CHAPTER 1: AUDITING AND INTERNAL CONTROL P2

detective controls. corrective controls

PDC control model

Statement on Auditing Standards No. 109

SAS 109

SAS 109

1. control environment 2. risk assessment 3. information and communication 4. monitoring 5. control activities

control environment

control environment

1. The integrity and ethical values of management. 2. The structure of the organization. 3. The participation of the organization’s board of directors and the audit committee, if one exists. 4. Management’s philosophy and operating style. 5. The procedures for delegating responsibility and authority. 6. Management’s methods for assessing performance. 7. External influences, such as examinations by regulatory agencies. 8. The organization’s policies and practices for managing its human resources.

SAS 109

1. Auditors should assess the integrity of the organization’s management and may use investigative agencies to report on the backgrounds of key managers. 2. Auditors should be aware of conditions that would predispose the management of an organization to commit fraud. 3. Auditors should understand a client’s business and industry and should be aware of conditions peculiar to the industry that may affect the audit. 4. The board of directors should adopt, as a minimum, the provisions of SOX.

1. separate CEO and chairman 2. set ethical standards 3. establish an independent audit committee 4. compensation committees 5. nominating committees 6. access to outside professionals

risk assessment

1. Changes in the operating environment that impose new or changed competitive pressures on the firm. 2. New personnel who have a different or inadequate understanding of internal control. 3. New or reengineered information systems that affect transaction processing. 4. Significant and rapid growth that strains existing internal controls. 5. The implementation of new technology into the production process or information system that impacts transaction processing. 6. The introduction of new product lines or activities with which the organization has little experience. 7. Organizational restructuring resulting in the reduction and/or reallocation of per- sonnel such that business operations and transaction processing are affected. 8. Entering into foreign markets that may impact operations (that is, the risks associ- ated with foreign currency transactions). 9. Adoption of a new accounting principle that impacts the preparation of financial statements.

SAS 109

1. Identify and record all valid financial transactions. 2. Provide timely information about transactions in sufficient detail to permit proper classification and financial reporting. 3. Accurately measure the financial value of transactions so their effects can be re- corded in financial statements. 4. Accurately record transactions in the time period in which they occurred.

1. The classes of transactions that are material to the financial statements and how those transactions are initiated. 2. The accounting records and accounts that are used in the processing of material transactions. 3. The transaction processing steps involved from the initiation of a transaction to its inclusion in the financial statements. 4. The financial reporting process used to prepare financial statements, disclosures, and accounting estimates.

monitoring

control activities

1. physical controls 2. information technology (IT) controls

Physical controls

1. transaction 2. authorization 3. segregation of duties 4. supervision 5. accounting records 6. access control 7. independent verification

transaction authorization

segregation of duties

Objective 1. The segregation of duties should be such that the authorization for a transaction is separate from the processing of the transaction. Objective 2. Responsibility for asset custody should be separate from the record- keeping responsibility. Objective 3. The organization should be structured so that a successful fraud requires collusion between two or more individuals with incompatible responsibili- ties.

supervision

compensating control

accounting records

access control

verification procedures

(1) the performance of individuals (2) the integrity of the transaction processing system (3) the correctness of data contained in accounting records.

1. Reconciling batch totals at points during transaction processing. 2. Comparing physical assets with accounting records. 3. Reconciling subsidiary accounts with control accounts. 4. Reviewing management reports (both computer and manually generated) that sum- marize business activity.

1. application controls 2. information technology controls

1. Ensure validity 2. Completeness 3. Accuracy of financial transactions

general controls