Internal controls
Part 1: Introduction to auditing internal controls
1. The COSO Internal Control Integrated Framework Executive Summary lists these five elements of the control environment. List at least one specific example for each of the five elements that would provide evidence that an organization has a well-managed internal control environment.
1) The organization demonstrates a commitment to integrity and ethical values.
2) The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
3) Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
4) The organization demonstrates a commitment to attract, develop and retain competent individuals in alignment with objectives.
5) The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
2. List two preventive controls and two detective and corrective controls that you would expect to see in the inventory purchase (cash disbursements) process.
Preventive controls:
Detective and corrective controls:
3. Explain why it is important to identify whether a control is an automated control, IT-dependent manual control or manual control.
4. Designate whether the following controls are automated controls, IT-dependent manual controls or manual controls.
Control description Type of control
Compare this years inventory turnover to last years inventory turnover
Perpetual inventory records are reconciled to the general ledger each month
Bank reconciliations are performed monthly
Purchases are immediately processed when they are made with vendors on the approved vendor list
Overhead costs are systematically applied to the cost of inventory produced
Contro
l description Type of control
Employees count inventory on hand at the end of each year; perpetual inventory records are updated based on the counts
Prepaid customer orders are processed without credit approval
Exception report generated by the cash disbursement application for invoices, purchase orders and receiving reports that dont match is reviewed by the cash disbursements manager
5. Auditing Standard (AS) 2201.24 instructs auditors to address the following list of entity-level controls. Give at least two examples of what auditors should consider when evaluating if these controls operate effectively. Refer to the COSO Framework and Auditing Standards to help answer these questions.
a. Controls related to the control environment
b. Controls over management override
c. The companys risk assessment process
d. Centralized processing and controls, including shared service environments
e. Controls to monitor results of operations
f. Controls to monitor other controls, including activities of the internal audit function, the audit committee and self-assessment programs
g. Controls over the period-end financial reporting process
h. Policies that address significant business control and risk management practices
6. AS 2201.29 instructs auditors to consider this list of qualitative and quantitative risk factors when considering accounts listed on financial statements. Provide an example of what auditors should consider when assessing these factors.
a. Size and composition of the account
b. Susceptibility to misstatement due to errors or fraud
c. Volume of activity, complexity and homogeneity of the individual transactions processed through the account or reflected in the disclosure
d. Nature of the account or disclosure
e. Accounting and reporting complexities associated with the account or disclosure
f. Exposure to losses in the account