Topic 4 internal control system (ics)

1. TOPIC 4:INTERNAL CONTROL
SYSTEMS
References: Chapter 10
AUD390 2011

2. AUD390 AUDITING DIA
INTERNAL CONTROL
SYSTEM (ICS)
INTERNAL CONTROL
SYSTEM (ICS)
Fundamental
Concepts
Documenting The
Understanding Of
Ic & Control Risk
Importance
Of Internal
Control (Ic)
Communication
Of IC Related
Matters
Components
Of ICS

3. AUD390 AUDITING DIA
 A system of internal controls consists of
policies & procedures to provide management
with reasonable assurance that the company
achieves its objectives & goals.
 These policies & procedures are called
controls, and they normally considered as
entity’s internal control

4.  A set of policies are principles, rules, and guidelines
formulated or adopted by an organization to reach
its long-term goals and typically published in a
booklet or other form that is widely accessible.
 Procedures are the specific methods employed to
express policies in action in day-to-day operations
of the organization. Together, policies and
procedures ensure that a point of view held by the
governing body of an organization is translated into
steps that result in an outcome compatible with
that view.
AUD390 AUDITING DIA

5.  Three objectives in designing internal control
systems:
reliability of financial reporting
effectiveness & efficiency of operations
compliance with laws & regulations
AUD390 AUDITING DIA

6.  Limitations of IC
 Human error
 Management override of IC
 Cost contraints
 Cost of entity’s ICS should note exceed
that are expected to derived
 Lack of personal quality among employee
 Collusion “an act of 2 or more employees
to steel assets or mistake records”
AUD390 AUDITING DIA

7.  AI400 Risk Assessment & Internal Control
 The Cadbury Report
 The Sarbanes Oxley 2002 Report
 The Coso Report
AUD390 AUDITING DIA

8. AUD390 AUDITING DIA
CONTROL ENVIRONMENT
RISK ASSESSMENT
CONTROL ACTIVITIES
INFORMATION &
COMMUNICATION
MONITORING

9.  Definition:
Actions, policies & procedures that reflect the
overall attitudes of top management, directors, &
owners of an entity about its IC & its importance
 Subcomponents:-
 Integrity & ethical values
 Commitment to competence
 BOD or AC participation
 Management’s philosophy & operating style
 Organizational structure
 Assignment of authority & responsibility
 HR policies & practices
AUD390 AUDITING DIA

10. AUD390 AUDITING DIA
 Definition:
Management’s identification & analysis of risks
relevant to the preparation of fin stat in
accordance with accounting standard i.e. FRS
 Risk assessment process
– Identify factors affecting risks
– Assess significance of risks & likelihood of
occurrence
– Determine actions necessary to manage risks

11. AUD390 AUDITING DIA
 Definition:
Policies & procedures that management has
established to meet its objectives for financial
reporting
 Types of specific control activities:-
– Adequate separation of duties
– Proper authorization of transactions & activities
– Adequate documents & records
– Physical control over assets & records
– Independent checks on performance

12. AUD390 AUDITING DIA
 Definition:
Method used to initiate, records, process & report
an entity’s transactions & to maintain
accountability for related assets

13. AUD390 AUDITING DIA
 Definition:
Management’s ongoing & periodic assessment of
the quality of IC performance to determine
whether controls are operating as intended and
are modified when necessary
 Monitoring mechanism:
– Studies of existing IC
– Internal Audit Reports

14. AUD390 AUDITING DIA
– Exception reporting on control activities
– Reports from Regulatory such as BNM, SC,
Bursa Malaysia
– Feedback from operating personnel
– Complaints from customers

15. AUD390 AUDITING DIA
Phase 1: Obtain & document understanding
of IC; Design & Operation
Phase 2: Assess control risk
Phase 3: Design, perform & evaluate
tests of controls
Phase 4: Decide planned detections
risk & substantive tests

16. AUD390 AUDITING DIA
 Purpose:
– To obtains an understanding of the entity’s IC
through
 Gathering evidence about the design of IC
 Observed whether the IC have been placed
in operations
 Methods in gathering evidence:
i. Narratives
ii. Flowcharts
iii. Internal Control Questionnaire

17. AUD390 AUDITING DIA
 Methods to evaluate whether the designed
controls are actually placed in operations:
i. Update & evaluate Auditor’s previous
experience with the entity
ii. Make inquiries of client personnel
iii. Examine documents & records
iv. Observe entity activities & operations
v. Perform walkthrough of the accounting
system

18. AUD390 AUDITING DIA
 Definition ~ A written description of a client’s IC
 A proper narrative of any ICS include 4
characteristics
i. The origin of every documents & records in the
system
ii. All processing that takes place
iii. The disposition of every document and records
in the system
iv. An indication of the controls relevant to the
assessment of control risk

19. AUD390 AUDITING DIA
 Definition ~ A diagram of the client’s documents
and their sequential flow in the organization
 Advantages:
– It provides a concise overview of the client’s
system
– It helps in identifying inadequacies in the
system
– Easier to read
– Easier to update
 Refer Appendix Flowcharting Techniques Ch 6 of
Messier et al, 2006
 Refer Case Question 10.38 Ch 10

20. AUD390 AUDITING DIA
 Definition ~ A series of questions about the
controls in each audit areas as a means of
uncovering aspects of internal control that may be
inadequate
 It require a ‘yes’ or ‘no’ response, where NO
indicating potential internal control deficiencies
 Refer Figure 10.3 Partial Internal Control
Questionnaire for Sales

21. AUD390 AUDITING DIA
Phase 1: Obtain & document understanding
of IC; Design & Operation
Phase 2: Assess control risk
Phase 3: Design, perform & evaluate
tests of controls
Phase 4: Decide planned detections
risk & substantive tests

22. AUD390 AUDITING DIA
 Definition:
A measure of the auditor’s expectation that IC will
neither prevent material misstatements from
occurring nor detect & correct them if they
occurred
 Control Risk Matrix
Definition: A methodology used to help the auditor
assess control risk by matching key internal
controls and IC deficiencies with transaction-
related audit objectives
 Refer Figure 10.4 Control Risk for Sintok Hardware
Sdn Bhd - Sales

23. AUD390 AUDITING DIA
Phase 1: Obtain & document understanding
of IC; Design & Operation
Phase 2: Assess control risk
Phase 3: Design, perform & evaluate
tests of controls
Phase 4: Decide planned detections
risk & substantive tests

24. AUD390 AUDITING DIA
 Definition ~ Audit procedures to test the
operating effectiveness of controls in support of
reduced assessed control risk
 4 types of procedures involved:
i. Make inquiries of appropriate client personnel
ii. Examine documents, records & reports
iii. Observe control-related activities
iv. Re-perform client procedures

25. AUD390 AUDITING DIA
Phase 1: Obtain & document understanding
of IC; Design & Operation
Phase 2: Assess control risk
Phase 3: Design, perform & evaluate
tests of controls
Phase 4: Decide planned detections
risk & substantive tests

26. AUD390 AUDITING DIA
 Auditor will use the results of the control risk
assessment process (Phase 2) and test of controls
(Phase 3) to determine the planned detection
risk & related substantive test for the audit of
financial statements.
 What the process involves?
 Linking the control risk assessment to the
balance-related audit objectives for the
accounts affected by the major transaction
types

27. AUD390 AUDITING DIA
 The appropriate level of detection risk for each
balance-related audit objectives is decided
using the audit risk model.
 All covered and will be discussed in Topic 7 on
Audit Planning

28.  Auditing Standards (ISA315 & ISA260) require
the auditor to communicate to those charged
with governance, as soon as practicable,
material weaknesses in the design or operation
of the accounting & internal control systems,
which have come to the auditor’s attention
1. Management Letter (ML)
An optional letter written by the auditor to a
client’s management containing the auditor’s
recommendations for improving any aspects of
the client’s business
AUD390 AUDITING DIA

29. • Items should be included in the ML:
 A statement that the purpose of the audit
was to report on the fin stats & not to
provide assurance on IC
 A statement that the letter only discusses
weaknesses in IC which have come to the
auditor’s attention as a result of the
audit
 A statement of restriction on the
distribution of the report
AUD390 AUDITING DIA

30. 2. Director’s Statement on IC
• Under the Listing Requirements of Bursa
Malaysia Securities Berhad (Listing
Requirements)
 Listed Companies to include a Statement
on Internal Control in the annual reports
 Company’s external auditors must review
the Statement on Internal Control &
report the result to the BOD
AUD390 AUDITING DIA

31. • The Director’s Statement on Internal Control
should incorporate the following aspects
 The Board should maintain a sound system of
IC to safeguard shareholders’ investment &
the company’s assets
 The Board should (inter alia)
 Identify the principal risks & ensure the
implementation of appropriate systems to
manage the risks;
AUD390 AUDITING DIA

32.  Review the adequacy & integrity of the
company’s ICS & Management information
system, including systems for compliance
with applicable laws, regulations rules,
directives & guidelines
AUD390 AUDITING DIA

33. 1. Explain what is control environment and state 2 factors
affecting this component.
2. Identify a key internal control and possible substantive
test of transactions that could perform for each of the
following audit objectives
i. Sales made to existing customer (Existence)
ii. Existing sales transaction are recorded
(Completeness)
iii. Recorded sales are for amount of goods shipped and
are correctly billed and recorded (Accuracy)
3. State the audit objective (s) for the following tests
performed.
4. You decided to issue a Management Letter
i. Define Management Letter
ii. Briefly explain 2 purposes of Management Letter
AUD390 AUDITING DIA