Internal Control and Risk Analysis %282%29

INTERNAL CONTROL AND RISK ANALYSIS: 

INTERNAL CONTROL AND RISK ANALYSIS CHAPTERS ITA 1 1

Sarbanes-Oxley Act of 2002: principal reforms : 

Sarbanes-Oxley Act of 2002: principal reforms Creation of the Public Company Accounting Oversight Board (PCAOB) Auditor independence—more separation between a firm’s attestation and non-auditing activities Corporate governance and responsibility—audit committee members must be independent and the audit committee must oversee the external auditors Disclosure requirements—increase issuer and management disclosure New federal crimes for the destruction of or tampering with documents, securities fraud, and actions against whistleblowers 2

Sarbanes-Oxley Act: 

Sarbanes-Oxley Act The 2002 Sarbanes-Oxley (SOX) Act: Internal control RQ 1-7 3

SOX Audit Implications: 

SOX Audit Implications Pre-SOX, audits did not require IC tests. Only required to be familiar with client’s IC Audit consisted primarily of substantive tests SOX – radically expanded scope of audit Required to test IC affecting financial information and c ollect documentation of management’s IC tests Thus, SOX made internal control a much bigger deal both for management and auditors 4

Internal Control Objectives According to AICPA: 

Internal Control Objectives According to AICPA RQ 1-8 5

Modifying Assumptions to the Internal Control Objectives: 

Modifying Assumptions to the Internal Control Objectives RQ 1-9 6

Limitations of Internal Controls: 

Limitations of Internal Controls Possibility of honest errors Circumvention via collusion Management override Changing conditions--especially in companies with high growth 7

Five Internal Control Components: SAS 78 / COSO: 

Five Internal Control Components: SAS 78 / COSO AICPA, AAA, FEI, IMA, IIA Developed a management perspective model for internal controls over a number of years RQ 1-13 8

Risk Assessment: 

Risk Assessment Identify, analyze and manage risks relevant to financial reporting: changes in external environment risky foreign markets significant and rapid growth that strain internal controls new product lines restructuring, downsizing changes in accounting policies 9

AUDITS: 

AUDITS 1 . Planning 2. Obtaining evidence Tests of Controls Substantive Testing CAATTs Analytical procedures 3. Ascertaining reliability MATERIALITY 4. Communicating results Audit opinion 10

Audit Risk : 

Audit Risk ITA RQ 1-18, 1-20 11

Relationship between tests of controls and substantive tests: 

Relationship between tests of controls and substantive tests ITA RQ 1-21 12

Control Activities: 

Control Activities Policies and procedures to ensure that the appropriate actions are taken in response to identified risks Levels of control activities RQ 1-10, 1-11, 1-12 Fall into two distinct categories: IT controls—relate specifically to the computer environment Physical controls—primarily pertain to human activities 13

Two Types of IT Controls: 

Two Types of IT Controls ITA RQ 1-16 14

Six Types of Physical Controls: 

Six Types of Physical Controls RQ 1-14 These categories are useful in performing a control analysis to help guide your thought process (e.g., what to look for in control cases). 15

Slide 16: 

COSO (Control Activities) 16 Hall, 3e

Application Homework Problems: 

Application Homework Problems ITA 1-3, 1-4 17