Lecture 17 sas framework internal control - james a. hall book chapter 3
Download as PPTX, PDF3 likes3,832 views
The document discusses the importance of internal control systems, outlining their objectives, risks, and frameworks such as the SAS 78 and COSO frameworks. Key components of effective internal controls include the control environment, risk assessment, information and communication, monitoring, and control activities, emphasizing the role of auditors in assessing these controls. Additionally, recommendations for boards of directors and risk assessment procedures are provided to help enhance financial reporting and audit effectiveness.
Lecture 17 sas framework internal control - james a. hall book chapter 3
- 1. Habib Ullah Qamar Govt. college of Commerce Gujranwala 4/19/2016
- 2. We started with the need of Internal Control What is internal Control Objectives of Internal control System Assumptions of ICS Exposures and risks PDC Model SOX provision and annual Report
- 3. The PDC control model is conceptually pleasing but offers little practical guidance for designing specific controls. For this, we need a more precise framework. The current authoritative document for specifying internal control objectives and techniques is Statement on Auditing Standards (SAS) No. 78, It is based on the COSO framework.
- 4. COSO framework was the basis for SAS 78, but was designed as a management tool rather than an audit tool. SAS 78, on the other hand, was developed for auditors and describes the complex relationship between the firm’s internal controls, the auditor’s assessment of risk, and the planning of audit procedures. Apart from their audience orientation, the two frameworks are essentially the same and interchangeable for SOX compliance purposes.
- 5. The key elements of the SAS 78/COSO framework consists of five components 1. The control environment 2. Risk assessment 3. Information and communication 4. Monitoring 5. control activities.
- 6. The control environment is the foundation for the other four control components. The control environment sets the tone for the organization and influences the control awareness of its management and employees. Important elements of the control environment are: 1. The integrity and ethical values of management. 2. The structure of the organization. 3. The participation of the organization’s board of directors and the audit committee, if one exists.
- 7. 4. Management’s philosophy and operating style. 5. The procedures for delegating responsibility and authority. 6. Management’s methods for assessing performance. 7. External influences, such as examinations by regulatory agencies. 8. The organization’s policies and practices for managing its human resources
- 8. Auditors should assess the integrity of the organization’s management and may use investigative agencies to report on the backgrounds of key managers. Some of the “Big Four” public accounting firms utilize ex-FBI agents whose primary responsibility is to perform background checks on existing and prospective clients. In case of serious reservations the auditor should withdraw from the audit. The reputation and integrity of the company’s managers are critical factors in determining the audit ability of the organization. Auditors cannot function properly in an environment in which client management is deemed unethical and corrupt.
- 9. Auditors should be aware of conditions that would prejudice the management of an organization to commit fraud. For example lack of sufficient working capital, adverse industry conditions, bad credit ratings, and the existence of extremely restrictive conditions in bank or indenture agreements. If auditors encounter any such conditions, their examination should give due consideration to the possibility of fraudulent financial reporting. Appropriate measures should be taken, and every attempt should be made to uncover any fraud.
- 10. Auditors should understand a client’s business and industry and should be aware of conditions peculiar to the industry that may affect the audit. Auditors should read industry-related literature and familiarize themselves with the risks that are inherent in the business. The board of directors should adopt, as a minimum, the provisions of SOX..
- 11. Separate CEO and chairman. The roles of CEO and board chairman should be separate. Executive sessions give directors the opportunity to discuss issues without management present, and an independent chairman is important in facilitating such discussions. Set ethical standards. Establish an independent audit committee Compensation committees
- 12. Nominating committees. The board nominations committee should have a plan to maintain a fully staffed board of directors with capable people as it moves forward for the next several years. The committee must recognize the need for independent directors and have criteria for determining independence. Access to outside professionals. All committees of the board should have access to attorneys and consultants other than the corporation’s normal counsel and consultants. Under the provisions of SOX, the audit committee of an SEC report-ing company is entitled to such representation independently.
- 13. Organizations must perform a risk assessment to identify, analyze, and manage risks relevant to financial reporting. Risk Circumstances 1. Changes in the operating environment that impose new or changed competitive pressures on the firm. 2. New personnel who have a different or inadequate understanding of internal control. 3. New or reengineered information systems that affect transaction processing. 4. Significant and rapid growth that damage existing internal controls.
- 14. 5. The introduction of new product lines or activities with which the organization has little experience. 6. Organizational restructuring resulting in the reduction and/or reallocation of person-nel such that business operations and transaction processing are affected. 7. Entering into foreign markets that may impact operations (that is, the risks associated with foreign currency transactions). 8. Adoption of a new accounting principle that impacts the preparation of financial statements SAS 78 requires that auditors obtain sufficient knowledge of the organization’s risk assessment procedures to understand how management identifies, prioritizes, and man-ages the risks related to financial reporting.
- 15. The accounting information system (AIS) consists of the records and methods used to initiate, identify, analyze, classify, and record the organization’s transactions and to account for the related assets and liabilities. SAS 78 requires that auditors obtain sufficient knowledge of the organization’s information system to understand 1. The classes of transactions that are material to the financial statements and how those transactions are initiated. 2. The accounting records and accounts that are used in the processing of material transactions. 3. The transaction processing steps involved from the initiation of a transaction to its inclusion in the financial statements. 4. The financial reporting process used to prepare financial statements, disclosures, and accounting estimates.
- 16. To evaluate the internal control system Monitoring is the process by which the quality of internal control design and operation can be assessed. An organization’s internal auditors may monitor the entity’s activities in separate procedures. Ongoing monitoring may be achieved by integrating special computer modules into the information system that capture key data and/or permit tests of controls to be conducted as part of routine operations. Another technique for achieving ongoing monitoring is the sensible use of management reports. (time and accuracy)
- 17. Control activities are the policies and procedures used to ensure that appropriate actions are taken to deal with the organization’s identified risks. Control activities can be grouped into two distinct categories IT controls Physical controls
- 18. IT controls relate specifically to the computer environment. They fall into two broad groups General controls Application controls General controls pertain to entity-wide concerns such as controls over the data center, organization databases, systems development, and program maintenance. Application controls ensure the integrity of specific systems such as sales order processing, accounts payable, and payroll applications.
- 19. This class of controls relates primarily to the human activities It may include Physical custody of assets Physical use of computers to record transactions or update accounts. They relate to the human activities that trigger and utilize the results computer generated Results. In other words, physical controls focus on people, but are not restricted to an environment in which clerks update paper accounts with pen and ink.
- 20. Transaction Authorization. The purpose of transaction authorization is to ensure that all material transactions processed by the information system are valid and in accordance with management’s objectives. Authorizations may be general or specific. General authority is granted to operations personnel to perform day-to-day operations. An example of general authorization is the procedure to authorize the purchase of inventories from a designated vendor only when inventory levels fall to their predetermined reorder points. This is called a programmed procedure (not necessarily in the computer sense of the word) where the decision rules are specified in advance, and no additional approvals are required.
- 21. Specific authorizations deal with case-by- case decisions associated with non-routine transactions. An example of this is the decision to extend a particular customer’s credit limit beyond the normal amount. Specific authority is usually a management responsibility .
- 22. Separation of employee duties to minimize incompatible functions. Segregation of duties can take many forms, depending on the specific duties to be controlled. However, the following three objectives provide general guidelines applicable to most organizations. Authorization for a transaction and Processing of the transaction should be separate. For example, the purchasing department should not initiate purchases until the inventory control department gives authorization.
- 23. Responsibility for the custody of assets should be separate from the record-keeping responsibility. For example, the department that has physical custody of finished goods inventory (the warehouse) should not keep the official inventory records. The organization should be structured so that a successful fraud requires involvement between two or more individuals with incompatible responsibilities. For example, no individual should have sufficient access to accounting records to perpetrate a fraud
- 24. Implementing adequate segregation of duties requires that a firm employ a sufficiently large number of employees. Achieving adequate segregation of duties often presents difficulties for small organizations. Obviously, it is impossible to separate five incompatible tasks among three employees. Therefore, in small organizations or in functional areas that lack sufficient personnel, management must compensate for the absence of segregation controls with close supervision. For this reason, supervision is often called a compensating control.
- 25. The accounting records of an organization consist of source documents, journals, and ledgers. The purpose of access controls is to ensure that only authorized personnel have access to the firm’s assets. Verification procedures are independent checks of the accounting system to identify errors and misrepresentations.
- 26. This chapter began by examining ethical issues. good ethics is a necessary condition for the long- term profitability of a business The next section examined fraud and its relationship to auditing. Fraud falls into two general categories: employee fraud and management fraud. The third section examined the subject of internal control. The adequacy of the internal control structure is an issue of great importance to both management and accountants. Internal control was examined first using the PDC control model that classifies controls as preventive, detective, and corrective. Next, the SAS 78/COSO framework recommended for compliance with SOX was examined.
- 27. Revenue Cycle
- 28. See you again in sha ALLAH 4/19/2016