CONSIDERATION OF INTERNAL CONTROL IN INTERNAL CONTROL

A FINANCIAL STATEMENT AUDIT

Definition:
INTERNAL CONTROL
The process designed, implemented, and
START – SYSTEM – MANAGEMENT – maintained by those charged with governance,
SUCCESS management and other personnel to provide
reasonable assurance about the achievement of
PSA 315 (Redrafted)
an entity's objectives with regard to reliability of
Scope: financial reporting, effectiveness and efficiency of
operations, and compliance with applicable laws
Identifying and Assessing the Risks of Material
and regulations.
Misstatement Through Understanding the Entity
and Its Environment including its Internal Control Summary of definition

INTRODUCTION 1. Policy & procedure adopted by:

The success of the business operations and  Those charge with governance
performance of the entity relies in its ability to  Management
achieve operating and organizational goals and  employees
objectives
2. To achieve objectives of:
How to attain these objectives and goals:
 Reliability of financial reporting
 Combined efforts of those charged with  Effective and efficient operation
governance, management, and  Compliance with applicable laws and
personnel within the entity regulations
 A system to oversee the carrying out of
Internal Control is designed and implemented to
policies and procedures to achieve the
address identified business risks that threaten
objectives and goals
the achievement of the entity's goals and
Widely accepted concept in Audit Theory and objectives.
Practice:
Objectives of Internal Control:
The importance of the client's System of Internal
 Reliability of entity's financial Reporting
Control to generate reliable financial information
 Effectiveness and Efficiency of
An excellent system of Internal Control that Operations
includes adequate controls for:  Compliance with Applicable Laws and
Regulations
 Providing reliable data
 Safeguarding assets and records INTERNAL CONTROL

Result: An internal control system consists of all the

policies and procedures adopted by management
The amount of audit evidence to be accumulated
of an entity to assist in achieving management's
can be significantly less than when controls are
objective of ensuring, as far as practice orderly
not adequate
and efficient conduct of its using including
adherence to management policies the  It sets the tone of an organization,
safeguarding of assets, the prevention and influencing the control consciousness
detection of fraud and error, the accuracy and providing discipline and structure
completeness of the accounting records, and the  Governs behavior as envisioned in the
timely preparation of reliable financial culture created by management and
information. directors

Functions of Internal Control: Control Environment

 Preventive controls - deter problems Some Factors:

before they arise
• Communication and enforcement of
 Detective controls - needed to discover
integrity and ethical values
problem as they arise
 Corrective controls - remedy the • Commitment to competence
problems discovered with detective
• Participation by those charged with
controls
governance
People responsible for effective Internal
• Management's philosophy and operating
Control:
style
 Management
• Organizational structure
 Those Charged with Governance
 Employees and Other Personnel • Assignment of authority and responsibility

Internal Control Under the PSA • Human resources policies and procedures

Elements of Internal Control: FACTORS THAT COMPRISE THE CONTROL

ENVIRONMENT
 Control Environment (top)
 The Entity's Risk Assessment Process A. Communication and Enforcement of
(implemented by top) Integrity and Ethical Values
 The Information System including
➤ Integrity and ethical values include the
Business Processes and Communication
removal and reduction process to eliminate
(library)
temptation for personnel to commit fraud, illegal
 Control Activities
acts
 Monitoring of Control
➤ Communication of values and behavioral
Internal Controls: An Overview
standards to personnel through policy statement
Control Environment (example: code of conduct)

The overall attitude, awareness, actions of those Management should establish ethical standards
charged with governance, management, and that discourage employees from engaging in
employees on the system and its importance to dishonest, unethical, or illegal acts that could
the entity. materially affect the financial statements
B. Commitment to Competence ❖Meeting budget, profit and established goals
affecting financial statements
➤ Competence is the knowledge and Skills
necessary to accomplish jobs E. Organizational Structure

➤ Management gives impetus on competence  Assist the entity in meeting goals and
level for a certain job. objectives
 Transactions are processed, recorded,
➤ The objective is to accomplish the job at the
summarized, and reported accurately
highest application of skill and competence. and timely

➤ Management hires employees competent to  Refers to the framework that dictates

how activities are planned, executed,
perform the task
controlled, and reviewed
C. Participation of Those Charged with  Considers key areas of authority and
Governance responsibilities and appropriate lines of
reporting
➤ Active involvement of the Directors in the
 Depends on the size and nature of
Control Consciousness
activities
➤ Codes of Practice and Regulations are
F. Assignment of Authority and
adopted to ensure active involvement
Responsibilities:
➤ Oversight of the Design and Effective
➤ Delineation of Authority and Functions
operation of whistle blower procedures
➤ No overlapping of Functions for Effective
➤ Review of the effectiveness of the entity's
attainment of objectives (Job descriptions)
Internal Control
G. Human Resource Policies and Practices:
Whistle Blower - A person who exposes
misconduct, alleged dishonesty or illegal activity ➤ Policies on recruitment, orientation, training,
occurring in an organization. counseling

D. Management's Philosophy and Operating ➤ Hiring Standards and Requirements to

Style achieve all these factors in Control Environment

❖Consideration and monitoring business risk LIMITATIONS OF THE CONTROL

ENVIRONMENT
❖Conservative or aggressive selection from
alternative accounting principles • Not an absolute deterrent in Fraud

❖Consciousness and conservatism in • Weaknesses in Control Environment undermine

developing accounting estimates effectiveness of Internal Control System

❖Attitude toward information processing, • Does not prevent or detect or correct a Material
Misstatement
accounting function, personnel
However, it may influence evaluation of
effectiveness of other controls
Specific Examples of Control Environment: 9. New Accounting Pronouncements

1. Organizational Chart Specific Examples of Risk Assessment:

2. Corporate Governance
1. Relocation of Site
3. Board Risk Committees
2. Conversion to IT System
4. Internal Audit
3. New appointed Managers & Supervisors
5. Identification card
4. New Board Members
6. Company Uniforms
5. Branching
7. Working hours
6. Consolidation & Merger
8. Audit Committee
7. Overseas Expansion
Entity's Risk Assessment Process
INFORMATION SYSTEM
➤ Identification, Analysis, Management of risks
 Consists of Infrastructure (physical and
pertaining to preparation of Financial Statements
hardware components), Software,

➤ Identifying and responding to Business Risk People, Procedures, and Data

and results thereof.  Well designed Information System is

effective in reducing risks of Material
➤ Estimating the significance of the risk Misstatement
 Auditor should know, understand:
➤ Assessing the likelihood of their occurrence
- The process that affects significant balances
➤ Deciding about actions to address those risks
- How transactions are initiated
Entity's Risk Assessment Process
- How documents and records are generated
Relevant Risks include:
- How the documents and records flow to the
➤ External and internal events and
Financial Statements
circumstances that may occur
INFORMATION SYSTEM
➤ Adversely affect ability to initiate, record,
Consists of procedures and records
process and report financial data consistent with
established to:
the assertions in the financial statement
 Initiate, Record, Process and Report
Risks may arise from these circumstances:
entity transactions
1. Change in operating environment  Maintain accountability for the related
2. New personnel Assets, Liability, Equity
3. New or revamped information system  Resolve incorrect processing
4. Rapid growth transactions
5. New technology  Process and Account for system
6. New business models, products, or overrides or bypasses to controls
activities  Transfer information from transaction
7. Corporate Restructuring processing system to the general ledger
8. Expanded Foreign Operations
  Capture information relevant to financial  Takes forms as policy manuals,
reporting other than transactions accounting and financial reporting
 Ensure information to be disclosed is manuals, memoranda
accumulated, recorded, processed,  Produced electronically or orally,
summarized and appropriately reported  Through the action of Management
in the financial statements
Specific Examples of Information &
Journal entries - An entity's information system Communications:
includes the use of:
1. Journal Entries
1. Standard Journal Entries 2. Accounting Cycle
2. Required on a recurring basis to record 3. Assertion level
transactions. 4. Flow Chart
5. Classes of Transactions
Non-standard Journal Entries - To record non-
6. IFRS/PFRS
Standard transactions or adjustments
7. Financial Statements
INFORMATION SYSTEM
CONTROL ACTIVITIES
Business Processes:
➤ Policies and procedures that help ensure that
 Develop, Purchase, Produce, Sell, and management's directives are carried out.
Distribute products and services
➤ Various objectives applied at various
 Ensure compliance with Laws and
Regulations organizational and functional levels

INFORMATION SYSTEM Major categories of control activities:

Consists of procedures and records 1. Performance reviews (actual vs.

established to: standard)

2. Information processing controls
1. Identify and Record all valid transactions 3. Physical control and access to assets
2. Describe the transactions in detail for 4. Adequate documents and records
proper classification
3. Measure the value of transactions for Performance Reviews:

proper monetary value

➤ Actual performance with:
4. Determine the time period to record
transactions in the proper accounting - Budget, forecast
period
- Prior period performance
5. Present the transactions and disclosures
in the Financial Statements - Competitor's data

Communication - Tracking major initiative or cost reduction

program
 Providing and Understanding individual
roles and responsibilities pertaining to ➤ Investigative performance and corrective
Internal Control actions
- Purchase price variances Internal controls in accounting system to
achieve objectives:
- Percentage of returns
 Transactions are performed in
- Causes of anomalies committed
accordance with management's proper
➤ Review of functional or activity authorization
performance  Prompt booking or recognition of all
transaction and events in correct
INFORMATION PROCESSING CONTROLS
amount, appropriate account, and proper
: Policies and Procedures designed to require accounting period
authorization of transactions and ensure the  Access to assets is permitted only in
accuracy and completeness of transaction accordance with management's
processing authorization
 Existing assets is compared against
Information Processing Controls
recorded assets at reasonable intervals
Classified as: and appropriate actions are taken
against discrepancies
➤Application controls:
Control activities related to the transaction
- Checking arithmetical accuracy or records
process:
- Maintaining and reviewing accounts and trial
Proper authorization of transaction activities:
balance
 Certain conditions to be met prior to
- Automated controls thru edit checks of input
booking of transactions
data
 Flows from stockholders to governance
- Numerical sequence checks to management to subordinates
 Creation of accounting and auditing path
- Manual follow-up of audit exceptions
Segregation of duties:
➤General-IT Controls:
➤Safeguards assets
- Activities to prevent or detect errors or
irregularities ➤ Ensures reliability of the accounting records

- Policies and procedures applications to support ➤No one person to control an entire phase of
the effective functioning of information system transaction

- Controls that restrict access to programs or Physical control and access to assets:
data
1. Physical security of assets
- Controls over the implementation of new 2. Authorization for access to computer
releases of software applications programs and data files

- Protections from hacking, piracy, unauthorized 3. Periodic counting and comparison with

access to data control records

Adequate documents and records: 7. Levels of authorization

 Reasonable Assurance that all valid Monitoring of Controls

transactions have been recorded
The process that an entity uses to assess the
 Use of controlling accounts
quality of internal control over time:
 Proof of accuracy to assure correctness
of operation  To establish and maintain internal control
on an ongoing basis
Independent check on performance
 Whether controls are operating and
Periodically compare the actual asset with the appropriate for changes
recorded balance  Communication from external parties to
detect problems or areas for
 Periodic count of assets and comparing
improvement.
the counts to the balances in the GL
 Internal auditors evaluate the design and
account
operation of controls and communicate
 Examples: inventory count, bank
strength and weaknesses
reconciliation
 Built into the normal activities of an entity
Segregation of Duties and include regular management and
supervisory activities
To achieve optimum segregation of duties
and responsibilities, the following functions Specific Examples of Monitoring activities:
should be performed by different employees:
1. Management Fraud
1. Independent checks or internal audits 2. Those Charge With Governance
2. Custody of assets Qualification
3. Authorization of transactions 3. Annual Stockholders' Meeting
4. Recording of transactions 4. Proxy Voting
5. Execution of transactions 5. Audit Report
6. Improper disposal of documents
However, if it is impractical to segregate the
7. Document Retention Period
above functions, at a minimum, three
functions must be segregated: Limitations of Internal Control System

1. Custody of Assets 1. Errors by personnel

2. Authorization of Transactions 2. Collusion
3. Recording of Transactions 3. Management override
4. Present conditions are not guaranteed in
Specific Examples of Control Activities:
the Future
1. Warehousing 5. Cost-Benefit Relationship
2. FIFO valuation method 6. Controls are directed to routine
3. Cash box transactions rather than non-routine
4. Cash vault transactions
5. Non-detachable Equipment Label
6. Cashiering
Auditors are not responsible for establishing Factors to consider in Risk Assessment
and maintaining an entity's accounting and
• Design of controls: Existence and
internal control systems
Applications
This is the responsibility of the management
• Effectiveness of Control: How the controls
Nevertheless, Auditors should give adequate effectively function
consideration to these controls
STAGES OF STUDY AND EVALUATION OF
Reasons: INTERNAL CONTROL

1. The quality of the entity's control systems 1. Obtaining an understanding the entity's
have a significant impact on the Audit internal control structure
2. There is a direct relationship between an 2. Assessing the preliminary level of control
entity's objectives and the control it risk
implements to assure the attainment of 3. Obtaining evidential matter to support the
these objectives assessed level of control risk
4. Evaluating the results of evidential matter
Responsibilities of an Auditor:
5. Determining the necessary level of
1. Plan the audit sufficiently detection risk
2. Assess control risk
The Audit Process
Means to accomplish the responsibilities:
1. Pre- Engagement
 Obtain an understanding of accounting 2. Audit Planning
and internal controls 3. Study & Evaluation of Internal Control
 Use professional judgment to assess 4. Substantive Testing
audit risk 5. Completing the Audit
 Design audit procedures to reduce risk to 6. Issuance of the Audit Report
an acceptably low level 7. Post Audit Responsibilities

Objectives of the study of Internal Control: Obtaining an Understanding of the Entity's

Internal Control Structure
 Plan the Audit
 Assess Control Risk: • Understanding the control environment
1. Assess control risk below maximum;
• Understanding control procedures
2. Evaluate effectiveness of control
placed in operation • Understanding the accounting and internal
control systems
Assess control risk below Maximum: Identify,
in each assertion, the specific controls to prevent • Documentation of understanding
or detect material misstatements
Determining whether controls have been
Evaluate effectiveness of existing controls: implemented: Accomplished by performing
Perform tests to determine if controls are applied "walk through" test.

(This phase is not required in the planning stage)

Walk-through test: Involves tracing one or two 3. Difficult to spot weakness in internal
transactions through the entire accounting control
systems, from their initial recording at source to
Audit Process
their final destination as a component of an
account balance in the financial statement Planning stage:

Documentation of the Auditor's 1. Appointment of auditors

Understanding of Internal Control: 2. Plan the audit
3. Understand client
1. Internal Control Questionnaire
4. Risk assessment
2. Flowcharts
5. Assess internal controls as effective?
3. Narrative description
4. Internal Control Checklist Yes: Test of controls
5. Decision tables
No: Report control weakness to client
Internal Control Questionnaire: Contains a
Evidence gathering stage:
series of questions designed to detect control
weaknesses. Test of controls: Internal controls are effective?

Advantages: Yes: Less substantive procedures

1. Presence or absence of all controls listed No: Report control weakness to client;
2. Uniform attestation of system review
- More substantive procedures
3. Guide to the audit staff
4. Detection of weakness and compliance Completion stage:
5. Easy to update
- Overall review of financial statements
Disadvantages: - Audit report

1. Automatic and Routine OTHER WAYS (chronological order):

2. Controls listed are generalized
1. Background Research
3. Overlook pertinent control
2. Announcement Letter and Entrance
Flowcharts: Symbolic diagram of a specific part Conference
of the control system indicating sequential flow of 3. Survey Phase (planning and limited
data and/or authority testing)
4. Fieldwork
Advantages:
5. Exit Conference
1. Easily understood 6. Draft Report
2. Better overall picture of complex system, 7. Agency Comments (30 days)
3. Parallels EDP documentation 8. Final Report and Follow-up
4. Easy to update

Disadvantages:

1. Requires Higher level of knowledge

2. Takes time to prepare
Narrative Description: Written description of a - The auditor must consider the audit implication
particular phase or phases of a Control System when errors or irregularities are likely to exist.

Advantages: - Initially, discussion with management personnel

may be made. If it appears that material errors
1. Flexible and swift tailor-made
and irregularities could occur, this fact must be
2. detailed analysis makes the auditor
communicated to the board of directors
understand the system
FIVE COMPONENTS AND THE PRINCIPLES
Disadvantages:
REPRESENTATIVE OF THE FUNDAMENTAL
1. May lack the ability to describe correctly CONCEPTS ASSOCIATED WITH THE
and concisely COMPONENT
2. Needs more time and careful study
1. Control Environment
3. Poorly written narrative may mislead the
audit objectives. Description: The collective effect on an entity's
board, management, and owner's on
INTERNAL CONTROL CHECKLIST
establishing, enhancing, or mitigating the
This contains a detailed enumeration of the effectiveness of control policies or procedures.
methods and practices which characterize good The control environment sets the tone and
internal control or of item to be considered in provides discipline and structure.
reviewing internal control.
Applicable Principles:
The checklist basically provides only a guide to
1. Demonstrates a commitment to integrity and
review the internal control of the auditee and
ethical values.
does not represent a record of the auditor's
findings. In most cases therefore, this tool is used 2. Demonstrates independence of the board of
together with the narrative approach. directors from management and exercises
oversight for the development and performance
HOW ADEQUACY OR INADEQUACY OF
of internal control.
INTERNAL CONTROL AFFECTS AUDIT
PROCEDURES 3. Establishes, with board oversight, structures,
reporting lines, and appropriate authorities and
- It should be remembered that the purpose of an
responsibilities in pursuit of objectives.
audit engagement is to determine whether the
financial statements are fairly presented in 4. Demonstrates a commitment to attract,
accordance with financial reporting standards. develop, and retain competent individuals in
alignment with objectives.
- The audit is not specifically designed to search
for errors or irregularities although during the 5. Holds individuals accountable for their internal
study and evaluation of internal accounting control responsibilities in the pursuit of
control system and the performance of objectives.
substantive tests, errors or irregularities may be
discovered.
2. Risk Assessment to the achievement of preparing reliable financial
statements. Control activities pertain to
Description: Management's efforts to identify,
performance physical controls, and segregation
analyze, and manage risks pertaining to the
of duties.
preparation of financial statements.
Applicable Principles:
Applicable Principles:
1. Selects and develops control activities that
1. Specifies objectives with sufficient clarity to
contribute to the mitigation of risks to the
enable the identification and assessment of risks
achievement of objectives to acceptable levels.
relating to objectives.
2. Selects and develops general control activities
2. Identifies risks to the achievement of its
over technology to support the achievement of
objectives across the entity and analyzes risks as
objectives.
a basis for determining how the risks should be
managed. 3. Deploys control activities through policies that
establish what is expected and in procedures that
3. Considers the potential for fraud in assessing
put policies into action.
risks to the achievement of objectives.
5. Monitoring
4. Identifies and assess changes that could
significantly impact the system of internal control. Description: The process an entity uses to
assess the quality of internal control over time
3. Information and Communication
Applicable Principles:
Description: The entity's information system and
procedures for communicating matters related to 1. Selects, develops, and performs ongoing
the processing of accounting data. This and/or separate evaluations to ascertain whether
component generates the financial statements. the components of internal control are present
and functioning.
Applicable Principles:
2. Evaluates and communicates internal control
1. Obtains or generates and uses relevant,
deficiencies in a timely manner to those parties
quality Information to support the functioning of
responsible for taking correction action, including
other components of internal control.
senior management and the board of directors,
2. Internally communicates Information, including as appropriate.
objectives and responsibilities for internal control,
necessary to support the functioning of other
components of internal control.

3. Communicates with external parties regarding

matters affecting the functioning of other
components of internal control.

4. Control Activities

Description: Policies and procedures to ensure

that necessary actions are taken to address risks