Module 3 notes - Internal Controls PDF

Preview

Summary

Download Module 3 notes - Internal Controls PDF

Description

Internal Controls Internal Controls - systems and procedures put into place to ensure a company meets its objectives. Internal Controls a. Entity Level controls - affect whole entity b. Transaction Level controls - affect transactions IT level Controls - More details will be provided in advanced audit a. General Controls b. Application Controls 5 components of internal controls 1. Control Environment - Board of directors, audit committee, management actions, attitudes, policies 2. Management Risk assessment process - identification, evaluation and mitigation of risk 3. Information and communication - data collection, processing, storage distribution 4. Monitoring - ensuring internal controls are operating as intended 5. Control activities relevant to the audit: This is where we look at Entity level controls and Transaction Level Controls Auditors Role with Internal Controls: 1) Understand the internal control environment a) Complete the internal control questionnaire with the client b) write down a narrative of how the control works c) Draw a flow chart of how the internal control works d) We document the WIR (weakness, implication and recommendation of the controls) e) We walkthrough one transaction from start to finish to see if controls are operating f) We evaluate the design of the control g) For good design controls, we test the key controls h) After testing key controls, if the design is working, we recommend a combined audit approach I) If after testing key controls, if the design is not working, we recommend a substantive audit approach How do you evaluate design of control - step f A good design of controls is a control that is: Regular and frequent performed by trained staff reviewed by management A poor design of controls is a control is: ad hoc performed by inexperienced staff not reviewed by management For the good design controls, there is potential to rely on controls and do less audit work. But, the first step we need to do is test key controls. A key control is a control that prevents material misstatements. For the bad design controls, there is no potential to rely on controls. As such, we are stuck doing more audit work. For bad design controls, we write a letter to the board of directors indicating the weakness of controls, the implications of that and any recommendations - we learn this in advanced audit. Testing Techniques of the good design controls - Inspect, Observe, Reperform Below are 5 good design controls that the auditor would like to test:

1) Blank cheques are kept in a locked safe Observe that a sample of blank cheques are kept in a locked safe 2) Overtime hours are approved by management Inspect a sample of time cards to ensure that they are signed off by management 3) Purchase orders are prenumbered Observe a sample of sequential purchase orders to ensure that they are prenumbered 4) Financial statements are reviewed by management on a monthly basis Reperform some financial ratios on a sample of F/S to ensure that they were appropriately reviewed by management 5) Access to the computers are password restricted Observe a sample of employees try to access their computer and see if they are prompted for passwords

WIR W I R

Inventory is not locked up There is a risk that inventory can be stolen Consider physically controlling your inventory by keeping it in a locked space

W I R

Cheques are only signed off by one person before issuing There is a risk that employees can write cheques to themselves Ensure there is appropriate authorization of all cheques issued by management

W I R

Financial reports seem to be inconsistent quarter over quarter There is a risk that the financial statements may not be accurate Increase management reliability of financial reporting, authorization of F/S, independent checks over F/S...