Question

1)Four approaches to internal control documentation are discussed in this chapter. List the advantages and disadvantages of each. How would documentation assist the auditor to identify the strengths and weaknesses of an entity’s system of internal controls?

2) If an auditor identifies an internal control weakness for an assertion, how does it affect the audit strategy? If the auditor identifies an internal control strength for an assertion, how does it affect the audit strategy?

Answer 1

The four approaches to internal control documentation are:

1.Narratives; the advantage is that the process can be described in full; thedisadvantage is that it can take many words to describe a process in full.

2.Flowcharts or logic diagrams; the advantage is that the standardised graphics allow a large amount of information to be presented on a single page torepresent complex flows of transactions and the key controls. If there is common understanding of the symbols, it is easier to review and understand.The disadvantage is that the reader may not understand the symbols or require additional clarification.

3.Combinations of narratives and flow charts or logic diagrams; the advantageis that complex systems can be described using standardised symbols, withadditional narrative to explain steps that are hard to chart. The disadvantageis that both the diagram and narrative have to be prepared and checked forconsistency.

4.Checklists and preformatted questionnaires; the advantage is that it is helpfulto inexperienced auditors because the checklist guides the process andassists in identifying critical controls. The disadvantage is that it can inhibit anexperienced auditor and slow down the process.

The documentation assists the auditor because the process of preparing thedocumentation prompts the auditor to ask detailed questions in order to gain a fullunderstanding. An experienced auditor would be able to identify departures from thesystems used at similar organisations and the graphical forms of documentationreveal quickly the destination of all copies of documents.

2.

Effective internal control over financial reporting provides reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes. If one or more material weaknesses exist, the company's internal control over financial reporting cannot be considered effective.

The auditor's objective in an audit of internal control over financial reporting is to express an opinion on the effectiveness of the company's internal control over financial reporting. Because a company's internal control cannot be considered effective if one or more material weaknesses exist, to form a basis for expressing an opinion, the auditor must plan and perform the audit to obtain appropriate evidence that is sufficient to obtain reasonable assurance about whether material weaknesses exist as of the date specified in management's assessment. A material weakness in internal control over financial reporting may exist even when financial statements are not materially misstated.

The auditor should use the same suitable, recognized control framework to perform his or her audit of internal control over financial reporting as management uses for its annual evaluation of the effectiveness of the company's internal control over financial reporting.

The audit of internal control over financial reporting should be integrated with the audit of the financial statements. The objectives of the audits are not identical, however, and the auditor must plan and perform the work to achieve the objectives of both audits.

In an integrated audit of internal control over financial reporting and the financial statements, the auditor should design his or her testing of controls to accomplish the objectives of both audits simultaneously -

• To obtain sufficient evidence to support the auditor's opinion on internal control over financial reporting as of year-end, and
• To obtain sufficient evidence to support the auditor's control risk assessments for purposes of the audit of financial statements.

Obtaining sufficient evidence to support control risk assessments of low for purposes of the financial statement audit ordinarily allows the auditor to reduce the amount of audit work that otherwise would have been necessary to opine on the financial statements.

The auditor should properly plan the audit of internal control over financial reporting and properly supervise the engagement team members. When planning an integrated audit, the auditor should evaluate whether the following matters are important to the company's financial statements and internal control over financial reporting and, if so, how they will affect the auditor's procedures -

• Knowledge of the company's internal control over financial reporting obtained during other engagements performed by the auditor;
• Matters affecting the industry in which the company operates, such as financial reporting practices, economic conditions, laws and regulations, and technological changes;
• Matters relating to the company's business, including its organization, operating characteristics, and capital structure;
• The extent of recent changes, if any, in the company, its operations, or its internal control over financial reporting;
• The auditor's preliminary judgments about materiality, risk, and other factors relating to the determination of material weaknesses;
• Control deficiencies previously communicated to the audit committee⁸ or management;
• Legal or regulatory matters of which the company is aware;
• The type and extent of available evidence related to the effectiveness of the company's internal control over financial reporting;
• Preliminary judgments about the effectiveness of internal control over financial reporting;
• Public information about the company relevant to the evaluation of the likelihood of material financial statement misstatements and the effectiveness of the company's internal control over financial reporting;
• Knowledge about risks related to the company evaluated as part of the auditor's client acceptance and retention evaluation; and

• The relative complexity of the company's operations.