Chapter 1 Auditing and Internal Control PDF
Chapter 1 Auditing and Internal Control PDF
Chapter 1 Auditing and Internal Control PDF
INTERNAL CONTROL
PIQUERO|MAGATAO|COMPENDIO
• Information Technology (IT) developments
have had a tremendous impact on auditing.
• Business organizations undergo different
types of audits for different purposes.
• Most common are external (financial) audits,
internal audits and fraud audits.
AUDITING
• Independent attestation performed by and expert
(i.e., CPA) who expresses and opinion regarding
the fair presentation of financial statements.
• Required by SEC for ALL public companies.
• Basis of public confidence in financial
statements.
• Strict rules must be followed.
– Defined by SEC, FASB, AICPA and SOX.
EXTERNAL AUDITS
• SOX greatly restricts the types of non-audit
services auditors may render to audit clients.
– Unlawful to provide many accounting,
financial, internal audit, management, human
resource or legal services unrelated to the
audit.
INTERNAL AUDITS
• External auditors represent outsiders while internal
auditors represent organization’s interests.
• Internal auditors often cooperate with and assist external
auditors in some aspects of financial audits.
– Extent of cooperation depends upon the independence
and competence of the internal audit staff.
• External auditors can rely in part on evidence gathered by
internal audit departments that are organizationally
independent and report to the board of director’s audit
committee.
FRAUD AUDITS
• Subcommittee of the board of directors
– Usually three members who are outsiders.
– SOX requires at least one member must be a
“financial expert”
• Serves as independent “check and balance” for the
internal audit function.
• SOX mandates that external auditors report to the
audit committee;
– Committee hires and fires auditors and resolve
disputes.
AUDITING STANDARDS
GENERALLY ACCEPTED AUDITING
STANDARDS (TIPPIEGIDO)
• Auditors develop audit objectives and design audit
procedures based on these assertions.
• Auditors seek evidential matter that corroborates
assertions.
• Auditor must determine whether internal control
weaknesses and misstatements are material.
• Auditors must communicate the results of
their tests, including an audit opinion.
AUDITING STANDARDS
AUDIT OBJECTIVES AND AUDIT
PROCEDURES BASED ON MANAGEMENT
ASSERTIONS
AUDIT RISK MODEL: AR = IR x CR x DR
• The stronger the internal control structure, the
lower the control risk and the less substantive
testing the auditor must do.
• Substantive tests are labor intensive and time
consuming, which drives up audit costs and cause
disruption.
– Management’s best interests are served by a strong
internal control structure.
AUDIT RISK
THE IT AUDIT
• Management required by law to establish and maintain
adequate system of internal controls.
INTERNAL CONTROL
• Sarbanes-Oxley Act of 2002 (SOX) requires
management of public companies to implement adequate
internal control system over their financial reporting
process.
• Under Section 302:
– Managers must certify organization’s internal controls
quarterly and annually.
– External auditors must perform certain procedures
quarterly to identify any material modifications that may
impact financial reporting
• Section 404 requires management of public companies
to access the effectiveness of their internal control in an
annual report
• Internal control system comprises policies, practices,
and procedures to achieve four broad objectives:
Safeguard assets of the firm.
Ensure accuracy and reliability of accounting records
and information.
Promote efficiency in the firm’s operations. –
Measure compliance with management’s prescribed
policies and procedures.