VITAL, Clark Jimuel J.

BSA – IV

Report Summary – Auditing and Internal Control (Part 2).

Internal Control Objectives, Principles, and Models

Objectives: 1. To safeguard assets of the firm.

2. To ensure the accuracy and reliability of accounting records and information.

3. To promote efficiency in the firm’s operations.

4. To measure compliance with management’s prescribed policies and procedures.

Modifying Principles

Management Responsibility – This concept holds that the establishment and maintenance of a system of
internal control is management responsibility.

Methods of Data Processing – In this principle, the internal control should achieve the four broad
objectives regardless of the data processing method used.

Limitations – 1. The possibility of error – no system is perfect.

2. Circumvention – personnel may circumvent the system through collusion or other

means.

3. Management override – management is in a position to override control procedures by

personnel distorting transactions.

4. Changing conditions – conditions may change over time so that existing effective
controls may become ineffectual.

PDC Model

Preventive Controls – passive techniques designed to reduce the frequency of occurrence of undesirable
events.

Detective Controls – devices, techniques, and procedures designed to identify and expose undesirable
events that elude preventive controls.

Corrective Controls – actually fix the problem.

Coso Internal Control Framework

The COSO framework consists of five components: the control environment, risk assessment,
information and communication, monitoring, and control activities.

The Control Environment

It is the foundation for the other four control components. It sets the tone for the organitation and
influences the control awareness of its management and employees.

SOX guidelines:

 Separate CEO and chairman

 Set ethical standards
 Establish an independent audit committee
 Compensation committee
 Nominating committee
 Access to outside professionals

Risk Assessment

Organization must perform a risk assessment to identify, analyze, and manage risk relevant to
financial reporting.

Information and Communication

The accounting information system consists of the records and methods used to initiate, identify,
analyze, classify, and record the organization’ss transactions and to account for the related assets and
liabilities.

Monitoring

It is the process by which the quality of internal control design and operation can be assessed.
This may be accomplished by separate procedures or by ongoing activities.

Control Activities

These are the policies and procedures used to ensure that appropriate actions are taken to deal
with the organization’s identified risks. It can be grouped into two distinct categories: physical controls
and information technology (IT) controls.

a. Physical Controls
This class of control relates primarily to the human activities employed in accounting
system.

Six categories of physical control activities:

 Transaction authorization
 Segregation of duties
  Supervision
 Accounting records
 Access control
 Independent verification

b. IT Controls
Information technology drives the financial reporting processes of modern organizations.
Automated systems initiate, authorize, record, and report the effects of financial
transactions.

Two broad groupings of IT controls:

 Application controls
Its objectives are to ensure the validity, completeness, and accuracy of
financial transactions.

 General control
They are so named because they are not application specific but, rather,
apply to all systems. General controls have other names in other frameworks,
including general computer controls and information technology controls.

Audit Implication of SOX

SOX legislation dramatically expands the role of external auditors by mandating that they attest
to the quality of their client organizations’ internal controls. This constitutes the issuance of a separate
audit opinion on the internal controls in addition to the opinion on the fairness of the financial statements

SOX places responsibility on auditors to detect fraudulent activity and emphasize the importance
of controls designed to prevent or detect fraud that could lead to material misstatement of the financial
statements.