Unit 8 Internal Control Objectives

Threat is any potential adverse occurrence or unwanted events that could injure the AIS or the organization.
Exposure is the potential dollar loss that would occur if the threat becomes reality.
Likelihood is the probability that the threat will occur.
Internal control is the policies, procedures, practices and organizational structure designed to provide reasonable assurance that business objective will be achieved or detected and corrected.

Internal control objectives
1. Safeguard asset
2. Maintain records in sufficient detail to report company assets accurately and fairly.
3. Provide accurate and reliable information.
4. Prepare financial report in accordance with established criteria
5. Promote and improve operational efficiency.
This may require the company to sell a division, exit a product line, or not expand as anticipated
Event / Risk / Response Model
Estimate Likelihood and Impact
Identify Controls
Estimate Costs and Benefits
Determine Cost/Benefit Effectiveness
Implement Control or Accept, Share, or Avoid the Risk
Calculating Risk Levels
Expected Loss = Exposure (or impact) Ⅹ Likelihood of risk occurring
Expected Loss: The value of a control procedure is the difference between expected loss with control procedure and expected loss without it.

Control Activities
Control Activities are policies and procedures that provide reasonable assurance that control objectives are met and risk responses are carried out.

Information & Communication
Primary purpose of an AIS: Gather, Record, Process, Summarize, and Communicate

Monitoring
(1) Evaluate internal control framework
(2) Effective supervision
(3) Responsibility accounting
2) Materiality: How significant is the impact of the evidence
3) Reasonable Assurance
Some risk remains that the audit conclusion is incorrect.
Reasonable assurance is a cost-benefit notion
Note that when inherent or control risk is high, the auditor must obtain greater assurance to offset the greater uncertainty and risks
It is prohibitively expensive to seek complete assurance that no material error exists, so the auditor must be willing to accept some risk that the audit conclusion is incorrect. Therefore, he seeks reasonable assurance, as opposed to absolute assurance.
(4) Communication of Audit Conclusion
: The auditor submits a written report summarizing audit findings and recommendations to management, the audit committee, the board of directors, and other appropriate