Assessing the Company and Internal Controls

By Kenneth W. Boyd

Internal controls are put in place to help a company achieve several goals. These controls allow a business to operate efficiently and to create accurate financial reports. Controls also ensure that a company will comply with applicable laws and regulations.

An auditor makes a judgment on internal controls. The judgment on internal controls helps the auditor decide the nature, timing, and extent of substantive testing. Substantive testing is defined as audit procedures performed to test the financials for material misstatement. The material misstatement may be in account balance or in an accounting transaction.

For example, suppose the auditor reviews internal controls over inventory. The client performs a well-planned inventory count at the end of each month. The company also keeps accurate documentation of the count.

The auditor may decide to perform less work on inventory or to change the type of procedures performed on inventory. In this case, the extent of the audit procedures would decline, and the nature of the procedures performed would change.

In most cases, the auditor insists on performing an inventory count on the balance sheet date. Because the client performs well-documented inventory counts each month, the auditor is willing to reply on a physical inventory count 5 days after the balance sheet date. The timing of the procedures is changed.

Every company has an internal control environment. The auditor needs to assess this environment so he can judge the reliability of the internal controls. Here are the components of a control environment:

  • Control activities: The company performs these procedures to implement internal controls. Control activities include checking information for accuracy and completeness. These activities also include proper segregation of duties.

  • Risk assessment by management: This addresses how management judges the effectiveness of internal controls. For example, the auditor considers how often management reviews internal controls and whether management is willing to make changes.

  • Documentation and communication: This component considers how controls are documented. For example, all companies should have a written manual of accounting procedures, including control procedures.

  • Supervision: The CPA considers how management trains employees on the controls. Implementing controls effectively should be a part of each employee’s performance evaluation.

  • Control environment: The CPA also judges how management communicates the importance of controls to the company. This component has to do with management’s attitude about the importance of controls.