Look, who is in

control?
“With men this is impossible;
but with God all things are
possible”. Matthew 19:6

Philippine eagle named “Raquel”...

perched at the highest peak of Apayao

“Many times it happens

we live our life in chains
and we never even know
we have the key.” -
Eagles
Internal Control
in an
Operational Audit

⚫ facilitator: alfonso s. bestoyong, cpa, mba

Learning Objectives:

Know the
Understand the objective of
nature & purpose studying an
of internal control. entity’s internal
control.

Understand the
relationship Know how to
between communicate
effectiveness of reportable
internal control conditions to
and substantive management.
tests.
 Internal Control (Defined)
❖ PSA 315 paragraph 4(c)
⚫ “The Process designed and effected by those charged
with governance, management, and other personnel to...
✓ provide reasonable assurance about the achievement of the
entity’s objectives with regard to...
a) reliability of financial reporting,
b) effectiveness and efficiency of operations and
c) compliance with applicable laws and regulations”

⚫ Internal control is designed and implemented to

address identified business risks that threaten the
achievement of any of these objectives
a) Reliability of the entity’s financial reporting
b) Effectiveness and efficiency of operations
c) Compliance with applicable laws and regulations.
 Internal Control System (Defined)
⚫ The policies and procedures (internal control)
adopted by the management of an entity to assist in
achieving management’s objectives of ensuring as far
as practicable,
a) the orderly and efficient conduct of it’s business,
including adherence to management policies,
b) the safeguarding of assets,
c) the prevention and detection of fraud and error,
d) the accuracy and completeness of the accounting
records, and
e) the timely preparation of reliable financial
information.
The Elements of
Internal Control

Information
The Entity’s System,
The Entity’s (including the
Risk Control Monitoring of
Control related business
Assessment processes, relevant Activities Controls
Environment to financial
Process reporting, and
communications).
The Elements of Internal Control
Lesson Review...
(Questions)
Question # 1
⚫ Reasons an auditor obtain an understanding of
the internal control structure…
Suggested Answer:
An auditor obtains an understanding of a client’s internal
control structure as a part of the control risk assessment
process in order…
1. to plan the nature, timing, and extent of subsequent
substantive audit procedures, and
2. to obtain information about reportable conditions
(control deficiencies) to report to the client.
Question # 2

⚫ Reasons for conducting an evaluation of an audit client’s

internal control…
Suggested Answer:
1. The primary reason for conducting an evaluation of a client’s
existing internal control system is to give the auditors a basis for
finalizing the details of the account balance audit program –
to determine the nature, timing and extent of subsequent substantive audit procedures.

2. A secondary purpose for conducting an evaluation of internal

control is to be able to make constructive suggestions for
improvements.
Officially, the profession considers these suggestions a part of the audit function and does not
define the work as a MAS consultation.

3. Another purpose of the evaluation is to report to management

and the board of directors or its audit committee any discovery of
“any reportable conditions” of internal control deficiencies.
Question # 3

⚫What are the factors that would

affect the nature, timing and
extent of the procedures
performed by the auditor to
obtain and understanding of the
accounting and internal control
system…
Suggested Answer:
 Advantages & Disadvantages of Documenting Internal Control

Question # 4 Advantages Disadvantages

1) Internal a) Easy to complete.

a) May contain numerous
control b) Checklist of questions.
irrelevant questions.
c) Less chance of overlooking
questionnaire b) Tendency to treat it like
something important.
another form to fill out.
d) Can explain the precise controls
2) Memorandum applicable to the particular
c) Hard to write. Often
client. (precise tailoring)
documentation lengthy.
e) Requires penetrating analysis.
f) Minimizes tendency toward d) Hard to revise in
perfunctory review. subsequent years.

g) Graphic presentation of systems.

3) Flowchart
h) Shows the steps required and the
flow of forms & documents.
i) Easy to read and analyze. e) Takes some time to draw
j) Easy to update in subsequent neatly.
years.
Question # 5
What is the difference between observation &
re-performance in tests of controls audit
procedure?
Observation Reperformance

✓ “Observation,” in a test of ✓ “Reperformance,” in a

control procedure, refers
to…
✓ auditors looking to see
whether client personnel
stamped, initialed, or left
other signs that their
assigned control procedures
had been performed.
test of control procedure,
refers to…
✓ auditors doing again the
control that was supposed to
have been performed by the
client personnel
(recalculating, looking up the right
price, comparing quantities, and
so forth).
Question # 6
Types of engagements can produce written report on
internal accounting control (IAC) for external use.
Type of Engagement Character of Report
Special IAC study ✓ Report on IAC with opinion on
IAC system taken as a whole.

Service auditor engaged to ✓ A special-purpose report on

report for benefit of user
auditor and their mutual
client.
IAC can take special forms, the
main feature of which includes
an opinion relating to the
controls applied by the service
organization to the client
organization’s transactions.
 Question # 7
⚫ What is meant by the auditor’s understanding of
a client’s internal control?

Suggested Answer:
✓ The auditor must obtain a sufficient understanding of the
client’s system of internal financial controls to identify the
types of potential material misstatements of financial
statement components, and the risks associated with each.

✓ Such understanding is obtained by gathering evidence

relating to the basic elements of the client’s internal
financial controls.
Question # 8
⚫ How does the auditor obtain an initial
understanding of a client’s financial control
policies and procedures?

Suggested Answer:
✓ The auditor obtains an initial understanding of the client’s
financial controls by studying the organizational structure,
inquiring of management, and studying last year’s working
papers if a recurring audit.
Question # 9
⚫ What kind of documentation is required relative to
the auditor’s understanding of a client’s internal financial
control?
Suggested Answer: The documentation of the auditor’s
understanding must…
✓ provide clear evidence of support for the auditor’s conclusions
regarding the assessed level of control risk.
This is especially necessary if control risk is assessed below the maximum
level.
✓ The documentation at this point typically consists of some
combination of…
• narrative memoranda,
• questionnaires or checklists, and
• internal control flowcharts, as well as
• documentation of the auditor’s conclusions, and
• the reason(s) for assessing control risk below maximum, if applicable.
 Question # 10
⚫ How does testing of internal controls help in the
design of substantive audit procedures?

Suggested Answer:
✓ Testing of internal financial controls may permit the auditor
to further reduce the assessed level of control risk.
✓ This, in turn, should lead to a decrease in the nature,
timing, and/or extent of substantive audit testing in the
circumstances.
Question # 11
⚫ Under what circumstances might an auditor decide
not to test internal financial controls beyond
obtaining an initial understanding…

Suggested Answer: The following factors may cause

the auditor…

✓ to decide not to test the client’s internal financial

controls beyond obtaining an initial understanding:
a) Controls may already have been evaluated as ineffective;
b) Further testing is not cost effective
(i.e., the cost of further testing is greater than the cost
savings resulting from reduced substantive testing)
Question # 12
⚫ Identify alternative means for testing of internal
financial controls…

Suggested Answer: …
✓ Some combination of the following means is typically
utilized by the auditor in testing a client’s internal
financial controls:
a) Reprocessing transactions through the client’s system;
b) Observation of controls; and
c) Document examination and testing.
Question # 13
• Differentiate between misrepresentation and
misappropriation
Suggested Answer: …

Misrepresentation Misappropriation

⚫ …is a form of financial ⚫ …is a form of fraud whereby

statement misstatement
caused by intentional
efforts by management to
distort reported financial
position and/or results of
operations
one or more employees
effect a transfer of assets
from employer to employee,
accompanied by
concealment in the form of
account or substance
alteration.
 Question # 14
• Example showing how control weakness may lead to
an expansion of substantive audit procedures.
Suggested Answer: …
Internal Control Weakness Substantive Testing

⚫ Perpetual inventory records ⚫ Expand test counts during

not maintained inventory observation

⚫ Bank accounts not ⚫ Expand year-end audit of

reconciled cash accounts

⚫ Customer exceptions to ⚫ Expand accounts receivable

monthly statements not confirmation at year-end.
investigated and cleared
Question # 15
⚫ What is meant by reportable conditions? What purpose is
served by the letter communicating matters related to
internal control to the audit committee?
Suggested Answer: …
✓ Reportable conditions are matters coming to the auditor’s attention, as
a result of his/her study and evaluation of the client’s internal financial
controls, relating to significant deficiencies in the design or operation or of
the internal controls that could adversely affect the organization’s ability to
record, process, summarize, and report financial data consistent with the
assertions of management in the financial statements.
✓ The purpose of the reportable conditions letter is to inform the audit
committee, or similar body within the organization, of weaknesses for which
they may not be aware. Such communication increases the likelihood that the
weaknesses will be corrected on a timely basis.
 Question #
16
⚫ Describe how the memorandum, questionnaire or
checklist and flowchart approaches might be used in
combination to provide an effective means for studying
and evaluating a client’s internal financial controls.
Suggested Answer: …
✓ Use of any one of the approaches to studying and documenting a client’s
internal financial controls, by itself, is inadequate. Each approach
adds a needed dimension to the analysis.
✓ The memorandum requires depth of analysis not found in the flowchart. The
flowchart, on the other hand, promotes ease of understanding and ready
identification of strengths and weaknesses in controls.
✓ The questionnaires and checklists add the dimension of
completeness of coverage.
✓ By using the three tools in combination, the auditor is able to gain a
deeper and clearer understanding of each of the subsets of the transaction
cycles, including major control strengths and weaknesses, thereby permitting
more accurate control risk assessments and more useful substantive audit
programs based on such assessments.
 Your Next
Lesson :

Understan
ding
the
Internal
25
26