3-21
3-67
Management is responsible for designing, implementing, and maintaining effective internal
control over financial reporting. Further, management should maintain adequate documentation
3-68
A transaction trail includes the documents and records that allow a user (or auditor) to trace a
transaction from its origination through to its final disposition, or vice versa.
Important aspects of an electronic transaction trail include:
• Unique identification of transaction. Examples include assigning a unique number by
the computer. The unique identifier could be assigned sequentially or could consist of a
location identifier and unique number within a location. Sales invoices, for example, are
sequentially numbered by the computer application.
• Date and time of transaction. These could be assigned automatically by the computer
application.
3-22
3-69
A review of Exhibit 3.5 highlights important features of management’s report. Management’s
report:
• Provides a statement that management is responsible for internal control
• Includes a definition of internal control
3-70
The steps identified in Exhibit 3.6 include:
• Identify Financial Reporting Risks
• Identify Controls that Mitigate Financial Reporting Risks
Students’ response regarding the evidence that management might obtain when assessing the
control environment will depend on their assumptions as to the how the principle was put into
operation at the organization. Some possible responses are presented in the following table.
CONTROL ENVIRONMENT PRINCIPLES
EVIDENCE THAT MANAGEMENT
MIGHT OBTAIN
1. The organization demonstrates a
commitment to integrity and ethical values.
Review of organization’s Code of Conduct,
including discussions with top and middle
management to determine if the Code is
3-23
2. The board of directors demonstrates
independence of management and exercises
oversight of the development and
performance of internal control.
Read the minutes of the meetings of the board
of directors and considered sufficiency of
meetings in addressing important issues
3. Management establishes, with board
oversight, structures, reporting lines, and
Review documents outline internal control
responsibilities
4. The organization demonstrates a
commitment to attract, develop, and retain
competent individuals in alignment with
Review policies on attracting, developing,
and retaining individuals
5. The organization holds individuals
Determine that performance measures have
Through inquiry and review of board minutes
3-71
Basing the internal control evaluation on only one component of internal control such as the
control activities is not appropriate. Determining whether internal control is effective requires an
3-72
Management should be capable of evaluating the competency of the accounting staff and /or use
the internal auditors to assist. Management and/or the internal auditors should have expertise in
3-73
If an audit committee has weak directors with little financial knowledge and inadequate
3-25
3-74
A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over
financial reporting that is less severe than a material weakness, yet important enough to merit
attention by those responsible for oversight of the company’s financial reporting.
A material weakness is a deficiency, or a combination of deficiencies, in internal control over
3-75
recording was made before shipment suggests that the control is somehow deficient. Because
this is a fundamental transaction to the revenue accounts and many other accounts could
potentially have been affected, it should be classified as a material weakness. That is, there is a
reasonable possibility that a material misstatement could occur—regardless of whether one
actually occurred.
(C) This scenario might be assessed as a significant deficiency, but probably doesn’t rise to that
level (it is not significant enough to report to the audit committee). The transactions were still
recorded for the proper amount-what the customer paid. This situation does not appear as
though it would cause a misstatement as much as it could lead to lower profitability of the
business. Questions of computer access controls could be raised.
(D) This scenario would likely be a material weakness. In over 20% of the transactions tested,
the control did not operate effectively. Considering that this again is a fundamental transaction,
the error could (with a reasonable possibility) have occurred on a large (material) scale.
Revenue could be overstated if unauthorized shipments are being made. The estimate for
(A) This deficiency would appear to be at least a significant deficiency in that the required
approval process did not operate effectively all the time. However, it appears that there is
another control (i.e., approval by sales manager) that would limit the likelihood of misstatement
and/or the magnitude of any misstatement that did occur. However, management would also
want to separately test the other control to make sure that it was operating effectively.
3-26
3-76
a.
Issue
Assessment
Additional Information
Needed, if applicable
A. Laid off
approximately
75 factory
workers
Not necessarily a
deficiency. Primarily an
operational issue.
• Did the change
affect the
segregation of
duties?
• Is the streamlined
receiving working?
B. Cut hourly
wages by $3 per
Most likely no effect on
internal controls unless it
• Are any of these
employees involved in
C. Reduced the
size of the board
etc.
A control deficiency that
might be considered a
material weakness,
primarily due to the decline
in the number of
independent directors.
In addition, the change in
compensation to only stock
options may
(inappropriately) influence
• How many directors are
there?
• What is the
independence of the one
remaining outside
director?
• How has the
compensation change
affected director
behavior, judgments,
etc.?
3-27
not objective when it comes
to evaluating the adequacy
assume responsibility for
evaluating and
implementing internal
controls. However, they are
E. Changed from a
Big 4 audit firm
to a regional
audit firm
The external audit is not
part of the organization’s
internal control system.
It makes sense to reduce
controls
monitoring.
is used to replace other
existing controls. In this
case, there is likely a
material weakness in
internal control for at least
3-28
c. There is no evidence of
any follow-up to identified
problems.
G. Tighter
performance
goals etc. for
managers
Significant deficiency in
internal controls. There is a
consideration regarding
operating philosophy and
style. We all know that
people are motivated by
how they are compensated.
• To what extent do the
current year results
differ from the previous
years?
• Has management or the
board assessed the level
of pressure resulting
H. The purchasing
department has
been challenged
to move away
from single-
supplier
contracts
the decrease in cost
Of course, this makes a
great deal of sense. There
are some risks that are
related to operational
efficiency, and potentially
to accounting that
management must consider.
However, those risks do not
constitute a material
weakness or significant
• Management should be
alert to the possibility of
greater returns or
warranty expenses
related to a potential
decrease in the quality
of parts.
3-29
I. A freeze on all
hiring, etc.
It is an operational issue that
could turn into an internal
control deficiency. The
control issue may come if it
affects the organization’s:
b. The risk related to reliable financial reporting has increased during the year due to:
▪ Potential violation of debt covenants
▪ Loss of independent directors
▪ Shortage of accounting personnel
3-77
The auditor will usually choose a test that is independent of that of management. However, the
3-78
Professional auditing standards require the auditor, as part of planning an audit, to identify and
assess a client’s risks of material misstatement, whether due to fraud or error. This assessment is
3-30
Fraud Focus: Contemporary and Historical Cases
3-79
a. Internal control helps an organization mitigate the risks of not achieving its objectives.
All organizations need effective internal control over financial reporting so they can produce
reliable financial statements. For example, internal control is needed to provide reasonable
b. Organizations face many risks of not achieving reliable financial reporting. For example,
a salesperson may overstate sales to improve the likelihood of receiving a bonus. Employees in
the receiving area may be too busy to accurately record inventory when it is received.
c. Professional auditing standards require the auditor, as part of planning an audit, to
identify and assess a client’s risks of material misstatement, whether due to fraud or error. This
assessment is based on an understanding of the organization and its environment, including its
internal control over financial reporting. The auditor needs to understand a company’s internal
controls in order to anticipate the types of misstatements that may occur and then develop
d. Internal control over financial reporting is a process, effected by an entity’s board of
directors, management, and other personnel, designed to provide reasonable assurance regarding
the reliability of reporting. The components of internal control include Control Environment,
Risk Assessment, Control Activities, Information and Communication, and Monitoring.
e. Segregation of duties is an important control activity that is designed to protect against
the risk that an individual could both perpetrate and cover up a fraud. Proper segregation of
duties requires that at least two employees be involved such that one does not have (a) the
f. Internal controls that would have helped the organization achieve its financial reporting
objective include policies and procedures requiring two authorizing signatures on a check, a
management review of the check register to compare payees against employees, and a periodic
check by internal auditors of petty cash to verify that appropriate documentation exists to support
all payments.
3-80
a. The need for a restatement suggests that the financial statements contained a material
misstatement and such a misstatement is an indicator of a material weakness in internal control.
Professional guidance specifically states that the restatement of previously issued financial
statement is an indicator of a material weakness.
Application Activities
3-81
This is a project that the authors have used successfully to facilitate student identification of
controls in actual working systems. It also provides a diversity of background and items that can
be called upon by the instructor to illustrate control concepts.
3-32
3-82
a. There are numerous ways in which continuous monitoring might be applied in a
computerized application that processes sales. Options the students might consider include:
• Compare daily recorded sales with sales orders and reconcile differences on a
daily basis.
b. The intent of this exercise is to get students familiar with a type of IT monitoring
software that is being used extensively. The systems that these firms sell have a common ability
to test for areas where controls are not operating, or were overridden. In addition, they are also
quite effective for analyzing incompatible duties in ERP systems such as Oracle or SAP. The
software of some of these firms is designed to:
3-83
a. Following is a copy of the management report that the students were to obtain.
(see p.79 of Form 10-K, via EDGAR at www.sec.gov)
MANAGEMENT’S REPORT ON INTERNAL CONTROL OVER FINANCIAL
REPORTING
Company management is responsible for establishing and maintaining adequate internal control
over financial reporting (as is defined in the Exchange Act Rule 13a-15(f)). Our internal control
over financial reporting is designed to provide reasonable assurance regarding the reliability of
financial reporting and the preparation of our financial statements for external purposes in
© 2015 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.
3-33
accordance with generally accepted accounting principles. Internal control over financial
reporting has inherent limitations and may not prevent or detect all misstatements. Therefore,
even if determined to be effective can provide only reasonable assurance with respect to the
reliability of financial reporting and the preparation of our financial statements. We used the
A material weakness is a deficiency, or a combination of deficiencies, in internal control over
financial reporting, such that there is a reasonable possibility that a material misstatement of the
company’s annual or interim financial statements will not be prevented or detected on a timely
basis. As a result, management has concluded that the Company’s internal control over financial
reporting was not effective as of July 31, 2013. We have reviewed the results of management’s
assessment with the Audit Committee of our Board of Directors. The material weaknesses in our
internal control over financial reporting as of July 31, 2013 were:
•
Complex and Non-routine Transactions — We did not maintain effective controls over
the accounting for complex and non-routine transactions. Specifically, we did not utilize
sufficient technical accounting capabilities related to complex and non-routine
transactions.
The complex and non-routine transactions material weakness resulted in audit adjustments
related to currency translation associated with the allocation of goodwill to reporting units
resulting from a change in segments, impairment of a long-lived intangible asset resulting from
facility closure, classification of restricted cash on the consolidated statement of cash flows and
b. These deficiencies were considered to be material weaknesses by management because
management had concluded that each of these deficiencies was severe enough that there was a
3-34
reasonable possibility that the financial statements could be materially misstated. In fact,
management even points out that misstatements (requiring audit adjustments) in the financial
statements had been identified.
3-84
Many situations requiring restatement involve poor or non-existent internal controls and might
include an overzealous management that is willing to override the existing controls to
accomplish their own goals. The objective of this project is to have the students read actual
Academic Research Cases
3-85
a. Companies were first required to maintain adequate internal controls (IC) beginning in
1977. Internal controls are processes implemented to provide reasonable assurance regarding the
reliability of financial reporting, effectiveness of operations and compliance with regulatory
3-35
b. The results indicated that IT deficiencies ranked as the sixth most commonly occurring
IC deficiency, with 20% of accelerated-files reporting at least one IT control deficiency in the
first three years after the implementation of SOX. The five most commonly reported accounting
errors reported in IT deficient companies were revenue recognition issues, receivable and cash
c. This issue is important to internal as well as external auditors. Internal auditors are often
responsible for testing the IT functions in the company, as well as various other issues that affect
the financial statements.
As a result of the PCAOB’s Auditing Standard (AS) No. 5, external auditors are responsible for
assessing the effectiveness of internal over financial reporting, and (for large public companies)
providing an independent opinion as to the effectiveness of internal control over financial
reporting. The auditors need to be alert to any risk to the effectiveness of the internal control over
financial reporting.
d. Data was gathered by examining 1,394 publicly traded companies that were identified by
Audit Analytics. The requirements were that the company had to report at least one IC deficiency
during the first three years after SOX section 404 was implemented. The companies were
separated into two categories. The first category included 278 companies that reported IT as an
3-36
e. The research for this paper only included companies who are considered accelerated
filers for SOX compliance. If the research had included smaller companies, non- accelerated
3-86
a. Section 302 of the Sarbanes-Oxley Act of 2002 (SOX) requires management to provide
quarterly certification about their controls, and did allow for management to provide
identification of internal control deficiencies as part of the initial certifications that were made in
the implementation phase of Section 404. Section 404 of SOX, which was implemented in
November 2004, requires testing and reporting related to internal controls by both management
and the external auditors.
b. Only a marginal number of accelerated filers reported internal control deficiencies as part
of their SOX section 302 reports, even though they subsequently reported material weaknesses in
their first Section 404 report. The assumption is that deficiencies reported per Section 404
existed during the fiscal year and management was either aware or should have been aware of
their existence.
c. Auditors need to be aware that material weaknesses may exist within a client’s internal
controls over financial reporting, even though management has not provided any indication of
these weaknesses. Identifying risk factors that may indicate a company is more prone or less
prone to report internal control deficiencies to investors earlier can be beneficial to the auditor
when determining an audit strategy to follow.
d. The research was conducted with a sample of 451 accelerated filers that had received an
adverse Section 404 opinion in the initial implement year of Section 404 (fiscal years ending
from November 15, 2004 – November 14, 2005) and whose data was available in the Audit
Analytics database.
e. The research for this paper was not able to completely separate the effects of
management being unaware of internal control deficiencies from management being aware of the
deficiencies but electing not to report them. The research also did not include non-accelerated
filers as they were not required to follow SOX Section 404 at the time the research was
conducted. The research may also have omitted certain independent variables related to
3-38
3-87
a. The purpose of this study is to determine if there is a relationship between current and
future reported material weaknesses in internal control over financial reporting. The authors
focus on IT and non-IT material weaknesses and examine three specific categories of those
b. The authors report a number of interesting findings:
• The presence and number of current reported material weaknesses are positively related
to the future number of material weaknesses and the future number of years in which
material weaknesses are reported
• Firms with an IT entity-level material weakness report 127 percent more future material
weaknesses than firms without that type of material weakness
• Firms with account-level material weaknesses report 129 percent more future material
c. This paper has important implications for those planning and conducting audits. Auditors
are required to evaluate a client’s internal control over financial reporting. When making this
d. The data used to examine the issues of interest comprise 20,318 SOX reports filed
between September 20, 2004, and December 31, 2009. This sample includes 18,535 SOX reports
with no material weaknesses, 397 SOX reports with IT material weaknesses, and 1,386 SOX
3-39
e. The study included data from 2004 to 2009, a period during which reported material
Ford and Toyota
3-88
Note to instructor: The solutions based upon the FYE 2012 annual reports for Ford and Toyota