Assessment of internal controls is part of today’s auditing requirements and helps identify risk factors. But it can sometimes be unclear why auditors ask so many questions about their clients’ internal controls.
The American Institute of Certified Public Accountants (AICPA) issues technical Q&As to address member inquiries on certain issues, and they recently shed some light on this subject. Here’s a set of five common questions and answers that the AICPA issued in April to help clarify an auditor’s responsibility for assessing a client’s internal controls.
Yes, the auditing standards require an auditor to understand a client’s information system, including the related business processes and communication relevant to financial reporting. The AICPA reminds auditors that it’s important to distinguish between business processes and control activities. Business processes are the activities designed to:
The AICPA defines control activities as “steps put in place by the entity to ensure that the financial transactions are correctly recorded and reported.” Auditors are expected to obtain an understanding of only those control activities that are considered relevant to the audit. There are no “cookie cutter” approaches when it comes to understanding business processes and control activities; rather, the requirements differ from audit to audit.
Yes, an auditor must understand each component of the client’s financial reporting controls. This includes the control environment, risk assessment process, information system, control activities that relate to the audit, and the client’s monitoring of the controls.
Yes, each year auditors must evaluate the design of the financial reporting controls that are related to the audit and determine if they’ve been properly implemented. This requires more than just inquiring with company personnel. Auditors must use additional procedures — such as observations, inspection or tracing transactions through the information system — to obtain an understanding of controls relevant to the audit. The appropriate procedures are a matter of the auditor’s professional judgment.
For existing clients, an auditor may leverage information obtained from his or her previous experience with the entity and the results from audit procedures performed in previous reporting periods. In doing so, the auditor should determine whether changes affecting the control environment have occurred since the previous audit that may affect that information’s relevance to the current audit.
Auditors are specifically expected to understand controls that address “significant” risks. These are identified and assessed for risks of material misstatement that, in the auditor’s professional judgment, require special audit consideration. Examples include control activities 1) relevant to the risk of fraud or 2) over journal entries (such as nonrecurring, unusual transactions or adjustments).
Control activities that are relevant to a given audit may vary, depending on the client’s size, complexity and nature of operations. The AICPA advises auditors to consider such issues as materiality, risk, other components of the internal controls, and legal and regulatory requirements. Again, what’s relevant is a matter of the auditor’s professional judgment.
Modern business and operating environments are rapidly changing. To reflect these changes, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) updated its Internal Control — Integrated Framework in 2013. The updated framework outlines five components of internal controls that are required under the Sarbanes-Oxley Act’s Section 404 provisions:
The updated COSO framework isn’t just for public companies that must comply with Sarbanes-Oxley. The framework applies to all entities that follow U.S. generally accepted accounting principles (GAAP), including for-profits, nonprofits and government bodies.
Whether you’re facing your first single audit or reinforcing your data management posture at an enterprise-level organization, it’s important to be aware of gaps in your internal controls and have a plan of action. Contact our experienced Internal Control consultants today for expertise that will set you up for success.
