chapter 10
Section 404 Audits
Sarbanes-Oxley Act section 404
1
Societe Generale
• junior trader gambled more than the
entire net worth of the bank
2
JP Morgan Chase
3
National Commission on Fraudulent
Financial Reporting
the “Treadway Commission”
1987
Committee of Sponsoring Organizations
“COSO”
4
COSO
Committee of Sponsoring Organizations
organizations that sponsored the Treadway Commission
American Institute of Certified Public Accountants
American Accounting Association
Institute of Internal Auditors
Institute of Management Accountants
Financial Executives Institute
5
Jake S
how does COSO define internal controls ?
6
COSO internal controls
day 1 handout
Internal control is a process, effected by those
charged with governance, management, and
other personnel that is designed to provide
reasonable assurance about the achievement of
the entity’s objectives with regard to the
• reliability of financial reporting
• effectiveness and efficiency of operations
• compliance with applicable laws and regulations
7
Foreign Corrupt
Practices Act
1977
any corporation that has a class of
securities registered, or that is required
to file reports under the Securities and
Exchange Act of 1934
8
U.S. Code
TITLE 15--COMMERCE AND
TRADE CHAPTER 2B
SECURITIES EXCHANGES
9
(2) Every issuer pursuant to section 78l or … shall–
(A)make and keep books, records, and accounts, which, in reasonable
detail, accurately and fairly reflect the transactions and dispositions
of the assets of the issuer;
(B) devise and maintain a system of internal accounting controls
sufficient to provide reasonable assurances that–
(i) transactions are executed in accordance with
management's general or specific authorization;
(ii) transactions are recorded as necessary
(I) to prepare financial statements in conformity with GAAP,
(II) to maintain accountability for assets;
(iii) access to assets is permitted only in accordance with
management's general or specific authorization; and
(iv) the recorded accountability for assets is compared with the
existing assets at reasonable intervals and appropriate
action is taken with respect to any differences; and
10
Sarbanes-Oxley Act 2002
§ 7262. Management assessment of internal controls
(a) Rules required The Commission shall prescribe rules requiring …. an
internal control report, which shall—
(1) state the responsibility of management for establishing and maintaining
an adequate internal control structure and procedures for financial
reporting; and
(2) contain an assessment, as of the end of the most recent fiscal year of
the issuer, of the effectiveness of the internal control structure ...
(b) Internal control evaluation and reporting …, each registered public
accounting firm that …issues the audit report for the issuer shall attest to, and
report on, the assessment made by the management of the issuer.
11
PCAOB auditor’s report on internal control
We have audited internal control over financial reporting as of Dec. 31, 2013, based
criteria established in Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission
(COSO). MMC’s management is responsible for maintaining effective internal control over financial reporting, and for its assessment of the
effectiveness of internal control over financial reporting, included in the accompanying Management Report on Internal Control Over Financial
Reporting. Our responsibility is to express an opinion on the company's internal control over financial reporting based on our audits.
We conducted our audits in accordance with the standards of the Public Company Accounting
Oversight Board. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether effective
internal control over financial reporting was maintained in all material respects. Our audits of internal control over financial reporting included
obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating
the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as
we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinion.
A company's internal control over financial reporting is
a process designed to provide reasonable assurance
regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted
accounting principles. A company's internal control over financial reporting includes those policies and procedures that (1) pertain to the
maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions
and dispositions of the assets of the company; (2) provide reasonable assurance that transactions
are recorded as necessary to permit preparation of financial statements in accordance with
generally accepted accounting principles, and that receipts and expenditures of the company are
being made only in accordance with authorizations of management and directors of the company; and (3)
provide reasonable assurance regarding prevention or timely detection of unauthorized
acquisition, use, or disposition of the company's assets that could have a material effect on the financial
statements.
Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also,
projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate
because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
In our opinion, MMC maintained, in all material respects, effective internal control over
financial reporting as of December 31, 2013, based on COSO criteria.
12
Sam
Which section of the auditing standards
most directly discusses internal controls?
13
Janet
Why are auditors required to understand
the client’s internal controls?
14
AU-C 315
Understanding the Entity & Its Environment &
Assessing RoMM
.03 The objective of the auditor is to identify
and assess the risks of material
misstatement, whether due to fraud or error, at
the financial statement and relevant assertion
levels through understanding the entity and its
environment, including the entity's internal
control, thereby providing a basis for
designing and implementing responses to
the assessed risks of material misstatement.
15
Bryce
what is the definition of control risk?
16
Control Risk
The risk that a misstatement that could
occur in an assertion about a class of
transaction, account balance, or
disclosure and that could be material,
either individually or when aggregated with other misstatements, will
not be prevented, or detected and
corrected, on a timely basis by the
entity's internal control.
17
Ashley
Discuss reasonable assurance.
18
Reasonable Assurance
Reasonable assurance. In the context of
an audit of financial statements, a high,
but not absolute, level of assurance.
19
Christina
Under Sarbanes-Oxley management must
report on the effectiveness of the
company’s internal controls.
With Regard to Internal Controls,
what STATEMENTS must MANAGEMENT
include in their annual report ?
20
Section 404 of
Sarbanes-Oxley
management must make the
following statements page 159
1 management is responsible for effective
internal controls over financial reporting
2 management’s assessment of the
effectiveness of the internal controls
3 the framework used to evaluate the
effectiveness of the internal controls
21
Evaluate the Effectiveness
1 management must evaluate the design
of internal controls
2 management must test the operating
effectiveness of those controls
22
Christine
what framework will management use to
evaluate the effectiveness of internal controls?
23
Vivian
In the standard unmodified audit report
What is management’s responsibility with regard
to the financial statements?
24
Management’s Responsibilty
Management is responsible for the preparation and fair
presentation of these financial statements in
accordance with accounting principles generally
accepted in the United States of America; this
includes the design, implementation, and
maintenance of internal control relevant to
the preparation and fair presentation of
financial statements that are free from material
misstatement, whether due to fraud or error.
25
Controls over
Sig Classes of Transactions
26
AU-C 315
The objective of the auditor is to identify and
assess the risks of material misstatement,
whether due to fraud or error, at the financial
statement and relevant assertion levels
through understanding the entity and its
environment, including the entity's internal
control,
27
Page 160
(Design of Internal Control)
Risks related to all relevant assertions
Evaluating Significant classes of transactions
Identify points in the transactions where material
misstatements could occur
Identify how each significant class of transactions
–
–
–
–
–
Initiated
Authorized
Recorded
Processed through the accounting system
Reported in the financial statements and disclosures
28
AU-c 315.84
the accounting system
Procedures and records designed to
Initiate, authorize, record, process, and report entity transactions
transactions
Maintain accountability for the assets, liabilities & equity
Transfer information to the general ledger
Capture information other than transactions that is relevant to the
financial statements.
e.g.journal
depreciation
and amortization of assets,
adjusting
entries
changes in the recoverability of receivables.
Ensure information that is required to be disclosed is accumulated,
disclosures
recorded, processed,
summarized, and appropriately reported in
the financial statements.
29
Fiona
In the standard unmodified audit report
What is the auditor’s responsibility?
30
Auditor’s Responsibilty
Our responsibility is to express an opinion on these financial statements based on our audit. We conducted our audit
Those standards
require that we plan and perform the audit to obtain reasonable assurance
about whether the financial statements are free from material misstatement.
in accordance with auditing standards generally accepted in the United States of America.
An audit involves performing procedures to obtain audit evidence about the amounts and disclosures in the financial
statements. The
procedures selected depend on the auditor's judgment,
including the assessment of the risks of material misstatement of the
financial statements, whether due to fraud or error.
In making those risk assessments, the auditor considers internal
control relevant to the entity's preparation and fair presentation of the
financial statements in order to design audit procedures that are
appropriate in the circumstances, but not for the purpose of expressing an
opinion on the effectiveness of the entity's internal control. Accordingly, we
express no such opinion.
An audit also includes evaluating the appropriateness of accounting policies used and the reasonableness of
significant accounting estimates made by management, as well as evaluating the overall presentation of the
financial statements.
We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit
opinion.
31
Auditors must document
their understanding
32
page 160/169
The classes of transactions that are significant
Procedures by which those transactions are:
Initiated, authorized & recorded
what accounting records exist,
Processed through the accounting system into the GL, and
reported in the financial statements.
How the info system captures other events that are
significant to the financial statements
Reporting process used to prepare the financial
statements, including significant estimates and disclosures.
33
Julia
COSO – 5 components of internal control
what are the five components of the
internal control framework ?
34
COSO components of internal controls
1.
2.
3.
4.
5.
Control environment
Risk assessment
Control procedures
Information and communication
Monitoring
35
COSO components of internal controls
1. Control environment
2. Risk assessment
3. Control procedures
4. Info & Comm --- Accounting System is part of
5. Monitoring
36
1. Control environment
•
•
•
•
•
•
management’s integrity and ethical values
commitment to competence
board of directors and audit committee
management’s philosophy & operating style
organizational structure
human resource policies and practices
page 163
37
1.
Control environment – Audit Committee
Bd of Directors - Audit Committee – Outside Directors
• Appointment of auditors
• Resolve differences between
management and auditors
• Oversight of internal audit
• Approval of non-audit services by auditor
page 163
38
COSO components of internal controls
1. Control environment
2. Risk Assessment
(p 165)
3. Control procedures
4. Information and communication
5. Monitoring
39
2. Risk assessment
How does the audit client manage risk?
Internal control is a process, effected by
those charged with governance,
management and other personnel that
is designed to provide reasonable
assurance about the achievement of
the entity’s objectives in the following
three categories:
40
Jake M
what can you assume when the Expected
Rate of Return for an investment or
project exceeds the interest rate on gov’t
insured savings accounts ?
41
business is about managing risk
otherwise companies should invest their
money in gov’t insured savings accounts
companies invest in risky assets and the
auditors must understand how the
company manages risks to convert those
assets into cash receipts
42
COSO Enterprise Risk Management
1.
Internal environment
2.
Objective Setting
3.
4.
5.
6.
7.
8.
Event identification
Risk assessment
Risk response
Control activities procedures
Information and communication
Monitoring
43
COSO components of internal controls
1. Control environment
2. Risk assessment
3. Control procedures
4. Information and communication
5. Monitoring
44
3. Control Procedures
Adequate segregation of duties
Proper authorization of transactions & activities
Adequate documents & records
Physical controls over assets & records
Independent checks on performance
45
page 160/169
The classes of transactions that are significant
Procedures by which those transactions are:
Initiated, authorized & recorded
what accounting records exist,
Processed through the accounting system into the GL, and
reported in the financial statements.
How the info system captures other events that are
significant to the financial statements
Reporting process used to prepare the financial
statements, including significant estimates and disclosures.
46
3. Control Procedures
Must separate
p. 166
Custody of Assets from Accounting (Record-Keeping)
Authorization of Trx from Custody of Related Assets
Operational Responsibility from Record-Keeping
IT Duties from User Departments
47
3. Control Procedures
Must separate
Custody of Assets
Authorization of Transactions involving those assets
Record-Keeping
48
3. Control Procedures
Adequate documents and records
Pre-numbered documents
1.
2.
3.
Checks
Purchase orders
Shipping documents
49
check no. 2228
Dec. 31
Pay to:
Cuesta Hardware
2014
$1,500.00
check no. 2229
Dec. 31
Pay to:
Lubricant Supply
2014
$875.00
check no. 2230
Dec. 31
Pay to:
The Electric Warehouse
2014
$970.00
check no. 2231
Dec. 31
Pay to:
Parts Supply Co.
six hundred and twenty-five
2014
$625.00
Dollars
Tad Miller
50
Cash Disbursements Journal
date
30-Dec
31-Dec
31-Dec
31-Dec
check
no.
written to
amount
2228 Cuesta Hardware
1,500.00
2230 The Electric Warehouse
970.00
2231 Parts Supply Co
625.00
total
disbursed
2,700.00
4,200.00
5,170.00
5,795.00
where is check 2229 to Lubricant Supply
51
Tim
if you discover a check that was not recorded
to which financial statement assertion does
an unrecorded check relate ?
52
COSO components of internal controls
1.
2.
3.
4.
5.
Control environment
Risk assessment
Control procedures
Information and communication
Monitoring
53
4.
Information & Communication / Monitoring
• Account balances are used to prepare
external financial statements
• Internal reports are part of
management’s feedback for Monitoring
operations
54
COSO components of internal controls
1.
2.
3.
4.
5.
Control environment
Risk assessment
Control procedures
Information and communication
Monitoring
55
5. Monitoring
•
•
•
•
•
•
Internal audit
Compare reports with your knowledge
of the business
Customer complaints
Vendor complaints
Regulators’ reports
Periodic reconciliations
56
Understanding Internal Controls
Obtain an understanding of internal controls
The design of internal controls
Document understanding
Assess Control Risk (preliminary)
Test Operating Effectiveness of controls
Assess Control Risk (after ToC’s)
57
page 160/169
The classes of transactions that are significant
Procedures by which those transactions are:
Initiated, authorized & recorded
what accounting records exist,
Processed through the accounting system into the GL, and
reported in the financial statements.
How the info system captures other events that are
significant to the financial statements
Reporting process used to prepare the financial
statements, including significant estimates and disclosures.
58
How –gain an understanding
Internal Controls
Internal Control Questionnaire
p. 172
Prior year’s work papers
p. 174
Inquiries of client
Examine documents
Observe activities – Perform Walkthroughs
59
Internal Controls Questionnaire
p. 173
A. Recorded sales are for shipments actually
made to existing customers
B. Existing sales transactions are recorded
C. Recorded sales are for the amount of goods
shipped and are correctly billed and
recorded
D.
Sales transactions are properly included in master files and
correctly summarized
E. Recorded sales transactions are properly
classified
F. Sales are recorded on the correct dates 60
Internal Controls Questionnaire
p. 173 (62-161)-176-207-252
A. Recorded sales are for shipmentsOccurrence
actually
made to existing customers
B. Existing sales transactions areCompleteness
recorded
Accuracy
C. Recorded sales are for the amount of
goods
shipped and are correctly billed and
recorded
D.
Sales transactions are properly included in master files and
correctly summarized
E. Recorded sales transactions are
properly
Classification
classified
F. Sales are recorded on the correct datesCutoff
61
62
Document-
our understanding of Internal Controls
Internal Control Questionnaire
Narative
Flowchart
p. 173
63
Must assess Control Risk
• for each fin statement assertion
• for each sig class of transaction
64
Control Risk Matrix
p. 176
Look at the headings of the columns
Audit Objectives / Assertions
Must have a control(s) in place for each
assertion / objective
65
66
p. 252
67
Tests of Controls
if a control is well designed
test if control is operating effectively
68
Internal Control Communications
69
Somer
what is a Control Deficiency?
page 176 --look at the last 2 lines in Figure 5
70
71
Control deficiency
(day one handout)
when the design or operation of a
control does not allow management or
employees, in the normal course of
performing their assigned functions, to
prevent, or detect and correct
misstatements on a timely basis
72
Control deficiency
if a control is not properly designed
Or well designed control may not operate
as designed
or the person performing the control is not
sufficiently qualified
73
Katina
what is a Material Weakness in internal control?
74
Material weakness
A deficiency, or a combination of deficiencies, in internal
control, such that there is a reasonable
possibility that a material misstatement of
the entity's financial statements will not be prevented, or
detected and corrected, on a timely
basis.
75
Lauren
what is a Significant Deficiency in
internal control ?
76
Significant deficiency
A deficiency, or a combination of deficiencies, in internal
control that is less severe than a material
weakness yet important enough to merit
attention by those charged with
governance.
77
Material
weakness
Figure 6
material
page 272
Material
Weakness
Likelihood
Remote
Reasonably
Possible
Probable
immaterial
78
Communications regarding Internal Control
Reportable Conditions
significant deficiencies
material weaknesses
Those charged with governance of the
company
audit committee
board of directors
senior management
79
Effectiveness of Internal
Controls
and
Audit Approaches
80
81
for private companies
non-SEC companies
not covered by Sarbanes-Oxley
82
Huyen
After evaluating the design of the controls you do not
believe the client’s controls would prevent, or detect
and correct misstatements even if properly
implemented
You believe the controls are INeffective
How will you preliminarily assess CR ?
83
Aleksandr
After evaluating the design of the controls you do not
believe the client’s controls would prevent, or detect
and correct misstatements even if properly
implemented
You believe the controls are INeffective
You preliminarily assess CR = High
Which audit approach will you take?
84
Ian
You believe it would cost less to perform
Tests of Contols than $ubstantive Test$
which audit approach will you take ?
85
Romy
Which types of audit tests will you perform
evaluate design of controls
Tests of Controls
test operating effectiveness
none
some
extensive
Substantive Tests
analytical procedures
test of details of account balances
none limited extensive
86
Madyson
After evaluating the design of the controls you believe
the client’s controls would prevent, or detect and
correct misstatements if properly implemented
You believe they would be Effective if implemented
How will you preliminarily assess CR ?
87
Marc
After evaluating the design of the controls you believe
the client’s controls would prevent, or detect and
correct misstatements if properly implemented
You believe they would be Effective if implemented
You preliminarily assess CR = Low
Which audit approach will you take?
88
Jena
You believe it would cost less to perform
Tests of Contols than $ubstantive Test$
which audit approach will you take ?
89
Julissa
Which types of audit tests will you perform
evaluate design of controls
Tests of Controls
test operating effectiveness
none
some
extensive
Substantive Tests
analytical procedures
test of details of account balances
none limited extensive
90
After evaluating the design of the controls you believe
the client’s controls would prevent, or detect and
correct misstatements if properly implemented
You believe they would be Effective if implemented
91
Jonathan deS
You believe it would cost less to perform
$ubstantive Test$ than Tests of Contols
which audit approach will you take ?
92
Loren
Which types of audit tests will you perform
evaluate design of controls
Tests of Controls
test operating effectiveness
none
some extensive
Substantive Tests
analytical procedures
test of details of account balances
none limited extensive
93
for private companies
non-SEC companies
not covered by Sarbanes-Oxley
94
Subst Tests
Less costly than
ToC
ToC
Less costly than
Subst Tests
controls
effective
(CR =Low)
extensive
Subst Tests
ToC
controls
ineffective
(CR = MAX)
Must do extensive Subst Tests
preliminarily
assess
limit subst tests =>
analytical procedures
95
•
Understand internal controls
–
–
•
•
•
Document understanding
Evaluate the design of the controls
Preliminarily assess control risk
– Document prelim CR assessment
If CR < Low &
$ToC < $Sub$t Tests
– Design and perform ToC
– Document results of ToC and CR assessment
– Design and perform limited Subst Tests
– Document results of Subst Tests
If CR = Max
–
–
or
$Sub$t < $ToC
Design and perform extensive Subst Tests
Document results of Subst Tests
96
for public companies
SEC companies
covered by Sarbanes-Oxley
97
98
Alyssa
After evaluating the design of the controls you
believe the client’s controls would prevent, or detect
and correct misstatements if properly implemented
You believe they would be Effective if implemented
How will you preliminarily assess CR
99
Xiaodan
After evaluating the design of the controls you
believe the client’s controls would prevent, or detect
and correct misstatements if properly implemented
You believe they would be Effective if implemented
You preliminarily assess CR = Low
Which audit approach will you take?
10
0
Nicole
You believe it would cost less to perform
Tests of Contols than $ubstantive Test$
which audit approach will you take ?
10
1
Gordon
Which types of procedures will you perform
evaluate design effectiveness
Tests of Controls
test operating effectiveness
none
some extensive
none
limited extensive
Substantive Tests
analytical procedures
test of details of account balances
10
2
Iris
You believe it would cost less to perform
$ubstantive Test$ than Tests of Contols
which audit approach will you take ?
10
3
Dillon
Which types of procedures will you perform
evaluate design effectiveness
Tests of Controls
test operating effectiveness
none
some extensive
none
limited extensive
Substantive Tests
analytical procedures
test of details of account balances
10
4
Stephanie
After evaluating the design of the controls you do not
believe the client’s controls would prevent, or detect
and correct misstatements even if properly
implemented
You believe the controls are INeffective
How will you preliminarily assess CR ?
10
5
Ricardo
After evaluating the design of the controls you do not
believe the client’s controls would prevent, or detect
and correct misstatements even if properly
implemented
You believe the controls are INeffective
You preliminarily assess CR = High
Which audit approach will you take?
10
6
Chen
You believe it would cost less to perform
Does it matter which types of tests are
least expensive?
which audit approach will you take ?
10
7
Katie
Which types of audit tests will you perform
evaluate design effectiveness
Tests of Controls
test operating effectiveness
none
some extensive
Substantive Tests
analytical procedures
test of details of account balance
none limited extensive
10
8
preliminarily
assess
controls
effective
(CR < Low)
controls
ineffective
(CR = MAX)
Subst Tests
Less costly than
ToC
ToC
Less costly than
Subst Tests
ToC
ToC
can limit subst tests
can limit subst tests
analytical procedures
analytical procedures
must do some ToC
must do some ToC
Extensive Subst
Tests
Tests of Details
Extensive Subst
Tests
Tests of Details
10
9
•
Understand internal control structure
– Document understanding
– Evaluate the Design Effectiveness of ICS
•
Design and perform ToC to assess CR
– Document results of ToC
– and CR assessment
•
If CR > Low
– Design and perform extensive Subst Tests
– Document results of Subst Tests
11
0
Audit Documentation
Workpapers
Must document
Record of compliance with GAAS
11
1
11
2
11
3
11
4
11
5
Statement
on Auditing
Standards
December 2006
109
AICPA
Understanding the
Entity and its
Environment and
Assessing the
Risks of Material
Misstatement
11
6
11
7
Assessing CR < Max
11
8
11
9
Assessing control risk
Identify:
• specific control objectives (assertions)
• points in the flow of transactions where
specific types of misstatements could occur
• specific controls procedures designed to
prevent or detect these misstatements
• Evaluate the design of control procedures
• perform tests of the operating effectiveness of
controls
12
0
For each significant class of transactions
For each Management Assertion
we will need to assess CR
If we assess CR < Max for an Assertion
must identify a Control Procedure
(strength)
Then design & perform a Test of Controls
to see if that Procedure is effective
12
1
credit sales
preliminary
assess of
control risk
final
assessment of
control risk
Occurrence
low
Accuracy
low
Completeness
low
Cutoff
max
max
Classification
max
max
12
2
12
3
Accounts receivable
Sales
occurrence
potential
misstate
sales to
unauthorized
customers
goods may be
released from
warehouse for
unauthorized orders
control
activity
test of control
customer on
approved
customer list
inspect list
approved sales
order
examine approved
sales order
results
of ToC
evaluate
approved sales
observe
order for all
warehouse person
goods released to filling orders
shipping
goods shipped may shipping clerks
not agree with
agree goods
goods ordered
received from
warehouse with
S.O.
signature of
shipping clerk
indicating he
performed the
check
12
4
potential
misstate
control
activity
test of control
unauthorized
shipments made
prepare Shipping Inspect Ship Docs
doc for each
order
billings may be
made for ficititous
transactions
matching S.D.
and approved
S.O. for each
invoice
vouch invoices to
S.D. and
approved S.O.
duplicate billings
may be made
matching S.D.
and approved
S.O. for each
vouch invoices to
S.D. and
approved S.O.
results
of ToC
evaluate
12
5
potential
misstate
fictitous sales may
be recorded
control
activity
sales invoice and
matching
documents
required for all
entries
invoices may be
mail monthly
posted to the wrong statements to
customers accounts customers with
independent
followup on
customer
complaints
test of control
results
of ToC
evaluate
vouch recorded
sales to
supporting
documents
observe mailing
and followup
procedures
12
6
Accounts receivable
Sales
completeness
potential
misstate
control
activity
test of control
goods shipped may shipping clerk
not agree with
agrees goods
goods ordered
received from
warehouse to
approved S.O.
signature of
shipping clerk
indicating he
agreed goods to
S.O.
some shipments
may not be billed
matching sales
invoice for each
S.D.
trace S.D. to
invoices
billings may be
made for ficititous
transactions
periodic
observe procedure
accounting for all re-perform
S.D.
results evaluate
of ToC
12
7
potential
misstate
invoices may not be
journalized or
posted to customer
accounts
control
activity
agree sales
journal entries
and amounts
posted to
customer
accounts with
control totals of
invoices
test of control
results evaluate
of ToC
review evidence
of independent
check
trace incoices to
sales journal and
custm\omer
accounts
periodic
observe procedure
accounting for all
sales invoices
re-perform
invoices may be
mailing of
posted to the wrong monthly
customer accounts statements and
followup on
customer
complaints
observe mainling
and followup
procedures
12
8
Accounts receivable
Sales
accuracy
potential
misstate
control
activity
test of control
sales may be made
without credit
approval
check on
customer’s credit
prior to each sale
examine evidence
of credit limit
check on each
sale
sales invoices may
have incorrect
prices
check pricing of
invoices
reperform check
on accuracy of
pricing
fictitous sales may
be recorded
sales invoice and
matching
documents
required for all
entries
vouch recorded
sales to
supporting
documents
results
of ToC
evaluate
12
9
potential
misstate
control
activity
invoices may not be
journalized or
posted to customer
accounts
agree entries in
sales journal and
amounts posted
to customer
accounts with
control totals of
invoices
review evidence
of independent
check
mailing of
montly
statements with
followup on
customer
complaints
observe mailing
and followup
procedures
invoices may be
mailed to wrong
customer account
test of control
results evaluate
of ToC
trace sales
invoices to sales
journal and
customer
accounts
13
0
Assess control risk
Identify:
• significant classes of transactions
• objectives assertions
• points where errors or fraud could occur
• specific controls that would prevent or detect
these errors
• Link specific controls with the assertions to
which they relate
• Evaluate the design of the control
• Test the operating effectiveness of the control
13
1