1. module 3
Park Avenue CPA Review
Joseph A. Maffia, CPA

2.
Joseph A. Maffia, CPA

3. Understanding Internal control
The second standard of fieldwork states:
A sufficient understanding of the entity and its environment, including internal control, to assess the risk of material misstatement of the financial statements whether due to error or fraud to design the nature timing and extent of further audit procedures. 2 2

4. Summary of Internal Control Definition
A process, effected by the entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding, achievement of (the entity’s) objectives on:
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with applicable laws and regulations 2 2

5. Control Objectives
In each area of internal control (financial reporting, operations and compliance)
Control objectives and
Sub objectives exist
Example: Area of financial reporting
Top level objective – prepare and issue reliable financial information
Detailed level applied to A/R sub objectives
All goods shipped are accurately billed in the proper period
Invoices are accurately recorded for all authorized shipments and only for such shipments
Authorized and only authorized sales returns and allowances are accurately recorded
The continued completeness and accuracy of A/R is ensured
Accounts receivable records are safeguarded

6. Controls over Financial Reporting
Preventive
Aimed at avoiding the occurrence of misstatements in the financial statements
Example: Segregation of duties
Detective
Designed to discover misstatements after they have occurred
Example: Monthly bank reconciliations
Corrective
Needed to remedy the situation uncovered by detective controls
Example: Backups of master file
Controls overlap
Complementary – function together
Redundant – address same assertion or control objective
Compensating – reduces risk existing weakness will result in misstatement

7. Components of Internal ControlCA
CERAMIC 3 3

8. Components of Internal Control
The Control Environment
Risk Assessment
The Accounting Information and Communication System
Control Activities
Monitoring 3 3

9. Control Environment Factors “ICHAMBO”
Integrity and ethical values
Commitment to competence
Human resource policies and practices
Assignment of authority and responsibility
Management philosophy and operating style
Board of directors or audit committee
Organizational structure 4 4

10. Control Activities “PIPS”
Performance reviews ( reviews of act vs. budget, forecasts, etc)
Information processing (controls that check accuracy, completeness and authorization of transactions.
Physical controls ( activities that assure the physical security of assets and records)
Segregation of duties ( separate authorization, recording, and custody) 4 4

11. Control Activities Monitoring
Internal Control Performance over time
Ongoing – recurring activities
Separate evaluations
Combination 4 4

12. COSO Components Defined
Control Environment
The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility and organizes and develops its people; and the attention and direction provided by the board of directors.
Risk Assessment
Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.
Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

13. COSO Components Defined (cont.)
Information and Communication
Pertinent information must be identified, captured and communicated in a form and timeframe that enables people to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream. There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.
Monitoring
Internal control systems need to be monitored -- a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

14. Financial Statement Assertions
Relevant assertions are those that, without regard for controls, have a reasonable possibility of containing a material misstatement; types
Assertions about account balances (Accounts)
Assertions about classes of transactions and events (Transactions)
Assertions about presentation and disclosure (Disclosures)

15. Financial Statement Assertions: Auditing Standards Board and International Standards
Accounts
Transactions
Disclosures
Existence
Occurrence
Rights and obligations
Completeness
Valuation and allocation
Accuracy
Accuracy and valuation
Cutoff
Classification
Classification and understandability

16. Combined Assertions “PERVC”
Presentation and Disclosure--Accounts are described and classified in accordance with generally accepted accounting principles, and financial statement disclosures are complete, appropriate, and clearly expressed
Existence or Occurrence--Assets, liabilities, and equity interests exist and recorded transactions have occurred
Rights and Obligations--The company holds rights to the assets, and liability are the obligations of the company
Valuation, Allocation and Accuracy—All transactions, assets, liabilities and equity interests are included in the financial statements at proper amounts
Completeness and Cutoff--All assets, liabilities, equity interests, and transactions that should have been recorded have been recorded. Transactions and events have been recorded in the correct accounting period 2 2

17. Documenting the Understanding of Internal Control
Questionnaires
Typically standardized by firm
Written Narratives
Memos that describe flow of transactions
Flowcharts
Systems flowcharts
Walk-through
Trace one or two transaction through cycle
Decision tables 11

19. Limitations of Internal Control
Errors may arise from misunderstandings of instructions, mistakes of judgment, fatigue, etc.
Controls that depend on the segregation of duties may be circumvented by collusion
Management may override the structure
Compliance may deteriorate over time
Cost constraints
Custom and cultural limitations 7 9

20. Foreign Corrupt Practices Act
Passed in 1977 in response to American corporation practice of paying bribes and kickbacks to officials in foreign countries to obtain business
The Act
Requires an effective system of internal control
Makes illegal payment of bribes to foreign officials
Applies to SEC corporations
Accurate set of books

21. Committee for sponsoring organizations of the Treadway Commission
American Accounting Association
AICPA
Financial Executives International
The Association for Accountants and Financial Professionals in Business
The Institute of Internal Auditors
Who are the sponsors?

22. The Committee of Sponsoring Organizations of the Treadway Commission (COSO), was formed in 1985 to improve the quality of financial reporting through business ethics, effective internal controls and corporate governance. Based on these principles, they developed and published the COSO framework in 1992 as a foundation for establishing internal control systems and determining their effectiveness.
Coso provides the framework for internal control – which is used to evaluate the internal control of an organization.

23. Auditors’ Overall Approach with Internal Control
Overall approach of an audit
1. Plan the audit
2. Obtain an understanding of the client and its environment, including internal control
3. Assess the risks of material misstatement and design further audit procedures
4. Perform further audit procedures
5. Complete the audit
6. Form an opinion and issue the audit report
Steps 2-4 relate most directly to the role of internal control in financial statement audits

24. Relationships Among Deficiencies
Deficiency in
Internal Control
Less than Significant Material
Significant Deficiency Weakness

25. PCAOB Audits
Integrated audits

26. Sarbanes-Oxley Act of 2002 Section 404
404(a) – requires annual report filed with SEC to include an internal control report
Management acknowledges responsibility for establishing and maintaining adequate internal control
Provides assessment of internal control effectiveness at end of fiscal year
404(b) – requires CPA firm to audit internal control and express an opinion on effectiveness of internal control. (Required for companies with a capitalization in excess of $75,000,000)

27. Management’s Report on Internal Control under Section 404a
Acknowledgment of responsibility for internal control
An assessment of internal control effectiveness as of the last day of the company’s fiscal yearn using suitable criteria
Support the evaluation with sufficient evidence

28. Approach to Audit of Internal Control under Section 404b
This section applies to public companies with a market capitalization of $75 million or more. For those companies, the auditors audit internal control as a part of an integrated audit as follows:
Plan the engagement
Use a top-down approach to identify the controls to test
Test and evaluate design effectiveness of internal control
Test and evaluate operating effectiveness of internal control
Form an opinion on effectiveness of internal control over financial reporting

29. Nature of an Integrated Audit
Auditors of public companies should report on:
Financial statements and
Internal control over financial reporting
Based on provisions of PCAOB Standard No. 5, the audits of internal control and financial reporting should be integrated

30. Management’s Responsibility
Accept responsibility for effectiveness
Evaluate the effectiveness using suitable criteria
Support the evaluation with sufficient evidence
Provide a report on internal control

31. Management’s Report on I/C
Report must:
State that it is management’s responsibility to establish and maintain adequate internal control.
Identify management’s framework for evaluating internal control.
Include management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the most recent fiscal period, including a statement as to whether internal control over financial reporting is effective.
Include a statement that the company’s auditors have issued an attestation report on management’s assessment.

32. Management Assessment
Management can be assisted by consultants but not by the CPA firm that conducts the audit of financial statements
Must understand definition of internal control adopted by the SEC
Evaluation must use an accepted “control framework” such as Internal Control-Integrated Framework created by COSO.
Must understand concepts of control deficiency, significant deficiency and material weakness

33. Objective of Management’s Evaluation of I/C
Provide a reasonable basis for its annual assessment
Process
Evaluate design effectiveness of controls
Evaluate operating effectiveness of internal control
Documentation of process
Reporting

34. Auditor’s Objective
Plan and perform the audit to obtain reasonable assurance about whether material weaknesses exist to express an opinion on company’s internal control over financial reporting
Evidence gathered as of date specified in management’s assessment – normally the last day of the company’s fiscal year

35. Audit Steps Plan the engagement
Use a top-down approach to identify controls to test
Test and evaluate design effectiveness of internal control
Test and evaluate operating effectiveness of internal control
Form an opinion on the effectiveness of internal control

36. Plan the Engagement
Efficient planning requires coordination with financial statement audit
Consider matters such as:
Client’s industry
Regulatory matters
Client’s business
Recent changes in client’s operations

37. Auditors’ Consideration of I/C
Difference between audit of internal control and audit of financial statements
Time period
Audit of internal control –as of date
Audit of financial statements – entire financial statement period
Differences between small and large clients
Degree of complexity of operations

38. Top-Down Approach

39. Top-Down Approach
Goal is to focus on testing those controls that are most important to auditor’s conclusion on internal control, avoiding those that are less important
Starts at top
Entity-level controls – those in control environment or monitoring components of internal control
Emphasize those relating to audit committee effectiveness, fraud, and period-end process
Direct or indirect effect

41. Significant Accounts and Disclosures
Account significant if reasonable possibility that it could contain a misstatement that individually or in aggregate has a material effect on financial statements
Factors
Size and composition.
Susceptibility of loss due to errors or fraud.
Volume of activity, complexity, and homogeneity of individual transactions.
Nature of the account.
Accounting and reporting complexity.
Exposure to losses.
Possibility of significant contingent liabilities.
Existence of related party transactions.
Changes from the prior period.

42. Identifying Relevant Assertions
Those that have meaningful bearing on whether account is presented fairly
(1) existence or occurrence;
(2) completeness;
(3) valuation or allocation;
(4) rights and obligations; and/or
(5) presentation and disclosure.

43. Design Effectiveness
Routine transactions are for recurring activities,
Examples: sales, purchases, cash receipts and disbursements, and payroll.
Nonroutine transactions occur only periodically; they generally are not part of the routine flow of transactions
Examples: transactions such as counting and pricing inventory, calculating depreciation expense, or determining prepaid expenses.
Accounting estimates are activities involving management’s judgments or assumptions,
Examples: determining the allowance for doubtful accounts, estimating warranty reserves and assessing assets for impairment

44. Likely Source of Misstatements
Understand the flow of transactions;
Verify points within the company’s processes at which a misstatement could arise that could be material;
Identify the controls management has implemented to address these potential misstatements; and
Identify the controls management has implemented to prevent or detect on a timely basis unauthorized acquisition, use, or disposition of the company’s assets that could result in a material misstatement.

45. Selecting Controls Not necessary to design tests of all controls
Redundant controls
Do not need to test if duplicate control is tested
Design tests for preventive and/or detective controls
Complementary controls
Should both be tested

46. Performing Walk-Throughs
Tracing a transaction from its origination through the company’s information system until it is reflected in the company’s financial reports
Provide evidence to:
Verify that they have identified points at which a significant risk of misstatement to a relevant assertion exists.
Verify their understanding of the design of controls, including those related to the prevention or detection of fraud.
Evaluate the effectiveness of the design of controls.
Confirm whether controls have been placed in operation (implemented).

47. Tests of Operating Effectiveness
Nature
Inquiries, inspections, observations and reperformance
Vary exact tests when possible
Timing
Sufficient period of time
Periodic controls – wait to after report date
Extent
Depend on frequency of control

48. Relationship Between Audits
Tests of controls
Same for internal control audit and financial statement audit
Evidence from internal control audit can be used for financial statement audit
Differences between audits
Objectives are different
Integrated audit
Testing should be spread through the year to satisfy both objectives

49. Effects of Internal Control Testing on Audit Substantive Procedures
Integrated audit requires tests of controls for all major account and relevant assertions
Will lead to decreased scope of substantive procedures
However, significant deficiencies or material weaknesses could lead to more substantive procedures
Not acceptable to omit substantive procedures completely

50. Effect of Substantive Procedures on Audit of Internal Control
Findings from substantive procedures may affect audit of internal control
Could provide evidence of effectiveness or ineffectiveness of internal control over financial reporting
Example: Identification of material misstatement in financial statements is indicative of at least a significant deficiency in internal control

51. Form an opinion Evaluate:
1. The results of their evaluation of the design,
2. The results of tests of the operating effectiveness of controls,
3. Negative results of substantive procedures performed during the financial statement audit, and
4. Any identified control deficiencies.

53. Circumstances Affecting the Auditors’ Opinions

54. Other Communication Requirements
Communicate in writing to management
All control deficiencies regardless of severity
To audit committee
Material weaknesses, significant deficiencies and that all deficiencies have been communicated to management
To board of directors
If conclude oversight of financial reporting and internal control is ineffective

55. Other Report
Reporting on Whether a Previously Reported Material Weakness Continues to Exist
Management believes material weakness has been eliminated
Auditor engaged to report on whether material weakness continues to exist
Engagement focused on evidence regarding material weakness

56. Integrated Audis for Nonpublic Companies
A nonpublic company may choose to have an integrated audit of its financial statements and its internal control. While the service is very similar to that for public companies, it differs as follows: