CONSIDERATION OF

INTERNAL CONTROLS
MODULE 1 (PART 2) - XGBERMIC
INTERNAL CONTROLS (DEFINED)
• PSA 315 DEFINES INTERNAL CONTROL AS THE
PROCESS DESIGNED AND EFFECTED BY THOSE
CHARGED WITH GOVERNANCE, MANAGEMENT, AND
OTHER PERSONNEL TO PROVIDE REASONABLE
ASSURANCE ABOUT THE ACHIEVEMENT OF THE
ENTITY’S OBJECTIVES WITH REGARD TO RELIABILITY
OF FINANCIAL REPORTING, EFFECTIVENESS AND
EFFICIENCY OF OPERATIONS AND COMPLIANCE WITH
APPLICABLE LAWS AND REGULATIONS.
INTERNAL CONTROLS (DEFINED)
• REASONABLE ASSURANCE MEANS A HIGH BUT NOT
ABSOLUTE LEVEL OF ASSURANCE.
• CATEGORIES OF COMPANY OBJECTIVES:
• RELIABILITY OF FINANCIAL REPORTING
• EFFECTIVENESS AND EFFICIENCY OF
OPERATIONS
• COMPLIANCE WITH APPLICABLE LAWS AND
REGULATIONS
INTERNAL CONTROLS (DEFINED)
• INTERNAL CONTROL SYSTEM MEANS ALL POLICIES AND
PROCEDURES ADOPTED BY THE MANAGEMENT TO ASSIST
IN ACHIEVING MANAGEMENT’S OBJECTIVE OF ENSURING,
AS FAR AS PRACTICABLE, THE ORDERLY AND EFFICIENT
CONDUCT OF ITS BUSINESS, INCLUDING ADHERENCE TO
MANAGEMENT POLICIES, THE SAFEGUARDING OF ASSETS,
THE PREVENTION AND DETECTION OF FRAUD AND ERROR,
THE ACCURACY OF COMPLETENESS OF THE ACCOUNTING
RECORDS, AND THE TIMELY PREPARATION OF RELIABLE
FINANCIAL INFORMATION.
INTERNAL CONTROLS (DEFINED)
• INTERNAL CONTROL STRUCTURE VARY
SIGNIFICANTLY FROM ONE COMPANY TO THE NEXT.
FACTORS THAT COULD BE THE CAUSE OF
DIFFERENTIATIONS:
• SIZE OF THE BUSINESS
• NATURE OF OPERATIONS
• GEOGRAPHICAL DISPERSION OF ITS ACTIVITIES
• OBJECTIVES OF THE ORGANIZATION
 INTERNAL CONTROLS (COMPONENTS)

C 1. THE CONTROL ENVIRONMENT

R 2. THE ENTITY’S RISK ASSESSMENT PROCEDURES
I 3. THE INFORMATION SYSTEM, INCLUDING THE
RELATED BUSINESS PROCESSES, RELEVANT TO
FINANCIAL REPORTING, AND COMMUNICATION
4. CONTROL ACTIVITIES
C
5. MONITORING OF CONTROLS
M
CONTROL ENVIRONMENT
• THE CONTROL ENVIRONMENT MEANS THE OVERALL
ATTITUDE, AWARENESS AND ACTIONS OF
DIRECTORS AND MANAGEMENT REGARDING THE
INTERNAL CONTROL SYSTEM AND ITS IMPORTANCE
IN THE ENTITY
• STRONG CONTROL ENVIRONMENT = EFFECTIVE
INTERNAL CONTROL SYSTEM
• THE ENVIRONMENT IN WHICH INTERNAL CONTROL
OPERATES HAS AN IMPACT ON THE EFFECTIVENESS
OF THE SPECIFIC CONTROL PROCEDURES
CONTROL ENVIRONMENT FACTORS

1. COMMUNICATION AND ENFORCEMENT OF

INTEGRITY AND ETHICAL VALUES
• AN ENTITY’S ETHICAL AND BEHAVIORAL STANDARDS
AND THE MANNER IN WHICH IT COMMUNICATES AND
REINFORCES THEM DETERMINE THE ENTITY’S
INTEGRITY AND ETHICAL BEHAVIOR
• IT INCLUDE MANAGEMENT’S ACTION TO REMOVE OR
REDUCE INCENTIVES AND TEMPTATIONS THAT MIGHT
PROMPT PERSONNEL TO ENGAGE IN DISHONEST,
ILLEGAL, OR UNETHICAL ACTS
CONTROL ENVIRONMENT FACTORS

2. COMMITMENT TO COMPETENCE
• COMPETENCE IS THE KNOWLEDGE AND SKILLS
NECESSARY TO ACCOMPLISH TASKS
• MANAGEMENT SHOULD HIRE EMPLOYEES
COMPETENT TO PERFORM A SPECIFIC TASK TO
ACHIEVE ITS OBJECTIVES
CONTROL ENVIRONMENT FACTORS
3. PARTICIPATION BY THOSE CHARGED WITH
GOVERNANCE
• THOSE CHARGED WITH GOVERNANCE—THE PERSON(S)
OR ORGANIZATION(S) (FOR EXAMPLE, A CORPORATE
TRUSTEE) WITH RESPONSIBILITY FOR OVERSEEING THE
STRATEGIC DIRECTION OF THE ENTITY AND OBLIGATIONS
RELATED TO THE ACCOUNTABILITY OF THE ENTITY. THIS
INCLUDES OVERSEEING THE FINANCIAL REPORTING
PROCESS.
• AN ENTITY’S CONTROL CONSCIOUSNESS IS INFLUENCED
SIGNIFICANTLY BY THOSE CHARGED WITH GOVERNANCE
CONTROL ENVIRONMENT FACTORS

4. MANAGEMENT’S PHILOSOPHY AND OPERATING

STYLE
• THIS REFERS TO MANAGEMENT’S ATTITUDE
TOWARDS (A) BUSINESS RISK, (B) FINANCIAL
REPORTING, (C) MEETING BUDGET, PROFIT AND
OTHER ESTABLISHED GOALS WHICH ALL HAVE
IMPACT ON THE RELIABILITY OF THE FINANCIAL
STATEMENTS
CONTROL ENVIRONMENT FACTORS

5. ORGANIZATIONAL STRUCTURE
• THE RESPONSIBILITIES AND AUTHORITIES OF
VARIOUS PERSONNEL SHOULD BE DESIGNED TO:
• ASSIST THE ENTITY IN MEETING ITS GOALS AND
OBJECTIVES
• ENSURE THAT TRANSACTIONS ARE
PROCESSED, RECORDED, SUMMARIZED, AND
REPORTED IN AN ACCURATE AND TIMELY
MANNER
CONTROL ENVIRONMENT FACTORS

6. ASSIGNMENT OF AUTHORITY AND RESPONSIBILITY

• PERSONNEL SHOULD HAVE A CLEAR
UNDERSTANDING OF THEIR RESPONSIBILITIES
AND THE RULES AND REGULATIONS THAT
GOVERN THEIR ACTIONS
• JOB DESCRIPTIONS, COMPUTER SYSTEM
DOCUMENTATIONS
CONTROL ENVIRONMENT FACTORS

7. HUMAN RESOURCES POLICIES AND PROCEDURES

• PERSONNEL POLICIES SHOULD BE ADOPTED BY
THE CLIENT TO REASONABLY ENSURE THAT ONLY
CAPABLE AND HONEST PERSONS ARE HIRED AND
RETAINED
• ADEQUATE PERSONNEL POLICIES CAN ENHANCE
THE LIKELIHOOD THAT THE CLIENT’S POLICIES
AND PROCEDURES WILL BE FOLLOWED
RISK ASSESSMENT PROCESS
• RISK ASSESSMENT IS THE IDENTIFICATION, ANALYSIS,
AND MANAGEMENT OF RISKS PERTAINING TO THE
PREPARATION OF THE FINANCIAL STATEMENTS.
• RISKS RELEVANT TO FINANCIAL REPORTING INCLUDE
EXTERNAL AND INTERNAL EVENTS AND
CIRCUMSTANCES THAT COULD ADVERSELY AFFECT
AND ENTITY’S ABILITY TO INITIATE, RECORD,
PROCESS, AND REPORT FINANCIAL DATA
CONSISTENT WITH THE ASSERTIONS OF
MANAGEMENT IN THE FINANCIAL STATEMENTS.
RISK ASSESSMENT PROCESS
• THE FOLLOWING ARE THE COMMON CAUSES WHERE RISK ARISES:
• CHANGES IN OPERATING ENVIRONMENT
• NEW PERSONNEL
• NEW OR REVAMPED INFORMATION SYSTEMS
• RAPID GROWTH
• NEW TECHNOLOGY
• NEW BUSINESS MODELS, PRODUCTS, OR ACTIVITIES
• CORPORATE RESTRUCTURING
• EXPANDED FOREIGN OPERATIONS
• NEW ACCOUNTING PRONOUNCEMENTS
INFORMATION SYSTEM
• AN INFORMATION SYSTEM CONSISTS OF
INFRASTRUCTURE (PHYSICAL AND HARDWARE
COMPONENTS), SOFTWARE, PEOPLE, PROCEDURE, AND
DATA
• BUSINESSES WITH MANUAL PROCESSES HAVE NO
INFORMATION SYSTEM
• AN ENTITY’S CONTROL STRUCTURE MUST PROVIDE FOR
THE IDENTIFICATION, CAPTURE AND EXCHANGE OF
INFORMATION BOTH WITHIN THE CHAPTER AND WITH
EXTERNAL PARTIES. INFORMATION COMMUNICATED
SHOULD BE TIMELY AND ACCURATE.
INFORMATION SYSTEM
• INFORMATION SYSTEM RELEVANT TO FINANCIAL
REPORTING OBJECTIVES FOCUSES ON PROPER
INITIATION, RECORDING, AND REPORTING OF
TRANSACTIONS
• RELATED BUSINESS PROCESSES – ARE THE
ACTIVITIES DESIGNED TO (1) DEVELOP, PRODUCE
AND SELL AN ENTITY’S PRODUCTS, (2) ENSURE
COMPLIANCE WITH LAWS AND REGULATIONS, AND
(3) RECORD INFORMATION
INFORMATION SYSTEM
• COMMUNICATION INVOLVES PROVIDING AN
UNDERSTANDING OF INDIVIDUAL ROLES AND
RESPONSIBILITIES PERTAINING TO INTERNAL
CONTROL OVER FINANCIAL REPORTING
• COMMUNICATION CAN TAKE SUCH FORMS AS
POLICY MANUALS, ACCOUNTING AND FINANCIAL
REPORTING MANUALS, AND MEMORANDA
CONTROL ACTIVITIES
• CONTROL ACTIVITIES HELP ENSURE RISK RESPONSES ARE
EFFECTIVELY CARRIED OUT AND INCLUDE POLICIES AND
PROCEDURES, APPROVALS, AUTHORIZATIONS,
VERIFICATIONS, RECONCILIATIONS, SECURITY OVER ASSETS,
AND SEGREGATION OF DUTIES. THESE ACTIVITIES OCCUR
ACROSS AN ENTITY, AT ALL LEVELS AND IN ALL FUNCTIONS,
AND ARE DESIGNED TO HELP PREVENT OR REDUCE THE
RISK THAT ENTITY OBJECTIVES WILL NOT BE ACHIEVED.
• THESE ARE THE POLICIES AND PROCEDURES THAT HELP
ENSURE THAT MANAGEMENT DIRECTIVES ARE CARRIED OUT
CONTROL ACTIVITIES
THE MAJOR CATEGORIES OF CONTROL PROCEDURES
ARE:
• PERFORMANCE REVIEW
• INFORMATION PROCESSING CONTROLS
• PHYSICAL CONTROLS
CONTROL ACTIVITIES
• IN PERFORMANCE REVIEW MANAGEMENT USES
ACCOUNTING AND OPERATING DATA TO ASSESS
PERFORMANCE, AND IT THEN TAKES CORRECTIVE
ACTIONS.
• PERFORMANCE REVIEWS MAY BE USED BY
MANAGERS FOR THE SOLE PURPOSE OF MAKING
OPERATING DECISIONS
• FOR EXAMPLE THE USE OF STANDARDS, BUDGETS,
FORECASTS, PRIOR PERIOD PERFORMANCE
CONTROL ACTIVITIES
• INFORMATION PROCESSING CONTROLS ARE POLICIES
AND PROCEDURES DESIGNED TO REQUIRE
AUTHORIZATION OF TRANSACTIONS AND TO ENSURE THE
ACCURACY AND COMPLETENESS OF TRANSACTION
PROCESSING
• CONTROL ACTIVITIES MAY BE CLASSIFIED INTO GENERAL
AND APPLICATION CONTROLS.
• PROPER SEGREGATION OF TRANSACTIONS AND
ACTIVITIES, SEGREGATION OF DUTIES, ADEQUATE
DOCUMENTS AND RECORDS, ACCESS TO ASSETS, AND
INDEPENDENT CHECKS ON PERFORMANCE
CONTROL ACTIVITIES
• THE EXTENT TO WHICH PHYSICAL CONTROLS
INTENDED TO PREVENT THE THEFT OF ASSETS ARE
RELEVANT TO THE RELIABILITY OF FINANCIAL
STATEMENT PREPARATIONS, AND THEREFORE THE
AUDIT, DEPENDS ON CIRCUMSTANCES SUCH AS
WHEN ASSETS ARE HIGHLY SUSCEPTIBLE TO
MISAPPROPRIATION
MONITORING OF CONTROLS
• MONITORING INVOLVES ASSESSING THE DESIGN
AND OPERATION OF CONTROLS ON A TIMELY BASIS
AND TAKING CORRECTIVE ACTION AS NECESSARY
• MONITORING IS EFFECTIVE WHEN IT LEADS TO THE
IDENTIFICATION AND CORRECTION OF CONTROL
WEAKNESSES BEFORE THEY MATERIALLY AFFECT
THE ACHIEVEMENT OF THE CHAPTER’S OBJECTIVES
OBJECTIVE OF THE STUDY OF
INTERNAL CONTROL
• THE AUDITOR SHOULD OBTAIN AN UNDERSTANDING
OF THE ACCOUNTING AND INTERNAL CONTROL
SYSTEMS SUFFICIENT TO PLAN THE AUDIT AND
DEVELOP AN EFFECTIVE AUDIT APPROACH
• THE AUDITOR’S UNDERSTANDING OF THEIR CLIENT’S
INTERNAL CONTROL PROVIDES A BASIS BOTH TO (1)
PLAN THE AUDIT; AND (2) ASSESS CONTROL RISK
OBJECTIVE OF THE STUDY OF
INTERNAL CONTROL
• TO UNDERSTAND THE DESIGN OF THE ACCOUNTING
INFORMATION SYSTEM, THE AUDITOR DETERMINES:
• THE MAJOR CLASSES OF TRANSACTIONS
• HOW THOSE TRANSACTIONS ARE INITIATED
• WHAT ACCOUNTING RECORDS EXISTS AND THEIR NATURE
• HOW TRANSACTIONS ARE PROCESSED
• AUDITORS OFTEN USE FLOWCHARTING TO PROVIDE FOR
A NARRATIVE DESCRIPTION OF THIS UNDERSTANDING
• AUDITS MAY ALSO PERFORM “WALK-THROUGHS”
OBJECTIVE OF THE STUDY OF
INTERNAL CONTROL
• AUDITOR’S UNDERSTANDING OF ACCOUNTING AND
INTERNAL CONTROL SYSTEM IS SUPPLEMENTED BY:
• INQUIRIES OF APPROPRIATE MANAGEMENT,
SUPERVISORY AND OTHER PERSONNEL AT VARIOUS
ORGANIZATIONAL LEVELS
• INSPECTION OF DOCUMENTS AND RECORDS
• OBSERVATION OF THE ENTITY’S ACTIVITIES AND
OPERATIONS
DOCUMENTATION OF
UNDERSTANDING
• THE AUDITOR SHOULD DOCUMENT THE
UNDERSTANDING OF THE ENTITY’S INTERNAL
CONTROL STRUCTURE ELEMENTS OBTAINED TO
PLAN THE AUDIT
• THE MORE COMPLEX THE INTERNAL CONTROL
STRUCTURE AND THE MORE EXTENSIVE THE
PROCEDURES PERFORMED, THE MORE EXTENSIVE
THE AUDITOR’S DOCUMENTATION SHOULD BE
DOCUMENTATION OF
UNDERSTANDING
1. INTERNAL ACCOUNTING CONTROL
QUESTIONNAIRES CONTAINS A SERIES OF
QUESTIONS DESIGNED TO DETECT CONTROL
WEAKNESSES.
• MOSTLY ANSWERABLE BY “YES” OR “NO”
• “YES” GENERALLY INDICATES SATISFACTORY
DEGREE OF INTERNAL ACCOUNTING CONTROL
• “NO” INDICATES A POSSIBLE WEAKNESS IN
CONTROL OR AT LEAST INDICATES FURTHER
INVESTIGATION IS NEEDED
DOCUMENTATION OF
UNDERSTANDING
2. FLOWCHART IS A SYMBOLIC DIAGRAM OF A
SPECIFIC PART OF AN INTERNAL ACCOUNTING
CONTROL SYSTEM INDICATING THE SEQUENTIAL
FLOW OF DATA AND/OR AUTHORITY
• IT PROVIDES A PICTORIAL OVERVIEW OF A
CLIENT’S INTERNAL CONTROL ACTIVITIES
• TECHNIQUES OFTEN USED BY AUDITORS: (1)
STANDARDIZED SYMBOLS, (2) FLOWLINES, (3)
DOCUMENTS, (4) PROCESSING, AND (5)
ANNOTATIONS
DOCUMENTATION OF
UNDERSTANDING
3. NARRATIVE DESCRIPTION IS A WRITTEN
DESCRIPTION OF A PARTICULAR PHASE OR
PHRASES OR A CONTROL SYSTEM
• IF THE SYSTEMS ARE EXTENSIVE AND/OR
COMPLEX, SEPARATE NARRATIVES MAY BE
PREPARED FOR SMALLER GROUPS OF CONTROLS
WHICH RELATE TO SPECIFIC CLASSES OF
TRANSACTIONS OR ACCOUNTS
DOCUMENTATION OF
UNDERSTANDING
4. INTERNAL CONTROL CHECKLIST CONTAINS A
DETAILED ENUMERATION OF THE METHODS AND
PRACTICES WHICH CHARACTERIZE GOOD
INTERNAL CONTROL OR OF ITEM TO BE
CONSIDERED IN REVIEWING INTERNAL CONTROL
• PROVIDES ONLY A GUIDE TO REVIEW THE
INTERNAL CONTROL, NOT A RECORD OF AUDIT
FINDINGS