Internal Control Ivory Book Tidrick Flashcards
What is internal control?
A process- effected by an entity’s board of directors, management, and other personnel- designed to provide reasonable assurance regarding the achievement of objectives in the following categories
- reliability of financial reporting
- Effectiveness and efficiency of operations
- compliance with applicable laws and regulations.
Who is responsible for the design, implementation and maintenance of internal controls?
management
What is the auditor’s responsibility in regards to internal control?
the auditor must obtain a sufficient understanding of the entity and its environment, including its internal control, to assess the risk of material misstatement of the FSs whether due to fraud or error, and to design the nature, timing and extent of further audit procedures.
The auditor should obtain an initial understanding of the ICs relevant to the entity’s financial statements, that’s primarily done through:
Inquiry of management
Observation of the entity’s accounting related activities
Review of documentation.
How is documenting the auditor’s understanding of internal controls done?
Preparing flowcharts of major transaction cycles
Interviewing the entity’s personnel using standardized internal control questionnaires
Preparing narrative write ups regarding internal control
does the extensiveness of the auditor’s review on Internal controls vary?
The extensiveness of the auditor’s review and documentation varies with the circumstances. For example, the emphasis on understanding internal controls increases if reliance on internal control is planned.
What are flowcharts?
A graphical depiction of the client’s accounting systems for major categories of transactions.
What are internal control questionnaires?
Questionnaires consisting of a list of questions about an entity’s control procedures and activities. A “no” answer is usually designed to indicate a control deficiency.
What are narrative write ups?
A written memo describing the important control related activities in the transaction cycles under consideration.
There are 2 reasons why the auditor might “assess control risk at the max level”, which means the same thing as adopting a wholly substantive audit approach with no reliance on IC:
the auditor may perceive the relevant ICs to be ineffective or
Even if the controls are viewed as effective, a reliance audit approach may be less efficient than a wholly substantive audit approach. Test of control would not be performed when the auditor has chosen a wholly substantive audit approach.
What is the required documentation of internal control?
The auditor should document the basis for the auditor’s conclusions about internal control either way, whether IC is received to be effective or ineffective.
The auditor should perform tests of controls to evaluate the operating effectiveness of relevant controls under either of two circumstances:
When the assessment of risks of material misstatement at the relevant assertion level includes an expectation that the controls are operating effectively (that is, the auditor intends to rely on the operating effectiveness of controls.
When the auditor’s substantive procedures alone cannot provide sufficient appropriate audit evidence at the relevant assertion level.
The purpose of performing tests of control is to verity that:
the controls that looked good on paper, known as design effectiveness, were actually working as intended through the period, known as operating effectiveness.
Re-evaluation phase, after performing the tests of controls, the auditor should decide whether the results of the tests of controls are:
consistent with the planned reliance on Internal controls. Sometimes ICs that look good on paper may not actually be working as intended. In such a case, the auditor should reconsider whether a reliance audit approach is appropriate.
Design audit plan phase:
The auditor should prepare a required written audit plan (also referred to as an audit “program”) that specifies the nature, timing, and extent of “further audit procedures” to be performed.
What are the 3 categories of audit procedures?
Risk assessment procedures
Tests of controls
Substantive procedures
What does a wholly substantive audit approach mean?
no reliance on IC (same as assessing control risk at the max level). in other words, the auditor plans to meet the audit risk objectives by performing only substantive audit procedures without any expectation about the operating effectiveness of IC. In this case, tests of control would not be performed.
True or False: the cost of ICs should not outweigh the benefits attributable to those controls.
True
What is collusion
A conspiracy among employees or management to circumvent internal controls.
Segregation of duties may break down due to:
collusion or
management’s override of controls.
What are the auditors risk assessment procedures?
Inquiries of management and other Observation and inspection Analytical procedures Review information Discussion among audit team members
the auditor’s responsibility to obtain an understanding of the entity and its environment focuses on understanding the following:
Industry, regulatory, and other external factors,
Nature of the entity
Objectives and strategies and related business risks that may cause misstatement of the financial statements.
Measurement and review of the entity’s financial performance
Internal control
