1. Section 404 Audits of Internal Control and Control Risk
Chapter 10

2. Learning Objective 1
Describe the three primary objectives of effective internal control.

3. Internal Control Objectives
Management has three broad objectives in
designing an effective internal control system
Reliability of
financial
reporting
Controls within a company encourage efficient and effective use of resources to optimize the company’s goals.
Management is responsible for preparing statements for investors, creditors and other users. Management has a legal and professional responsibility to be sure the information is fairly presented in accordance with the reporting frameworks such as GAAP or IFRS.
Efficiency/
effectiveness
of operations
Compliance
with laws and
regulations

4. Learning Objective 2
Contrast management’s responsibilities for maintaining and reporting on internal controls with the auditor’s responsibilities for understanding, testing, and reporting on internal controls.

5. Management’s Responsibilities for Establishing Internal Control
Management must establish and
maintain the entity’s internal controls
Management’s design and implementation
of internal controls is based on two key
underlying concepts:
Internal controls can never be completely effective, regardless of the care followed in their design and implementation.
A company should develop internal controls that provide reasonable but not absolute, assurance that the financial statements are fairly stated.
Management's responsibility for controls is consistent with the concept that management is responsible for the preparation of the financial statements.
Reasonable
assurance
Inherent
limitations

6. Management’s Section 404 Reporting Responsibilities
Management of all public companies
to issue an internal control report that
includes the following:
An acknowledgement of responsibility
for internal controls
Results of annual internal control
assessment
Management must also identify the framework used to evaluate the effectiveness of internal control.
procedures for financial reporting as of the end of the company’s fiscal year.
An assessment of the effectiveness of the internal control structure and
for financial reporting.
maintaining an adequate internal control structure and procedures
A statement that management is responsible for establishing and
2010 federal financial reform laws permanently exempted nonaccelerated filers from reporting on internal controls.

7. Management’s Assessment of Internal Controls
Management must first test the design of
internal controls over financial reporting.
Management must also test the operating
effectiveness of those controls.
For those controls that are deemed to be designed appropriately, management must test to see if those controls are operating as designed.
Management must evaluate whether the controls are designed and put in place to prevent or detect material misstatements in the financial statements. 7

8. Management’s Assessment of Internal Controls8

9. Auditor Responsibilities for Understanding Internal Control
Second GAAS fieldwork standard
Must assess control risk in every audit
Primarily concerned about controls over:
reliability of financial reporting
classes of transactions
Auditors emphasize internal control over classes of transactions rather than account balances because the accuracy of accounting system outputs depends heavily on the accuracy of inputs and processing (transactions).
Auditors have a significant responsibility for the discovery of material fraudulent financial reporting and misappropriation of assets (fraud) and direct-effect illegal acts.
The auditor is less concerned with controls that affect the efficiency and effectiveness of company operations because such controls may not influence the financial statements.
Financial statements are not likely to correctly reflect GAAP or IFRS if internal controls over financial reporting are inadequate.

10. Sales Transaction-related Audit Objectives

11. Auditor Responsibilities for Testing Internal Control
Obtains understanding of controls
Performs tests of controls:
significant account balances
classes of transactions
disclosures and related financial
statement assertions 11

12. Learning Objective 3
Explain the five components of the COSO internal control framework.

13. Five Components of Internal Control

14. The Control Environment
Integrity and ethical values
Commitment to competence
Board of directors or audit
committee participation
The control environment consists of the actions, policies, and procedures that reflect the overall attitudes of top management, directors, and owners of an entity about internal control and its importance to the entity.
Integrity and ethical values are the product of the entity’s ethical and behavioral standards as well as how they are communicated and reinforced in practice.
Competence is the knowledge and skills necessary to accomplish tasks that define an individual’s job.
The board of directors is essential for effective corporate governance because it has ultimate responsibility to make sure management implements proper internal control and financial reporting processes.

15. The Control Environment
Management’s philosophy
and operating style
Human resource
policies and practices
Organizational
structure
Management through its activities provides clear signals to employees about the importance of internal control.
The organization structure defines the existing lines of responsibility and authority.
The most important aspect of internal control is personnel.

16. Risk Assessment Identify factors that may increase risk
Estimate the significance of the risk
Assess the likelihood of the risk occurring
This is management’s assessment of the risk factors related to the preparation of the financial statements inconformity with appropriate accounting standards.
Determine actions necessary to manage the risk

17. Control Activities 1. Adequate separation of duties
2. Proper authorization of transactions and activities
3. Adequate documents and records
4. Physical control over assets and records
Control activities are the policies and procedures that help ensure that necessary actions are taken to address risks to the achievement of the entity’s objectives.
5. Independent checks on performance

18. Adequate Separation of Duties
Custody of assets
from
Accounting
Authorization
of transactions
from
The custody of
related assets
Operational
responsibility
from
Record-keeping
responsibility
IT duties
from
User departments

19. Proper Authorization of Transactions and Activities
Transaction Approval Policies
General
Authorization
Specific
Authorization
Management establishes policies and subordinates are instructed to implement these general authorizations by approving all transactions within the limits set by the policy.
Specific authorization applies to individual transactions.

20. Adequate Documents and Records
Prenumbered consecutively
Prepared at the time of transaction
Designed for multiple use
Documents and records are the records upon which transactions are entered and summarized.
Constructed to encourage correct preparation

21. Physical Control Over Assets and Records
The most important type of protective
measure for safeguarding assets and
records is the use of physical precautions.
To maintain adequate internal control, assets and records must be protected.

22. Independent Checks on Performance
The need for independent checks arises
because internal control tends to change
over time unless there is a mechanism
for frequent review.
The need for independent checks arises because internal controls tend to change over time unless there is frequent review.

23. Information and Communication
The purpose of an accounting information
and communication system
Initiate
Maintain
Accountability
for Related Assets
The purpose of an accounting information and communication system is to initiate, record, process, and report
the entity’s transactions and to maintain accountability for the related assets.
Report
transactions
Record
Process

24. Monitoring Monitoring activities deal with management’s
ongoing and periodic assessment of the
quality of internal control performance…
to determine whether controls are operating
as intended and modified when needed.
For many companies, an internal audit department is essential for effective monitoring of the operating performance of internal controls.

25. Learning Objective 4
Obtain and document an understanding of internal control.

26. Process for Understanding Internal Control and Assessing Control Risk

27. Obtain and Document Understanding of Internal Control
Auditing standards require auditors to obtain
an understanding of internal control for every
audit.
Procedures to obtain an understanding:
Design of internal controls
Whether placed in operation
Uses this information as a basis for the
integrated audit

28. Methods Used
Narrative
Flowchart
Internal
control
questionnaire

29. Narrative 1. The origin of every document and record in the system
2. All processing that takes place
3. The disposition of every document
and record in the system
4. An indication of the controls relevant
to the assessment of control risk

30. Evaluating Internal Control Operation
Update and evaluate auditor’s previous
experience with the entity
Make inquiries of client personnel
Examine documents and records
Observe entity activities and operations
Perform walk-throughs of the accounting system

31. Learning Objective 5
Assess control risk by linking key controls, significant deficiencies, and material weaknesses to transaction-related audit objectives.

32. Assess Control Risk Assess whether the financial statements
are auditable.
Determine assessed control risk supported
by the understanding obtained assuming
the controls are being followed.
A preliminary assessment of control risk is made as part of the auditor’s overall assessment of the risk of material misstatement.
Use a control risk matrix to assess
control risk.

33. Control Risk Matrix Many auditors use the control risk matrix
to assist in the control risk assessment
process.
The purpose of the risk matrix is to provide a convenient way to organize assessing control risk for each audit objective.

34. Control Risk Matrix Identify audit objectives
Identify existing controls
Associate controls with related audit objectives
Identify and evaluate control deficiencies,
significant deficiencies, and material weaknesses

35. Evaluating Significant Control Deficiencies
A control deficiency exists if the design or operation of controls does not permit company personnel to prevent or detect misstatements on a timely basis.
A significant deficiency exists if one or more control deficiencies exist that is less severe than a material weakness, but important enough to merit attention by those responsible for oversight.
A material weakness exists if a significant deficiency by itself or in combination with other significant deficiencies, results in a reasonable possibility that internal control will not prevent or detect material financial statement misstatements on a timely basis.

36. Identify Deficiencies and Material Weaknesses
Identify existing controls
Identify the absence of key controls
Consider the possibility of compensating controls
Decide whether there is a significant deficiency
or material weakness
Determine potential misstatements that could result

37. Communications to Those Charged with Governance
Auditor must communicate in writing
significant deficiencies and material
weaknesses to the audit committee
Management letters from the auditor
less significant control weaknesses
ideas for operational improvements

38. Learning Objective 6
Describe the process of designing and performing tests of controls.

39. Tests of Controls The procedures to test effectiveness of controls
in support of a reduced assessed control
risk are called tests of controls.

40. Procedures for Tests of Controls
Inquire of
client personnel
Examine
documents,
records, reports
Reperform
client
procedures
Observe
control-related
activities

41. Extent of Procedures Reliance on evidence from prior year’s audit
Testing of controls related to significant risks
Testing less than the entire audit period
Auditing standards require tests of the controls’ effectiveness at least every third year. If controls have changed since it was last tested, they should test it in the current year.
Significant risks are those risks that the auditor believes require special audit consideration.
PCAOB standard 5 requires the auditor to perform tests of controls that are adequate to determine whether controls are operating effectively at year-end.

42. Relationship of Assessed Control Risk and Extent of Procedures
Type of
procedure
High level:
Procedures to obtain
an understanding
Lower level:
Tests of controls
Inquiry
Documentation
Observation
Reperformance
Yes–extensive
Yes–with transaction
walk-through No
Yes–some
Yes–using sampling
Yes–at multiple times
There is significant overlap between tests of controls and procedures to obtain an understanding both include inquiry, documentation and observation.
Two primary differences in the application of these common procedures:
procedures to obtain an overall understanding are applied to all controls. Tests of controls are applied only when the control risk has not been satisfied.
Procedures to obtain an understanding are applied to only a few transactions. Tests of controls are applied on larger samples of transactions.

43. Decide Planned Detection Risk and Design Substantive Tests
Control risk
assessment
process results
Planned
detection
risk
Tests of
controls
Related
substantive
tests
The auditor uses the results of the control risk assessment process and tests of controls to
determine the planned detection risk and related substantive tests.
The auditor links the control risk assessments to the balance-related audit objectives.
Balance
related audit
objectives
Control risk
assessments

44. Learning Objective 7
Understand Section 404 requirements for auditor reporting on internal control.

45. Section 404 Reporting on Internal Control
The scope of the auditor’s report on internal control
is limited to obtaining reasonable assurance that
material weaknesses in internal control are
identified.

46. No material weaknesses
Types of Opinions
No material weaknesses
No scope restrictions
Unqualified
One or more
material weaknesses
Adverse
Scope limitation
Qualified or
disclaimer

47. Learning Objective 8
Describe the differences in evaluating, reporting, and testing internal control for nonpublic companies.

48. Evaluating, Reporting, and Testing Internal Control for Nonpublic Companies
1. Reporting requirements
2. Extent of required internal controls
3. Extent of understanding needed
In audits of nonpublic companies, there is no requirement for an audit of internal control over financial reporting.
The auditor is required by auditing standards to issue a written report on significant deficiencies and material weaknesses in internal control to those charged with governance.
Management is responsible for establishing adequate internal controls in nonpublic companies just like management for public companies.
An auditor must have a sufficient understanding of internal control to assess control risk.
In non-public companies, there exists a greater chance control risk may be set at the maximum when controls are weak or nonexistent since public companies are expected to have effective controls for significant transactions and accounts.
Auditor will not perform tests on controls when control risk is set at the maximum.
4. Assessing control risk
5. Extent of tests of controls needed

49. Differences in Scope of Controls Tested
Internal controls over financial reporting
Internal controls used to assess
control risk below maximum
Controls that must be tested in
an audit of internal controls
Controls that must be tested in
an audit of financial statements

50. End of Chapter 10