Auditing: Internal Controls and Risk Assessment

Summary

This lecture covers the critical elements of internal control and risk assessment in auditing, focusing on the COSO framework. It discusses the responsibilities of both management and auditors, emphasizing the importance of internal controls in financial reporting, operational efficiency, and legal compliance. Key components include the control environment, risk assessment, control activities, information and communication, and monitoring. The lecture also delves into the audit process, highlighting the testing of controls, evaluating deficiencies, and issuing opinions on the effectiveness of internal controls. The session concludes with insights on PCAOB auditing standards, specifically regarding integrated audits of internal controls over financial reporting.

Takeaways

• 😀 Internal control is a process designed to provide reasonable assurance on three key objectives: reliability of financial reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.
• 😀 Management is responsible for establishing, maintaining, and assessing internal controls over financial reporting, while auditors are responsible for issuing an opinion on the effectiveness of those controls, especially for public companies.
• 😀 Auditors must assess control risk to determine the nature, timing, and extent of substantive procedures during the audit process.
• 😀 COSO's internal control framework consists of five key components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring, remembered by the acronym 'CRIME'.
• 😀 The Control Environment sets the tone for the organization and influences the control consciousness of employees. It includes principles such as integrity, ethical values, and board oversight.
• 😀 The Audit Committee plays a key role in ensuring auditor independence and overseeing the audit process, including appointing auditors, resolving disagreements between management and auditors, and overseeing fraud hotlines.
• 😀 Risk Assessment involves identifying, analyzing, and managing risks that could affect the achievement of an organization's objectives. Fraud risk is a critical area to assess.
• 😀 Control Activities are the policies and procedures that ensure management directives are carried out, including segregation of duties, approvals, authorizations, and reconciliation procedures.
• 😀 Information and Communication systems must ensure that financial reporting is accurate, including the use of audit trails to track the flow of data from source documents to financial statements.
• 😀 Monitoring activities ensure that internal controls are functioning properly, with ongoing evaluations and reporting deficiencies in a timely manner to management and the board.
• 😀 Auditors issue one of three opinions on internal controls: unqualified (no material weaknesses), disclaimer (unable to perform necessary procedures), or adverse (found material weaknesses).

Q & A

What is internal control and what objectives does it aim to achieve?

Internal control is a process affected by an entity’s board of directors, management, and personnel designed to provide reasonable assurance regarding the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with laws and regulations.

What are management’s responsibilities regarding internal control over financial reporting?

Management is responsible for establishing and maintaining adequate internal controls over financial reporting, assessing their effectiveness, and reporting on the effectiveness of those controls.

What are the auditor’s responsibilities related to internal controls in an integrated audit?

The auditor must audit and issue an opinion on the effectiveness of internal controls over financial reporting and also issue a separate opinion on the financial statements. The auditor must also evaluate fraud risk and assess control risk to determine the nature, timing, and extent of audit procedures.

What are the five components of the COSO internal control framework?

The five components are Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. These components work together to ensure an effective internal control system.

Why is the control environment considered the foundation of internal control?

The control environment sets the tone at the top of the organization, influencing the control consciousness of employees and supporting all other components of internal control, such as risk assessment and monitoring.

What is the role of the audit committee in corporate governance?

The audit committee oversees the financial reporting process, appoints and supervises the external auditor, resolves disputes between management and auditors, oversees the internal audit function, approves non-audit services, and monitors fraud reporting systems.

What is the purpose of risk assessment in internal control?

Risk assessment involves identifying and analyzing risks that may prevent the organization from achieving its objectives, including risks of material misstatement due to fraud, so that appropriate controls can be designed.

What are control activities and what are some examples?

Control activities are policies and procedures designed to ensure management directives are carried out. Examples include segregation of duties, authorizations, reconciliations, physical controls over assets, and management reviews.

Why is segregation of duties important in internal control?

Segregation of duties prevents one person from having control over all aspects of a transaction. Ideally, different individuals should authorize transactions, record them, have custody of assets, and perform reconciliations to reduce the risk of fraud or error.

What is the purpose of monitoring in the internal control system?

Monitoring ensures that internal controls continue to operate effectively over time through ongoing evaluations, internal audits, supervisory reviews, and timely communication of deficiencies to management and the board.

What are the three phases of internal control evaluation performed by auditors?

The three phases are: understanding and documenting internal controls, assessing control risk, and testing controls to determine their effectiveness.

What is a walkthrough in auditing?

A walkthrough involves tracing a transaction through the accounting system from start to finish to understand how the internal control process works and to evaluate whether controls are properly designed.

What is the difference between a design deficiency and an operating deficiency?

A design deficiency exists when a necessary control is missing or poorly designed, while an operating deficiency occurs when a properly designed control is not functioning as intended, often due to human error or lack of training.

How does a material weakness differ from a significant deficiency?

A material weakness is a deficiency that creates a reasonable possibility that a material misstatement will not be prevented or detected in time, while a significant deficiency is less severe but still important enough to merit attention from those charged with governance.

What types of opinions can auditors issue on internal control over financial reporting?

Auditors can issue an unqualified opinion if no material weaknesses exist, an adverse opinion if material weaknesses are found, or a disclaimer of opinion if they cannot obtain sufficient evidence due to scope limitations.