1. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Chapter 10 10-1

2. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-2 Describe the three primary objectives of effective internal control. Contrast management’s responsibilities for maintaining internal control with the auditor’s responsibilities for evaluating and reporting on internal control. Explain the five components of the COSO internal control framework. Obtain and document an understanding of internal control.

3. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-3 Assess control risk by linking key controls and control deficiencies to transaction-related audit objectives. Describe the process of designing and performing tests of controls. Understand Section 404 requirements for auditor reporting on internal control. Describe the differences in evaluating, reporting, and testing internal control for nonpublic companies.

4. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Describe the three primary objectives of effective internal control. 1 1 10-4

5. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-5 Management has three broad objectives in designing an effective internal control system Compliance with laws and regulations Reliability of financial reporting Efficiency/ effectiveness of operations

6. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Contrast management’s responsibilities for maintaining and reporting on internal controls with the auditor’s responsibilities for understanding, testing, and reporting on internal control. 2 2 10-6

7. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-7  Management must establish and maintain the entity’s internal controls  Management’s design and implementation of internal controls is based on two key underlying concepts:  Reasonable assurance  Inherent limitations

8. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-8 Management of all public companies are required to issue an internal control report that includes the following:  An acknowledgement of responsibility for internal controls  Results of annual internal control assessment

9. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-9  Management must evaluate the design of internal controls over financial reporting.  Management must also test the operating effectiveness of those controls.

10. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-10

11. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-11  Must assess control risk in every audit  Primarily concerned about controls over: reliability of financial reporting classes of transactions

12. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-12

13. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-13  Obtains understanding of controls  Performs tests of controls: significant account balances classes of transactions disclosures and related financial statement assertions

14. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Explain the five components of the COSO internal control framework. 3 3 10-14

15. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-15

16. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-16  Integrity and ethical values  Commitment to competence  Board of directors or audit committee participation

17. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-17 Management’s philosophy and operating style Human resource policies and practices Organizational structure

18. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-18  Identify factors that may increase risk  Estimate the significance of the risk  Assess the likelihood of the risk occurring  Determine actions necessary to manage the risk

19. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-19 1. Adequate separation of duties 2. Proper authorization of transactions and activities 3. Adequate documents and records 4. Physical control over assets and records 5. Independent checks on performance

20. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-20 Custody of assets Authorization of transactions Operational responsibility IT duties from Accounting The custody of related assets Record-keeping responsibility User departments

21. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-21 Transaction Approval Policies General Authorization Specific Authorization

22. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-22  Prenumbered consecutively  Prepared at the time of transaction  Designed for multiple use  Constructed to encourage correct preparation

23. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-23 The most important type of protective measure for safeguarding assets and records is the use of physical precautions.

24. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-24 The need for independent checks arises because internal control tends to change over time, unless there is frequent review.

25. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-25 The purpose of an accounting information and communication system Initiate Record Process Report transactions Maintain Accountability for Related Assets

26. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-26 Monitoring activities deal with management’s ongoing and periodic assessment of the quality of internal control performance… to determine whether controls are operating as intended and modified when needed.

27. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Obtain and document an understanding of internal control. 4 4 10-27

28. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-28

29. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-29 Auditing standards require auditors to obtain an understanding of internal control for every audit. Procedure to obtain an understanding:  Inspection  Inquiry of entity personnel  Observation of employees

30. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-30 Narrative Flowchart Internal control questionnaire

31. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-31 1. The origin of every document and record in the system 2. All processing that takes place 3. The disposition of every document and record in the system 4. An indication of the controls relevant to the assessment of control risk

32. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-32  Update and evaluate auditor’s previous experience with the entity  Make inquiries of client personnel  Examine documents and records  Observe entity activities and operations  Perform walk-throughs of the accounting system

33. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Assess control risk by linking key controls and control deficiencies to transaction-related audit objectives. 5 5 10-33

34. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-34 Assess whether the financial statements are auditable. Determine assessed control risk supported by the understanding obtained. Use a control risk matrix to assess control risk.

35. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-35 Many auditors use the control risk matrix to assist in the control risk assessment process at the transaction level.

36. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-36  Identify audit objectives  Identify existing controls  Associate controls with related audit objectives  Identify and evaluate control deficiencies, significant deficiencies, and material weaknesses

37. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-37

38. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-38  Identify existing controls  Identify the absence of key controls  Consider the possibility of compensating controls  Decide whether there is a significant deficiency or material weakness  Determine potential misstatements that could result

39. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-39  Auditor must communicate in writing significant deficiencies and material weaknesses to the audit committee  Management letters from the auditor  Less significant control weaknesses  Ideas for operational improvements

40. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Describe the process of designing and performing tests of controls. 6 6 10-40

41. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-41 The procedures to test effectiveness of controls in support of a reduced assessed control risk are called tests of controls.

42. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-42 Inquire of client personnel Reperform client procedures Examine documents, records, reports Observe control-related activities

43. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-43  Reliance on evidence from prior year’s audit  Testing of controls related to significant risks  Testing less than the entire audit period

44. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-44 Assessed Control Risk Type of procedure High level: Procedures to obtain an understanding Lower level: Tests of controls Inquiry Inspection Observation Reperformance Yes–extensive Yes–with transaction walk-through Yes–with transaction walk-through No Yes–some Yes–using sampling Yes–at multiple times Yes–using sampling

45. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-45 Control risk assessment process results Tests of controls Control risk assessments Planned detection risk Related substantive tests Balance related audit objectives

46. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Understand Section 404 requirements for auditor reporting on internal control. 7 7 10-46

47. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-47 The scope of the auditor’s report on internal control is limited to obtaining reasonable assurance that material weaknesses in internal control are identified.

48. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-48 No material weaknesses No scope restrictions One or more material weaknesses Scope limitation Unqualified Adverse Qualified or disclaimer

49. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. Describe the differences in evaluating, reporting, and testing internal control for nonpublic companies. 8 8 10-49

50. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-50 1. Reporting requirements 2. Extent of required internal controls 3. Extent of understanding needed 4. Assessing control risk 5. Extent of tests of controls needed

51. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-51 Internal controls over financial reporting Internal controls used to assess control risk below maximum Controls that must be tested in an audit of internal controls Controls that must be tested in an audit of financial statements

52. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-52

53. Copyright © 2014 Pearson Education, Inc. Publishing as Prentice Hall. 10-53 Copyright All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher. Printed in the United States of America.