1 internal control over financial reporting : an is control perspective ca anand prakash jangid
TRANSCRIPT
![Page 1: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/1.jpg)
1
Internal control over Financial reporting : An IS control perspectiveCA ANAND PRAKASH JANGID
![Page 2: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/2.jpg)
2
Agenda
• Check in
• Financial Reporting & Regulation
• Understanding Internal Control
• IS Controls & Internal controls
• Summary
![Page 3: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/3.jpg)
33
What is common among them????
![Page 4: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/4.jpg)
4
Financial Reporting & Regulation
![Page 5: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/5.jpg)
5
Effects
Goodwill? Public Trust? Belief? Jobs Penalties Money
![Page 6: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/6.jpg)
6
Causes
GreedInefficient Internal Controls
Loopholes
Lack of Guidance
![Page 7: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/7.jpg)
7
Key Audit standards and IS controls
SA 300 - Planning an Audit of Financial Statements
SA 315- Identifying and assessing the risk of material misstatement through understanding the entity and its environment
SA 402 - Audit considerations relating to an entity using a service organization
SA
![Page 8: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/8.jpg)
8
SA 300
The effect of information technology on the audit procedures, including the availability of data and the expected use of computer assisted audit techniques.
Evidence of management’s commitment to the design, implementation and maintenance of sound internal control, including evidence of appropriate documentation of such internal control.
![Page 9: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/9.jpg)
9
SA 315 : Para A50
• Controls in IT systems consist of a combination of automated controls (for example, controls embedded in computer programs) and manual controls.
• Further, manual controls may be independent of IT, may use information produced by IT, or may be limited to monitoring the effective functioning of IT and of automated controls, and to handling exceptions.
• When IT is used to initiate, record, process or report transactions, or other financial data for inclusion in financial statements, the systems and programs may include controls related to the corresponding assertions for material accounts or may be critical to the effective functioning of manual controls that depend on IT.
![Page 10: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/10.jpg)
10
SA 315 : Para 52
Information Technology also poses specific risks to an entity’s internal control, including, for example : Reliance on systems or programs that are inaccurately processing data, processing inaccurate
data, or both. Unauthorized access to data that may result in destruction of data or improper changes to data,
including the recording of unauthorized or nonexistent Transactions, or inaccurate recording of transactions. Particular risks may arise where multiple
users access a common database. The possibility of IT personnel gaining access privileges beyond those necessary to perform their
assigned duties thereby breaking down segregation of duties. Unauthorized changes to data in master files. Unauthorized changes to systems or programs. Failure to make necessary changes to systems or programs. Inappropriate manual intervention. Potential loss of data or inability to access data as required.
![Page 11: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/11.jpg)
11
SA 402
Para 3: “ Services provided by a service organization are relevant to the audit of a user entity’s financial statements when those services, and the controls over them, are part of the user entity’s information system, including related business processes, relevant to financial reporting”
Para 5 : Information available on general controls and computer systems controls relevant to the client's applications
![Page 12: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/12.jpg)
12
SA 265 - COMMUNICATING DEFICIENCIES IN INTERNAL CONTROL TO THOSE CHARGED WITH GOVERNANCE AND MANAGEMENT
Duties of Auditor
• To find significant deficiencies in the IC system.• Impact on F/S after performing Risk Assessment
Procedures (SA 315).• Obtaining Written Representations from Management (SA
580) and communication.
![Page 13: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/13.jpg)
13
SA 315 - IDENTIFYING AND ASSESSING THE RISK OF MATERIAL MISSTATEMENT THROUGH UNDERSTANDING THE ENTITY AND ITS ENVIRONMENT
Auditor’s Role
• Obtain Understanding of the Internal Control System.• Perform Risk Assessment Procedures.• Categorization of Risks.
![Page 14: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/14.jpg)
14
SA 330 - THE AUDITOR’S RESPONSES TO ASSESSED RISKS
Auditor’s Role
• Classifying assessed risks as inherent or controllable• Design Responses to assessed risks• Communicate to Management (SA 265)
![Page 15: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/15.jpg)
15
IS Controls and CARO
Para 34 of SA 400
![Page 16: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/16.jpg)
16
Clause 49 – CEO-CFO Certification
The CEO and the CFO certify that they:
• accept the responsibility for establishing and maintaining internal controls; • have evaluated the effectiveness of internal control systems• have disclosed to the Auditors and the Audit Committee:
– deficiencies in internal controls (in design & operation) and– remediation steps (taken or proposed to be taken)
• They have indicated to the Auditors and Audit Committee significant changes in internal control during the year
![Page 17: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/17.jpg)
17
Understanding Internal Controls
![Page 18: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/18.jpg)
18
Internal Controls
Internal control is defined as a process affected by an organization's structure, work and authority flows, people and management information systems, designed to help the organization accomplish specific goals or objectives.
It means policies framed by the management in order to have stronger and adequate control within the organization which can be checked by the internal auditor in order to ensure that the goals and objectives are duly met.
![Page 19: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/19.jpg)
19
Components of Internal Controls
Control Environment
Risk Assessment Control
Activities
Information and Communication Monitoring
![Page 20: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/20.jpg)
20
Equation of Internal Control
General Financial Controls
IS Controls
Internal Controls
![Page 21: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/21.jpg)
21
IS Controls
IS Controls
Application Controls
IT General Controls
![Page 22: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/22.jpg)
22
Objective of IS Controls
Maintaining Confidentiality
Preserving Integrity
Ensuring Availability
![Page 23: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/23.jpg)
23
Applications Controls
• Application software is the software that processes business transactions.
• The application software could be a payroll system, a retail banking system, an inventory system, a billing system or, possibly, an integrated ERP.
• It is the application software that understands data with reference to their business context. The rules pertaining to the business processes are implemented in the application software.
![Page 24: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/24.jpg)
24
Examples of Applications
• General Ledger
• Fixed Assets
• Inventory Control
• Enterprise Resource Planning
• Human Resources
• And, everyone’s favorite – Payroll…
![Page 25: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/25.jpg)
25
Types of Application ControlsIn
put
Con
trol
s
Processing
Controls
Output Controls Integrity
Controls
Managem
e
nt Trail
![Page 26: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/26.jpg)
26
Examples for Application controls
Input Controls
• Data checks and validations
• Automated authorization, approval, and override
• Automated SOD
Processing Controls
• Automated file identification and validation
• Automated functionality and calculations
• Audit trails and overrides• Data extraction, filtering,
and reporting• Interface balancing• Automated functionality
and aging• Duplicate checks
Output Controls
• General ledger and sub-ledger posting
• Update authorization
![Page 27: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/27.jpg)
27
Examples for Application Controls
Integrity Controls
• Data encryption, which locks data by cipher• Data backup, which stores a copy of data in
an alternate location• Access controls, including assignment of
read/write privileges• Input validation, to prevent incorrect data
entry• Data validation, to certify uncorrupted
transmission
Management Trail
• Systems Control Audit Review File and Embedded Audit Modules (SCARF/EAM)
• Snapshots• Audit hooks• Integrated Test Facility• Continuous and Intermittent Simulation
![Page 28: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/28.jpg)
28
General Controls
IT general controls (ITGC) are controls that apply to all systems components, processes, and data for a given organization or information technology (IT) environment. The objectives of ITGCs are to ensure the proper development and implementation of applications, as well as the integrity of programs, data files, and computer operations.
ITGCs may also be referred to as General Computer Controls which are defined as: Controls, other than application controls, which relate to the environment within which computer-based application systems are developed, maintained and operated, and which are therefore applicable to all applications.
These are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems.
![Page 29: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/29.jpg)
29
Types of IT General ControlsLo
gica
l acc
ess
cont
rols
over
infra
stru
ctur
e,
appl
icat
ions
, and
data
.
System
development li
fe
cycle
contro
ls.
Program change
management
controls.
Data center physical security
controls.System and data
backup and recovery controls.
End User controls.
IS S
ecurity
![Page 30: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/30.jpg)
30
Key areas which needs attention
Logical Access
• Grant of access• Revocation of Access
SDLC
• Documentation of Requirements
• Integration testing and UAT• Training to end users
Change Management
• Source Code versioning• Rollback Plan• Release Management• Archival of older versions
![Page 31: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/31.jpg)
31
Key areas which needs attention
Data Center and Physical Access
• Physical Locks and Bio metric locks
• Data Center Environment• Security Personnel
Backup and Recovery
• Backup Procedures• Recovery Procedures• Application data and
environment• Backup Tapes
End User
• Acceptable Usage• Password Policy• Ticket Management• Logs and Review
![Page 32: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/32.jpg)
32
Antivirus
Firewall
Wireless Network
Computers
• Server• Computers• Network
• Servers• Computers
• Encryption• MAC Filter
• Patch Updates• Virus Definition Updates• Automatic Log out and screen lock
Key areas which needs attention – IS Security
![Page 33: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/33.jpg)
33
Summary
With the advent of IT in every sphere of business it have been evident that we Chartered Accountants need to rise and seize this opportunity.
![Page 34: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/34.jpg)
34
Check out
When are these opportunities??Half our life is spent trying to find something to do with the time we have rushed through life trying to
save.
Will Rogers
![Page 35: 1 Internal control over Financial reporting : An IS control perspective CA ANAND PRAKASH JANGID](https://reader033.vdocument.in/reader033/viewer/2022051819/55163776550346b2068b4f4a/html5/thumbnails/35.jpg)
35
Questions???