Ch07 PrinciplesOfAuditing Ed3

INTERNAL CONTROL AND CONTROL RISK 7.1 Learning Objectives After studying this chapter, you should be able to Understand the basic definition of internal control. Discuss why internal controls are important to the auditor. Characterize the differences between general and application IT controls and how to reduce IT risk. Distinguish between the different components of internal control. Describe the elements of the control environment. Evaluate how managements objectives are related to risk assessment. Explain the effects of information and communication on the internal control system. Distinguish between the major types of control activities. Give examples of major types of control procedures (activities). Identify monitoring controls. Distinguish between hard and soft controls and understand their control objectives. Know what is meant by design of controls. Follow what an auditor does in preliminary planning assessments of internal control risk. 7.2 Introduction Internal control is not only essential to maintaining the accounting and financial records of an organization, it is essential to managing the entity. Everyone from the external auditors to management to the board of directors to the stockholders of large public companies to government, have an interest in internal controls. In many parts of the world, regulators have emphasized the importance of internal control by requiring management to make annual public statements about the effectiveness of internal controls. Reinforcing internal controls is generally seen as one of the most important steps in avoiding negative surprises. Even a company that is considered in control will face risks. Effective internal controls will ensure that risks are identified at an early stage. Company risk management procedures will identify ways to deal with these risks, to the extent possible. As we discussed in Chapter 6 Main Audit Concepts and Planning the Audit (ISA 300, 315, 320), the consideration of internal control is