Date Class # Topic#

Thursday, September 6, 2012 8 Risk & Internal Control

Background Reading:

From the COSO Internal Control Framework (http://www.coso.org/ICIntegratedFramework-summary.htm):

Internal Control
Internal control means different things to different people. This causes confusion among businesspeople, legislators, regulators and others. Resulting miscommunication and different expectations cause problems within an enterprise. Problems are compounded when the term, if not clearly defined, is written into law, regulation or rule. This report deals with the needs and expectations of management and others. It defines and describes internal control to: 1. Establish a common definition serving the needs of different parties. 2. Provide a standard against which business and other entities--large or small, in the public or private sector, for profit or not--can assess their control systems and determine how to improve them. Internal control is broadly defined as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial reporting. 3. Compliance with applicable laws and regulations. The first category addresses an entity's basic business objectives, including performance and profitability goals and safeguarding of resources. The second relates to the preparation of reliable published financial statements, including interim and condensed financial statements and selected financial data derived from such statements, such as earnings releases, reported publicly. The third deals with complying with those laws and regulations to which the entity is subject. These distinct but overlapping categories address different needs and allow a directed focus to meet the separate needs. Internal control systems operate at different levels of effectiveness. Internal control can be judged effective in each of the three categories, respectively, if the board of directors and management have reasonable assurance that: They understand the extent to which the entity's operations objectives are being achieved.

1. Published financial statements are being prepared reliably. 2. Applicable laws and regulations are being complied with. 3. While internal control is a process, its effectiveness is a state or condition of the process at one or more points in time. Internal control consists of five interrelated components. These are derived from the way management runs a business, and are integrated with the management process. Although the components apply to all entities, small and mid-size companies may implement them differently than large ones. Its controls may be

less formal and less structured, yet a small company can still have effective internal control. The components are:

Control Environment
The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.

Risk Assessment
Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

Information and Communication

Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream. There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.

Monitoring
Internal control systems need to be monitored--a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board. There is synergy and linkage among these components, forming an integrated system that reacts dynamically to changing conditions. The internal control system is intertwined with the entity's operating activities and exists for fundamental business reasons. Internal control is most effective when controls are built into the entity's infrastructure and are a part of the essence of the enterprise. "Built in" controls support quality and empowerment initiatives, avoid unnecessary costs and enable quick response to changing conditions.

There is a direct relationship between the three categories of objectives, which are what an entity strives to achieve, and components, which represent what is needed to achieve the objectives. All components are relevant to each objectives category. When looking at any one category--the effectiveness and efficiency of operations, for instance--all five components must be present and functioning effectively to conclude that internal control over operations is effective. The internal control definition--with its underlying fundamental concepts of a process, effected by people, providing reasonable assurance--together with the categorization of objectives and the components and criteria for effectiveness, and the associated discussions, constitute this internal control framework.

What Internal Control Can Do

Internal control can help an entity achieve its performance and profitability targets, and prevent loss of resources. It can help ensure reliable financial reporting. And it can help ensure that the enterprise complies with laws and regulations, avoiding damage to its reputation and other consequences. In sum, it can help an entity get to where it wants to go, and avoid pitfalls and surprises along the way.

What Internal Control Cannot Do

Unfortunately, some people have greater, and unrealistic, expectations. They look for absolutes, believing that: Internal control can ensure an entity's success--that is, it will ensure achievement of basic business objectives or will, at the least, ensure survival. Even effective internal control can only help an entity achieve these objectives. It can provide management information about the entity's progress, or lack of it, toward their achievement. But internal control cannot change an inherently poor manager into a good one. And, shifts in government policy or programs, competitors' actions or economic conditions can be beyond management's control. Internal control cannot ensure success, or even survival. Internal control can ensure the reliability of financial reporting and compliance with laws and regulations. This belief is also unwarranted. An internal control system, no matter how well conceived and operated, can provide only reasonable--not absolute--assurance to management and the board regarding achievement of an entity's objectives. The likelihood of achievement is affected by limitations inherent in all internal control systems. These include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of simple error or mistake. Additionally, controls can be circumvented by the collusion of two or more people, and management has the ability to override the system. Another limiting factor is that the design of an internal control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Thus, while internal control can help an entity achieve its objectives, it is not a panacea.

Roles and Responsibilities

Everyone in an organization has responsibility for internal control. Management The chief executive officer is ultimately responsible and should assume "ownership" of the system. More than any other individual, the chief executive sets the "tone at the top" that affects integrity and ethics and other factors of a positive control environment. In a large company, the chief executive fulfills this duty by providing leadership and direction to senior managers and reviewing the way they're controlling the business. Senior managers, in turn, assign responsibility for establishment of more specific internal control policies and procedures to personnel responsible for the unit's functions. In a smaller entity, the influence of the chief executive, often an owner-manager, is usually more direct. In any event, in a cascading responsibility, a manager is effectively a chief executive of his or her sphere of responsibility. Of particular

significance are financial officers and their staffs, whose control activities cut across, as well as up and down, the operating and other units of an enterprise. Board of Directors Management is accountable to the board of directors, which provides governance, guidance and oversight. Effective board members are objective, capable and inquisitive. They also have a knowledge of the entity's activities and environment, and commit the time necessary to fulfill their board responsibilities. Management may be in a position to override controls and ignore or stifle communications from subordinates, enabling a dishonest management which intentionally misrepresents results to cover its tracks. A strong, active board, particularly when coupled with effective upward communications channels and capable financial, legal and internal audit functions, is often best able to identify and correct such a problem. Internal Auditors Internal auditors play an important role in evaluating the effectiveness of control systems, and contribute to ongoing effectiveness. Because of organizational position and authority in an entity, an internal audit function often plays a significant monitoring role. Other Personnel Internal control is, to some degree, the responsibility of everyone in an organization and therefore should be an explicit or implicit part of everyone's job description. Virtually all employees produce information used in the internal control system or take other actions needed to effect control. Also, all personnel should be responsible for communicating upward problems in operations, noncompliance with the code of conduct, or other policy violations or illegal actions. A number of external parties often contribute to achievement of an entity's objectives. External auditors, bringing an independent and objective view, contribute directly through the financial statement audit and indirectly by providing information useful to management and the board in carrying out their responsibilities. Others providing information to the entity useful in effecting internal control are legislators and regulators, customers and others transacting business with the enterprise, financial analysts, bond raters and the news media. External parties, however, are not responsible for, nor are they a part of, the entity's internal control system. Other background reading: Ethics:

Ethics pertains to the principles of conduct that individuals use in making choices guiding their behavior in situations that involve the concepts of right or wrong. Business ethics involves answering 2 questions: 1. How do managers decide what is right in conducting business? 2. How do managers achieve what is right?

Fraud: Fraud is a false representation of a material fact made by one party to another party with the intent to deceive and induce the other party to justifiably rely on the fact to his/ her detriment.

Types of fraud: Employee fraud: o Committed by non-management personnel o Usually consists of: an employee taking cash or other assets for personal gain by circumventing a companys system of internal controls Management fraud: o Perpetrated at levels of management above the one to which internal control structure relates o Frequently involves using financial statements to create an illusion that an entity is more healthy and prosperous than it actually is o Involves misappropriation of assets, it frequently is shrouded in a maze of complex business transactions

Fraud schemes: 1. Fraudulent Statements Misstating the financial statements Usually occurs as management fraud May be caused by: focus on short-term financial measures for success management bonus packages being tied to financial statements The underlying problems of Enron, Worldcom and Adelphia provide some insights into what allows financial statement fraud to be perpetrated:

lack of auditor independence auditors are too closely aligned with management, are not willing/ able to identify executive fraud lack of director independence board members have incentives to let the company misstate f/s questionably executive compensation schemes create incentives for executives to want to misstate f/s inappropriate accounting practices

The Sarbanes Oxley Act was put into place to mitigate these issues. The act establishes a framework to modernize and reform the oversight and regulation of public company auditing. Its principal reforms pertain to (1) the creation of an accounting oversight board (the PCAOB), (2) auditor independence, (3) corporate governance & responsibility, (4) disclosure requirements, and (5) penalties for fraud and other violations. 2. Corruption Involves an executive, manager or employee in collusion with an outsider. 4 main types 1.Bribery giving, offering, soliciting or receiving things of value to influence an official in the performance of his or her lawful duties. 2.Illegal Gratuities giving, receiving, offering or soliciting something of value because an official act has been taken (similar to a bribe, but occurs AFTER the fact). 3.Conflicts of Interest an employee acts on behalf of a third party during the execution of his or her duties. Or has self-interest in the activity being performed. 4.Economic extortion the use (or threat) of force (including economic sanctions) by an individual or organization to obtain something of value.

3. Asset Misappropriation theft of assets

Most common type of fraud and often occurs as employee fraud Examples: making charges to expense accounts to cover theft of asset (especially cash) lapping: using customers check from one account to cover theft from a different account transaction fraud: deleting, altering, or adding false transactions to steal assets

Some Sarbanes Oxley stuff: Sarbanes Oxley was passed by the U.S. Congress in 2002. Link to act: http://fl1.findlaw.com/news.findlaw.com/cnn/docs/gwbush/sarbanesoxley072302.pdf Applies to publicly held companies and their auditors Intended to prevent financial statement fraud, make financial reports more transparent, provide protection to investors, strengthen internal control and punish perpetrators of fraud Some of the most important implications of SOX: o Development of the PCAOB (Public Company Accounting Oversight Board) Controls the auditing profession o New rules for auditors Must report specific info to AC Partners must rotate Auditors cannot complete nonaudit services (e.g., bookkeeping) o New roles for audit committees AC members must be independent of the company AC must have a financial expert AC hires, pays and oversees auditors o New rules for management CEO and CFO must certify the financials and disclosures are fairly presented Certify that they are responsible for internal controls If mgmt willingly violates certification they can be imprisoned for up to 20 years & fined $5,000,000 o New internal control requirements

SOX 404 requires publically held companies to issue a report accompanying the financial statements that states that management is responsible for establishing and maintain an adequate internal control structure & appropriate control procedures. 404 report contain mgmts assessment of the internal controls & attest to their accuracy, including notations of significant defects or material noncompliance found during tests. The evaluation of internal controls must be based on a recognized framework (likely to be COSO) Material internal control weaknesses must be disclosed If there are material weaknesses, management must conclude that the company does not have effective internal controls.

Internal Control: Internal control is defined as a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Reliability of financial reporting Effectiveness and efficiency of operations Compliance with applicable laws and regulations Safeguarding of assets

Control Activities: There are 5 major categories of control activities: 1. Proper authorization of transactions and activities 1. Ensures employees are only carrying out authorized transactions 2. Segregation of Duties A fundamental element of internal control is the segregation of certain key duties. The basic idea underlying SOD is that no employee or group of employees should be in a position both to perpetrate and to conceal errors or fraud in the normal course of their duties. In general, the principal incompatible duties to be segregated are: Custody of assets. Authorization or approval of related transactions affecting those assets. Recording or reporting of related transactions. Traditional systems of internal control rely on assigning certain responsibilities to different individuals or segregating incompatible functions. The general premise of SOD is to prevent one person from having both access to assets and responsibility for maintaining the accountability of those assets

Supervision- sometimes it is not possible to have adequately segregated duties.

If this is the case, proper supervision may be a sufficient substitute. 1. Occurs while the activity is being performed by a supervisor with direct responsibility for the task.

3. Proper design and use of adequate documents and records source documents, journals and ledgers capture the economic essence of the transactions provide an audit trail

4. Safeguarding assets, records and data (aka access controls)

Ensure that only authorized personnel have access to the firms assets. 5. Independent checks/ verification Independent checks of the accounting system to identify errors and misrepresentations. Takes place after the fact (unlike supervision) Performed by someone not directly responsible for the task (unlike supervision) Through verification, management can assess: 1. The performance of individuals 2. The integrity of the transaction processing system The accuracy of the data contained in the accounting records Control classifications: There are several ways to classify controls By function: To prevent, detect or correct errors/fraud 1. Preventive Controls -- Prevent problems before they occur 2. Detective Controls -- Detect problems after they occur 3. Corrective Controls -- Correct problems By WHAT is being controlled: Output controls vs. Behavioral controls

1. Output controls measure, evaluate output 2. Behavior controls limit activities

By HOW the control works: Levers of control

1. 2. 3. 4.
IT CONTROLS:

Belief systems core values, ethics, (e.g., honor code) Boundary systems limits (e.g., policies and procedures, authorizations) Diagnostic systems compares actual to plan (e.g., did we meet budget?) Interactive systems helps mgmt be regularly involved (e.g., communication, mgmt review, etc)

There are 2 types :

General controlspertain to the entity-wide computer environment

Examples: controls over the data center, organization databases, systems development, and program maintenance Application controlsensure the integrity of specific systems (aka specific programs or applications) Examples: controls over sales order processing, accounts payable, and payroll applications

Class Notes: Companies have various objectives and goals. They can be organized into 4 categories: _________________, ____________________, _________________ & ___________________ What can go wrong?

RISK: Risk is the likelihood that _______________ or ____________ will exist. They are the _______________ that will get in the way of the organizations ability to ________________________.

Risk Assessments Allow the company to consider the extent to which potential events have an impact on the objectives Management assesses events based on: Likelihood Impact Uses a combination of qualitative & quantitative methods

Risks can be examined on an inherent and residual basis Inherent risk gross risk; absent any actions by management Residual risk net risk; remaining risk after managements risk response

Risk Assessment Example:

Fraud: ___________________ of a ___________________ made by one party to another party with the ______________to deceive and induce the other party to ________________ on the fact to his or her detriment. Fraud definitions:

False representation false statement or disclosure Material fact substantial & induces someone to act Intent to deceive INTENT must exist Misrepresentation must have resulted in a justifiable reliance upon the information, which The misrepresentation must have caused injury or loss

Internal Control: Internal control is defined as a ___________, affected by an entity's _____________________________ designed to provide ______________________ regarding the achievement of objectives in the following categories: 1. Reliability of financial reporting 2. Effectiveness & efficiency of operations 3. Compliance with laws and regulations

4. Safeguarding of assets 10

In the late 1990s/ 2000 there were a series of corporate internal control failures including Enron and WorldCom. As a result, Congress passed __________________________________________ The goals of ________ were to: 1.Prevent financial statement _________________ 2. Improve financial statement _________________ 3. Strengthen ______________________________ 4. Restore _________________________________ 5. Punish ___________________________________ Of the many things required by SOX, one requirement that were going to focus on is the requirement the companies use a formal framework: Organizations must use a formal control framework to assess the effectiveness of internal control. They can either develop this internally or use a pre-existing one. Most organizations use the COSO Internal Control Framework. Who is COSO? The Committee of Sponsoring Organizations is a private sector group consisting of the American Accounting Association, the AICPA, the Institute of Internal Auditors, the Institute of Management Accountants, and the Financial Executives Institute.

Criteria to assess internal control consists of the following five components: Control Environment: The core of any business is its people their individual attributes, including integrity, ethical values, and competence and the environment in which they operate. 11

Risk Assessment: The organization must be aware of and deal with the risks it faces. It must also establish mechanisms to identify, analyze and manage the related risks. Risk is assessed on 2 dimensions: Likelihood of occurrence and Magnitude of impact Control Activities: Control policies and procedures must be established and executed to help ensure that the actions identified by management as necessary to address risks and achieve the organizations objectives are effectively carried out. Information & Communication: Surrounding the control activities are information & communications systems that enable the organization to capture and exchange the information needed to conduct, manage & control its operations. Monitoring: The entire process must be monitored, and modifications made as necessary so the system can react dynamically and change as conditions warrant.

Control Activities: Internal Controls perform 2 important functions: 1. Preventive Controls 2. Detective Controls ** some controls are considered corrective. These are procedures designed to remedy problems discovered through detective controls Control activities generally fall into one of the following categories: 1. 2. 3. 4. 5. (1) Proper Authorization of Transactions and Activities: Employees are ____________________________________________________ Authorizations are often documented with _______________________________ Authorization should be ______________________________________________

Example: Managements review & approval may be required for specific transactions (e.g., sales >$20k, capital expenditures >$10k); employees have general authorization for routine transactions

12

(2) Segregation of Duties Good internal control requires that no single employee be given too much responsibility over business transactions or processes. An employee should not be in a position to (i.e., have no incentives) to commit and conceal fraud or unintentional errors. The principal incompatible duties to be segregated include: 1._________________________ - approving transactions & decisions 2.________________________ - preparing source documents; entering data into online systems; maintaining journals, ledgers, files or databases; preparing reconciliations; preparing performance reports 3._________________________ - handling cash, tools, inventory, or fixed assets; receiving incoming customer checks; writing checks on the companys bank account No one employee or group of employees should have_______________________

If an adequate segregation of duties does not exist, the following could occur: 1. Misappropriation of assets 2. Misstated financial statements 3. Inaccurate financial documents 4. Improper use or modification of data (undetected)
Example: If a job foreman were allowed to hire employee, approve their hours, and distribute paychecks, authorization would not be segregated from custody (of the checks). A dishonest foreman could make up a fictitious employee, and collect the paychecks If paychecks were distributed by someone else the opportunity for this type of fraud would be reduced.

If an organization does not have sufficient resources to adequately segregate duties, ________________________can be an effective substitute. (3) Proper Design and Use of Adequate Documents and Records Documents provide __________________ and establish _________________. Documents that initiate a transaction should contain __________________ for authorization. Those used to transfer assets should have a space for ____________________. Documents should be ___________________________________: o To reduce the likelihood that they would be used fraudulently o To help ensure that all valid transactions are recorded (4). Safeguard Assets, Records, and Data Need to safeguard: Need to safeguard: 13

To safeguard assets: 1. Create and enforce appropriate _________________________________________ 2. Maintain accurate ____________________________________________________ 3. 4. Periodically reconcile _________________________________________________ Restrict access to _____________________________________________________

***sometimes these controls are referred to as access controls Example: locks, security, etc. (5) Independent checks (aka Verification): Used to ensure the transactions are processed accurately. Independent checks are the careful and continuous review of the other controls Personnel performing independent checks must be independent from those originally preparing the data. _______ : Management should periodically compare actual performance to planned performance as shown in budgets and The performance of competitors _________: Examinations of relationships between different sets of data. For example, if credit sales increased significantly during the period and there were no changes in credit policy, then bad debt expense should probably have increased also. : Examples include bank reconciliations and comparing accounts payable control account to sum of subsidiary accounts. : Examples include: periodical physical inventory count, high-dollar items and critical components should be counted more frequently. _____________________________ after one person processes a transaction, a second person reviews the work.

Limitations of Internal Controls: Possibility of honest errors Changing conditions--especially in companies with high growth Circumvention via collusion Management override CPA Review question: If internal control is properly designed, the same employee MAY be permitted to: A. Receive & deposit checks & also approve write-offs to customer accounts. B. Approve vouchers for payment & also sign checks. C. Reconcile the bank statements & also receive & deposit cash. D. Sign checks and also cancel supporting document 14