UNDERSTANDING THE ENTITY’S INTERNAL CONTROL corroborating inquiries through observation or inspection of

documents. For example, through inquiries of management and

The Entity’s Internal Control employees, the auditor may obtain an understanding of how
Internal control is the process designed, implemented and management communicates to employees its views on business
maintained by TCWG, management and other personnel to practices and ethical behavior and considering whether
address risks that are present between the entity and the management has a written code of conduct and whether it acts in
accomplishment of its objectives. Its purpose is to address a manner that supports the code.
identified business risks that threaten the achievement of the
entity’s objectives about: Risk Assessment Process
 the reliability of the entity’s financial reporting The entity’s risk assessment process refers to the entity’s process
(auditor’s primary concern); for identifying business risks relevant to financial reporting
 the effectiveness and efficiency of its operations; and objectives an deciding about actions to address those risks, and
 its compliance with applicable laws and regulations. the results thereof. If that process is appropriate to the
circumstances, including the nature, size and complexity of the
Internal control structure varies with an entity’s size and entity, it assists the auditor in identifying ROMM. Whether
complexity. Smaller entities may use less structured means and entity’s risk assessment process is appropriate is a matter of
simpler processes and procedures. judgment.

An understanding of internal control assists the auditor in The auditor shall obtain an understanding of whether the entity
identifying types of potential misstatements and factors that has a process for:
affect the ROMM, and in designing the nature, timing, and  identifying business risks relevant to financial reporting
extent of FAP (ToC and SP). objectives;
 estimating the significance of the risks;
Components of Internal Control  assessing the likelihood of their occurrence; and
The following are the five components of an effectiveness  deciding about actions to address those risks.
internal control:
 control environment Information System and Communication
 risk assessment process Information and communication relates to the identification,
 information system and communication capture, and exchange of information that enables individuals to
 control activities carry out their responsibilities. It includes information system
 monitoring and communication relevant to financial reporting system which
consists of the procedures and records established to initiate,
Control Environment record, process and report entity transactions (as well as events
Control environment is the governance and management and conditions) and to maintain accountability for the related
functions and the attitudes, awareness, and actions of TCWG assets, liabilities and equity.
and management concerning the entity’s internal control and its
importance in the entity. It is the foundation of internal control Information system and communication consists of
as it sets the tone of an organization that influences the control infrastructure (physical and hardware components), software,
consciousness of its people. people, procedures and data.

The seven elements of the control environment are: The auditor shall obtain an understanding of the information
 communication and enforcement of integrity and ethical system, including the related business processes, relevant to
values financial reporting, including how the entity communicates
 commitment to competence financial reporting roles and responsibilities and significant
matters relating to financial reporting, including:
 human resource policies and practices
 communications between management and TCWG; and
 assignment of authority and responsibility
 external communications, such as those with regulatory
 management’s philosophy and operating style
authorities
 participation of those charged with governance
 organizational structure
Control Activities
Control activities are policies and procedures of the entity that
The auditor shall obtain an understanding of the control
help ensure that management directives are carried out.
environment. As part of obtaining this understanding, the auditor
shall evaluate whether:
Examples of control activities include policies and procedures
 management, with the oversight of TCWG, has created
on :
and maintained a culture of honesty and ethical
 authorization
behavior; and
 performance reviews
 the strengths in the control environment elements
 information processing
collectively provide an appropriate foundation for the
 physical controls
other components of internal control, and whether those
other components are not undermined by control  segregation of duties
environment weakness.
The auditor shall obtain an understanding of control activities
Relevant audit evidence may be obtained through a combination relevant to the audit.
of inquiries and other risk assessment procedures such Control activities that are relevant to the audit are:

1
  those that are required to be treated as such, being  production or conversion (inventory and warehousing)
control activities that relate to significant risks and cycle
those that relate to risks for which substantive  investing and financing cycle
procedures alone do not provide sufficient appropriate
audit evidence; or Collectively these cycles have no beginning or end except at the
 those that are considered to be relevant in the judgment origin and final disposition of an entity.
of the auditor, being those necessary in order to assess
the ROMM at the assertion level and design FAP Relevant Controls: Nature and Extent of the Auditor’s
responsive to assessed risks. Understanding
The auditor shall obtain an understanding of internal control
Risks arising from, and control activities in , IT relevant to the audit, not all controls that relate to financial
In understanding the entity’s control activities, the auditor shall reporting are relevant to the audit. It is a matter of the auditor’s
obtain an understanding of how the entity has responded to risks professional judgment whether a control, is relevant to the audit.
arising from IT.
When obtaining an understanding of controls that are relevant to
Monitoring the audit, the auditor shall evaluate the design of those controls
Monitoring is a process that assesses the effectiveness of internal and determine whether they have been implemented, by
control performance over time. It includes assessing the design performing procedures in addition to inquiry of the entity’s
and operation of controls on a timely basis and taking necessary personnel.
corrective actions modified for changes in conditions.
Evaluating the design of a control involves considering whether
The types of monitoring activities are: the control, individually or in combination with other controls, is
 ongoing monitoring activities - often built into the capable of effectively preventing, or detecting and correcting,
normal recurring activities of an entity and include material misstatements. Implementation of a control means that
regular management and supervisory activities. the control exists and that the entity is using it. There is little
 separate evaluations – often performed by internal point in assessing the implementation of a control that is not
auditors or company employees and provide feedback effective, and so the design of a control is considered first. An
on the effectiveness of other internal control process. improperly designed control may represent a material weakness
 a combination of the two above. (to be discussed at the end part of the lecture notes) in the
entity’s internal control.
Internal auditing is often considered a highly effective
monitoring control. Procedures to Obtain Understanding of Internal Controls
Risk assessment procedures to obtain audit evidence about the
The auditor shall obtain an understanding of the major activities design and implementation (D&I) of relevant controls may
that the entity uses to monitor internal control over financial include:
reporting, including those related to those control activities  inquiring of entity personnel
relevant to the audit, and how the entity initiates corrective  observing the application of specific controls
actions to its controls.  inspecting documents and reports
 tracing transactions through the information system
Inter-relationship of Components of Internal Control relevant to financial reporting
Internal control consists of five interrelated components
designated to work together as a process in order to address Inquiry alone, however, is not sufficient for such purposes.
entity’s business risks and help it accomplish the objectives.
Evaluating the design of a control involves considering whether
Inherent Limitations of Internal Control the control is capable of effectively preventing, or detecting and
Internal control can only provide reasonable assurance that the correcting, material misstatements. Implementation of a control
entity’s objectives are met because of the following inherent means that the control exists and that the entity is using it. There
limitations: is little point in assessing the implementation of a control that is
 cost-benefit considerations not effective, and so the design of a control is considered first.
 human errors or mistakes An improperly designated control may represent a material
 management override or circumvention weakness in the entity’s internal control.
 collusion among employees or outside parties
Obtaining an understanding of an entity’s controls is not
Understanding Entity’s Internal Controls Through sufficient to test their operating effectiveness (which is
Transaction Cycles determined through test of controls), unless is some automation
Transaction cycles refer to certain business processes, or that provides for the consistent operation of the controls.
segments into which related transactions can be conveniently
grouped and for which specific accounting procedures and Documentation
control activities are established by entity’s management. The auditor shall document the key element of each of the
internal control components, including the sources of
The common divisions of transactions cycles are: information from which the understanding was obtained.
 revenue and receipt cycle
 purchasing and disbursement cycle The auditor may document its understanding through any or
 payroll and personnel cycle combination of the following techniques:

2
  Narratives – a narrative is a written description of a Significant deficiency in internal control refers to a deficiency or
client’s internal controls. combination of deficiencies in internal control that, in the
 Flowcharts – an internal control flowchart is a diagram auditor’s professional judgment, is of sufficient importance to
of the client’s documents and their sequential flow in merit the attention of those charged with governance. Significant
the organization. Flowcharts have two advantages over deficiency is less severe than a material weakness.
narratives: typically they are easier to read and easier to
update. It is unusual to use both a narrative and a Material weakness in internal control is deficiency, or a
flowchart to describe the same system because both combination of deficiencies, in internal control over financial
present the same information. reporting, such that there is a reasonable possibility that a
 Internal Control Questionnaire (ICQ) – an ICQ asks a material misstatement of the company’s annual or interim
series of questions about the controls in each audit area financial statements will not be prevented or detected on a
as a means of identifying internal control deficiencies. timely basis. In other words, if a deficiency in an internal control
Most questionnaires require a “yes” or a “no” response, is thought to be of material weakness, this means that it could
with “no” responses indicating potential internal control lead to a material misstatement in a company’s financial
deficiencies. The two main disadvantages of statements.
questionnaires are their inability to provide an overview
of the system and their inapplicability for some audits, The auditor shall evaluate whether, on the basis of the audit
especially smaller ones. work performed, the auditor has identified a material weakness
in the design, implementation or maintenance of internal control.
Performing a Transaction Walkthrough Test
Walkthrough test involves tracing a few transactions through the The types of material weaknesses in internal control that the
financial reporting system. This test is normally done after the auditor may identify when obtaining an understanding of the
auditor has initially documented its understanding of the entity and its internal controls may include:
transaction cycle and significant business processes. It should be  ROMM that the auditor identifies and which the entity
done every year. has not controlled, or for which the relevant control is
inadequate.
The auditor shall perform walkthroughs to achieve the following  A weakness in the entity’s risk assessment process that
objectives: the auditor identifies as material, or the absence of a
 confirm understanding, as identified in during process risk assessment process in those cases where it would
documentation, of the flow of significant classes of be appropriate for one to have been established.
transactions within significant processes or sources and
preparation of information resulting in significant The auditor shall communicate material weaknesses in internal
disclosures, including how these transactions are control identified during the audit on a timely basis to
initiated, authorized, recorded, processed and reported; management at an appropriate level of responsibility and with
and those charged with governance.
 verify the identified “what can go wrong” (WCGWs)
that have the potential to materially affect relevant Material weaknesses may also be identified in controls that
financial statement assertions related to significant prevent, or detect and correct, error, or those to prevent and
accounts and disclosures within each significant class detect fraud.
of transactions.

Deficiencies and Material Weakness in Internal Control

The auditor shall determine whether, on the basis of the audit
work performed, the auditor has identified one or more
deficiencies in internal control.

Deficiency in internal control exists when:

 a control is designed, implemented or operated in such
a way that it is unable to prevent, or detect and correct,
misstatements in the financial statements on a timely
basis; or
 a control necessary to prevent, or detect and correct,
misstatements in the financial statements on a timely
basis is missing.

If the auditor has identified one or more deficiencies in internal

control, the auditor shall determine, on the basis of the audit
work performed, whether, individually or in combination, they
constitute significant deficiencies.

The auditor shall communicate in writing significant deficiencies

in internal control identified during the audit to those charged
with governance on a timely basis.