Auditing Internal Control
The assessment of the effectiveness of internal control over financial reporting is integrated into the audit of the financial statements. The purpose of assessing internal control is to provide assurance of the reliability of the financial statements by third parties. The auditor must have knowledge of a company’s internal control system, which includes documenting separation of duties in the authorization and recording of transactions as well as the separation of duties involving those having custody of assets from those making the entries onto the books. Internal control involves the use of processes that must be monitored in order to assess the quality of the control environment as well as an assessment of a firm’s overall business practices.
The Sarbanes-Oxley Act of 2002 [SOX] greatly strengthened the the regulation of audits of public companies and addressed issues such as corporate governance, auditor independence and internal controls. As a result of SOX, the Public Company Accounting Oversight Board [PCAOB] was created, which regulates auditors of public companies. The PCAOB issued Auditing Standard No. 5 in 2007, which sets forth standards of the audit of internal controls.
In assessing internal control, an auditor of a small company may take into consideration the scale of the risk of misstatement and the internal controls in addressing risk. Commonly-used risk assessment models include materiality judgments based upon a percentage of revenues and/or assets, however, not all internal control reviews rely upon quantitative methods. Other risk areas such as the type of information technology system that is in place may enter into the decision as to whether the internal control environment provides for reliability. This is often referred to as the top-down approach, in which Section 404 of SOX allows an auditor to judge the effectiveness of a company’s internal control system in a manner that is more cost-effective and relies more on management for establishing and maintaining an adequate internal control structure.
The auditor may rely on prior-year’s assessment of internal control, however, this is not a substitute for proper planning. The auditor must be familiar with the industry in which the company operates, its organization, legal or regulatory matters as well as the complexity of the company’s operations. The work of internal auditors or third parties under management’s control may be used in order to evaluate the work the auditor might otherwise perform.
By selecting samples of transactions, the flow of transactions can be documented and the potential for misstatements can be assessed. However, this does not rule out making direct inquiries of company personnel in order to detect possible weaknesses. Other factors affecting the reliability of the system of internal control include the frequency of errors, the competency of personnel, occurrences of fraud whether material or not on the part of management, and whether there is internal oversight.
There are a great number of things that can go wrong in a company, all of which cannot be documented. However, Sarbanes Oxley focuses on the integration of the audit of internal controls with the audit of the financial statements, the purpose of which is the process of monitoring the internal control environment, assessing the IT system, determining risk assessments and other internal control activities that are key elements of auditing internal control. Prior to SOX, the Committee of Sponsoring Organizations, or COSO, was formed in 1985 by an independent private-sector study group that analyzed the factors that lead to fraudulent financial reporting. COSO defines internal control as a means to an end, not an end in itself. It recognizes internal control as affecting an entire organization encompassing the board of directors as well as management and other personnel. The purpose of internal control was set forth as a process whereby the financial reporting of a company can be relied upon and is in compliance with applicable laws and regulations.
The scope of the assessment of internal controls is almost certain to continue to give rise to conflicts over their effectiveness versus the costs of implementing them, and it is required that an auditor is familiar with the rules governing the assessment of internal control as well as those governing the audit of the financial statements. However, the auditor must take into account the policies and procedures of the company and assess the effectiveness of them. As for privately owned companies, AICPA section AU 319 sets professional standards for auditors to obtain an understanding of internal controls and utilizes principles contained in COSO.
We encourage our readers to refer to the handy sidebar located on the right side of the page in order to refer to the rules and regulations governing the auditing of internal control under SOX, PCAOB, and the AICPA.

