In the world of accounting and auditing, the term “internal control” has been a buzz word for so long that it appears professionals have lost sight of what internal control actually means. It is imperative that auditors take a back-to-basics look at internal controls in order to make audit processes more effective and efficient. Utilizing predefined walkthrough documentation checklists and practice aids as a guideline only and relying on the client’s narrative to create an individualized walkthrough document not only provides efficiencies on the audit but can add value to the audit service to clients.
BACK TO BASICS
The Committee on Sponsoring Organizations defines internal control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations; reliability of financial reporting; compliance with applicable laws and regulations; and safeguarding of assets.” Auditors can become so involved with workpaper documentation that it’s easy to lose sight of this definition, and the relationship with the client can suffer. Having conversations with clients early in the audit process adds value and prepares clients for subsequent management letters and other recommendations.
STARTING THE CONVERSATION
Many auditors provide premade questionnaires to clients that they are expected to complete with little to no guidance. This provides no added value and seems like a school homework assignment to upper management. Instead, start by reviewing the trial balance with the client and asking how certain balances found their way into the accounting system. This will reduce the time needed to review the client-prepared walkthrough and will foster a relationship with the entity’s key personnel. Documenting internal controls processes as a part of a client’s narrative over work performed on a daily basis will help the auditor achieve an understanding of the client’s internal controls processes.
ASSURING THE EFFECTIVENESS OF INTERNAL CONTROLS
Once we understand the client’s internal controls and make recommendations if necessary, it is up to the auditor to assure that the process is operating effectively, the business is achieving its objectives, the financials are reliable, and the entity is in compliance with applicable laws and regulations. Although subjective by their nature, many auditors overlook documenting effectiveness of internal controls through financial statement assertions. But this can be an integral way of documenting professional judgment as an auditor. Understanding financial statement assertions within each step of a controls process and documenting them accordingly is all it takes to have appropriate documentation of the effectiveness of internal controls at an entity. Essentially, if you’re able to hit all relevant financial statement assertions while documenting the walkthrough with the client, then the controls process is operating effectively, and you can move onto substantive testing. If you cannot conclude that all relevant financial statement assertions have been met by the process, then issue further controls recommendations, significant deficiencies or material weakness.
The ultimate goal of any audit is to not only provide feedback to the client, but to assure financial statement readers that the information presented is reasonable and reliable. Get back to the fundamentals of auditing by utilizing client narratives and financial statement assertions as part of understanding and evaluating the effectiveness of internal controls. This can mitigate risk and allow the auditor to truly understand the client, their financial needs and provide added value through building strong relationships and providing recommendations applicable to the actual processes carried on at the entity.