With regard to Financial Statements, management makes assertions as to three aspects of information. 

Account balances 

 Transactions 

Presentation and disclosure

Auditing Standard No. 15, issued by the PCAOB, states in paragraph 11: 

In representing that the financial statements are presented fairly in conformity with the applicable financial reporting framework, management implicitly or explicitly makes assertions regarding the recognition, measurement, presentation, and disclosure of the various elements of financial statements and related disclosures. Those assertions can be classified into the following categories: 

Existence or occurrence 

Completeness

Valuation or allocation

Rights and obligations

Presentation and disclosure

How does management make sure that the assertions are proper and that the financial statements do fairly present, in all material respects, financial position, results of operations and cash flow in conformity with US GAAP? 

Internal controls is a process, effected by the board of directors, management, and other personnel that provides reasonable assurance regarding achievement of controls in the following categories: 

Effectiveness and efficiency of operations;

Accuracy of financial reports; and

Compliance with applicable laws and regulations.

Inherent Risk

Control Risk

Recorded transactions are valid and documented. 

All valid transactions are recorded, and none are omitted. 

Transactions are authorized according to company policy. 

Transactions are properly classified in the accounts. 

Transactions are recorded in the proper period. 

Transaction dollar amounts are properly calculated. 

Transaction accounting is complete.

1) Human error

2) Employee collusion

3) Management override

4) Cost/Benefit

1) Preventive controls 

2) Detective controls 

3) Corrective controls

 Categorize internal controls by scope for computer-based systems: 

1) general controls – refers to entire control environment

2) application controls – specific to application programs 

The requirement for an effective internal control system is further strengthened through 2 federal 

laws. They are: 

1) FCPA of 1977 

2) Sarbanes-Oxley Act of 2002. 

SOX requires a company to base its evaluation of its internal control structure for 

financial reporting on a recognized control framework. Most companies are using 

COSO. 

3 Control Frameworks: 

1) COBIT – controls for IT 

 2) COSO – issued its report in 1992 – all controls, not just IT.

 3) COSO’s Enterprise Risk Management 

COSO Framework – The 5 Components of Internal Control Structure are:  

1. Control Environment 

2. Risk Assessment

3. Control Activities

4. Information and Communication

5. Monitoring

a) Management philosophy & operating style

b) Integrity and ethical values

c) Commitment to competence

d) Board of Directors and audit committee

e) Organizational Structure/Assigning Authority and Responsibility

f) Human Resources Standards

Which of the 5 components of the COSO Framework Internal Control Structure control environment is described as "tone at the top”, management’s attitude toward internal controls; excessive risk takers; centralized decision making. 

 Ex. CFO requesting check without documentation 

Which of the 5 components of the COSO Framework Internal Control Structure control environment is described as where management must create a culture within the organization of right and wrong/honesty. Must be COMMUNICATED in writing to employees. Pressure to meet financial goals regardless of the method. Require reporting of dishonest behavior. 

Which of the 5 components of the COSO Framework Internal Control Structure control environment is described where only outside directors allowed on the audit committee. In adherence to the SOX Act of 2002 – hire external auditors; meet with internal and 

external auditors; whistleblower procedures; general oversight of internal control structure and financial reporting. At least one member of the audit committee has to be a financial expert. 

Which of the 5 components of the COSO Framework Internal Control Structure control environment is described with lines of authority, responsibility and reporting. Layers of reporting versus teams; job 

descriptions, employee training, budgets, performance reports. 

Which of the 5 components of the COSO Framework Internal Control Structure control environment is described as addressing:

hiring – background checks; compensating; promoting; 

training – including fraud and ethics; vacations; job rotations; fidelity bonding; discharging employees; counseling; handling of identified fraud 

Must identify the risk and then decide how to handle it –  

Look at threat: nature, likelihood, and impact. Then decide how to respond – reduce/accept/share/avoid risk. 

Proper authorization of activities and transactions

Segregation of duties

 Adequate Documents and Records

Safeguard Assets, Records, and Data

Independent Checks on Performance

The COSO Risk control activity describing uses of signatures, initials, authorization codes; general and specific authorization; ties back to IC; and the objective that all transactions are authorized according to company policy is known as (6 words): 

The COSO Risk control activity describing AIS responsibility for providing information to decision-makers and the communication within the organization of responsibilities such as budgets and performance reporting is known as: 

The COSO Risk Control activity that requires consideration of whether controls are operating as intended and that they are modified as appropriate for changes in conditions, and is often the work of the Internal audit department is known as: 

ALTHOUGH THE TEXTBOOK PRIMARILY GIVES EXAMPLES OF FRAUD TO 

EXPLAIN THE CONSEQUENCES OF WEAKNESSES IN OR LACK OF INTERNAL 

CONTROLS, THE MAJORITY OF NONCOMPLIANT EVENTS ARE

Although the textbook primarily gives examples of fraud to explain the consequences of weaknesses in or lack of internal controls, the marority of noncompliant events are:

Authorization 

Recording

Custody of Assets

Independent Verification

General Controls

and

Application Controls 

1. Belief System

2. Boundary System

3. Diagnostic Control System

4. Interactive Control System

Creation of the Public Company Accounting Oversight Board (PCAOB)

New Rules for Auditors

New roles for Audit Committees

New rules for management

New internal control requirements

*Companies are formed to create value for their owners
*Management must to decide how much uncertainty it will accept as it  creates value.
*Uncertainty results in risk, which is the possibility that something  negatively affects the company's ability to create or preserve value. 
*Uncertainty results in opportunity, which is the possibility that  something positively affects the company's ability to create or  preserve value. 
*The ERM framework can manage uncertainty as well as create and preserve value.