Download Chapter 6

CHAPTER 6
INTERNAL CONTROL IN A
FINANCIAL STATEMENT AUDIT
Answers to Review Questions
6-1 From management's perspective, the internal control provides a way to meet its
stewardship or agency responsibilities. Management also needs a control system that
generates reliable information for decision-making purposes.
The importance of internal control to the auditor is rooted in the second standard of
fieldwork. The controls that are relevant to the entity's ability to initiate, record, process,
and report financial data consistent with management's assertions are the auditor's main
concern. The auditor needs assurances about the reliability of the data generated within
the entity's internal control system in terms of how it affects the fairness of the financial
statements and how well the assets and records of the entity are safeguarded.
6-2
Internal control structure is composed of five components:
1. Control environment:
The control environment sets the tone of the
organization, influencing the control consciousness of its people. It is the
foundation of all other components of internal control, providing discipline and
structure.
2. Risk assessment: Risk assessment is the entity’s identification and analysis of
relevant risks to achievement of its objectives, forming a basis for determining
how the risks should be managed.
3. Control activities: Control activities are policies and procedures that help
ensure that management directives are carried out.
4. Information and communication: The information and communication systems
support the identification, capture, and exchange of information to a form and
time frame that enable people to carry out their responsibilities.
5. Monitoring: Monitoring is a process that assesses the quality of the internal
control over time.
6-3 Factors that affect the control environment include:
 Integrity and ethical values of management.
 A commitment to competence.
 Participation of the board of directors or audit committee.
 Management's philosophy and operating style.
 Organizational structure.
 Assignment of authority and responsibility.
 Human resource policies and practices.
1
6-4 The potential benefits and risks to an entity’s internal control from information
technology include:
Benefits:






Consistent application of predefined business rules and performance
of complex calculations in processing large volumes of transactions
or data.
Enhancement of the timeliness, availability, and accuracy of
information.
Facilitation of additional analysis of information.
Enhancement of the ability to monitor the performance of the entity's
activities and its policies and procedures.
Reduction in the risk that controls will be circumvented.
Enhancement of the ability to achieve effective segregation of duties
by implementing security controls in applications, databases, and
operating systems.
Risks:







Reliance on systems or programs that are inaccurately process
data, process inaccurate data, or both.
Unauthorized access to data that may result in destruction of
data or improper changes to data, including the recording of
unauthorized or nonexistent transactions or inaccurate
recording of transactions.
Unauthorized changes to data in master files.
Unauthorized changes to systems or programs.
Failure to make necessary changes to systems or programs.
Inappropriate manual intervention.
Potential loss of data.
6-5 A substantive audit strategy means that the auditor has made a decision not to rely
on the entity's controls and to audit the related financial statement accounts directly.
Control risk is set at the maximum when a substantive audit strategy is followed. With a
reliance strategy, the auditor relies on the entity's controls and sets control risk below the
maximum.
The reliance strategy requires a more detailed understanding and
documentation of internal control than does the substantive strategy. The auditor also
plans and performs tests of controls to support the lower assessed level of control risk.
6-6 In addition to planning the audit of the financial statements, the auditor's
understanding of the entity's internal control is used to (1) identify the types of potential
misstatements, (2) consider factors that affect the risk of material misstatement, (3)
design tests of controls, and (3) design of substantive tests.
2
6-7 The concept of reasonable assurance recognizes that the cost of an entity's internal
control system should not exceed the benefits that are expected to be derived. Thus, an
internal control system will not detect every error that might occur because it would be
too costly to design such a system. Management override of internal control, personnel
errors or mistakes, and collusion are inherent limitations of internal control.
6-8 A number of tools are available to the auditor for documenting the understanding
of the internal control, including copies of the entity's procedures manuals and
organizational charts, narrative descriptions, internal control questionnaires, and
flowcharts
6-9 Auditing standards state that the auditor should document the basis of the
conclusions about the assessed level of control risk. The auditor should also document
the assessed level of control risk so that the audit risk model can be used.
6-10 The auditor might consider conducting substantive tests at an interim date for a
number of reasons. For example, the client may want the auditor to confirm accounts
receivable before year-end because of demands on the client’s staff at year-end.
Alternatively, the auditor may wish to conduct substantive tests at an interim date to
minimize staff overtime at year-end. The auditor should consider the following factors
when substantive tests are to be completed at an interim date:
 The level of control risk.
 Changing business conditions or circumstances that may cause management to
misstate financial statements in the remaining period.
 Control procedures for ensuring that the account is properly analyzed and adjusted,
including proper cutoff procedures.
 The auditor's ability to investigate the remaining period.
When the auditor conducts substantive tests of an account at an interim date, additional
substantive tests might include comparing the year-end account balance with the interim
account balance, conducting some analytical procedures, and/or reviewing related
journals and ledgers for large or unusual transactions during the remaining period.
6-11 Auditing standards require that the auditor report any reportable conditions to the
audit committee, or to a similar level of authority when the entity does not have an audit
committee.
Answers to Multiple-Choice Questions
6-12
6-13
6-14
6-15
6-16
6-17
D
D
A
C
A
B
6-18
6-19
6-20
6-21
6-22
6-23
C
B
C
B
B
B
3