Slide 1: Assessing Financial Statement Risks and Internal Controls
Assessing Financial Statement Risks and Internal Controls A Suggested Approach for Companies
Slide 2: Overview
Overview This presentation describes: • Financial statement risks • Reasons for identifying risks • Examples and sources of risks • Internal control components, control objectives, and key controls • An approach for— – Identifying financial statement risks – Assessing whether controls are adequate t
Slide 3: Reasons for This Presentation
Reasons for This Presentation • To assist you in fulfilling your responsibilities for financial reporting • To assist our firm in meeting professional requirements when performing your audit • To help minimize your audit fees
Slide 4: What are Financial Statement Risks?
What are Financial Statement Risks? • Risks that affect the achievement of financial reporting objectives • Conditions or indications that something could go wrong in the financial statements • May relate to error or fraud • May be pervasive to the financial statements or related to specific transac
Slide 5: Why Identify and Understand Risks?
Why Identify and Understand Risks? • Risk assessment is a key component of internal control • Identifies what could go wrong in the financial statements • Allows an evaluation of the likelihood and magnitude of potential misstatements • Provides a foundation for assessing whether controls are proper
Slide 6: Considering Financial Statement Assertions
Considering Financial Statement Assertions • Existence or occurrence • Completeness • Rights or obligations • Valuation or allocation • Accuracy or classification • Cutoff
Slide 7: Examples of Risks
Examples of Risks Financial Statement Risk Indicator Risk Inventory is highly liquid Overstatement of inventory due to theft (Existence) Inventory cost accounting Overstatement or method is highly complex and understatement of inventory subjective due to improper cost accounting (Valuation) Key cust
Slide 8: Possible Sources of Risk
Possible Sources of Risk • Structure, ownership, governance, and related parties • Industry, regulatory, and other external factors • The nature of the company, for example: – Revenue sources – Types of products, services, and markets – Nature of assets, liabilities, expenses, investments, and finan
Slide 9: Possible Sources of Risk (Continued)
Possible Sources of Risk (Continued) • Objectives and strategies • Key performance measures • Going concern issues • Potential fraud – Incentives/pressures – Opportunities – Attitudes/rationalizations
Slide 10: Internal Control
Internal Control • Process employed by the company to provide reasonable assurance of achieving financial reporting objectives • Consists of five interrelated components • To be effective, all components should be present and functioning and operating together • Applies to all companies—both small a
Slide 11: Five Components of Internal Control
Five Components of Internal Control • Control Environment • Risk Assessment • Information and Communication • Monitoring • Control Activities
Slide 12: Control Objectives, Principles, and Key Controls
Control Objectives, Principles, and Key Controls • A control objective states the purpose of a control • Principles represent the fundamental concepts associated with each component of internal control • Controls are effectively designed if they achieve the objective/principle • Key controls are tho
Slide 13: Control Environment Principles
Control Environment Principles • The entity demonstrates a commitment to integrity and ethical values • The board of directors demonstrates independence from management in exercising oversight of the development and performance of internal control over financial reporting • With board oversight, man
Slide 14: Control Environment Examples
Control Environment Principle Examples Control Example The entity demonstrates a A process exists by which those commitment to integrity and charged with governance are ethical values made aware of key developments that may affect financial reporting The board of directors The board of directors is
Slide 15: Control Environment Examples (Continued)
Control Environment Examples (Continued) Principle Control Example The entity demonstrates a Employee recruitment and commitment to attract, develop, retention practices for key and retain competent individuals financial positions are in alignment with financial guided by principles of reporting int
Slide 16: Risk Assessment Principles
Risk Assessment Principles • The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to financial reporting objectives • The entity identifies risks to achieving its objectives and analyzes risks to determine how the risks should be manag
Slide 17: Risk Assessment Examples
Risk Assessment Examples Principle Control Example The entity specifies objectives Management identifies risks with sufficient clarity to enable related to laws or regulations the identification and that may affect financial assessment of risks relating to reporting financial reporting objectives Th
Slide 18: Information and Communication Principles
Information and Communication Principles Information: • The entity obtains or generates and uses relevant, quality information to support the functioning of internal control over financial reporting
Slide 19: Information and Communication Principles (Continued)
Information and Communication Principles (Continued) Communication: • The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control over financial reporting • The entity communicates with exter
Slide 20: Information Examples
Information Examples Principle Control Example The entity obtains or Relevant operating information is generates and uses used to develop accounting and relevant, quality financial information and whether it information to support the serves as a basis for reliable functioning of internal financial
Slide 21: Communication Examples
Communication Examples Principle Control Example The entity internally Management has developed communicates communication approaches that information, including specify individual responsibilities in objectives and dealing with inappropriate responsibilities for behavior internal control, to suppor
Slide 22: Monitoring Principles
Monitoring Principles • The entity selects, develops, and performs ongoing and/or separate evaluations to determine whether the components of internal control are present and functioning • The entity evaluates and communicates internal control deficiencies in a timely manner to those parties respons
Slide 23: Monitoring Examples
Monitoring Examples Principle Control Example The entity selects, Management’s ongoing develops, and performs monitoring serves as a primary ongoing and/or separate indicator of both control design evaluations to determine and operating effectiveness and whether the components of of risk conditions
Slide 24: Control Activities Principles
Control Activities Principles • The entity selects and develops activities that contribute to the mitigation of risks to the achievement of financial reporting objectives to acceptable levels. • The entity selects and develops general control activities over technology to support the achievement of
Slide 25: Control Activities Examples
Control Activities Examples Principle Control Example The entity selects and The company’s control develops activities that activities include periodic contribute to the mitigation of inventory observations and risks to the achievement of reconciliations to the general financial reporting objectives
Slide 26: Types of Control Activities
Types of Control Activities • Performance reviews • Information processing controls • Physical controls • Segregation of duties • Accountability
Slide 27: Control Activities Objectives — Processing Cash Receipts
Control Activities Objectives — Processing Cash Receipts • Cash receipts information is valid and processed only once (E/O, R/O) • Cash receipts are appropriately safeguarded (E/O) • Cash received is posted in the proper period (CO) • Cash receipts information is recorded in the correct account (A/C
Slide 28: Control Activities Examples — Processing Cash Receipts
Control Activities Examples — Processing Cash Receipts • Lockbox receipts are compared to customer remittances (E/O, C, R/O, A/CL, CO) • Cash receipts are reconciled to general ledger postings daily (E/O, V, R/O, CO) • Bank reconciliations are prepared and reviewed in a timely manner (E/O, C, V, R/O
Slide 29: Putting It All Together: A Process for Identifying Risks and Assessing Controls
Putting It All Together: A Process for Identifying Risks and Assessing Controls • Consider the aspects of the company that are sources of risk • Gather information that indicates potential risks • Accumulate and synthesize the information to identify risks • Identify key controls that address the ri
Slide 30: A Practical Approach to Reviewing Internal Control
A Practical Approach to Reviewing Internal Control • Supporting tools to help you assess entity-level controls: – Complete (or update) a narrative describing your entity-level controls using “Understanding the Design and Implementation of Internal Control” – Supplement the documentation by completin
Slide 31: A Practical Approach to Reviewing Internal Control
A Practical Approach to Reviewing Internal Control (Continued) • Supporting tools to help you assess activity-level controls: – Complete (or update) a narrative describing your activity-level controls using “Financial Reporting System Documentation Form―Financial Close and Reporting, Significant Tra
Slide 32: A Practical Approach to Reviewing Internal Control
A Practical Approach to Reviewing Internal Control (continued) Evaluate controls to determine if: • Key controls are present to achieve control objectives/principles and address relevant financial statement risks • Controls are properly designed to prevent, or detect and correct, misstatements • Con
Slide 33: A Practical Approach to Reviewing Internal Control
A Practical Approach to Reviewing Internal Control (continued) If controls are “missing” or improperly designed, determine: • Whether another control could mitigate the deficiency • The likelihood and magnitude of potential errors • The pervasiveness of potential errors • The priority for corrective
Slide 34: Conclusion
Conclusion Risk Assessment: • A key component of internal control • Allows the company to evaluate whether controls are adequate • Establishes a framework for prioritizing the correction of control deficiencies • Assists in the audit process
Slide 35: Questions?
Questions?