1. Richard F. Chambers, CIA, CGAP Vice President, IIA Learning Center The Institute of Internal Auditors

2. Annual Certification of Internal Controls The Internal Audit Department’s Role The Institute of Internal Auditors Webcast Series on Sarbanes-Oxley Session #2 - February 18, 2003

3. The Webcast Series on Sarbanes-Oxley’s Impact on Internal Auditing January 28 - Disclosure Controls - Available in online archive and on CD Rom February 18 - Annual Certification of Internal Controls April 1 - Coordination of Internal & External Audit Work April 15 - Looking Ahead to Future Changes Impacting Internal Auditing Tuesdays from 1:00 - 2:30 p.m. EST

4. 1:00 - 1:10 Introduction & Overview of Annual Certification of Controls - Richard Chambers 1:10 - 1:17Documentation Tools - Sheryl Hildebrand 1:17 - 1:24Testing the Controls - Gary McGuire 1:24 - 1:30FDIC Certification Experience - Brian Szabo 1:30 - 1:45External Auditor Attestation - Gary Stauffer 1:45 - 1:50Break 1:50 - 2:25Questions & Answers - Panel 2:25 - 2:30Concluding Remarks - Richard Chambers Agenda

5. Statement of Management’s Responsibilities (establishing & maintaining) An assessment, at end of the most recent fiscal year –Effectiveness of internal controls –Procedures for financial reporting –Reporting to audit committee & external auditor any significant deficiencies and material weaknesses in the design or operation of internal controls External auditor attestation Requirements (proposed)

6. Internal Controls ??? “ A Process, Effected by an Entity’s Board of Directors, Management and Other Personnel, Designed to Provide Reasonable Assurance Regarding the Achievement of Objectives in the Following Categories: –Effectiveness & Efficiency of Operations –Reliability of Financial Reporting –Compliance with Applicable Laws and Regulations.” Source: COSO

7. Control Components Control environment Risk assessment Control activities Information and communications Monitoring Used to evaluate overall company’s accomplishment of objectives and specific processes’ performance: Used to evaluate overall company’s accomplishment of objectives and specific processes’ performance:

8. Management’s Assessment Transactions properly authorized Access to assets controlled against unauthorized or improper use Transactions recorded to –Permit preparation of FS (GAAP) –Maintain accountability of assets Controls in place to ensure proper reporting for external purposes Process designed to provide reasonable assurance: Process designed to provide reasonable assurance:

9. Definition of internal controls? –Financial –Operational –Compliance What is the level of internal control documentation needed? How to test & evaluation criteria? Process or organizational driven? Requirements for attestation? Issues

10. Material Weakness Impact of control structure on preventing –Errors –Fraud Not detected in –Timely manner –Normal course of work Material impact on financial statements –Material = influence decisions made based on financial information

11. 1:00 - 1:10 Introduction & Overview of Annual Certification of Controls - Richard Chambers 1:10 - 1:17Documentation Tools - Sheryl Hildebrand 1:17 - 1:24Testing the Controls - Gary McGuire 1:24 - 1:30FDIC Certification Experience - Brian Szabo 1:30 - 1:45External Auditor Attestation - Gary Stauffer 1:45 - 1:50Break 1:50 - 2:25Questions & Answers - Panel 2:25 - 2:30Concluding Remarks - Richard Chambers Agenda

12. 1:00 - 1:10 Introduction & Overview of Annual Certification of Controls - Richard Chambers 1:10 - 1:17Documentation Tools - Sheryl Hildebrand 1:17 - 1:24Testing the Controls - Gary McGuire 1:24 - 1:30FDIC Certification Experience - Brian Szabo 1:30 - 1:45External Auditor Attestation - Gary Stauffer 1:45 - 1:50Break 1:50 - 2:25Questions & Answers - Panel 2:25 - 2:30Concluding Remarks - Richard Chambers Agenda

13. 1:00 - 1:10 Introduction & Overview of Annual Certification of Controls - Richard Chambers 1:10 - 1:17Documentation Tools - Sheryl Hildebrand 1:17 - 1:24Testing the Controls - Gary McGuire 1:24 - 1:30FDIC Certification Experience - Brian Szabo 1:30 - 1:45External Auditor Attestation - Gary Stauffer 1:45 - 1:50Break 1:50 - 2:25Questions & Answers - Panel 2:25 - 2:30Concluding Remarks - Richard Chambers Agenda

14. 1:00 - 1:10 Introduction & Overview of Annual Certification of Controls - Richard Chambers 1:10 - 1:17Documentation Tools - Sheryl Hildebrand 1:17 - 1:24Testing the Controls - Gary McGuire 1:24 - 1:30FDIC Certification Experience - Brian Szabo 1:30 - 1:45External Auditor Attestation - Gary Stauffer 1:45 - 1:50Break 1:50 - 2:25Questions & Answers - Panel 2:25 - 2:30Concluding Remarks - Richard Chambers Agenda

15. 1:00 - 1:10 Introduction & Overview of Annual Certification of Controls - Richard Chambers 1:10 - 1:17Documentation Tools - Sheryl Hildebrand 1:17 - 1:24Testing the Controls - Gary McGuire 1:24 - 1:30FDIC Certification Experience - Brian Szabo 1:30 - 1:45External Auditor Attestation - Gary Stauffer 1:45 - 1:50Break 1:50 - 2:25Questions & Answers - Panel 2:25 - 2:30Concluding Remarks - Richard Chambers Agenda