Section 3: Internal Controls Flashcards
Components of IC
CRIME
- Control Activities
- Risk Assessment
- Information and Communication
- Monitoring
- Control Environment
Control Activities
RIPS
- Reviews
- Information processing
- Physical controls
- Segregation of duties
Segregation of Duties
ARCC
- Authorization
- Recording
- Custody of Assets
- Comparisons
Objectives of IC
ACE
- Accurate and reliable financial reporting
- Compliance with laws and regulations
- Effectiveness and efficiency of operations
Control Environment
CHOPPER
- Commitment to competence
- Human resource policies
- Organizational structure
- Participation by mgt
- Philosophy of mgt
- Ethical values
- Responsibility assignment
Documenting Understanding of IC
FIND
- Flowcharts
- IC Questionnaire - only shows strengths of IC
- Narrative
- Decision Table
Test of Controls
Testing ARCC by using RIIO
- Reperformance
- Inspection
- Inquiries
- Observation - most effective
Inherent Limitations of IC
COCO
- Collusion
- Override by mgt
- Competence
- Obsolescence
Financial Statement Assertions
U-PERCV
- Understandability and Classification
- Presentation and Disclosure
- Existence and Occurrence (Vouching)
- Rights and Obligations
- Completeness (Tracing) and Cutoff
- Valuation, Allocation, and Accuracy
Investment Assertions
PERCV
- Presentation and Disclosure
- Existence
- Rights and Obligations
- Completeness
- Valuation
Production and Conversion Assertions
PECV
- Presentation and Disclosure
- Existence and Occurrence
- Completeness and Cutoff
- Valuation, Allocation, and Accuracy
Items to Test in IC
PRAISE
- Physical Controls
- Recording
- Authorization
- Independence Checks - are documents compared to verify agreement before transactions are executed? Are records reconciled?
- Segregation of Duties
- Evaluate Performance - Are policies written? Are unusual transactions investigated?
Control Defieciency
When the design or operation of a control does not allow for mgt or employees, in normal course of performing functions, to prevent or detect and correct misstatements on a timely basis
Material or Significant Defic?
Look for Probability (Remote, Reasonable Prob, Prob) and Magnitude (Material, Immaterial)
Design Deficiency
Needed control has not been put in place or the control put in place is not designed to mitigate the risk it was intended to address
Operation Deficiency
Well-Designed control is not operating as designed or individual responsible for performing the control lacks authority or ability to perform ir effectively
