ACC 442 Lecture Notes - Lecture 9: Internal Audit, Audit Risk, External Auditor
COSO
Committee of Sponsoring Organizations of the Treadway Commission
Internal Control
The method by which an entity's board and management provide reasonable assurance
Who has the responsibility of maintaining adequate internal controls?
Management
Audit Strategy
The auditor's understanding of the client's internal controls. If these controls can be relied on, auditor
can do less substantive testing
Five Components of Internal Control
Monitoring, Information & Communication, Control Activities, Risk Assessment, and Control
Enviornment
Control Enviornment
Does the management/board create an organization where internal control is important and valued;
sets the tone of an organization
Risk Assessment
Management performs various business risks, estimates their significance, and assess likelihood of
occurance
Information Systems & Communication
Transactions are all valid, properly classified, proper monetary value, correct accounting period, and
properly presented
Control Activities
The policies and procedures that help ensure that management's directives are carried out. [where the
bulk of internal control testing is done]
find more resources at oneclass.com
find more resources at oneclass.com
Control Activity Example
Segregation of duties: receipts of cash & recording of accounts receivable are separated
Monitoring of Controls
A process to assess the quality of internal control performance over time. External audit is not a part of
clients controls
What are auditors required to assess?
Control Risk
Audit Strategy Selection
Rely on Internal Controls: Reliance Strategy
No reliance on Internal Controls: Substantive Strategy
Substantive Strategy
Set control risk to maximum; commonly used for audits of private companies
Reliance Strategy
Assess controls at below maximum; perform tests of internal controls to assess if they're operating
effectively
Preventive Control
Controls in place to prevent misstatement [required credit check before sale]
Detective Control
Controls put in place to identify and correct misstatements that have occurred [review of account
reconciliations]
Design Effectiveness
The control is suitably designed to prevent or detect & correct, material misstatement
find more resources at oneclass.com
find more resources at oneclass.com
Document Summary
Committee of sponsoring organizations of the treadway commission. The method by which an entity"s board and management provide reasonable assurance. The auditor"s understanding of the client"s internal controls. If these controls can be relied on, auditor can do less substantive testing. Monitoring, information & communication, control activities, risk assessment, and control. Does the management/board create an organization where internal control is important and valued; sets the tone of an organization. Management performs various business risks, estimates their significance, and assess likelihood of occurance. Transactions are all valid, properly classified, proper monetary value, correct accounting period, and properly presented. The policies and procedures that help ensure that management"s directives are carried out. [where the bulk of internal control testing is done] Segregation of duties: receipts of cash & recording of accounts receivable are separated. A process to assess the quality of internal control performance over time. External audit is not a part of clients controls.
