1
FINANCIAL ACCOUNTING
& INTERNAL AUDITS
How financial accounting and internal audits
can benefit government agencies.
Lydia Lafleur, CIA
LSU Center for Internal Auditing
2
Agenda
• Accounting and Auditing Standards
• Internal Auditing
• Internal Controls
• Governance
• Fraud
• Management Responsibilities
3
Financial Accounting
Information & Measurement System
Identifies
Records
Communicates
Business Activities
Decision Makers
External Users
Internal Users
Investors, Creditor, Suppliers, etc.
Managers, Supervisors, Directors, etc.
FASB: Financial Accounting Standards Board
4
Governmental Accounting
GASB: Governmental Accounting Standards Board
GASB Concept Statement No. 1, Objectives of Financial Reporting:
“…financial reporting should provide information to assist users in assessing
the service efforts, costs, and accomplishments of the governmental entity.”
Stakeholders
• Citizens and taxpayers
• Legislative and oversight bodies
• Creditors and investors
Accountability
• Fiscal
• Operational
Characteristics of
Financial Reports
•
•
•
•
•
•
Understandability
Reliability
Relevance
Timeliness
Consistency
Comparability
5
Auditing Standards
• Institute of Internal Auditors Professional
Practices Framework
• Generally Accepted Government Auditing
Standards (GAGAS) (The Yellow Book)
• Other Guidance
• Standards for Internal Control in the Federal Government (The
Green Book)
• Internal Control Management and Evaluation Tool
• Structured approach to assessing the internal control structure
6
Accountability
• Management and officials are responsible for:
• Carrying out public functions
• Providing service to the public effectively, efficiently, economically,
ethically, and equitably
• Providing reliable, useful, and timely information
• Users need to know whether:
1. Management and officials manage government resources and
use their authority properly and in compliance with laws
2. Programs are achieving the objectives and desired outcomes
3. Services are provided efficiently, economically, ethically and
equitably
Generally Accepted Government Auditing Standards Introduction
7
Internal Auditing Definition
• Internal auditing is an independent and
objective assurance and consulting activity
that is guided by a philosophy of adding value to
improve the operations of the organization. It
assists an organization in accomplishing its
objectives by bringing a systematic and
disciplined approach to evaluate and improve the
effectiveness of the organization’s risk
management, control, and governance
processes.
Institute of Internal Auditors
8
Internal Auditing
Audit Planning
Add-Value
Corporate
Governance
Risks
Controls
Assurance Consulting
Plan
• Triple Bottom Line
- Environmental
- Social
- Economic
Types of Audits:
1. Financial Audits
2. Attestation Engagements
3. Performance Audits
Organization
9
Internal Controls
Adequate Controls
G&O
RxC=r
G&O
Plan
Organize
G = Goals
O = Objectives
R = Risk
L = Likelihood
I = Impact
C = Controls
r = Residual Risk
Reasonable Assurance
RLI x CL x CI = rLI
10
Internal Controls
Continuous Improvement Model
Goals &
Objectives
Goals &
Objectives
"Monitoring & Learning"
 Specific
 Measurable
 Attainable
 Relevant
 Timely
"Purpose"
Preventive
Detective
Directive
Controls
Hard
Soft
Control
Environment
"Commitment"
COCO
•
•
•
•
Purpose
Commitment
Capability
Monitor & Learn
Management
Plan
• Tactical
• Strategic
Organize
Staff
Direct
Monitor
"Capability"
Selection
• Alternatives
Control Activities
Segregation
• Access
• Accountability
• Authority
Reconcile
• Completeness
Authority
Transactions
• Manage
Accountability
Safeguard
Design
In Place
Functioning
• Compliance
11
COSO
 Financial
 Compliance
 Operations
Management Controls:
Planning
• To achieve goals
• Tactical
 Systems
Monitoring
Methodology used for
assessing the quality
of internal controls.
Control Activities
Hard Controls:
• Segregation of Duties (AAA)
• Safeguarding of assets
• Transactions recorded
• Accountability
• Periodic Reconciliation
Risk Analysis
• Strategic
Organizing
• Delegation
Staffing
• Right People
Directing
• Policies and Procedures
Monitoring
• Communication and information
• Analytics and Analysis
• Change management
Common factors used in identifying and
assessing materiality of risks.
Control Environment
Soft Controls:
• Corporate Culture
• Tone at the Top
Committee of Sponsoring Organizations of the Treadway Commission
12
COSO Control (Addressing Governance)
Challenge:
Monitoring
Control Activities
Activity 2
Entity
Information & Communication
Unit A
Aggregate
Activity 1
• Evolving from Control Activities
to the Control Environment
Process
Risk Assessment
Unit
Control Environment
Tone at the Top
Tone at the Middle
“Systemic cultural problem” Mark Emmert, NCAA President
“Management should periodically check the batteries in their moral compass.” GES
13
Update Formalizes Fundamental Concepts Embedded in the
Original Framework as Principles
1.
2.
3.
4.
5.
Demonstrates commitment to integrity and ethical values
Exercises oversight responsibility
Establishes structure, authority and responsibility
Demonstrates commitment to competence
Enforces accountability
Risk Assessment
6.
7.
8.
9.
Specifies suitable objectives
Identifies and analyzes risk
Assesses fraud risk
Identifies and analyzes significant changes
Control Activities
10. Selects and develops control activities
11. Selects and develops general controls over technology
12. Deploys through policies and procedures
Control Environment
Information &
Communication
Monitoring Activities
13. Uses relevant information
14. Communicates internally
15. Communicates externally
16. Conducts ongoing and / or separate evaluations
17. Evaluates and communicates deficiencies
Source: COSO, “Internal Control – Integrated Framework”, September 2012
14
Quality Drift (Cascading Process)
Subjective
Control Environment
Management Controls
P-O-S-D-M
Control Activities
Objective
15
Controls
Subjectivity
Challenges:
• Hard to Soft
• Objective to Subjective
• Simple to Complex
• Evolution to Revolution
Complexity
Parkinson’s Law:
Complexity leads to decay
16
Criteria of Control: CoCo
Purpose
Monitoring
Action
Commitment
Capability
17
Internal Auditing: Adding Value
Subjective
(Mature)
(Embryo)
•Opportunities
•Threats
(Radar)
Governance
Risk
Controls
Control Environment
Objective
Management Controls
Objective
Control Activities
Integration
• GRC
Evaluation
Board
• Check the box
• Reality
External
Entity
Process
Audit Committee
• Charter
Internal Audit
• Charter
Unit
Evolution of the Profession
Quality
Subjective
Question: Can you be in 100% compliance and go out of business?
(Evaluation Audit). Does compliance equal quality?
18
Governance
The Big Risk
SOD
Board
Selection Process
Audit
Committee
Risk
Committee
Compensation
Committee
• Stock options
• Bonus plans
CAE
CRO
• Global
• Strategic
(CRMA)
CEO
COB
• Counterproductive
• Salaries
• Up, up, up, and
away
• The Bear
• Charley Mac
• Shareholder Input
Sub.
Obj.
AAA
Issues:
•
•
•
•
Accountability – Governance, Risks, and Controls
King III
Transparency
Sustainability
Personal Opinion:
The CEO and CFO should not be involved in selecting members of the Board, Audit Committee, Risk Committee,
or Compensation Committee
19
Organizational Governance
(Roles and Responsibilities)
Control Environment
BOARD & SUB-COMMITTEES
Plan – Organize – Staff – Direct – Monitor (P-O-S-D-M)
Executive Management
P-O-S-D-M
Process Owner
Process Owner
Process Owner
P-O-S-D-M
P-O-S-D-M
P-O-S-D-M
Control Activities
Employees
Specific Job Descriptions
Organizations Should Be Organized
Delineation of Goals & Objectives
(Integration & Linkage)
Governance
20
COSO Risk
Focus:
• Internal Environment
• Strategies
• Integration
Objectives
Internal Environment
Event Identification
Risk Assessment
Division
Objective Setting
Risk Response
Control Activities
Info. & Communication
Monitoring
ERM – Conceptual Framework
21
Governance Infrastructure (Integration & Linkage)
Governance
Audit Committee of Board of Directors
Reporting
ERM
Oversight
Oversight
(Responsibility)
Chief Risk Officer
(CRO)
(Execution)
Audit
Audit Plan (Risk Driven)
Macro (Resource Allocation)
Auditor in Charge (AIC)
Micro (Engagement Planning-Risk Driven)
Governance
Input
Chief Audit Executive (CAE)
Feedback
Input
Enterprise Risk Management (ERM)
Priority
Reporting
Comprehensive Report
CEO
Governance
Governance
(Oversight)
22
The Reporting Model (Risks and Controls)
Recommendation
Plan
Criteria
 Plan
 Tactical
 Strategic
 Implementation
 Monitor
 Analysis
Subjective
 Benchmarking
Inappropriately Included
Criteria
Controls
Policy
General
External
Inappropriately Excluded
Specific
Law
Performance Drift
(The way it should be.)
Reactive
Risk Threats
Internal
Partially
Controllable
 Best Practices
Controllable
Objective
Consulting
Negotiation
Assurance
Agent of Change
Preview
 Reengineering
• Evolution
• Revolution
Review
Proactive
Risk
Opportunities
 CSA
Cause
Condition
Effect
(How we got to where
we are?)
(The way it is.)
(What difference does it
make?)
Management
 Plan
 Organize
 Staff
 Direct
 Monitor
Recommendation





Persuasion
Follow-up




Revenue
Cost
Effectiveness
Efficiency
Goals
Issue Addressed
Recommendation Implemented
Management Solution
Risk Accepted
 Meeting
23
The Fraud Risk Triangle
Incentive/Pressure
Opportunity
Attitude/Rationalization
The Fraud Risk Triangle (FRT) consists of three key elements
which are generally correlated with fraud. The FRT was
developed by a criminologist, Donald R. Cressey, in 1973.
How do you address the Fraud Triangle?
24
The Fraud Risk Triangle
Opportunity
Attitude
Incentive
Pressure Rationalization
Over-ride
O
P
R
OR
O
P
R
OR
O
P
R
OR
The Fraud Diamond
Opportunity
Pressure
Rationalization
Ability
Kennesaw State
25
Management Responsibility
Pre-Control
RLFIF
*
Post-Control
CLF
*
ClF =
Prevent
Detect
(Analytics)
(Analytics)
Control Override
Control Failure
rLFIF
Residual risk
Risk tolerance
Risk appetite
Affordable risk
Override Control
RLFIF
rLFIF
Management Functions
Plan
Tactical, Strategic
Organize
Delegation, Accountability
Staff
Competencies, Training
Direct
Policies, Procedure
Monitor
Supervision, Oversight, Change management
26
Management Responsibility
• Setting policies and strategic direction
• Directing employees in performance of routine activities
• Custody of entity’s assets
• Reporting to those in charge of governance
• Implementation of audit recommendations
• Design, implement, and maintain internal controls
• Develop performance measurement system
27
Questions?