Auditing and Internal Control

Scoping and Evaluation Judgments in the Audit of Internal Control over Financial Reporting 12.1 EyeMax Corporation . . Evaluation of Audit Differences

Furthermore, when the internal control is fixed, the outside auditor can rely on the clients system and less audit testing can be conducted. When everything is improved, the management letter is given to the organization’s top management and not disclosed to the public, (Finkler, S. A., Ward, D. M., & Calabrese, T. D., 2013). Next, is the auditor’s report that entails the opinion letter usually written in three paragraphs and given to the board of trustees. Then, the opinion paragraph is added on to state the organizations financial statements are in accordance of the financial position and followed through with (GAAP). The clean opinion addresses the opinion of the auditor and the overall exercising of professionalism. Also, the complete opinion of the financial statements is to give a representation of the organization. All other opinions may be included and can be addressed by adverse opinions if (GAAP) was not in accordance. A qualified opinion can be added if a specific area wasn’t included in the financial statement when needed. Finally, the management reports are conducted by the management team and not the auditors. The management report is the annual report the topics included in the report are the internal control system and the responsibility of the audit committee.

According to the Sarbanes-Oxley Section 404 Act, it is the responsibility of the management to establish and maintain internal controls required for financial reporting. The company’s latest year assessment of

COBIT stands for Control Objectives for Information and Related Technologies (Damianides, 2004). It is a set best control framework which was developed by Information Systems Audit and Control Association (ISACA) and IT Government Institute in 1996. COBIT has been employed by companies which need to be compliant with SOX as well as being used by the Auditors who do assess the control features. COBIT’s approximately 300 control objectives are usually grouped into Executive summary, Framework, Control Objectives, Control Practice, Management Guidelines, and Audit Guidelines which constitutes the six BOBIT components. COBIT’s

3. (TCO 5) Internal Control Procedures are required to safeguard company assets and to ensure ethical operation

● Monitoring — Internal control systems need to be monitored–a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

For the public traded companies in the United States, the Sarbanes-Oxley Act has approximately eleven different sections that these public traded companies must abide by. In addition, The Securities and Exchange Commission or the SEC also has a significant impact in the implementation of rules and requirements to abide by the law. As a result, top level management officers such as the Chief Executive Officer (CEO), Chief Operations Officer (COO), Chief Financial Officer (CFO), and the Board of Directors must now follow stricter laws enacted such as internal control, corporate governance, auditing rules, and other financial practices.

This was designed to show accuracy of financial data and confidence because of adequate controls that safeguarded the financial data. End of year financial reports were also required to contain an assessment of the effectiveness of the internal controls. The issuer's auditing firm is required to attest to that assessment, after reviewing controls, policies, and procedures during a Section 404 audit, conducted along with a traditional financial audit (Thomas & Klutz, n.d.).

The committee of sponsoring organizations and the Control objectives for information and related technology are important because they supply advice to businesses as to what internal controls should involve. COSO tells a business how to prevent risk or fraud with the internal control it uses, and COBIT with the IT controls, and how to avoid the misuse of funds, or to prevent any

Control Weakness: CEO conceals information from the Audit Committee. The Director of Internal Audit also does not feel that the Audit Committee is friendly. Internal Audit has been steered away from the manufacturing process and the reconciliation process by the CEO. Although there is a code of conduct, a monthly newsletter and an open door policy according to the CEO, these efforts do not appear to be successful because of management override. Employees interviewed lack of awareness of these programs. All of these issues are signals of a deficiency of the Control Environment aspect of the COSO framework.

The final responsibility for the integrity of an SEC registrant’s internal controls lies on the management team. U.S. companies need to refer to a comprehensive framework of internal control when assessing the quality of financial reporting to determine that financial statements are being presented under General Accepted Accounting Principles, GAAP. The widely used framework is referred as COSO, Committee of Sponsoring Organizations of the Treadway Commission, sponsored by the following organizations American Accounting Association, the American Institute of CPA’s, Financial Executives International, the Institute of Internal Auditors, and the Institute of Management Accountants. COSO’s defines internal control as:

Under the Sarbanes-Oxley Act of 2002, reports on internal control are required. Did the company’s management acknowledge its responsibility for establishing and

Does the Board or audit committee understands and exercises oversight responsibility over financial reporting and internal control?

COSO cites the control environment of the organization as the foundation of any internal control structure. The control environment reflects the overall attitude or actions of the board of directors, management, and others concerning the importance of internal controls in the organization. This overall attitude of upper management sends a message to the rest of the organization referred to as the “tone at the top.”For example, if upper management stresses high-quality products, a strong positive message is sent to the organization. This would create a strong internal control environment. On the other hand, if upper management has a reputation of looking the other way regarding policy violations, a negative message is

Section 404 requires public companies to establish internal controls and report annually on their effectiveness over financial reporting. The CFO and CEO are held personally responsible for the internal controls via the requirement to sign a statement certifying the adequacy of the internal control system (Moffett and Grant, 2011, p. 3). Additionally, the company’s independent auditor must issue an attestation regarding management’s assessment of the internal structure as part of the company’s annual report (Bloch, 2003, p. 68).