An audit of internal control begins by utilizing a top-down attack. The top down attack starts with a companies fiscal statements, and the hearer deriving apprehension of the hazards related to internal control over fiscal coverage. Once the hearer has this background knowledge the following measure is to look at entity-level controls and travel downward to important histories, revelations, and averments that may bespeak a material misstatement in the fiscal statements and revelations. Once this is completed the hearer so confirms their apprehension of the company and the hazard associated with its procedures. Last the hearer chooses which controls to prove.
Its is the hearer ‘s duty to prove entity-level controls that are relevant to the hearer ‘s concluding sentiment on effectivity of the company ‘s internal controls. The rating of these controls determines how intensely they are tested.
There are three different types of entity-level controls, which differ in their relationship and importance. The first type of entity-level control is one that controls the environment. This type of control is indirectly related to the likeliness that a misstatement would be detected or prevented in a timely mode. This type of control may besides hold an affect on the other controls the hearer chooses to prove.
Controls that monitor the effectivity of the other controls is the 2nd type of control. These controls are structured to place dislocations in lower degree controls. By themselves these controls do non adequately assess hazard of misstatements. If these controls are working decently they may let the hearer to cut down on the sum of proving done to other controls.
The 3rd degree of entity controls is designed to adequately forestall or observe misstatements on a timely footing. If these controls are efficaciously in topographic point and working decently the hearer does n’t necessitate to prove any other controls associating to that peculiar hazard.
Entity-level controls consist of controls related to the control environment: the hearer must find if direction ‘s doctrine and operating manner create an effectual internal control over fiscal coverage, if unity and ethical values are present, and if the Board or scrutinize commission understands and participates in oversight duties over fiscal coverage and internal controls.
Besides included in entity-level controls are controls over: direction override abilities, the company ‘s hazard appraisal, and supervising consequences of the company ‘s operations. There are besides controls in topographic point over: internal audit activities, the audit commission, and self-assessment plans.
Last entity-level controls include controls over the procedure of period-end fiscal coverage and policies that address important concern controls and hazard direction patterns. Due to the direct relation of the procedure of period-end fiscal coverage, and what the company reports the hearer must measure this entity-level control carefully. This procedure is made up of the processs that: enter dealing sums into the general leger ; find the choice and application of accounting constabularies ; novice, authorise, record and process diary entries into the general leger ; are used to do normal and unnatural accommodations to one-fourth and annually fiscal statements ; and fix one-year and quarterly fiscal statements and revelations.
In order to decently measure this subdivision of entity-controls and hearer should measure inputs, processs performed, and outputs that the company has used to make their one-year and one-fourth fiscal statements. The hearer should besides measure the engagement of IT in the period-end fiscal coverage procedure, along with the persons from direction who are straight involved. Locations related to period-end fiscal coverage, types of adjusting and consolidating entries, and the nature and extent of inadvertence by directors, the board of managers and the audit commission, should besides be evaluated by the hearer to find the strength of the controls.
Hearers should besides place of import histories, revelations, and relevant averments that have a good possibility of incorporating a material misstatement. The fiscal statement averments and hearer should place are: being, happening, completeness, rating, allotment, rights and duties, and Presentation and revelation.
In order to place of import histories, revelations and averments an hearer should measure the hazard factors related to line points on fiscal statement and included revelations. Hazard factors are: size and composing ; likeliness of misstatement because of mistakes or fraud ; volume of activity, complexness, or uniformity of single minutess ; nature of the history or revelation, complexness of the history or revelation, exposure to loss in the history, likeliness of stuff liabilities due to activities in the history or a revelation ; related party minutess in a history ; and alterations in the history or revelations from the old period.
Along with understanding the hazard factors associated with fiscal statement line points hearers should besides take for these aims: understand the flow of a company ‘s minutess, how they are initiated, authorized, processed, and recorded ; place countries in the company ‘s procedures where material misstatement is most likely ; place controls direction has in topographic point to forestall material misstatement ; and place controls over bar and sensing of unauthorised ownership, usage and disposal of the company ‘s assets with a possible consequence of doing a material misstatement on the fiscal statements.
While executing these activities it is of import that the hearer stay independent of direction. It is besides of import that the hearer understand how IT affects the company ‘s minutess, and the hazard associated with it. These activities may be best understood while executing walkthroughs and interacting and inquiring inquiries of forces.
After the hearer has completed all the stairss and understands the company ‘s operations and bad countries, they must choose which controls to prove. This can be done my selecting controls that are of import to the hearers sentiment about the sufficiently of the controls in topographic point to turn to the hazard of material misstatement. There may be multiple controls that pertain to a hazard, or one control may turn to multiple hazards. It is non necessary to prove all or excess controls. The determination of which controls to prove depends on how good the hazard of misstatement can be tested.
A stuff failing is a lack, or combination of lacks in internal control over a company ‘s fiscal coverage to the extent that it is “ moderately possible “ or “ Probable ” that a material misstatement will non be detected or prevented. A material failing could ensue in misstated one-year or quarterly fiscal statements. The difference between stuff failing and important lack is that a stuff failing is more terrible than a important lack. A important lack is of import plenty to pay attending to by those who over see the company ‘s fiscal coverage, but is non every bit likely to ensue in a material misstatement.
Indexs of stuff failing over fiscal coverage are: the designation of fraud, stuff or non, committed by senior direction ; a restatement of late issued fiscal statement to rectify a material misstatement ; designation of material misstatement of fiscal statement in the current period by the hearer, which would probably non hold been detected by the company ‘s internal controls ; uneffective inadvertence by the audit commission of the company ‘s external coverage and internal controls.
While analyzing the badness of one or many lacks the hearer should make up one’s mind on a degree of confidence that would guarantee minutess are recorded as needed to fix the fiscal statements in conformity with GAAP. If the hearer determines that the lack or lacks causes a deficiency of sensible confidence that the fiscal statements can be in conformity with GAAP, so the hearer should handle it as an index of stuff failing.
Once a thorough audit has been completed the findings of all stuff weaknesses found during the audit must be communicated in composing to the direction and audit commission. This communicating should be made before to the hearers report on internal control over fiscal coverage. If the decision of the audit includes that the inadvertence of the company ‘s internal control over fiscal coverage and fiscal coverage is uneffective it must be communicated to the board of managers in a written study. At this clip the hearer should besides pass on any important lacks to the audit commission in authorship.
Management should besides have a written study at the decision of the audit bespeaking any internal control failing over fiscal coverage. This study should be made known to the audit commission at the clip of issue.
It is besides of import that when describing their determination, the hearer does n’t publish a study bespeaking that no lacks or failings were noted during the audit due to the fact that non all controls were tested for stuff failings.
Communicating the findings of an audit and describing them differ, because an audit study has required elements that are non present in the communicating of the findings. The hearers report on internal control must include these elements: a rubric that has the word independent ; a statement about directions duties for keeping effectual internal control over fiscal coverage ; an designation of directions study on internal control ; the hearers duty to give an sentiment on the company ‘s internal control over fiscal statements based on the audit ; and a definition of internal control. The audit study must besides include the statements with the undermentioned elements: the audit was conducted in conformity with the PCAOB ; the criterions of the PCAOB require the hearer program and execute the audit with sensible confidence of effectual internal control in all material respects ; that an audit includes obtaining and understanding internal control, measuring the hazard that a material failing exist, proving and measuring internal control based upon likely hazard, and executing other processs the hearer considered needed in the fortunes ; the belief the hearer has that the audit provides a footing for their sentiment ; that internal control may non forestall or observe material misstatement, and that future periods are capable to put on the line due to altering conditions. The audit study should besides include the hearer ‘s sentiment of effectual internal control in all material respects as of the specified day of the month, based on control standards. Along with a manual or printed signature of the hearer ‘s house, metropolis, province, and day of the month of the audit study.