Internal Controls in Audit and Assurance - for ACCA F8, AA and CA

Audit Procedures Overview

In this lecture, we are going to discuss internal controls and systems. Before we start with internal controls as a topic, let us quickly recap audit procedures. There are usually two types of audit procedures to be performed:

• Test of controls
• Substantive procedures

When it comes to test of controls, this is the area where the auditor will evaluate the internal control systems of the organization: whether internal controls are good or bad, efficient and effective, working properly or not, whether there are violations against internal control systems, whether authorizations are properly taking place, whether periodical reviews are conducted, whether there is a proper hierarchy maintained in the entity, and whether segregation of duties exists. Everything related to internal controls shall be evaluated by the auditor while performing the test of controls. Substantive procedures are classified into two categories:

• Analytical procedures
• Test of details

Understanding the Entity

To understand audit with a holistic picture and get the complete picture of audit as a whole, consider when you are appointed as an auditor of an entity. Before you start verification, vouching, or analytical procedures, you first need to get a picture of the entire organization as a whole under ISA 315, identifying and assessing the risks of material misstatement through understanding the entity and its environment.

First, read about the organization: what kind of business they are involved in, their organizational hierarchy, their corporate governance structure, how many executive and non-executive directors there are, the roles and responsibilities associated with them, whether the organization has an audit committee in place, whether it is functioning properly, how many times the audit committee conducted meetings and review meetings, and whether internal audit is appointed. If so, assess the efficiency and effectiveness of internal audit, to whom they report, whether they report to the board of directors or the audit committee, the frequency of internal audit, and whether interim audits have been conducted during the period under review. There are many questions an auditor must answer before walking into an entity and taking sales vouchers, sales accounts, and sales invoices to tick them off. That is not real audit. You need to get the complete picture about the organization first, and then you can start with vouching and verification.

Audit Risk Components

After understanding the entity, look into the internal control systems of the organization. Looking back at audit risk, audit risk is a combination of inherent risk, control risk, and detection risk:

Audit Risk = Inherent Risk * Control Risk * Detection Risk

Inherent risk is the risk of the business itself because of the nature, complexity, and volume of transactions. Control risk is the risk that internal controls may not be efficiently and effectively working. Detection risk is the risk that the auditor might not be able to detect material misstatements because of sampling or non-sampling errors.

As an auditor, your ultimate objective is to reduce audit risk to an acceptable level. You do that by making sure that all three risks are reduced or offset by each other. If control risk is bad and internal controls are not efficient, the auditor has to perform more substantive procedures to reduce detection risk.

There is a correlation between audit procedures and audit risk. First, understand the nature of the entity to evaluate inherent risk. When you understand corporate governance, the nature of transactions, the business, and the laws and regulations they must comply with, you get a picture of the inherent risk of the entity. Next, look into the controls in place to evaluate control risk by performing tests of controls.

Segregation of Duties

There are various methods of performing tests of controls. Consider the example of walking into a bank. When you walk into a bank, there are certain procedures to follow if you want to open an account, deposit money, and get a checkbook. You cannot simply go to one counter and complete everything at once. First, go to counter one to get an account opening form, fill it in, submit it, produce KYC documents for verification, and open the account. Once the account is open, go to counter two with a deposit slip, fill in the denominations, deposit the cash, and have the amount credited to your account. Then go to counter three to apply for a checkbook, specify the number of leaves needed, and receive the checkbook or have it delivered.

This represents an internal control called segregation of duties. The same person is not associated with multiple duties. If the same person were associated with multiple duties, they might abuse their power.

Apply this to a business entity. Suppose Mr. X is the sales manager who fixes sales prices and discounts, collects cash from customers, and records journal entries in the books of accounts. When selling to a customer, he could issue an original invoice for one hundred units at ten dollars each, totaling one thousand dollars, and give that to the customer. In the books of accounts, he could record one hundred units at eight dollars each, totaling eight hundred dollars. He collects one thousand dollars from the customer, records eight hundred dollars in the books, and misappropriates the remaining two hundred dollars. That is embezzlement of funds and theft of cash. This happens because the same person is responsible for selling, collecting cash, and recording in the books of accounts.

If three different people handle each activity—a sales manager responsible for selling, a cashier responsible for collecting cash, and an accountant responsible for recording in the books of accounts—mismanagement cannot easily happen. If the sales manager sells for one thousand dollars, the cashier collects one thousand dollars, and the accountant records one thousand dollars.

Risk of Collusion

Even with segregation of duties, there is still a possibility of fraud through collusion. Collusion occurs when multiple people associated with a transaction come together to commit fraud against the company. All three could agree to sell for one thousand dollars, collect one thousand dollars, record eight hundred dollars, and distribute the remaining two hundred dollars among themselves.

Because collusion can occur, the auditor must always perform substantive procedures, even when internal controls are very efficient. There is still a possibility that effectiveness is lacking. The auditor must perform vouching and verification regardless of how good internal controls appear.

Efficiency and Effectiveness of Controls

When performing tests of controls, the auditor evaluates internal control systems on two elements:

• Efficient
• Effective

Efficiency refers to how good the internal control system is designed on paper. Is it foolproof, well-designed, and suitable for the entity? In the case of segregation of duties, the design is efficient because different tasks are allocated to different people.

Effectiveness refers to how the controls are implemented in practice. If employees collude together and do not follow the established controls, the controls are not effectively implemented. As an auditor, you must check both the efficiency of the internal controls designed and their effectiveness in implementation.

Impact on Substantive Procedures

Once you evaluate both the efficiency and effectiveness of internal control systems, you reach a decision. If internal control systems are efficient and effective, the volume of substantive procedures can be reduced. You do not need to test as much information because you can place reliance upon the information provided by management. You can perform audit sampling, reduce the sample size from the entire population, and place reliance on written representations, internal audit reviews, and audit committee reviews. You still perform substantive procedures, but the extent of testing is reduced.

Conversely, if internal controls are very weak—either poorly designed or poorly implemented—a red flag arises. You must increase the volume of substantive procedures, increase the sample size for tests of details (for example, verifying sixty percent of vouchers rather than twenty percent), and gather more external evidence rather than relying on internal documentation.

Do not rely heavily on analytical procedures when internal controls are weak. Analytical procedures evaluate relationships between financial and non-financial data, such as ratio analysis. If controls are weak and transactions are manipulated through collusion, the recorded financial information itself is doubtful. If sales are understated, calculated ratios such as sales growth rates will be incorrect. Planning or concluding an audit based on incorrect ratios leads to incorrect audit conclusions. Test of details must be increased, external evidence must be gathered, and reliance on management representations must be restricted.

Auditor Reporting and Credibility

The ultimate responsibility of the auditor is to express an opinion on the financial statements regarding:

• Whether the financial statements as a whole are free from material misstatement
• Whether they give a true and fair view
• Whether they comply with the applicable financial reporting framework

By expressing an opinion and issuing the audit report, the auditor increases the credibility of the financial statements and enhances the confidence level of shareholders. Shareholders can trust the financial statements because an independent expert third party has reviewed and audited them.

The auditor provides that confidence by conducting appropriate audit procedures: performing tests of controls and determining the necessary extent of substantive procedures based on the results of those control tests.