Information Technology, Internal Control, and Financial Statement Audits

2. Prepare a list of the controls described in the case. What control problems are they designed to address? Are the managers interviewed for the case justified in being proud of their company’s control system? Why or why not?

* From the e-Activity, choose one (1) of the eight (8) steps in the Clarified Auditing Standards–Learning and Implementation Plan. Based on the step you have chosen, analyze support for the action plan proposed, and make at least two (2) recommendations that would improve support of the action plan.

documentation, materiality and risk, internal control, statistical tools, and the overall audit plan and program.

The design and implementation and objectives of company controls are not adequate to meet the control objectives. The control environment control objective is ineffective. This control objective lacks a written policy on ethical conduct, is lacking oversight from the board of directors and audit committee, lacks a consistent style and philosophy from management, and lacks a strong commitment to competence. The risk assessment control objective is effective but lacks any antifraud program and controls. The information and communication control is ineffective. A virus has been detected and is affecting the files of the company. This control is lacking a strong IT department. The general controls financial reporting control objective is effective but is weak in detecting or preventing material misstatement. The monitoring control objective is ineffective; this control has need of an internal auditor.

The second aspect of management used to investigate the issue is Controlling. Control is a concern that is facing every manager in every organisation today. Many businesses continually look to improve relationships between all levels of staff in order for a healthy working environment. To effectively control a business the organisation requires information about

The chances of failures can be decreased by executing the checks on the systems. These keep an eye on the systems preventing risks from occurring, and these checks are avoided as the interior controls. The motivation behind the inner controls is to keep the organization safe from risks associated with the modernized accounting-system risks. Organizations change their manual accounting systems to computerized accounting systems for different reasons, this incorporates the points of interest, and the explanation behind utilizing electronic accounting information is instinct. The organizations embrace the policies of their

To illustrate the linkage of management assertions to audit evidence in the context of auditing Notes Payable.

● Monitoring — Internal control systems need to be monitored–a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

Internal controls, no matter how well designed and operated, provide only reasonable assurance to management regarding the achievement of a department’s objectives. Certain limitations are inherent in all internal control systems. Despite these limitations, the reasonable assurance that internal control does provide enables a department to focus on reaching its objectives while minimizing undesirable events. Managers can start by analyzing the two circumstances most likely to threaten the achievement of objectives, change and inherent risk. The examples listed below are not all-inclusive, nor will every item apply to every department. The risk to accomplishing objectives increases dramatically during a time of change. Because any change increases risk, managers must diligently monitor and assess all significant changes within their departments. Some examples of change that expose a department to increased risk are: Changes in personnel. Changes in the regulatory environment. New or revamped information systems and technology. Rapid growth or expansion of operations Moving to a new location. New programs or services. Reorganizations within or between

Another aspect relevant to the information technology is the system-generated data and reports. If auditors choose a control that uses some information generated from the company’s internal IT system, the effectiveness of the control requires obtaining audit evidence of the accuracy and completeness of the internal information. In the ZOU’s case, when testing of the controls over risk #2, auditors use reports, which are automatically generated by the Warehouse K system. Auditors decide to further test the controls over accuracy and completeness. When testing the controls over risk #3, both monthly reporting package and budget information are somewhat generated internally by ZOU’s internal system. Depending on different systems, auditors decide to further test controls for accuracy and completeness with respect to the monthly reporting package, which is generated from PeopleSoft.

1. The requirements related to developing an expectation and conducting analytical procedures when those procedures are intended to provide substantive evidence is provided by the reorganized Audit Standard 2305 Substantive Analytical Procedures effective December 31, 2016 in the following list:

Internal controls prevent errors and irregularities from happening. If errors or irregularities do happen to occur internal controls will help ensure that they are detected in a timely manner. Internal controls also encourage adherence to prescribe policies and procedures. Internal control are also put into place in order to protect employees by outlining tasks and responsibilities, providing checks and balances, and also from being accused of misappropriations, errors and irregularities.

In order to satisfy legal obligations we collect such information as contract arrangements, employees’ duties, payments, working hours, holiday entitlements, bonuses, as well as documents relating to health and safety. It is important for the organization to timely provide accurate and valid data in order to avoid fees or other sanctions for the Inspections that can check any data regarding individual employees.

ABSTRACT: Information Technology General Controls (ITGCs), a fundamental category of internal controls, provide an overall foundation for reliance on any information produced by a system. Since the relation between ITGCs and the information produced by an organization’s various application programs is indirect, understanding how ITGCs interact and affect an auditor’s risk assessment is often challenging for students. This case helps students assess overall ITGC risk within an organization’s information systems. Students identify

The framework describes internal control as a process designed to provide reasonable assurance regarding the achievement of objectives in the following categories: