INTERNAL
CONTROL
SECTION 9
Internal Control: Principles and
Concepts
•
The client’s system of internal is an
important factor in an audit engagement
•
The study of internal control often represents
a significant part of field work
•
We will examine:
1.
2.
Basic considerations
Meeting the second standard of GAAS
ST. CATHARINES: Former stock broker Stan Magda has been jailed for contempt of court for refusing to say
what happened to the $2 million his wife stole from the St. Catharines Standard.
Ontario Superior Court Justice Linda Walters sentenced the 59-year-old self described house husband to five
says in jail yesterday and gave him until Sep. 7 to account for the money his wife stole from her employer.
Lucy Magda, 62, was sentenced to 34 months in penitentiary last July for embezzling $2.2 million over a
five-year period while she was running the classified ad department at The Standard. She is now living in a halfway house in Dundas.
Once considered a trusted employee, she stuffed up to $6,000 a day in her handbag and covered her tracks
by destroying or doctoring the paper trail. She was caught and immediately fired in the spring of 1997 after a
temporary employee she had berated discovered discrepancies in the books.
She and her husband, who was no longer working, were both charged with theft related charges in1997. But
the charges against Stan were dropped in January 2004, after she pleaded guilty to theft over $5,000.
The St. Catharines Standard had earlier won a $2.3 million civil judgment that held the couple jointly
responsible for the missing funds. The case has dragged on in the courts for almost eight years with lawyers for the
paper pressing the pair to account for the money.
During the theft investigation, Niagara police found what s detective described as an “Aladdin's cave” of
stolen booty in the couple’s modest Thorold home. Police tallied about $1,170,000 worth of items, including
hundreds of pairs of shoes and rooms full of unworn clothing that still had price tags.
They also found about $470,000 in cash stashed in the house and several hundred thousands in numerous
bank accounts under aliases. Lucy had never earned more than $48,000 a year.
When asked about the money during pre-trial discoveries, Lucy told The Standard’s lawyer Peter Mahoney
her late father had won the $470,000 while gambling with his buddies in the 1960’s, according to court documents.
She said her father, who died in 1975, told her to keep the money in the house until it was sold. She also
claimed her dad had given her money to go shopping.
The Hamilton Spectator, Wednesday, June 22, 2005.
What is Internal Control?
•
•
Remember the second examination standard
CICA 5200
• Those policies and procedures established and
maintained by management that affect control risk
relating to specific financial statement assertions at the
account balance or class of transaction level
•
Comprises of the entity's control environment and control
systems installed by management
•
Two subdivision of internal control
1. Administrative controls
•
The plan of the organization and the procedures and
records concerned with the decision process
•
Also includes statistical analyses, time and motion
studies, performance reports, and quality controls
•
Some administrative controls do have an impact on
accounting records
2. Accounting controls
•
The plan of the organization and the procedures and
records concerned with safeguarding of assets
•
Designed to provide reasonable assurance that:
1.
Transactions are authorized
2.
Transaction recorded in conformity with?
3.
Access to assets is authorized
4.
Recorded accountability for assets is compared to existing records
Management’s Objectives for
Internal Control
•
Managements responsibility
•
Objectives should include:
1.
2.
3.
4.
5.
6.
Discharge of statutory responsibilities
Profitability and cost minimization
Prevention and detection of fraud and error
Safeguarding of assets
Reliability of accounting records
Timely preparation of reliable financial information
Internal Control Environment
•
A good internal control environment complements
prescribed control procedures
•
Should include:
1.
2.
3.
4.
5.
6.
7.
Management leadership
Organizational structure
Budgets and internal reports
Internal auditing
Reliable personnel
Sound practices
Company circumstances
Internal Accounting Control
Principles
•
Classified as preventative, detective, or corrective
•
Preventative controls are used prior to or during the
authorization, physical event, or recording of the
transaction
•
Detective controls are utilized after the transaction
has occurred or been recorded
Major Categories of Controls
1. Authorization Procedures
•
The purpose is to ensure that transactions are authorized
by management personnel acting within the scope of their
authority
•
Authorizations may be routine or non-routine
•
Authorization procedures are also important in limiting
access to assets
2.
Segregation of Duties
•
It is important for an entity to segregate the authorization
of transactions, recording of transaction, and custody of
related assets.
•
Independent performance of each of these functions
reduces the opportunity for any one person to be in a
position to both perpetrate and conceal errors or fraud
•
Different departments and individuals
•
Small companies?
3.
Documentation Procedures
•
Provides evidence of occurrence
•
Signing or stamping documents
•
Prenumbered documents
•
Chart of accounts
•
Accounting procedures that relate to timely
processing
4.
Access to Assets and Records
•
Physical precautions
•
Data processing
•
Physical controls
•
Access controls
•
Backup and recovery
5.
Independent Internal Verification
•
Reviewing the accuracy and propriety of an employee’s
work by another employee
•
Who performs the task?
•
How often?
•
Errors and exceptions?
Meeting the Second Examination
Standard
•
A sufficient understanding of internal control should be
obtained to plan the audit. When control risk is assessed
below maximum, sufficient appropriate audit evidence
should be obtained through tests of controls to support the
assessment.
•
Reliance on internal control
•
If internal control is not tested, at what level is control risk
set?
Objectives and Scope of the Standard
•
Internal controls can change significantly from year to year
•
Sufficient understanding of internal control
•
Appropriate audit evidence
•
Relationship between reliance on internal control and the
amount of substantive audit work needed
Methodology for the Study of Internal Control
•
Two closely related parts:
1. A review of the system
2. Tests of controls
Planning Phase
•
The minimum study contemplated by the second
examination standard
•
General knowledge
•
At the conclusion, the auditor must decide, for each
major class of transactions, whether to continue or
terminate the review
Study Phase
•
The auditor obtains specific knowledge and understanding of
the client’s prescribed control procedures
1.
Gathering information
2.
Verifying the understanding
3.
Preliminary evaluation
1.
Gathering Information
•
Obtaining the information
•
Generally information is organized according to one of the
following approaches:
a) Transaction cycles
b) Financial Statement classification
c) Business function
•
Questionnaires
•
A series of questions relating to control procedures required
to prevent and detect errors and irregularities
Campus Theatre
Internal Accounting Internal Control Questionnaire
December 31, 200X
CYCLE: Revenue
Control Procedure
Date: 9/8/200X
CLASS OF TRANSACTIONS: Cash Receipts
Yes
1. Are prenumbered tickets used and
subsequently accounted for?
X
2. Is there restricted access to rolls of unused
tickets?
X
3. Is a ticket machine used in issuing tickets?
X
4. Are tickets voided upon admission of patrons?
X
5. Is there segregation of duties between
issuance of tickets and admission of patrons?
X
6. Is there an independent daily cash count and
reconciliation with tickets issued?
X
7. Are cash receipts deposited in total daily?
Prepared by: ILA
No
X
Remarks
Deposited weekly
•
Flowcharts
•
•
Separate flowcharts are prepared for each major class of
transactions
Narratives
•
Written comments by the auditor about the system
2.
3.
Verifying the Understanding
•
Reinforces the understanding of the information gathered
•
Transaction walkthrough
Making a Preliminary Evaluation
a)
Rely on internal?
b)
Which internal controls?
c)
Substantive auditing procedures necessary due to weakness in internal
control
•
When is internal control considered reliable?
•
When there is no planned reliance on a internal control procedure
•
Communication to management
•
A material weakness exists when there more than a relatively low risk
that error or fraud would have a material effect on the financial
statements
•
At what percentage?
Prepared by:ILA
Date: 9/10/200X
Campus Theatre
Preliminary Evaluation: Cash Receipts Transactions
December 31, 200X
Errors and Fraud
Necessary Control
Procedures
The Theatre’s Prescribed
Control Procedures
Planned
Reliance
Yes
1
2
3
4
5
Tickets may be issued without
accounting for cash
Prenumbered tickets
All tickets are prenumbered
and the theatre manager
accounts for tickets issued
X
Unused tickets may be stolen and
sold for cash
Physical control and
restricted access
Unused tickets are stored in a
safe. Only the manager has
access
X
Tickets may be issued out of
sequence and cash may not be
accounted for
Mechanical equipment for
issuing tickets
Ticket machines are used in
issuing tickets
X
Doorperson could resell tickets or
combine with cashier to resell
tickets and keep the cash
Mutilation of tickets upon
admission of patron
Doorperson tears tickets in half
when admitting patron
X
The cashier may collect cash and
admit patron without issuing ticket
Segregation of duties in
admissions
Cashier issues tickets and the
doorperson admits patrons with
tickets
X
No
Prepared by:ILA
Date: 9/10/200X
Campus Theatre
Preliminary Evaluation: Cash Receipts Transactions
December 31, 200X
Errors and Fraud
Necessary Control
Procedures
The Theatre’s Prescribed
Control Procedures
Planned
Reliance
Yes
6
7
Cash may be over or short due to
mistakes in making changes
Independent daily cash
count and reconciliation
with tickets issued
Theatre manager makes a daily
cash count and reconciliation
All cash receipts may not be
deposited
Deposit total cash receipts
daily
Cash receipts are deposited
wekly
No
X
X
Tests of Controls
•
Performed in order to obtain reasonable assurance that the
controls expected to be relied upon are in use and operating
as planned throughout the period of reliance
1.
Nature of Test of Controls
•
Concerned with four questions:
•
•
•
•
Were the procedures performed?
How?
By whom?
Throughout the period
•
The failure to perform a required procedure or the failure to perform
it properly
•
CICA 5215
•
•
Document inspection
•
Inquiry and observation
Also reperformance
•
Assume that in the billing department, a second clerk must
independently verify the correctness of unit selling prices on invoices
by comparing the price to an authorized price list
•
What would be the evidence of this control?
•
In testing compliance by reperformance?
•
Each instance of the use of incorrect prices would be regarded as an
exception
2.
Extent and Timing
•
Throughout the accounting period being audited
•
An example of Tests of Controls
•
Campus Theatre cash receipts scenario
Campus Theatre
Audit Program
December 31, 200X
Tests of Controls: Revenue cycle
Working
Paper
Reference
Class of Transactions: Cash Receipts
Done by
Audit Procedure
1 Examine tickets for prenumbering. Six series of 100 throughout the year.
2 Observe storage of unused tickets and inquire about authorized access to the
safe. At interim and year-end.
3 Observe the use of ticket machines issuing tickets. At interim and year-end.
4 Observe the doorperson in admitting patrons and examine ticket receptacle
for mutilated tickets. At interim and year-end.
5 Observe segregation of duties between the cashier and the doorperson. At
interim and year-end.
6 Examine documentary evidence of daily cash counts and reconciliations
with tickets issued. One week, for each of six months.
Auditor
Date
Final Evaluation of Controls
•
On completion of the tests of controls
•
Nature of the Evaluation
•
Weaknesses affecting different classes of transactions do
not offset each other
•
The number of exceptions may be of such magnitude to
doubt that the control procedure can be relied on
•
The auditor should look at what was the underlying
cause of the exception
•
In some cases you might expect some exceptions
•
It is essential to attempt to see if the exception was
caused by an error
•
Fraud?
•
Purpose of the Evaluation
•
To determine the extent to which the clients
controls can be relied on in performing substantive
tests
•
Three level of risk
•
Low
•
Medium
•
High
•
To what is the final evaluation directed?
•
Should be documented in the working papers
1. Strengths
2. Weaknesses
3. Effects on substantive tests
4. Communication to management
Prepared by: ILA
Date: 9/15/200X
Campus Theatre
Evaluation of Internal Control Over Cash Receipts
December 31, 200X
Strengths
All of the controls on which reliance is planned were tested for compliance. These controls were found to be
functioning as planned. In my judgment, the control risk associated with these controls is low.
Weaknesses
Cash is deposited in the bank only once a week. This procedure is not satisfactory for good internal control.
Effect on Substantive Tests
For controls in which control risk is low, the planned audit program should be implemented. For the control
over depositing cash, the substantive tests should be extended.
Management Communication
Indicate that the failure to deposit cash intact daily also makes cash vulnerable to theft. Suggest that the
manager make daily deposits using the banks night depository vault.
Determining Effects on Substantive
Tests
•
The second examination standard does not permit
complete reliance on internal control
•
The auditor relies on internal control to reduce
control risk, and substantive tests to reduce
detection risk
•
Reliance on internal control may affect the nature,
timing, and extent of substantive tests.
•
Nature
•
The type of auditing procedure to be performed
•
For the verification of sales transactions
•
For a low risk of errors in sales transactions as
demonstrated by tests of controls
•
For a high risk of errors
•
Timing
•
The time when the testing is done
•
When there is a low risk of errors in processing
sales transactions
•
When the risk of errors is high
•
Extent
•
The amount of substantive testing to be performed
•
When the risk of errors in processing sales
transaction is low
•
When the risk is high
Internal Control Letter to
Management
•
It is important that the auditor communicate any
awareness of significant weaknesses in internal
control to management
•
Internal control letter
•
Communication should be made at the earliest
practicable date to the appropriate official
Problem 1: Distinguish between a substantive approach and a combined approach in
auditing a financial statement assertion.
Problem 2:
The following are errors or fraud and other irregularities that have
occurred in Fresh Foods Grocery Store Ltd., a wholesale and retail grocery
company.
1.
The incorrect price was used on sales invoices for billing and shipments to
customers because the wrong price was entered into a computer file.
2.
A vendors invoice was paid twice for the same shipment. The second payment
arose because the vendor sent a duplicate copy of the original two weeks after
payment was due.
3.
Employees in the receiving department took sides of beef for their personal use.
When a shipment of meat was received, the receiving department filled out a
receiving report and forwarded it to the accounting department for the amount of
goods actually received. At the time, two sides of beef were put in an employee’s
pickup truck rather than in the storage freezer.
4.
During the physical count of inventory of the retail grocery, one counter wrote
down the wrong description of several products and miscounted the quantity.
5.
A salesperson sold an entire carload of lamb at a price below cost because she did
not know the cost of lamb had increased in the past week.
6.
On the last day of the year, a truckload of beef was set aside for shipment but was
not shipped. Because it was still on hand, it was counted as inventory. The
shipping document was dated the last day of the year so it was also included as a
Required:
a.
For each error or fraud and other irregularity, identify one or more types of
controls that were absent.
b.
For each error or fraud or other irregularity, identify the objectives that have not
been met.
c.
For each error or fraud and other irregularity, suggest a control to correct the
deficiency.
Problem 3: Recently, while eating lunch with some friends at a cafeteria at your
university, you observe a practice that is somewhat unusual. As you reach the end
of the cafeteria line, a server asks how many persons are in your party. He then
totals the food purchases on the trays for all of your party and writes the number
of persons included in the group on your bill. He hands you the bill and asks you
to pay when you finish eating. Near the end of the meal, you decide you want a
piece of pie and coffee so you return to the line, select your food, and again go
through the line. The server goes through the same procedures, but this time he
staples the second bill to the original and returns it to you.
When you leave the cafeteria, you hand the stapled bills to the cashier, who totals
the two bill's, takes your money, and puts the bills on a spindle.
Required:
a.
What internal controls has the cafeteria instituted for its operations?
b.
How can the manager of the cafeteria evaluate the effectiveness of the controls?
c.
How do these controls differ from those used by fast-food outlets?
d.
What are the costs and benefits of the cafeteria’s system?
Problem 4: Lew Pherson and Marie Violette are friends who are employed by different public
accounting firms. One day during lunch they are discussing the importance of internal
controls in determining the amount of audit evidence required for an engagement. Pherson
expresses the view that internal controls must be carefully evaluated in all companies,
regardless of their size, in basically the same manner. His public accounting firm requires a
standard internal control questionnaire on every audit as well as a flowchart of every
transaction area. In addition, he says the firm requires a careful evaluation of the system
and a modification in the evidence accumulated based on the controls and weaknesses in
the system.
Violette responds by saying she believes internal control cannot be adequate in many of the
small companies she audits although she recognizes that the CICA Assurance Handbook
requires her to obtain a sufficient understanding.” She disagrees with the Handbook
Recommendations and goes on to say, “Why should I spend a lot of time obtaining an
understanding of internal control and assessing control risk when I know it has all kinds of
weaknesses before I start? I would rather spend the time it takes to fill out all those forms in
testing whether the statements are correct.”
Required:
a.
Express in general terms the most important difference between the nature of the potential
controls available for large and small companies.
b.
Criticize the positions taken by Pherson and Violette, and express your own opinion about
the similarities and differences that should exist in understanding internal control and
assessing control risk for different-sized companies.