02 Handout 1
02 Handout 1
02 Handout 1
The auditor should obtain an understanding of the internal control sufficient to plan the audit and develop
an effective audit approach. The auditor this understanding to identify types of potential misstatements,
consider factors that affect the risks of material misstatement, and design the nature, timing, and extent
of further audit procedures (Asuncion et al., 2018).
Internal Control
Internal control is a process, effected by those charged with governance, management, and other
personnel, designed to provide reasonable assurance regarding the achievement of objectives in the
following categories:
1. Effectiveness and efficiency of operations;
2. Reliability of financial reporting; and
3. Compliance with applicable laws and regulations.
Inherent Limitations of Internal Control
The internal control can only provide reasonable assurance because of inherent limitations that may affect
the effectiveness of internal controls. Such limitations include:
1. Management usual requirement that a control be cost-effective (cost-benefit consideration);
2. The possibility that a person responsible for exercising control could abuse that responsibility
(management overriding the control);
3. The possibility of circumvention of controls through collusion with parties outside the entity or
with employees of the entity;
4. The possibility that procedures may become inadequate due to changes in condition and
compliance with procedures may deteriorate;
5. The potential for human error due to carelessness, distraction, mistakes of judgment or the
misunderstanding of instructions; and
6. The fact that most controls tend to be directed at anticipated types (routine) of transactions and
not at unusual (non-routine) transactions.
Controls Relevant to the Audit
The auditor's risk assessment process relates to controls pertaining to the entity's objective of preparing
financial statements for external purposes and the management risk that may give rise to a material
misstatement in those financial statements.
It is a matter of professional judgment, subject to the requirements of PSA, whether a control, individually
or in combination with others, is relevant to the auditor's considerations in assessing the risks of material
misstatement. In exercising that judgment, the auditor considers the applicable component and factors
such as the following:
1. The auditor's judgment about materiality;
2. The size of the entity;
3. The nature of the entity's business, including its organization and ownership characteristics;
4. The diversity and complexity of the entity's operations;
5. Applicable legal and regulatory requirements; and
6. The nature and complexity of the systems that are part of the entity's internal control, including
the use of service organizations.
For financial reporting purposes, the entity's risk assessment process includes how management
identifies risks relevant to the preparation of financial statements that are presented fairly, in all
material respects in accordance with the entity's applicable financial reporting framework,
estimates their significance, assesses the likelihood of their occurrence, and decides upon actions
to manage them.
The auditor shall obtain an understanding of whether the entity has a process for:
a. Identifying business risks relevant to financial reporting objectives
b. Assessing the significance of risks and the likelihood of their occurrence
c. Deciding how to manage those risks
The information system relevant to financial reporting objectives, such as the financial reporting
system, consists of the procedures and records established to initiate, record, process, and report
entity transactions (as well as events and conditions) and to maintain accountability for the
related assets, liabilities, and equity.
4. Control Activities
Control activities are the policies and procedures to help ensure that management directives are
carried out. Examples of control activities include those relating to the following:
a. Authorization
b. Performance reviews (actual performance versus budget, forecasts, and prior period
performance)
c. Information processing (from initiation up to the eventual inclusion of transaction in
financial reports)
d. Physical controls (for both assets and documents)
e. Segregation of duties. To achieve optimum segregation of responsibilities, the following
functions should be performed by different employees:
i. Independent checks
ii. Custody of assets
iii. Authorization of transactions
5. Monitoring of Controls
Monitoring is the process of assessing the quality of internal control performance over time. It
involves assessing the design and operations of controls on a timely basis and taking necessary
corrective actions.
1. Consider the reasons for the assessment given to the risk of material misstatement at the assertion
level for each class of transactions, account balance, and disclosure, including:
a. The likelihood of material misstatement due to the particular characteristics of the relevant
class of transactions, account balance, or disclosure (i.e., the inherent risk); and
b. Whether the risk assessment takes account of relevant controls (i.e., the control risk), thereby
requiring the auditor to obtain audit evidence to determine whether the controls are
operating effectively i.e.,
i. the auditor intends to rely on the operating effectiveness of controls in determining
the nature, timing and extent of substantive procedures); and
ii. Obtain more persuasive audit evidence, the higher the auditor's assessment of risk.
Test of Controls
The auditor should give adequate consideration to controls relevant to the audit. The quality of the
entity's internal control can have a significant impact in determining the nature, timing and extent of the
audit procedures in gathering audit evidence related to class of transactions, account balances and
disclosures.
The auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence as
to the operating effectiveness of relevant controls when:
1. The auditor's assessment of risks of material misstatement at the assertion level includes an
expectation that the controls are operating effectively i.e., the auditor intends to rely on the
operating effectiveness of controls in determining the nature, timing and extent of substantive
procedures); or
2. Substantive procedures alone cannot provide sufficient appropriate audit evidence at the
assertion level.
Tests of controls over the design of a policy or procedure include Inquiry, Observation Inspection,
Reperformance, and Walk-through tests.
Documentation Requirements
Control Risk Understanding of Control Risk Basis for the Control
Assessment Internal Control Assessment Risk Assessment
High Yes Yes No
Less than high Yes Yes Yes
treasury and general accounting, pay liability on time and take advantage
respectively of discounts, if any
E. Treasury Department
Activities Possible Controls
1. Reviews voucher Common controls adopted by different entities in this department
package received include:
2. Prepares check and • The person last signing the check cancels the voucher
have it signed by package by placing a mark such as “paid”, “cancelled” or
authorized check number
signatories • Entity may adopt any of the following in relation to issuance
3. Forwards checks to of checks
vendors o Check over a certain amount should have an
4. Prepares daily identified payee
summary which is o No checks shall be issued without an identified
to be forwarded to payee
general accounting o Checks should be signed by at least two authorized
persons
Human Resources and Payroll Cycle (Asuncion, Ngina, & Escala, 2018)
Human resources and payroll cycle is a continuation of the expenditure and disbursement cycle. This cycle
covers the entity's acquisition of services from its employees or personnel. The following are main reasons
why the auditor is concerned with this cycle.
1. Payroll include different categories of employee benefits (short-term; post-employment, other
long-term and retirement) that could significantly affect major elements of financial statements;
and
2. For most entities, significant amount of resources is incurred
The following accounts are usually used in this cycle:
1. Salaries and wages expense and payable
2. Premiums expense and payable
3. Withholding taxes payable
4. Inventories (for inventoriable salaries and wages)
5. Cash
Forms or documents received, initiated and processed
Form Description Initiated by: Distributed to:
HR records It contains all information related to HR department • Payroll
(Personnel entity’s employees from time they (limited to
records or are hired up to their eventual payroll
201 file) termination. It documents all actions related
taken by the employees or information
management on behalf of an only)
employee. Commonly, it also
documents salary rates, deductions,
and other payroll related information
Daily time Describes the number of hours User department • Payroll
record (DTR) worked by an employee during a
Primary objective: To provide reasonable assurance that the payroll calculation in every pay period is
valid
Activities Possible Controls
1. Receives and reviews relevant payroll Common controls adopted by different
related information from HR and user entities in this department include:
departments • Appropriate level of management
2. Considers any update on employees’ pay (preferably a member who is not
rates and deductions involved in payroll preparation)
3. Prepares payroll register reviews the payroll register for
4. Updates cumulative employee earnings accuracy and reasonableness
records • To assure adequacy of segregation
5. Identifies and submits to inventory of duties, payroll department
accounting capitalizable payroll in case of should be segregated from HR,
servicing and manufacturing companies Treasury and some user
with inventoriable labor costs departments.
D. Treasury department (Disbursement)
Primary objective: To provide reasonable assurance that all payroll cash disbursements are based
upon a recognized liability or actual services rendered by employees
Activities Possible Controls
1. Reviews payroll register received Common controls adopted by different entities in
2. Prepares check and have it signed by this department include:
authorized signatories* • Separate bank account should be
3. Distributes checks to employees maintained exclusively for payroll
4. Prepares daily summary which is to disbursements
be forwarded to general accounting • On a surprise basis, an employee
independent from payroll and user
*Note: Most companies disburse payroll departments may distribute paychecks.
through bank fund transfers from company’s The purpose of this is to identify whether
payroll fund to individual employees’ payroll or not fictitious employees exist.
account. In this case, the treasury • Unclaimed payroll checks shall be re-
department should be the one authorizing deposited to the bank.
the bank transfer.
E. Accounting department
Primary objective: To provide reasonable assurance that items related to payroll are appropriately
classified and recorded in correct accounting period at appropriate amounts
1. Inventory: Records inventoriable labor costs to appropriate jobs or customers account and
forward a daily summary to general accounting
2. General: Reviews daily summaries and documents received from Payroll, Treasury and
Inventory departments. It records the recognition of payroll related expenses and liabilities in
the general journal.
Production and Conversion Cycle
Production or conversion cycle covers the production of entity's product for sale. It is where materials,
labor and overhead are converted into finished goods.
The primary objective of this cycle is the proper valuation of inventories and cost of goods sold. Such
objective encompasses the proper allocation of costs to each run made by the production department. In
order to attain this, the production department uses inputs from the expenditure and disbursement cycle
and provides resources and information to revenue and receipt cycle.
The following accounts are usually used in this cycle:
1. Raw Materials Inventories
2. Work-In-Progress Inventories
3. Finished Goods Inventories
4. Expenditure Cycle Related Accounts
5. Revenue Cycle Related Accounts
The focus of this discussion will be purely on controls over custody of resources involved, authorization of
activities, and recording of transactions.
Summary of control-related duties and responsibilities
Duties and Person/s assigned to perform the Procedures performed by
responsibilities function auditor
Custody Physical custody of materials and labor Auditor observes physical count
documents is normally held by the and reconciles the result of such
production department. count to entity’s records.
Since most of the assets here are highly If held by other parties, auditor
susceptible to theft and may send confirmation requests
misappropriation, adequate physical to the custodian (e.g. consignees,
control must be implemented. agents, or branches)
Authorization The production department is Auditor reviews production
authorized to make normal production orders and related documents
runs. supporting production runs made
However, in case of special runs (to by the department to determine
meet a special order), authorization whether it bears necessary
must come from the board of directors authorization.
or its authorized representative.
Recording Transactions are recorded by the cost Auditor normally reviews the:
accounting. Daily summaries are then ✓ Competency of the
prepared and forwarded to general individuals making
accounting for recoding and posting in journal entries
the general journal and ledger, ✓ Reconciliation of the
respectively. general ledger
Finance and Investment Cycle (Asuncion, Ngina, & Escala, 2018)
Finance and investment cycle generally involve three major categories of transactions: investments, long-
term debts, and shareholders' equity. It covers complicated processes such as accounting for investments,
mergers, long-term liabilities, and equity transactions.
This cycle normally involves few but significant amounts of resources. Thus, employs substantive testing
to gather sufficient appropriate evidence. However, it must be noted that prior to designing of substantive
test procedures, control-related duties and responsibilities is one of the major considerations of the
auditor.
With this, similar with the production or conversion cycle, the focus of this discussion note will be on the
different controls over custody, authorization, and recording of the different transactions covered by this
cycle.
Important notes:
1. Regardless of the manner of safekeeping, access to these certificates is given to at least two high-
ranking officers (e.g. President, Treasurer, CEO, COO, CFO, or Chairman of the board). This control
is sometimes called dual control or joint custody.
2. The auditor normally requests for the conduct of securities count in the financial institutions
holding the client's certificates.
References
Asuncion, D. J., Ngina, M. A., & Escala, R. F. (2018). Applied Auditing Book 1 of 2. Baguio: Real Excellence
Publishing.
Philippine Standard on Auditing 315 (Redrafted). (2009). Identifying and Assessing the Risks of Material
Misstatement through Understanding the Entity and its Environment.