<p> INTERNAL CONTROL </p><p>I. INTERNAL CONTROL (SAS 78) – a process-- effected by an entity’s Board of Directors, management, and other personnel—designed to provide reasonable assurance regarding the achievement of objectives in the following categories: </p><p> a) reliability of financial reporting,</p><p> b) effectiveness and efficiency of operations,</p><p> c) compliance with applicable laws and regulations.</p><p>II. Second Std of Fieldwork: A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed. III. ELEMENTS COMPONENTS OF INTERNAL CONTROL STRUCTURE </p><p>SAS 55 (old) SAS 78 (new)</p><p>Control Environment Control Environment ---No equivalent--- Risk Assessment Control Procedures Control Activities Accounting System Information and Communication ---No equivalent--- Monitoring A. Control environment - Management's and directors' attitudes, awareness & actions</p><p>1. Management’s philosophy and operating style</p><p>2. </p><p>3. Board of Directors’ involvement</p><p>4. Assignment of authority and resp.</p><p>5. Commitment to Competence</p><p>6. </p><p>7. Human resource policies and procedures B. Risk Assessment - identification, analysis, and management of risks relevant to the preparation of financial statements that are presented in accordance with GAAP.</p><p>C. Control Activities</p><p>1. Performance reviews</p><p>2. Information processing</p><p>3. Physical controls</p><p>4. Segregation of duties D. Information and Communication</p><p>The information system should accomplish the following for transactions:</p><p>1. Identify and record all transactions.</p><p>2. Describe on a timely basis.</p><p>3. Measure the value properly.</p><p>4. Record in proper time period.</p><p>5. Properly present and disclose.</p><p>Communication includes communicating employee responsibilities for internal control (possibly through manuals and oral statements).</p><p>E. Monitoring – assessing controls on a timely basis and making appropriate modifications. IV. Overview of Auditor Responsibilities</p><p>Obtain understanding of Internal Control</p><p>Rely on controls?</p><p> a) apply to assertion(s) b) likely to be effective c) cost efficient to audit </p><p>No Yes</p><p>Decide planned assessed level of control risk Assess control risk at the maximum. Perform Tests of Controls</p><p>No Was planned assessment justified?</p><p>Yes Are additional reductions in control risk justified Yes (i.e., cost-efficient)?</p><p>No</p><p>Document final assessment of control risk.</p><p>Determine Detection Risk V. – “understand each of the five components of internal control sufficient to plan the audit by performing procedures to understand the design of controls relevant to an audit of financial statements, and whether they have been placed in operation”. “Placed in operation” means the entity is using the control A. Why?</p><p>1. Identify potential misstatements,</p><p>2. Consider factors that affect risk of material misstatement,</p><p>3. .</p><p>B. How?</p><p>1. Prior experience w/client and industry,</p><p>2. </p><p>3. Inspect records,</p><p>4. VI. Documentation - Required to document but the extent of documentation depends on size and complexity of client. Could include:</p><p>A. </p><p>B. </p><p>C. </p><p>VII. Tests of Controls: Determine whether prescribed controls are in use and operating effectively (only controls related to reduced control risk)</p><p>A. Nature: </p><p>B. Timing: </p><p>C. Extent: VIII. Walk-Through Tests vs. Tests of Controls</p><p>A. --Trace one or two transactions of each major type through the system.</p><p>B. --Tests directed toward design or operation of an internal control policy or procedure to assess its effectiveness in preventing or detecting misstatements. </p><p>IX. Types of Tests of controls</p><p>A. </p><p>B. </p><p>C. Observation of application of policies and procedures</p><p>D . Reperformance of application (by auditor) of policies and procedures. X. INTERNAL CONTROL EXAMPLES</p><p>A. The ticket taker of a motion picture theater is required to tear each ticket presented for admission in two and present the stub to the patron.</p><p>B. </p><p>C.</p><p>D.</p><p>E. XI. LIMITATIONS OF INTERNAL CONTROL</p><p>A. The best structure may break down due to:</p><p>1. Misunderstandings</p><p>2. Mistakes of judgment</p><p>3. Carelessness (especially due to time compliance)</p><p>4. Collusion</p><p>5. Management override</p><p>XII. Other Internal Control Issues</p><p>A. Deficiencies (SAS 60)</p><p>1. – deficiencies in which the design or operation of the specific internal control could adversely affect the organization’s ability to record, process, summarize, and report financial data consistent with assertions of management in the financial statements. 2. -- is a reportable condition in which the design or operation of one or more internal control components does not reduce to a relatively low level the risk that material errors or fraud may occur and not be detected in a timely manner by employees in the normal course of duty.</p><p>(Very significant reportable condition)</p><p>All Control Deficiencies Reportable Conditions</p><p>Material Weaknesses</p><p>3. Required to communicate to audit committee any reportable condition.</p><p>What if no audit committee exists?</p><p>4. Is the auditor required to search</p><p> for all reportable conditions?</p><p>5. Report example</p><p>In planning and performing our audit of the financial statements of the ABC Corporation for the year ended December 31, 19XX, we considered its internal control in order to determine our auditing procedures for the purpose of expressing our opinion on the financial statements and not to provide assurance on the internal control. However, we noted certain matters involving the internal control and its operation that we consider to be reportable conditions under standards established by the American Institute of Certified Public Accountants. Reportable conditions involve matters coming to our attention relating to significant deficiencies in the design or operation of the internal control that, in our judgment, could adversely affect the organization's ability to record, process, summarize, and report financial data consistent with the assertions of management in the financial statements.</p><p>[Include paragraphs to describe the reportable conditions noted.]</p><p>This report is intended solely for the information and use of the audit committee (board of directors, board of trustees, or owners in owner-managed enterprises), management, and others within the organization (or specified regulatory agency or other specified third party). 13 B. Expressing an opinion on a client’s internal control</p><p>Independent Accountant's Report</p><p>[Introductory paragraph]</p><p>We have examined management's assertion [identify management's assertion, for example, that W Company maintained an effective internal control over financial reporting as of December 31, 19XX] included in the accompanying [title of management report].</p><p>[Scope paragraph]</p><p>Our examination was made in accordance with standards established by the American Institute of Certified Public Accountants and, accordingly, included obtaining an understanding of the internal control over financial reporting, testing, and evaluating the design and operating effectiveness of internal controls, and such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion.</p><p>[Inherent limitations paragraph]</p><p>Because of inherent limitations in any internal control, errors or irregularities may occur and not be detected. Also, projections of any evaluation of the internal control over financial reporting to future periods are subject to the risk that the internal control may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.</p><p>[Opinion paragraph]</p><p>In our opinion, management's assertion [identify management's assertion, for example, that W Company maintained an effective internal control over financial reporting as of December 31, 19XX] is fairly stated, in all material respects, based on criteria [identify stated or 14 established standards).</p><p>This report is intended solely for the information and use of the board of directors and management of X Company and should not be used for any other purpose.</p><p>1. The auditor should obtain representations from management:</p><p> a. acknowledging management’s responsibility,</p><p> b. stating mgt. evaluated internal control,</p><p> c. stating mgt. assertion is based on a certain control criteria (identify),</p><p> d. stating that deficiencies in internal control have been disclosed to accountant,</p><p> e. indicating any changes in internal control that have occurred since management’s assertion.</p>