III. Internal Control: According To AICPA Statement On Auditing Standards (SAS)

III.
Internal Control
Internal Control is the process for assuring an organization’s objectives in operational

effectiveness and efficiency, reliable financial reporting, and compliance with laws,
regulations, and policies.
i. Objectives of Internal Control
To be able to maximize the firm’s potential in dealing with frauds, the firm must perform
the concepts of internal control. To do this, the firm must engage in having an internal
control system. This system is comprised of sets of policies, practices and procedures
being used by the organization so that it can achieve these four objectives 1:
1. To safeguard the assets of the firm.
By having a good internal control system, the firm can manage and protect the
assets of the firm from fraudulent acts of employees and other parties who have
the capacity to do the same.
2. To ensure the accuracy and reliability of accounting records and information.
To attain this objective, having an internal control system is not enough. The
system must be objective and must not be affected by external factors in
preparing the accounting records and information. These records must be
produced free from bias and should be accurate and reliable.
3. To promote efficiency in the firm’s operations.
The system of internal control sets standards for the managers of different
division to measure their efficiency.
4. To measure compliance with management’s prescribed policies and
procedures.
Internal control system observes the management’s activities and check if it is in
compliance with the prescribed policies and procedures of the firm.
ii. Modifying Assumptions

There are four modifying assumptions that are very intrinsic in the
aforementioned control objectives.
 Management Responsibility
It is assumed that the responsibility of establishing and maintaining an
internal control system lies in the hands of the management. It is because
1
According to AICPA Statement on Auditing Standards (SAS)
the objectives of this system are in accordance to the responsibilities of
the management.
 Reasonable Assurance
It is assumed that the management must ensure that the internal control
systems are providing reasonable assurance that the said four control
objectives are met efficiently. The cost of achieving an improved system
control should not outweigh its benefits.
 Methods of Data Processing

There is no single data processing that will address the need of all types
of technology used in system control. It is assumed that the methods of
data processing is according to the type of technology used and is
expected to vary with respect to the techniques used to achieve the four
broad objectives.
Figure 3.1 Internal Control Shield

iii. Limitations of Internal Control
It is presumed further that there is not perfect system. Due to this fact, every
system has there some limitations on its effectiveness, and internal control
systems are not exceptions. Limitations of internal control are the following:
 Possibility of honest error- this is due to the fact that no system is perfect.
 Circumvention- this may be because of personnel circumventing the
system via collusion or any other means.
 Management override- the management may override the control
procedures since it is in the position to do so. Overriding procedure may
happen by directing a personnel or by personally distort the transactions.
 Changing conditions- the system can be subjected to certain condition that
may render it ineffective.
iv. Exposures and Risks

The system of internal control serves as a shield against the different threats of
the firm. These threats include but not limited to attempts at unauthorized access
to the firm’s assets, fraud, errors due to employee incompetence, faulty computer
programs and corrupted input data.
The absence or weakness of a control is called an exposure. A weakness in an
internal control may expose the firm to one or more of the following types of risks.
These risks are enumerated below:
1. Destruction of assets
Since these risks are due to some weakness in the internal control, one of the
objectives of the system will not be attained and that is the safeguarding of
the firm’s assets.
2. Theft of Assets
Aside from the destruction of assets, they can also be subjected to theft since
the internal control system is damaged.
3. Corruption of information or the information system.
The internal control, which is also known as shield against computer viruses
can cause data corruption if weakened and exposed.
4. Disruption of the information system
This is the worst case scenario that is expected be happen if the shield is
damaged.
v. The Preventive-Detective-Corrective Internal Control Model
The internal control shield is composed of three levels of control; these are the
preventive controls, detective controls, and corrective controls. These are also known
as PDC control model.
Preventive Controls
This is the first line of defense in the control structure. Preventive controls are
passive techniques designed to reduce the frequency of occurrence of
undesirable events. It screen out aberrant events through forcing compliance
with prescribed or desired actions.
Detective Controls
These are the second line of defense in the control structure. These detective
controls are composed of devices,
Figure 3.2 Preventive, techniques,
Detective, and Control
and Corrective procedures designed to
identify and expose undesirable events that elude preventive controls. Their roles
is to identify and find specific types of errors, this can be done by comparing
actual occurrences to pre-established standards. Once these errors had been
identified, the detector produces an alarm to attract attention so the problem can
be solved immediately.
Corrective Controls
This are the actions that take place after the detection of specific error from the
second line of defense. This is to reverse the effects and the possible risks
brought about by the errors. Since detective controls identify the problem,
corrective controls actually solve the problem.
vi. Sarbanes-Oxley and Internal Control

Sarbanes-Oxley is a legislation that requires the management of public
companies to pursue and implement an adequate system of internal controls
over their financial reporting process. The management’s responsibilities for the
said legislation are codified in Sections 304 and 404 of SOX.
Section 302- this requires that the corporate management certify their
organizations’ internal controls on a quarterly and annual basis.
Section 404- requires the management of public companies to assess the
effectiveness of their organizations’ internal controls.
Figure 3.3 Preventive, Detective, and Corrective Control Roles

This entails providing an annual report addressing the following points:
1. Statement of management’s responsibility for establishing and maintaining
adequate internal control
2. Assessment of the effectiveness of the company’s internal controls over
financial reporting
3. A statement that the company’s internal auditors have issued an attestation
report on management’s assessment
4. An explicit written report conclusion as to the effectiveness of internal control
over financial reporting
5. A statement identifying the framework used in their assessment of
international controls
Regarding the control framework to be used, both the PCAOB and the SEC have
endorsed the framework put forward by the Committee of Sponsoring Organizations of
the Treadway Commission (COSO). Further, they require that any other framework
used should encompass all of COSO’s general themes.20 The COSO framework was
the basis for SAS 78, but was designed as a management tool rather than an audit tool.
SAS 78, on the other hand, was developed for auditors and describes the complex
relationship between the firm’s internal controls, the auditor’s assessment of risk, and
the planning of audit procedures. Apart from their audience orientation, the two
frameworks are essentially the same and interchangeable for SOX compliance
purposes. The key elements of the SAS 78/COSO framework are presented in the
following section.
vii. SAS 78/COSO Internal Control Framework
This framework consists of five components which are the control environment, risk
assessment, information and communication, monitoring and the control activity. These
components will be further elaborated below.
 The Control Environment
Among the five components, the control environment is the foundation of all the
components. It sets the tone for the organization and influences the control
awareness of its management and employees. The important elements of
control environment are:
 The integrity and ethical values of the management
 The structure of the organization
 The participation of the organization’s board of directors and the audit
committee
 Management’s philosophy and operating cycle
 The procedures for delegating responsibility and authority
 Management’s methods for assessing performance
 External influences
 The organization’s policies and practices for managing its human
resources
Moreover, SAS 78/COSO requires that auditors obtain sufficient knowledge to assess
the attitude and awareness of the organization’s management, board of directors, and
owners regarding internal control. In order to obtain understanding of the control
environment, the auditors should assess the integrity of the organization’s management
and may use investigative agencies to report on the background of key managers.
Additionally, auditors should also be aware of conditions that would predispose the
management of an organization to commit fraud.
 Risk Assessment
Risk Assessment is essential in identifying, analyzing, and managing risks
relevant to financial reporting. It also help to immediately provide actions to
solve a certain problem. Risks can arise or change from a significant and rapid
growth that strains existing internal controls, implementation of new technology
into the production process or information system that impacts transaction
processing, ad adaptation of a new accounting principle that impacts the
preparation of financial statements.
SAS 78/COSO requires also that the auditors obtain enough information of the firm’s
risk assessment procedures to understand how it identifies, prioritizes, and manages
the risks related to financial reporting.
 Information and Communication

An accounting information system consists of the records and methods used to
initiate, identify, analyze, classify, and record the organization’s transactions and
to account for the related assets and liabilities. An information system must be
effective to generate factual and accurate information so it can make a relevant
impact on the management’s decisions.
 Monitoring
In the event when the management will determine if the internal controls are
functioning as intended, monitoring takes its place. It is the process by which the
quality of internal control design and operation can be assessed.
To achieve an ongoing monitoring, the management can integrate special
computer modules into the information system that capture key data or permit
tests of controls to be conducted as part of routine operations. Another
technique to achieve an ongoing monitoring is the judicious use of management
reports.
 Control Activities
To define, control activities are the policies and procedures used to ensure that
appropriate actions are taken to deal with the organization’s identified risks. It
has two distinct categories which are the information technology controls and
physical controls.
 Segregation of Duties
Segregation of employee duties is very important in minimizing incompatible
functions. Segregation of duties can take any forms, depending on the specific
duties to be controlled.
There are three objectives that provide general guidelines in segregating duties
which are applicable to most organizations.
Figure 3.4 Segregation of Duties Objectives
 Supervision
In performing Achieving adequate segregation of duties often presents
difficulties for small organizations. Obviously, it is impossible to separate five
incompatible tasks among three employees. Therefore, in small organizations or
in functional areas that lack sufficient personnel, management must compensate
for the absence of segregation controls with close supervision. For this reason,
supervision is often called a compensating control.
Figure 3.5 Process of Internal Control

 Accounting Records
The organization’s source documents, journals, and ledgers capture the

economic essence of transactions and provide an audit trail of economic events.
The audit trail enables the auditor to trace any transaction through all phases of
its processing from the initiation of the event to the financial statements.
Organizations must maintain audit trails for two reasons. First, this information is
needed for conducting day-to-day operations. The audit trail helps employees
respond to customer inquiries by showing the current status of transactions in
process. Second, the audit trail plays an essential role in the financial audit of
the firm. It enables external (and internal) auditors to verify selected transactions
by tracing them from the financial statements to the ledger accounts, to the
journals, to the source documents, and back to their original source. For
reasons of both practical expedience and legal obligation, business
organizations must maintain sufficient accounting records to preserve their audit
trails.
 Access Controls
The purpose of access controls is to ensure that only authorized personnel have
access to the firm’s assets. Unauthorized access exposes assets to
misappropriation, damage, and theft. Therefore, access controls play an
important role in safeguarding assets. Access to assets can be direct or indirect.
Physical security devices, such as locks, safes, fences, and electronic and
infrared alarm systems, control against direct access. Indirect access to assets
is achieved by gaining access to the records and documents that control the
use, ownership, and disposition of the asset.
Example:
An individual with access to all the relevant accounting records can destroy the
audit trail that describes a particular sales transaction. Thus, by removing the
records of the transaction, including the accounts receivable balance, the sale
may never be billed and the firm will never receive payment for the items sold.
The access controls needed to protect accounting records will depend on the
technological characteristics of the accounting system. Indirect access control is
accomplished by controlling the use of documents and records and by
segregating the duties of those who must access and process these records.
 Independent Verification
Verification procedures are independent checks of the accounting system to

identify errors and misrepresentations. Verification differs from supervision
because it takes place after the fact, by an individual who is not directly involved
with the transaction or task being verified. Supervision takes place while the
activity is being performed, by a supervisor with direct responsibility for the task.
Through independent verification procedures, management can assess (1) the
performance of individuals, (2) the integrity of the transaction processing
system, and (3) the correctness of data contained in accounting records.
Examples of independent verifications include:
 Reconciling batch totals at points during transaction processing.
 Comparing physical assets with accounting records.
 Reconciling subsidiary accounts with control accounts.
 Reviewing management reports (both computer and manually generated)
that summarize business activity.
The timing of verification depends on the technology employed in the accounting
system and the task under review. Verifications may occur several times an
hour or several times a day. In some cases, a verification may occur daily,
weekly, monthly, or annually.

III. Internal Control: According To AICPA Statement On Auditing Standards (SAS)

Uploaded by

Copyright:

Available Formats

III. Internal Control: According To AICPA Statement On Auditing Standards (SAS)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

III. Internal Control: According To AICPA Statement On Auditing Standards (SAS)

Uploaded by

Copyright:

Available Formats

III.

Internal Control is the process for assuring an organization’s objectives in operational

ii. Modifying Assumptions

 Methods of Data Processing

Figure 3.1 Internal Control Shield

iv. Exposures and Risks

vi. Sarbanes-Oxley and Internal Control

Figure 3.3 Preventive, Detective, and Corrective Control Roles

 Information and Communication

Figure 3.5 Process of Internal Control

The organization’s source documents, journals, and ledgers capture the

Verification procedures are independent checks of the accounting system to

You might also like