A.I.S. Class 11: Outline I Learning Objectives for Chapter 10 I Controls I Misstatements I Internal Control Structure I Control Objectives and Audit Objectives I COBIT I Events and Event Risks I Group Work for Chapter 10 I Mid-term Examination Dr. Peter R Gillett October 12, 2005 1
Learning Objectives for Chapter 10 I After studying this chapter you should be able to: N provide a definition of controls N explain the concepts of exposure and reasonable assurance as they relate to controls N explain the difference between preventive, detective, and corrective controls N describe and discuss a number of risks that could be found in computer based systems N discuss the essence of Sarbanes-Oxley and its impact on internal controls N discuss Statement on Auditing Standards (SAS) No. 55 and 78 and their implications for controls in information systems N provide a basic distinction between general and application controls as categories of controls Dr. Peter R Gillett October 12, 2005 2
Learning Objectives for Chapter 10 N describe general control procedures for database oriented systems environments N describe application controls that can be incorporated into a database AIS N indicate some control procedures that can be instituted only in on line database systems N explain how entity integrity and referential integrity contribute to better control in a database AIS N explain the hierarchical nature of the relationship between the control environment, the accounting system, general and application control procedures N briefly describe the COBIT control framework released by the Information Systems Audit and Control Association Dr. Peter R Gillett October 12, 2005 3
Controls I Controls are mechanisms to prevent or detect errors and irregularities I Risk is the likelihood that an information system will experience errors or irregularities I Exposure is the amount of loss that could occur if a risk is realized I Controls are designed to provide reasonable assurance that data are error free Dr. Peter R Gillett October 12, 2005 4
Controls I Preventive v. detective � Corrective procedures N are corrective N but are not really controls I Manual v. programmed I General v. application I Compensating controls � Controls in one place remediate absence of controls in others I Key controls � Subset of controls on which auditors plan to rely Dr. Peter R Gillett October 12, 2005 5
Misstatements I Errors � unintentional mistakes I Irregularities � intentional alteration or misstatement of data I Fraud (defalcation) I Management fraud Dr. Peter R Gillett October 12, 2005 6
Exposures and Risks I Exposures may arise from N Erroneous record keeping N Unacceptable accounting N Business interruption N Erroneous management decisions N Fraud and embezzlement N Statutory sanctions N Excessive costs N Loss or destruction of assets N Competitive disadvantage Dr. Peter R Gillett October 12, 2005 7
Exposures and Risks I Risks N Errors in data N Irregularities in data N Loss of data N Natural disasters N Computer crime Dr. Peter R Gillett October 12, 2005 8
Internal Controls and Sarbanes-Oxley I Sarbanes-Oxley Act 2002 � In response to Enron, World-Com, etc. I Created Public Company Accounting Oversight Board (PCAOB) � Overseen by SEC I Previously, Statements of Auditing Standards (SAS) published by the AICPA’s Auditing Standards Board I Now, PCAOB has the right to adopt, amend, modify, repeal or reject auditing standards Dr. Peter R Gillett October 12, 2005 9
Internal Controls and Sarbanes-Oxley I Title I � PCAOB regulates audits and auditors of public companies I Title II � Auditor independence provisions and audit committees I Title III � New responsibilities regarding financial reporting I Title IV � New disclosures Dr. Peter R Gillett October 12, 2005 10
Internal Controls and Sarbanes-Oxley I In April 2003, PCAOB asserted authority over auditing standards I Existing standards were “grandfathered” until they can be replaced I Four new standards have been issued so far I Auditing Standard No 2: � An Audit of Internal Control Over Financial Reporting Conducted in Conjunction With An Audit of Financial Statements Dr. Peter R Gillett October 12, 2005 11
Internal Controls and Sarbanes-Oxley I Sarbanes-Oxley Act Section 404 � Management responsible for N Establishing and maintaining adequate internal controls over financial reporting N Assessment of the effectiveness of controls N Documenting and testing internal controls over financial reporting and reporting their conclusions to the auditor � Auditors must attest and report on management’s assertions regarding internal controls N This significantly extends the amount of work that would previously have been required Dr. Peter R Gillett October 12, 2005 12
Internal Controls and Sarbanes-Oxley I Sarbanes-Oxley Act Section 404 � Last year, compliance for the first time was a huge expense for public companies and a huge logistical problem for auditor firms who were struggling to meet the demand � Soon even more (smaller) companies will be subject to Section 404! � Last year 11% of public companies capitalized at over $75M disclosed control deficiencies � This represented 6-8% of firms audited by Big 4 and 15% of firms audited by Grant Thornton and BDO Dr. Peter R Gillett October 12, 2005 13
Internal Controls and Sarbanes-Oxley I Under the Act, COSO has been adopted by the SEC as the acceptable internal control framework I COSO is already incorporated into existing auditing standards (SAS 55, etc.) I Auditing of controls at Public Companies now ruled by Auditing Standard No 2 Dr. Peter R Gillett October 12, 2005 14
General Systems Model I Every system has � Inputs � Processes � Outputs � Boundary � Environment I Control systems � Sensors � Standards � Control comparisons � Activating units Dr. Peter R Gillett October 12, 2005 15
Internal Control Structure I SAS 55, COSO, SAS 78, SAS 94 � Internal Control is a process effected by an entity’s board of directors, and other personnel, that is designed to provide reasonable assurance regarding the achievement of objectives in the following categories: N effectiveness and efficiency of operations N reliability of financial reporting N compliance with applicable laws and regulations Dr. Peter R Gillett October 12, 2005 16
Internal Control Structure I SAS 55, COSO, SAS 78 � Control Environment � Management’s Risk Assessment � Information System and Communication � Control Activities � Monitoring Dr. Peter R Gillett October 12, 2005 17
Control Environment I Integrity and ethical values I Commitment to competence I Board of directors or audit committee I Management’s philosophy and operating style I Organizational structure I Assignment of authority and responsibility I Human resource policies and practices Dr. Peter R Gillett October 12, 2005 18
Management’s Risk Assessment I Risk assessment for financial reporting is the identification, analysis, and management of risks relevant to the preparation of financial statements that are fairly presented in conformity with GAAP Dr. Peter R Gillett October 12, 2005 19
Risk Assessment I Risks may arise from N Changes in the operating environment N New personnel N New or revamped information systems N Rapid growth N New technology N New lines, products or activities N Corporate restructuring N Foreign operations N Accounting pronouncements Dr. Peter R Gillett October 12, 2005 20
Information System I Procedures aimed at identifying, assembling, analyzing, classifying recording and reporting an entity’s transactions I Maintain accountability for the related assets and liabilities Dr. Peter R Gillett October 12, 2005 21
Control Activities I Policies and guidelines that management has established to provide reasonable assurance that specific entity objectives will be met � Adequate separation of duties � Proper authorization of transactions � Adequate documents and records � Physical control over assets and records � Independent checks on performance Dr. Peter R Gillett October 12, 2005 22
Control Activities I General control procedures � Organizational controls � Systems development and amendment � Hardware and systems software controls � Security and access controls � Operations controls � Data backup and recovery Dr. Peter R Gillett October 12, 2005 23
Control Activities I Application control procedures � Input controls N field tests N range tests N length tests N validity tests N valid combinations tests N closed loop verification N completeness tests N prompting N system generated data N entity integrity N referential integrity Dr. Peter R Gillett October 12, 2005 24
Control Activities I Application control procedures � Processing controls N internal label tests N sequence checks N control total verification � Output controls � User control procedures Dr. Peter R Gillett October 12, 2005 25
Control Objectives I Completeness � All transactions that occurred are entered and accepted for processing I Accuracy � All transactions are recorded N at the correct amount N in the proper account N in the proper period I Validity � All recorded transactions N actually occurred N relate to the company N were approved / authorized I Restricted Access � Data is protected against unauthorized amendments Dr. Peter R Gillett October 12, 2005 26
Recommend
More recommend
