Evaluation of Internal Controls
COSO defines internal control as, “a process, influenced by an entity’s board of directors, management, and other personnel, that is designed to provide reasonable assurance in the effectiveness and efficiency of operations, reliability of financial reporting, and the compliance of applicable laws and regulations”. The auditor evaluates the organization’s control structure by understanding the organization’s five interrelated control components. They include:
- Control Environment Provides the foundation for the other components. Encompasses such factors as management’s philosophy and operating style.
- Risk Assessment Consists of risk identification and analysis.
- Control Activities Consists of the policies and procedures that ensure employees carry out management’s directions. Types of control activities an organization must implement are preventative controls (controls intended to stop an error from occurring), detective controls (controls intended to detect if an error has occurred), and mitigating controls (control activities that can mitigate the risks associated with a key control not operating effectively).
- Information and Communication Ensures the organization obtains pertinent information, and then communicates it throughout the organization.
- Monitoring Reviewing the output generated by control activities and conducting special evaluations.
In addition to understanding the organization’s control components, the auditor must also evaluate the organization’s General and Application controls. there are three audit risk componenets which are control risk, detection risk and inherent risk.
Read more about this topic: Information Technology Audit Process
Famous quotes containing the words evaluation of, evaluation, internal and/or controls:
“Good critical writing is measured by the perception and evaluation of the subject; bad critical writing by the necessity of maintaining the professional standing of the critic.”
—Raymond Chandler (1888–1959)
“Good critical writing is measured by the perception and evaluation of the subject; bad critical writing by the necessity of maintaining the professional standing of the critic.”
—Raymond Chandler (1888–1959)
“The analogy between the mind and a computer fails for many reasons. The brain is constructed by principles that assure diversity and degeneracy. Unlike a computer, it has no replicative memory. It is historical and value driven. It forms categories by internal criteria and by constraints acting at many scales, not by means of a syntactically constructed program. The world with which the brain interacts is not unequivocally made up of classical categories.”
—Gerald M. Edelman (b. 1928)
“The confusion of emotions with behavior causes no end of unnecessary trouble to both adults and children. Behavior can be commanded; emotions can’t. An adult can put controls on a child’s behavior—at least part of the time—but how do you put controls on what a child feels? An adult can impose controls on his own behavior—if he’s grown up—but how does he order what he feels?”
—Leontine Young (20th century)