Standar Pekerjaan Lapangan: Pemahaman Memadai atas Pengendalian Intern

1
Standar Pekerjaan LapanganPemahaman
Memadaiatas Pengendalian Intern

• Pertemuan 5

2
Learning Objectives

1. Managements need for internal control vs. the
   Auditors need to consider internal control in
   designing an audit
2. How IT affects internal control
3. Explain the five components of internal control
4. Explain methods used to obtain an understanding
   of internal control
5. Assess control risk
6. Describe the process of designing and performing
   tests of controls

3
Client and Auditor Concern about Internal Control

• System Internal Control
• consists of policies and procedures designed to
  provide management with reasonable assurance that
  the company achieves its objectives and goals
• 3 key concepts underlie the study of IC and
  assessment control risk
• Management Responsibility
• Reasonable Assurance
• Inherent Limitations

4
Client Concerns about Internal Control

• (COSO Report)
• 3 (three) concerns of management in designing an
  effective control system
• Reliability of Financial Reporting
• Efficiency and Effectiveness of Operation
• Compliance with Applicable Laws and Regulation

5
Auditor Concerns about Internal Control

1. Controls related to the Reliability of Financial
   Reporting
2. Control over Classes of Transactions

6
Effect of IT on Internal Control

• Advantages
• Able to process large volume of transactions
• Processes transactions with highly accuracy
• No human judgment.
• Disadvantages
• Program error - GIGO
• Unauthorized persons accessing the system (data
  and program)
• System (data or program) corruption because of
  virus.

7
Components of Internal Control

• 5 Categories of Controls (PSA69 SA Seksi 319
  COSO)
• The control environment
• Risk assessment
• Control activities
• Information and Communication
• Monitoring

8
Control Environment

• Integrity and ethical Value
• Commitment to Competence
• Board of Directors or Audit Committee
• Managements Philosophy and Operating Style
• Organization Structure
• Assignment of Authority and Responsibility
• Human Resource a Policies and Practices

9
Risk Assessment

• All entities regardless of size, structure,
  nature, or industry, face a variety of risks from
  external and internal sources that must be
  managed, as they are constantly change
• The important first step is to identify factors
  that may increase risks.
• Mgt assesses risks as a part of designing and
  operating internal control to minimize errors and
  fraud

10
Risk Assessment

• Risk occur because of
• Changes in Operating Environment
• New Personnel
• New or Repaired Information System
• New Technology
• New Product Lines, Products, or Activities
• Corporate Restructuring
• Foreign Operation
• New Accounting standard

11
Control Activities(1)

• Control Activities (SAS 94 and COSO Report)
  generally relate to policies and procedures
• Segregation of Duties
• Information Processing
• Physical Control
• Performance Review

12
Control Activities(2)

• 5 Specific Control Activities related to policies
  and procedures
• Adequate separation of Duties
• Proper authorization of transactions and
  activities
• Adequate documents and records
• Physical Control over assets and records
• Independent check on performance

13
Information and Communication

• Information system relevant with the objective of
  Financial Reporting consisted of the methods and
  records established to record, process,
  summarize, and report the transactions of the
  entity, and also to maintain the accountability
  of assets, liabilities and equities of the entity
• Communication consists of providing understanding
  about individuals roles and responsibilities
  related to internal control on financial reporting

14
Information and Communication(2)

• Auditor should get reasonable understanding
  about
• Group of transactions significant in the
  financial statements
• How does a transaction begin ?
• Accounting record, supporting information, and
  certain accounts in the financial statements
• Accounting process from transaction till
  financial reports.

15
Monitoring

• Management is responsible to establish and
  maintain internal control.
• For that management should monitor to consider
  whether the IC works properly and what needed to
  be justified (up-dated) as the environment
  changes

16
Adequate Documentsand Records

• Relevant principles dictate the proper design and
  use of documents and Records
• Pre-numbered
• Prepare at the time a transaction takes place
• Sufficiently simple
• Designed for multiple use
• Constructed in a manner that encourage correct
  preparation

17
Procedures to Obtain an Understanding of
Internal Control

• Reasons
• Auditability
• Potential Material misstatement
• Detection Risk
• Design of tests
• Procedures to Determine Design and Placement in
  Operation (see p.284)
• Documentation of the Understanding (see p. 285)

18
Assess Control Risk

• Four specific assessments must be made
• Assess whether the Financial Statements are
  auditable
• Determine assessed control risks supported by
  understanding obtained
• Assess whether it likely that a lower assessed
  control risk could be supported
• Determine the appropriate assessed control risk

19
Assess Control Risk(2)

• Identify Transaction-Related Audit Objectives
• Identify Specific Controls
• Identify and evaluate Weaknesses (see Figure 10
  4 on p. 290)
• The Control Risk Matrix (see Figure 10 5 on p.
  291)
• Assess Control Risk
• Communicate Reportable Conditions and Related
  Matters

20
Test of Control

• Procedures for Test of Controls
• Make inquires of appropriate client personnel
• Examine documents, records, and reports
• Observe Control-Related activities
• Reperform Client Procedures