ongoing activities or separate evaluations, such as 1. 2. 3. 4. II. internal auditors continual management review of exception and operation reports periodic independent audit regulator’s suggestions for improvement review/response to customer complaints LIMITATIONS OF INTERNAL CONTROLS A. Management override B. Collusion C. Cost constraints (Cost of internal control should not exceed the benefits to be derived.) D. Mistakes, including mistakes in judgment. (Sometimes employees are careless, sometimes they misunderstand.) 4 INTERNAL CONTROL COMPONENT SUMMARY CONTROL ENVIRONMENT The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. INFORMATION SYSTEM & COMMUNICATION The information system relevant to financial reporting objectives, which includes the accounting system, consists of the methods and records established to record, process, summarize, and report entity transactions (as well as events and conditions) and to maintain accountability for the related assets, liabilities, and equity. Communication involves providing an understanding of individual roles and responsibilities pertaining to internal control over financial reporting. RISK ASSESSMENT An entity’s risk assessment for financial reporting purposes is its identification, analysis, and management of risks relevant to the preparation of financial statements that are fairly presented in conformity with generally accepted accounting principles. CONTROL ACTIVITIES Control activities are the policies and procedures that help ensure that management directives are carried out. MONITORING Monitoring is a process that assesses the quality of internal control performance over time. INTERNAL CONTROL COMPONENT DETAILS CONTROL ENVIRONMENT Factors are: 1. Integrity and ethical values 2. Audit committee and Board of Directors 3. Philosophy of Mgmt. and operating style 4. Assignment of authority and responsibility 5. Commitment to competence 6. Human resource policies and procedures 7. Organizational structure ACCOUNTING SYSTEM Objectives relating to transactions: 1. Identify and record all valid transactions 2. Record on a timely basis 3. Measure the value properly 4. Record in the proper period 5. Properly present & disclose RISK ASSESSMENT Risks can arise or change due to: 1. New Information System 2. Changes in the Operating Environment 3. New Lines, products, or activities 4. New Personnel on board 5. Rapid Growth 6. Corporate Restructuring 7. Accounting Pronouncements 8. Foreign Operations 9. New Technology CONTROL ACTIVITIES Specific procedures are: 1. Segregation of duties- custody, authorization, record keeping 2. Information Processing 3. Performance reviews 4. Physical MONITORING Examples include: 1. internal auditors 2. continual mgmt. review of exception and operation reports 3. periodic independent audit 4. regulator’s suggestions for improvement 5. review/response to customer complaints Miscellaneous notes: ♦ Inherent risk - susceptibility of an account balance or class of transactions to error(s) that could be material, assuming there were no related internal controls. ♦ Control risk - risk that material error(s) will not be prevented or detected on a timely basis by the internal controls. ♦ A test of control evaluates the operating effectiveness of internal control policies and effectiveness of internal control policies and procedures ♦ External auditors rely heavily on a company’s internal controls to determine how much substantive audit work must be done. Strong I/C - less audit work Weaker I/C - more audit work ♦ Internal auditors are an important part of a companies internal controls. ♦ Internal controls can be preventative or detective. In a manual environment detective controls are very important. In a computerized environment preventative controls become critical. 5 Number 1 (Estimated time -- 15 to 25 minutes) Smith, CPA, has been engaged to audit the financial statements of Reed Inc., a publicly held retailing company. Before assessing control risk, Smith is required to obtain an understanding of Reed’s control environment. Required: a) Identify additional control environment factors (excluding the factor illustrated in the example below) that establish, enhance, or mitigate the effectiveness of specific policies and procedures. b) For the control environment factors identified in a, describe the components that could be of interest to the auditor. Use the following format: Management Philosophy and Operating Style Management philosophy and operating style characteristics may include the following: management’s approach to taking and monitoring business risks; management’s attitudes and actions toward financial reporting; and management’s emphasis on meeting budget, profit and other financial and operating goals. (Answer on next page) 6 Answer 1 The control environment factors (excluding the factor illustrated in the example) that establish, enhance, or mitigate the effectiveness of specific policies and procedures, and their components are Integrity and ethical values. The effectiveness of controls cannot rise above the integrity and ethical values of the people who create, administer, and monitor them. Integrity and ethical values are essential elements of the control environment, affecting the design, administration, and monitoring of other components. Integrity and ethical behavior are the product of the entity’s ethical and behavioral standards, how they are communicated, and how they are reinforced in practice. They include management’s actions to remove or reduce incentives and temptations that might prompt personnel to engage in dishonest, illegal, or unethical acts. They also include the communication of entity values and behavioral standards to personnel through policy statements and codes of conduct and by example. Commitment to competence Competence is the knowledge and skills necessary to accomplish task that define the individual’s job. Commitment to competence includes management’s consideration of the competence levels for particular jobs and how those levels translate into requisite skills and knowledge. Board of directors or audit committee participation. An entity’s control consciousness is influenced significantly by the entity’s board of directors or audit committee. Attributes include the board or audit committee’s independence from management, the experience and stature of its members, the extent of its involvement and scrutiny of activities, the appropriateness of its actions, the degree to which difficult questions are raised and pursued with management, and its interaction with internal and external auditors. Management’s philosophy and operating style. Management’s philosophy and operating style encompass abroad range of characteristics. Such characteristics may include the following: management’s approach to taking and monitoring business risk; management’s attitudes and actions toward financial reporting (conservative or aggressive selection from available alternative accounting principles, and conscientiousness and conservatism with which accounting estimates are developed); and management’s attitudes toward information processing and accounting functions and personnel. Organizational structure. An entity’s organizational structure provides the framework within which its activities for achieving entitywide objectives are planned, executed, controlled, and monitored. Establishing a relevant organizational structure includes considering key areas of authority and responsibility and appropriate lines of reporting. An entity develops an organizational structure depends, in part, on its size and the nature of its activities. Assignment of authority and responsibility This factor includes how authority and responsibility for operating activities are assigned and how reporting relationships and authorization hierarchies are established. It also includes policies relating to appropriate business practices, knowledge and experience of key personnel, and resources provided for carrying out duties. In addition, it includes policies and communications directed at ensuring that all personnel understand the entity’s objectives, know how their individual actions interrelate and contribute to those objectives, and recognize how and for what they will be held accountable. Human resource policies and practices Human resource policies and practices related to hiring, orientation, training, evaluating, counseling, promoting, compensating, and remedial action for example, standards for hiring the most qualified individuals- with emphasis on educational background, prior work experience, past accomplishments, and evidence of integrity and ethical behavior- demonstrate an entity’s commitment to competent and trustworthy people. Training policies that communicate prospective roles and responsibilities and include practices such as training schools and seminars illustrate expected level of performance and behavior. Promotions driven by periodic performance appraisals demonstrate the entity’s commitment to the advance of qualified personnel to higher levels of responsibility. 7 IV. DOCUMENTATION TECHNIQUES Technique 1. questionnaire Advantages • easy to complete • comprehensive • weaknesses obvious 2. flowchart • • • • • • 3. narrative 4. decision tables • good for systems easy to follow fairly comprehensive detailed analysis tailor-made efficient means of describing IC decision • doesn’t document flow of system Decision tables are graphic methods of describing the logic of decisions. Various combinations of conditions are matched to one of several actions. In an internal control setting, the various important controls are reviewed and, based on the combination of answers received, an action is taken, perhaps a decision on whether to perform tests of controls. Conditions Rules 1. Segregation of functions adequate 2. Adequate documents Actions 1. Perform all relevant TC’s 2. Perform limited TC’s V. Disadvantages • may be completed without thought • standardized questionnaires • time consuming weaknesses not always obvious • same as flowchart 1 y y 2 y y 3 y n x x 4 y n 5 n y 6 n y 7 n n x x INTERNAL CONTROL DEFICIENCIES A. A reportable condition is a significant deficiency in the design or functioning of the internal controls that could adversely affect the entity’s ability to record, process, summarize and report financial data in F/S. Examples include: • • • Absence of appropriate segregation of duties consistent with appropriate control objectives Inadequate provisions for the safeguarding of assets Absence of a sufficient level of control consciousness within the organization 8 • • Evidence that employees or management lack the qualifications and training to fulfill their assigned functions Evidence of misrepresentation by client personnel to the auditor B. A reportable condition may be so significant as to be considered a material weakness in internal control. C. A material internal control weakness is a reportable condition in which the design or operation of the specific ICS elements do not reduce to a relatively low level the risk that errors or irregularities in amounts that would be material may occur and not be detected within a timely period by employees in the normal course of performing their assigned functions. D. An external auditor gives a report to the company on any reportable conditions found during the course of an audit. REPORTABLE CONDITIONS Deficiencies in Internal Control Design: • Inadequate overall internal control design. • Absence of appropriate reviews/approvals of transactions or accounting entries. • Inadequate procedures for appropriately assessing and applying accounting principles. • Absence of other control techniques considered appropriate for the type and level of transactions activity. • Evidence that a system fails to provide complete and accurate output that is consistent with objectives and current needs because of design flaws. • Evidence of failure of identified controls to prevent or detect misstatements of accounting information. • Evidence that a system fails to provide complete and accurate output consistent with the entity’s control objectives because of the misapplication of control procedures. • Evidence of failure to safeguard assets from loss, damage or misappropriation. • Evidence of intentional override of the internal control by those in authority to the detriment of the overall objectives of the system. • Evidence of failure to perform tests that are part of the internal control, such as reconciliations not prepared or not prepared on a timely basis. • Evidence of willful wrongdoing by employees or management. • Evidence of manipulation, falsification, or alteration of accounting records/documents. • Evidence of intentional misapplication of accounting principles. • Failure to follow up and correct previously identified internal control deficiencies. • Evidence of significant or extensive undisclosed related-party transactions. • Evidence of undue bias or lack of objectivity by those responsible for accounting decisions. 9