21st Century Accounting

8/2/2019 21st Century Accounting

1/358

21st Century Accounting

Manjit Biant


2/358

10 Basic Accounting Principles

Manjit Biant


3/358

10 Accounting Principles

The field of accounting is governed by

certain general concepts. These general

concepts, referred to as basic accountingprinciples and guidelines, are the basis for a

detailed and comprehensive set of

accounting rules and standards.


4/358

1 Economic Entity Assumption

For accounting purposes, a sole

proprietorship and its owner are considered

to be two separate entities.


5/358

2. Monetary Unit Assumption

For accounting purposes, economic activity

is measured in s.


6/358

3 Time Period Assumption

There is an assumption that it is possible to

report the activities of a business in distinct

time intervals.


7/358

4 Cost Principle

Cost refers to the price of a purchase when

it was originally bought and, therefore,

amounts on financial statements refer tohistorical cost.


8/358

5. Full Disclosure Principle

If information is vital to a lender or

investor, that information should be

disclosed within the financial statement orits notes.


9/358

6. Going Concern Principle

It is assumed that a company will continue

to exist long enough to meet its objectives

and obligations and that it will not shutdown in the foreseeable future.


10/358

7. Matching Principle

This obliges companies to use the accrual

basis of accounting, which requires that

expenses be matched with revenues.


11/358

8. Revenue Recognition Principle

Under the accrual basis of accounting,

revenues are recognized when a product has

been sold or a service performed, regardlessof when the money is actually received.


12/358

9. Materiality

This basic accounting principle or guideline

permits an accountant to violate another

accounting principle if an amount isinsignificant or immaterial


13/358

10. Conservatism

Where there are two acceptable alternatives

for reporting an item, conservatism directs

the accountant to choose the alternative thatwill result in less net income and/or a lower

asset amount.


14/358

Advantages

These general concepts direct the field ofaccounting and form the foundation on which moredetailed, complicated and legalistic accounting rules

are based. The Financial Accounting Standards Board (FASB)

uses the basic accounting principles and guidelinesas the starting place for its own set of accountingrules and standards, which are more detailed and

comprehensive. If we understand the ten principles and guidelines, it

is easier to comprehend GAAP.


15/358

Disadvantages

Although the basic accounting principles

and guidelines form the basis for GAAP,

the latter have become more complex overthe years because financial transactions

have become more complex and variations

in reporting exist from industry to industryand from country to country.


16/358

Converging World

Manjit Biant


17/358

Converge 1. a. To tend toward or approach an

intersecting point: lines that converge.

b. To come together from different

directions; meet: The avenues converge at a

central square.

2. To tend toward or achieve union or a

common conclusion or result: In time, ourviews and our efforts converged.

3.Mathematics To approach a limit.


18/358

To compete and be effective - Finance and

IT need to work together.


19/358

Managing 21st Century

FinancesManjit Biant


20/358

Main Points CFOs have to balance long-term planning with

short-termist behavior in the markets.

In order to do this, its essential to have a good

business model, a clear understanding ofbusiness risk, sustainable revenues, and propercommunication.

Failing to manage the financial informationsystems well can seriously damage your brand.Getting it right will please both short- andlong-term investors.


21/358

Main Points Matters have been complicated by the

globalization of standards and reinterpretationof company accounts.

Tangible value creation remains top of theagenda. When investors are frightened or losefaith, they can destroy value much faster thanyou can create it.

Relationship management is one of the mostimportant new skills to acquire on the road tosuccess.


22/358

Introduction

Corporate purpose, for most companies, is

to create and sustain long-term stockholder

value. However, markets can be driven byfear or euphoria. Stuck in the middle are top

managers, especially the CFOs. They have

to balance long-term planning with short-termist behavior in the markets. How can

this be achieved? What are the new metrics

for survival and sustainable prosperity?


23/358

As some companies have destroyed value, somehave begun to question whether stockholder valueshould be a goal, or rather a consequence of

excellence. In both quoted and private companies you need a

clear, understandable business model that works;to be able to explain it easily and consistently; to

understand strategic business risk and make itwork for you; to generate sustainable revenues,income, and cash with rapid and reliablereporting; and no surprises!


24/358

Managing Investors Expectations

Managing stockholder value is also aboutmanaging expectations.

The major long-term players (institutions,

pension, investment, and insurance funds) areadvised by analysts.

Short-term investors, traders, and the public aremore influenced by news flow and market

movements. How can we reconcile these forces? By timelyfinancial information, no surprises, alwayshaving cash, and finally, having a credible,understandable business model.


25/358

Financial Reporting in the

Communications Age Great companies produce rapid, reliable, succinct,simple, usable financial information.

Internally, more than three days to report is toolong.

The Internet or intranets can provide always-on,real-time connection for the whole company.

Management and financial reporting tools andtechnology allow fast collection, collation,interpretation, and distribution of results.

Now, three factors are converging internal withexternal reporting: urgency, transparency, andconsistency.


26/358

Global markets and the pace of change mean that

management needs reliable financial feedback, fast. Meanwhile, external reporting periods are shortening.

This is spilling into Europe. Information is a globalproperty, especially when it leaks.

Global brand management demands control of yourown destiny.

The market wants information as fast as you get it.

Too much conversion for external consumption takestime, unsettling management and investor alike.

Meanwhile, market regulation requires transparencyand equality of distribution.


27/358

Investors want financial information that isconsistent with expectations.

The more frequently it is released, the smallerthe mismatch.

Regular, progressive business and financialnews flow, along with rational enhancementsto the business model, can lead to

outperformance. When there are surprises, markets wonder

whether management is competent.


28/358

Uneven information flow; profit warnings or their lack;

information released to analysts before the market; lackof comment on speculation; all these unsettle investorsand regulators, sometimes causing sharp movements instock prices.

News and specialist market services supply corporate

information 24 hours a day. Analysts interpret it as fast as it is produced. The

changes in Accounting Standards, SarbanesOxley,Basel II, and other complications mean more reliance

on expert interpretation. While some have argued about the validity of newstandards, industry leaders and others have got on withit to create a sustainable advantage.


29/358

Some CFOs may need to wake up to the new

paradigm. Others will see it as an opportunity for skilled

relationship management, making the financialinformation systems work for the company as

another weapon in the public relations armory.

The swift can capitalize on the lethargy of theslow.

Brand is everything. Failing this new challengecan seriously damage yours.

The right approach will please both short- andlong-term investors.


30/358

Cash Is King Investors will demand that companies report quicker. This is a challenge for accounting standards and

governance.

Historic price/earnings multiples have been replaced by

forecast revenues and EBITDA (earnings beforeinterest, tax, depreciation, and amortization) as thecurrency of decisions.

As accounts become almost impenetrable, the metricwe all understand is cash.

How much cash was generated in the last period; howmuch remains in the balance sheet; what is the NPV ofsustainable future cash flows?


31/358

Business Model

Apart from cash, the other factor that bringstogether short- and long-term interests is acredible, explainable business model.

If you dont have one, analysts will create theirown.

For example, good TMT (technology, media,telecommunications) stocks have floated up

and down with the bad on the waves of marketvolatility. Some values were absurd, for goodor ill.


32/358

Case Study Nortel (US) and Bookham (UK) were both top 100 stocks in

their own markets.

They were both linked to building communicationsnetworks. Nortels market capitalization peaked at around$282 billion in 2000.

It collapsed in value after the dot-com bubble burst and inJanuary 2009 Nortel filed for protection from its creditors.

Bookham Technology was a darling of the FTSE, floated inJuly 2000 at roughly $18. Its shares rocketed to $94 in a few

months, based on the NPV of forecast revenues for abusiness model that few people understood.

The price was driven by over-optimistic analyst estimates,blind faith, and greed.


33/358

Case Study

Its price fell 99% and its market capitalizationfrom $11.4 to around 88 million. Like Nortel,it was buffeted by fear and optimism. Unlike

Nortel, it had never made any money and itmoved to the NASDAQ to try and escape its

past.

In 2004 it became a US domiciled companyand recently produced its best ever quarterlyprofit.


34/358

Case Study

There are other examples:

Insurance companies have ebbed and flowed with eachother, washed by pension fund and capital adequacy

fears. In personal finance, Cattles and Provident Financialsrecent fortunes have been very different. Both aredescribed as doorstep lenders even though this is nowless than 10% of Cattles business.

Unless you regularly communicate a cleardifferentiation and a plausible business model, you mayremain at the whim of the market.


35/358

So its the financial model that really counts, especiallygenerating and sustaining cash.

Its lack of cash that busts companies, not lack of

capital. When you dont have enough cash to survive a recessionand the market isnt receptive to new issues, you have tostart slashing costseating yourselfto stay alive.

This can damage the business model, undermine the

stock price, and become a vicious spiral toward death, orat best consumption by a sounder business model.


36/358

Valuing the Business

There has been much theoretical talk in the

past about value added.

The theory is that every company should befocused on protecting, creating, and

sustaining value.

Failure could mean stock price falls, cashcalls, unwelcome bids, or business failure.


37/358

So the CEO, CFO, and colleagues need vision andcourage.

Value creation is top of the agenda. It involvesgenerating the value and protecting it.

Brand, fear, technical, and fundamental analysis ofmarkets have assumed more significance than theinternal business plan, budgets, and the annual

report. When investors are frightened or lose faith, they can

destroy value much faster than you can create it.


38/358

This is why cash generation is critical.

Stock prices that are already eroding due to

poor results or loss of confidence in abusiness model fall dramatically faster

when you have to raise cash in an

unreceptive market. Investors share your wish to sleep easy at

night.


39/358

Some CFOs therefore cite short-termism as

the real driver of value. They castigate

teenage scribblers and analysts for notunderstanding their business.

Some make errors of judgment, not only in

their handling of such relationships, but alsoin silence or, worse still, nasty surprises.


40/358

Marconi was the classic case in the United Kingdom.

For months investors expected a profit warning.

The company continued to make reassuring noises.

Investors continued to sell against an expectation of bad news.Eventually trading in the stock was suspended.

Dreadful news was released.

Returning from suspension the price was savaged. It had fallenfrom over $20 to under 35 cents in a year.

In early 2004, it was recapitalized by its bankers, a shadow of itsonce great self.

In October 2005 the Marconi name and most of the assets werebought by Ericsson.


41/358

Messages for Managers

Creating and protecting stockholder value are

even more important in the 21st century.

Volatility, expectations, speed of reporting,

and a hungry investor demand for real-time

information have changed the dynamics.

The CFO needs new skills.

These include strategic thinking, proactive risk

management, and communication and

interpersonal skills of a high order.


42/358

Value creation is about having a clear strategic andbusiness focus, flexible and adaptable asappropriate.

The CFO and executive colleagues must recognizethe importance of having a sound, understandablebusiness model.

The financial model must be based on valuecreation, ideally measured in sustainable revenues,income, and especially cash.

Reporting should be rapid and transparent, using thespeed of technology, with no surprises.


43/358

You can create long-term value, but investors can take it awayin the short term when fear overrides faith if you dont heedthese messages.

Relationship management with analysts, investors, and the

media is the critical skill that wasnt mentioned when the CFOtrained as an accountant.

When you understand and manage strategic business risk andthe macro-economic factors, you may at least anticipate thechallenge of analysts, whether or not they understand your ownunique business model.

If the unforeseen occurs, report it rapidly and accurately, with aclear understanding of the factors and a plan to manage theconsequences.


44/358

For private companies this is all applicable.

Investment of private capital is accelerating.

A clear business model is fundamental to

accessing the cash for investment and

growth, especially if they plan eventually to

come to market.


45/358

All companies can follow this best practice to prosper in the

21st century:

fast, reliable reporting against a sound businessmodel;

proactively anticipating and managing investor

interest; investing in relationships to differentiate your

company;

being clear, informed, and consistent;

creating and sustaining long-term corporateand brand value.


46/358

Origins and Rationale for IFRS

Convergence

Manjit Biant


47/358

Worldwide convergence on international standards forfinancial reporting will make investment and financialreporting more efficient.

Investors gain access to more investment opportunitiesand the cost of capital comes down.

As more countries use International Financial ReportingStandards (IFRS), so international groups can use themfor subsidiary reporting and group reporting.

The International Accounting Standards Committee, theinternational standard-setter, came into existence in1973 as an initiative by the accounting profession toaddress the emerging needs of cross-border business.


48/358

The standard-setter negotiated a role with the international co-ordinator of stock exchange regulators as a supplier of rules forsecondary listings.

The International Accounting Standards Board, the successor

body, was created in 2000 at the time when the European Unionannounced it would adopt IFRS for listed companies.

IFRS are now mandatory or permitted in more than 100countries. China, Japan, India, Canada, Brazil, and South Koreaare set to adopt IFRS in 2011.

Companies using IFRS can list in the United States withoutpreparing a costly reconciliation of their numbers to US GAAP.


49/358

Advantages of IFRS

Companies can more and more easily access different stockmarkets, and investors can step across national and culturalboundaries.

Investment should be getting more efficient. Since 2001,

International Financial Reporting Standards (IFRS) have beenset in London by the International Accounting Standards Board(IASB), a privately financed independent body.

Their standards are used for listed companies within theEuropean Union and in many other places. In 2011 China,Japan, India, Brazil, and South Korea will start using them.

Even the United States is considering abandoning its rules infavor of the international ones.


50/358

Why Convergence Is Necessary

Evidently, having different national accounting systemsis costly for companies and investors.

Companies have to keep duplicate accounting systems,

and investors are wary about buying shares ofcompanies whose accounts they do not understand.

The problem arises because accounting regulation hasdeveloped over a couple of centuries in nationaleconomies whose needs have differed from each other,

and whose ways of regulating peoples activities havealso differed.

What people are looking for from accounting is oftendifferent.


51/358

Much accounting regulation is contingent: you get anaccounting failure, then you get rules to shut the stable door; so,for example, the Enron debacle was followed by the SarbanesOxley Act.

This has been going on ever since there were accounting rules.The first government requirements were developed because of aspate of bankruptcies in Paris in the seventeenth century.

Consequently, while much of the basic methodology (doubleentry bookkeeping, balance sheet, etc.) is the same everywhere,the details can differespecially when it comes to the more

complex situations where there is no obvious best solution.


52/358

This has a number of consequences, which in turnbring costs.

Internally within a multinational group there is

usually a network of national subsidiaries (e.g.Nestl has more than a thousand) spread across theworld.

They have to report nationally using their national

GAAP (Generally Accepted AccountingPrinciples) and also have to report to the parent,which has to prepare consolidated statements using

parent company GAAP.


53/358

This means that either the subsidiary has dualaccounting systems, or the parent has tomaintain a special team to adjust the accountsof subsidiaries to parent GAAP.

This is costly, and it also means that it is notthat easy to transfer accounting staff around

the world because of the different localrequirements, and it is more expensive to trainthem.


54/358

The group consolidated financial statements are thenused to communicate to present and potentialshareholders.

If the company is listed on several stock exchanges, thismeans the possibility of having to provide informationadjusted to the requirements of the individual foreignstock exchangesas in the case of the SECreconciliation to US GAAP.

Investors are not comfortable with financial statementsthat are not prepared under the GAAP they are used to.Consequently they either do not invest, or they willrequire a higher risk premium to do so.


55/358

This situation has the effect of limiting the extent to whichinternational capital markets are truly international.

A company may choose not to list in a major marketbecause of the reporting costs, and therefore cuts itself offfrom investors based there who for legal, cultural, and other

reasons will not invest outside that market. Equally there is a cost for investors because their choice is

restricted.

The US investor cannot directly compare Whirlpool withElectrolux or Siemens.

If they could directly compare all washing machinemanufacturers around the globe, they could choose the mostefficient, and global wealth would increase.


56/358

The Development of Global

Standards International trade started to grow

significantly from the 1960s, and by the

early 1970s was starting to register as anissue that needed to be addressed.

People were staring to transact more

frequently across borders and would need acommon accounting language


57/358

By the 1980s the IASCs standards were beingvoluntarily adopted by multinationals in countriessuch as Switzerland, France, and Italy (e.g. Nestl,

Roche, Arospatiale, Cap Gemini) to make up for alack of detailed rules for consolidated financialstatements.

They were also being used as a model in developing

countries that were members of the BritishCommonwealth to build on to the model they hadinherited from the British Empire


58/358

The IASB is a small committee of professional

standard-setters. It has a large technical team, based in London still,

and is funded through voluntary contributions fromcompanies, audit firms, and various institutions,both national and international.

It adopted the predecessor bodys standards, butused a different name (IFRS instead of IAS) for itsown standards.

IFRS is also the generic term for all the standards

together with the interpretations issued by theInternational Financial Reporting InterpretationsCommittee (IFRIC).


59/358

Convergence on a Worldwide

Standard Where the IASC was part of a world of harmonizationor movement toward each otherthe IASB is firmlycommitted to develop, in the public interest, a single set ofhigh quality, understandable and enforceable global

accounting standards and to bring about convergence ofnational accounting standards and IFRSs to high qualitysolutions (Preface to IFRS, London: IASC Foundation).

Though it has not focused exclusively on the United States,the IASBs main driver is convergence with US GAAP.

It entered into an agreement with the FASB in 2002 topursue convergence through a joint program of removingdifferences and developing new standards together.


60/358

This program yielded a big prize in 2007.

The Securities and Exchange Commission decided that it wouldrecognize financial statements prepared under IFRS as issued by theIASB as equivalent to US GAAP.

Until then, foreign registrants with the SEC were obliged to fileannually either a set of accounts using US GAAP, or a reconciliationof annual earnings and equity at balance sheet date with how theywould have been measured under US GAAP.

This was a big burden to companies listed on the New York StockExchange or NASDAQ and a major disincentive to foreigncompanies to list there.

In 2007 the chief financial officer of AXA told the SEC at a roundtable that the company budgeted $20 million a year to produce thereconciliation.

Another part of the cost is that the companies end up publishingtwo, or even three, sets of figures and then having to discuss withanalysts and journalists which is the correct profit.


61/358

The removal of the reconciliation requirementmeans that, for example, European companiesthat are using IFRS can simply file with the SECthe same accounts that they file with their primarystock exchange.

Of course the SEC has other requirements thatstill have to be complied with, including

managements discussion and analysis of results. However, companies no longer have to be able to

restate their figures to US GAAP, nor retain teamsto monitor US GAAP.


62/358

Convergence on IFRS is taking us to a

bright new world where investors can

indeed take their pick from around theglobe, and where companies maintain a

single accounting basis throughout their

network.


63/358

IFRS are already either compulsory or

permitted for listed companies in more than

100 countries around the world. When thenext wave of adopters joins in 2011, a large

slice of the world economy will be IFRS

conversant.


64/358

It will take time for investors to become

confident about reading IFRS accounts

although that happened quickly within theEuropean Union.

But multinational companies should quickly

reap the benefits of having uniform systems

across the globe and will be able to exploit

the opportunities of being listed on several

stock exchanges at much lower cost.


65/358

Making It Happen

Using IFRS at group level is mandatory in manycountries, but is voluntary in some.

It is often voluntary at subsidiary level: both parent andsubsidiaries need to choose this option to access thebenefits.

Using IFRS makes access to capital markets outside thecountry where the group has its primary listing mucheasier and cheaper.

In what markets would there be special benefits for yourcompany? Remember that a secondary listing is not justabout access to foreign investors, it is about credibilityand flexibility in that market.


66/358

Are your group accounting and internal auditprofessionals able to move easily from one foreignsubsidiary to another?

Using IFRS would facilitate their work and potentiallyimprove internal control.

Do professional fund managers and analysts that youdeal with understand IFRS? Talk to them about whetherthey are IFRS literate and ask if they see benefits inswitching.

What do your group auditors think? The largeinternational firms are fully geared up for IFRS. Theywill help you switch.


67/358

Case Study

Cadbury Changes to IFRS from UK GAAP

Manjit Biant


68/358

In common with all companies listed on EU stock exchanges,Cadbury PLC (at the time Cadbury Schweppes PLC) officiallyswitched to IFRS in 2005, as required by the EU IASRegulation.

In practice, the real transition moment was the beginning of the2004 financial year: IFRS require that a company providesprevious-year comparative figures with the annual financialstatements.

Consequently, when reporting the 2005 results, the companyhad also to provide 2004 figures according to IFRS.

However, the company had also had to report 2004 under localGAAP (in Cadburys case, UK GAAP), and IFRS 1, thestandard dealing with transition, requires that a company alsoprovide a reconciliation between the local GAAP figures for

2004 and the IFRS figures for 2004. From an investorsperspective, therefore, every company provides a statementcomparing its pretransition figures with the same transactionsreported under IFRS.


69/358

Cadbury is also listed in the US and therefore is registered with theSecurities and Exchange Commission.

Consequently, at that time it was also obliged to provide areconciliation of its annual earnings and its equity to US GAAP.

This means that, for 2004, an investor could observe the earnings

and net assets of Cadbury under three different sets of GAAP: UKGAAP, IFRS, and US GAAP.

The figures show thatdespite the fact that all three sets ofaccounting rules belong to the same underlying tradition of Anglo-Saxon accounting, with financial reporting oriented towardinforming investorsthere still remain significant differences of

measurement at a detailed level. This illustrates how difficult it is to compare the results of

companies that are using different comprehensive bases ofaccounting, and why investors and international companies are keento move to a different global standard.


70/358

If we take equitythe net worth of the group

after deducting all liabilities from assetstheCadbury figures at the end of 2004 were:

million UK GAAP 3,088

IFRS 2,300

US GAAP 3,998

There is a presentational

difference in that the USdefinition of equity at the

time excluded minority

interests. For comparative

purposes we have added

these to the US GAAPnumber in the above table.


71/358

It is not particularly productive to make a detailedanalysis of why the differences occur.

Basically, they reflect different ways of accounting

for business combinations that had occurred in thepast, different treatment of pension liabilities, andthe significantly different treatment of deferred taxin the United Kingdom from that under IFRS andUS GAAP.

There is a detailed analysis in the notes to the2005 Cadbury (Cadbury Schweppes) annualreport.


72/358

If we take net earnings, the numbers are:

million

UK GAAP 453

IFRS 547

US GAAP 484


73/358

We can see that in 2003 investors had two setsof figures to choose from, while in 2004 theconvergence initiative meant that in the

transitional phase they had three differentmeasures of the same performance.

However, in 2007, when the SEC removed theUS GAAP reconciliation requirement, they

would have come down to a single view ofperformance which was comparable to thatused in 100 countries.


74/358

It should be emphasized that, of course, the

companys cash flows do not change with

the different accounting bases: What drives the differences is different

timing assumptions, different measurement

rules for some transactions, and differentallocations across time periods


75/358

You can only know absolutely how much

profit a company has made when it has

stopped trading and all its assets andliabilities have been liquidated.

The only profit that is irrefutable is the

lifetimes net increase or net decrease incash.


76/358

This is not much help for investors, and financialreporting is a means of estimating what part of thelifetime profit has been earned in a particular year,

in order to help investors decide whether to buy,sell, or hold the companys securities.

However, the annual profit is only an estimate, it isnot a fact.

All estimates are based on assumptionschange theassumptions and you have a different profit.


77/358

So none of the three sets of figures Cadbury

published for 2004 is correct or

incorrectthey are all justifiableestimates.

Hence the need for a unified set of

accounting standards!


78/358

AUDIT

Manjit Biant


79/358

Audit The contemporary development of international audit

regulation is connected to the growing significance ofinternational investors who demand financial reportsthat are prepared and audited in accordance withglobally accepted international standards.

International Standards on Auditing (ISAs) are set bythe International Auditing and Assurance StandardsBoard (IAASB), an independent standard-setting boardworking within the International Federation of

Accountants (IFAC) and subject to public oversight byinternational regulators.

ISAs have been adopted in more than 100 countries, buttheir practical impact depends centrally on how they areimplemented and enforced.
http://www.qfinance.com/dictionary/financial-reporthttp://www.qfinance.com/dictionary/financial-report


80/358

INTERNAL AUDIT

Manjit Biant


81/358

INTERNAL AUDIT

REVIEW


82/358

INTERNAL AUDIT

Setting up an Internal Audit

Department


83/358

The following comprise a set of guidelines for initiating an

internal audit:

Clarify guidelines and expectations withmanagement (for example, purpose, timing, scope).

Set up an audit committee and, with its help,

develop an audit charter. Consider an appropriate budget and staffing model.

Formulate reporting responsibilities for the internalaudit function.

Initiate a risk assessment, with management andaudit committee involvement.


84/358

Develop an internal audit plan in response tothe risk assessment.

Determine staffing requirements.

Carry out the audit plan, including a

monitoring and follow-up system.

Update the risk assessment plan as

circumstances change.

Enhance and modify the audit function to meet

the organizations changing needs.


85/358

If an evaluation of internal controls is to beeffective, the audit function should be properlyfinanced.

When making staffing decisions, companies shouldlook at their risk profiles.

A business facing a significant number of risks orparticularly complex risks will require various types

of specialist expertize. A chief audit executive commands most internal

audit departments, with specialist support staff.


86/358

Advantages

Internal audits improve understanding of underlyingbusiness trends by giving independent objectivefinancial information.

Internal audits let managers know if a business canexpand or needs to pull back, if it can deal with thenormal revenue ebbs and flows, or if it should takeimmediate steps to boost cash reserves.

Internal audits can identify and help to analyze trends,particularly in the areas of receivables and payables. Forexample, is the receivables cycle lengthening? Canreceivables be collected more aggressively? Is somedebt un-collectable?


87/358

Disadvantages

Results sometimes depend on the accountingmethods used. Measuring and reporting givemanagement considerable discretion and

opportunity to influence results. Internal audits are not always rigorously carried out,

and figures may not be a true reflection of thefinancial position of the company.

Salaries for internal audit staff are paid for by theorganization; this can lead to bias.

Can be costly overhead.


88/358

When reviewing, internal audits should beprepared to be involved in a long and detailed

process of analysis where some areas will need

clarification by experts. Generally Accepted Accounting Principles

(GAAP) should be used in the internal audit of

the business area or country in which you havean interest.

Internal audits are not infallible.


89/358

Dos and Donts

Do Make sure that you take the time and effort to analyze

the internal audit and, if in doubt, consult an externalexpert.

Use your judgment when reviewing internal audits;numbers do not always tell the whole story.

Dont

Dont leave out the boring bits; number crunching isnot always effortless or interesting, and often it istempting to skip parts.

Sometimes, however, the truth lies in the detail.


90/358


91/358


92/358

INTERNAL AUDIT

Function of IA


93/358

Internal Audit may be defined as a review

of operations and records, sometimes

continuous, undertaken within a business byspecifically assigned staff (ICAEW

statement U4 Para 10)


94/358

The Institute for Internal Auditors (IIA) definesinternal auditing as an independent, objectiveassurance and consulting activity designed to add

value and improve an organizations operations. An internal audit helps an organization accomplish

its objectives by bringing a systematic, disciplinedapproach to evaluate and improve the effectiveness

ofrisk management, control and governanceprocesses.
http://www.qfinance.com/dictionary/internal-audithttp://www.qfinance.com/dictionary/internal-audithttp://www.qfinance.com/dictionary/risk-managementhttp://www.qfinance.com/dictionary/risk-managementhttp://www.qfinance.com/dictionary/internal-audithttp://www.qfinance.com/dictionary/internal-audit


95/358

In practice the internal audit department is

often an independent department, reporting

directly to top management and usually tothe board of directors.

The functions of the IA department will

differ from one company to another butcould include the following:


96/358

1. Verifying the accuracy of the financial

records and related reports.

2. Ensuring that the various internal controlsare operating effectively.

3. Reviewing financial statements.

4. Reviewing management informationincluding management accounts.

5. Reviewing accounting policies


97/358

6. Controlling the checking of continuous

stock systems.

7. Carrying out special investigations formanagement including study of labour

relations, wastage of assets and operating

efficiency of units of the business. 8. Ensuring that management policies are

being followed.


98/358

IA as you can see helps internal

management to run the business more

efficiently and those that would be ofparticular interest to the external auditor.


99/358

INTERNAL AUDIT

Differences Between IA & EA


100/358

The IA and external Auditor under the

companies act operate largely in the same field

and have a common interest in ascertaining

that:

1. An adequate system of internal control

operates satisfactorily

2. An adequate accounting system operates

satisfactorily so as to provide financial

statements showing a true and fair view.

Area Of Difference Internal Auditor External Auditor


101/358

1. SCOPE Determined by Management Determined by Statue, Law

and Accounting standards.

2. APPROACH To ensure accounting system

efficient and providing management

with accurate and materialinformation.

To satisfy himself that the

financial statements to be

presented to theshareholders, present a true

and fair view.

3.

RESPONSIBILITY

To management To Shareholders


102/358

INTERNAL AUDIT

Assessment of the IA Function


103/358


104/358

1. The IAs degree of independence from

those people whose work and

responsibilities are reviewed by the externalauditor. In any business the IA reports

directly to senior management or the Board.

2. The professional qualifications andexperience of the IA staff


105/358

3. The scope, extent, direction and timing of

the IAs tests. This will also include an

examination of the way in which the IAdepartment operates, for example the use of

procedures manuals and systems notes and

the basis of deciding on surprise visits.

4. The available evidence of work done by

the IA department including a review of that

work.


106/358

5. The reports produced by the internal

department and the extent to which action is

taken by management.


107/358

INTERNAL AUDIT

Relationship of IA & EA


108/358

The work carried out by the IA & EA is

carried out by largely similar means such as

observations, inquiry, verification,examining and checking of accounting

records.

h l di f l h h


109/358

The External Auditor can formulate how much

more detailed work is necessary from the

internal auditors opinion of the internal

control in operation.

Joint programs can be planned so that the EA

relies on the IA to undertake some (but not all)

or assist in cash accounts, branch visits etc

The internal auditor may assist in the year end

programme of debtors, asset verification andpreparation of working schedules.

Statutory responsibilities do come into effect.


110/358

y p

The EA must always bear these in mind and

the fact that the IA is not his servant. Consultation between the 2 auditors and

management must take place in order to agree

the maximum co-operation. There is an increasing tendency for IA & EA

to work together more closely. There is a good

deal of evidence to suggest that in manycompanies the EA plays an important role in

developing the programmes of the IA.


111/358

INTERNAL AUDIT

Fraud & Error

Definition


112/358

Definition

Fraud has been defined as a falserepresentation of fact made with knowledge of

its falsity or without belief in its truth, or

recklessly careless, whether it be true or false. In other words, anything which is deliberately

dishonest is fraudulent.

Error may be defined as an honest or carelessmistake.


113/358

Responsibility

Management is responsible for the

prevention and detection of irregularities

and fraud. Their responsibility is dischargedby instituting and maintaining an adequate

system of internal control.


114/358

Auditors Position

The auditor is not required by legislation

specifically to search for irregularities or

fraud. The audit cannot be relied upon todisclose all irregularities or fraud.


115/358

However what does concern the auditor is

the possibility of material irregularities or

fraud impairing the true and fair view. Thismeans that the auditor should plan and carry

out the audit in such a way that he has a

reasonable expectation of detecting major

mis-statements in the financial statements

resulting from irregularities or fraud.


116/358

In this connection, the evaluation of internal

controls is of prime importance. Effective

internal controls can reduce (although notentirely remove) the possibility of errors

and irregularities. The work of the internal

audit department will help in this area.


117/358

In both the letter of engagement and the

letter of weakness by an EA it is useful to

point out that the main purpose of the auditis the expression of an opinion and that the

audit cannot be relied up to disclose all

irregularities or fraud.

f d


118/358

Types of Fraud & Errors

1. Unwitting clerical errors in the processing ofaccounting data, resulting in lack of accuracy anddependability.

2. Deliberate clerical irregularities, committed in

order to produce inaccurate and undependableaccounting data, and thus, misleadinginformation.

3. Deliberate clerical irregularities, committed in

order to cover up misappropriators of thebusinesss physical resources such as cash andstocks.


119/358

4. Misappropriation of physical resources

such as cash and stocks.


120/358

INTERNAL AUDIT

Audit Evidence


121/358

If preliminary evaluation indicates strong

internal controls, and it is the most

efficicient route to take, the auditor will goon to compliance testing the controls.

If the auditor wishes to place reliance on

any internal control, he should ascertain and

evaluate those controls and perform

compliance tests on their operation

Operational Standard


122/358

The auditor carries out compliance tests (tests ofcontrol to gather evidence that the controls onwhich he wishes to rely were functioning both

properly and throughout the period. The idea of an exception is an important one. The

auditor cannot excuse failure of a control on thegrounds that the amounts involved were small. If it

can fail with respect to a small monetary amount, itis likely to fail with a significant amount.


123/358

Compliance tests should cover the whole

period being audited.

Where the control system has changedduring the period, the auditor would break

the period down into two and deal with

them independently. The auditor would also

need to consider the internal controls over

the changeover period itself.


124/358

INTERNAL AUDIT

Reliance on Internal Audit


125/358

Internal Audit is one element of the internal

control system established by management.

As a result EA may decide they want to relyon the IA department.

EA will want to perform procedures to

establish whether the department isopertaing effectively.


126/358

As with any system of controls, the EA will

perform a preliminary evaluation of the

internal audit department, to enable adecision to be made as to whether he wishes

to rely on the work of the IA department.


127/358

The size of many organisations makes it impossiblefor top management to exercise direct control andsupervision of operations.

As remoteness increases, so the factors ofmisrepresentation, misunderstanding andmisjudgement operate in such a way as to hamperthe achievement of the set goals.

The IA may therefore be used to bridge the gap

between management and the shop floor and canassure management that the policies and systemslaid down are being adhered to.


128/358

Equally he will be able to provide an

independent check on the accounting

records and other operations of theorganisation.


129/358

The EA as a result of reliance on the

internal audit function can reduce his work

in 2 broad areas. These cover the bulk of theexternal auditors work, and effective

reliance on IA can lead to a very cost

effective audit approach.


130/358

The IA should not be restricted by functionalboundaries within the organisation as his workshould cover all aspects of financial and non-

financial matters. In order to do this, he mustbe completely divorced from executiveresponsibility and allowed to investigate anyarea of the organisations activities. He must

be fully conversant with all clerical systems

and methods of production and distribution. Heshould be responsible directly to the board ofdirectors or very senior management.


131/358

INTERNAL AUDIT

Assessment

D f I d d


132/358

Degree of Independence

The IA should report to the highest level of management. He istherefore reporting over the heads of those on whom he isreporting. His work will not suffer through threat of dismissal.

Normally the department would be controlled by a chief internalauditor, directly responsible to top management. It is importantthat he is not responsible to the chief accountant, as he wouldthen be responsible to the head of the department whose work,in the main, he will be reviewing and criticising. Such a positionmay become untenable. It is preferable for the chief internalauditor to be responsible to the chairman or deputy chairpersonor controller.

Scope & Objecti es


133/358

Scope & Objectives

The scope of the department should

unrestricted.

Due Professional Care


134/358

Due Professional Care

The same care expected of EA should becarried by IA

Technical Competence


135/358


The chief Internal Auditor will normally havereceived his early training in a practicingaccounts office and therefore have

considerable experience and knowledge ofauditing techniques and principles. However itwill of a great advantage to the organisation asa whole if he has experience, in an executivecapacity, in industry. He will then realise the

problems encountered by management whennew systems are introduced and resources arelimited.

Internal Audit Reports


136/358

Internal Audit Reports

If senior management take little or no notice

of these reports they may as well not be

produced. If their reports are not takenseriously, the internal audit department will

be ineffective.

Level Of Resources


137/358

Level Of Resources

Work cannot be carried out effectively if

resources are insufficient.

The work of the IA should be reviewed bythe EA if their work is to be relied upon.

Has the work been properly controlled and

recorded and sufficient evidence been

obtained.


138/358

INTERNAL AUDIT

Assessment Questionaire


139/358

Sample questionnaire that an EA could use

but good idea to do self examination.

Degree Of Independence


140/358

Degree Of Independence

Are you entirely responsible for the

appointment, remuneration and promotion

of internal audit staff. If not, who is?

Do you, as head of the department, report

directly to the board as a whole? Are any

specific limitations placed on the scope and

nature of the work which your department

performs?

Are members of your department able to plan and

carry out their work as they wish?


141/358

carry out their work as they wish?

Are you allowed free access to records, assets,and personnel of the company?

Do you have access to senior management and

freedom to report and discuss matters with them?

Are you free to communicate with external

auditors?

Do you have any responsibility for day to day

operations which may conflict with yourobjectives as internal auditor?

Scope & Objectives Of Work


142/358

Scope & Objectives Of Work

What are the principle areas of work of the

Internal Audit Function?

In respect of internal controlsDo you identify, evaluate and compliance test

controls?

What methods of ascertaining and evaluating

are used eg Flowcarts, ICQs etc

Are weaknesses in the system reported to

management?

In particular in relation to the computer system


143/358

In particular in relation to the computer system

Do you ensure that there is security against

unauthorised access?

Do you ensure that there are adequate backup

procedures?

Do management accept advice about controls,improvements to the system?

Do management involve you in the

implementation of changes in systems?

Professional Standards


144/358

Professional Standards

How is each assignment planned?

What control procedures are adopted to ensure

that an assignment proceeds smoothly?

Are standard working papers and audit work

programmes used?

What review procedures are carried out?

Does an internal audit manual exist? If so are

EA able to view it?


145/358

Are staff allocated to assignments according

to trainning, experience and proficiency?

Are staff briefed prior to commencement ofan assignment?

Who supervises assignments?

Who is responsible for drawing up thereports following an assignment?

Do management review these?


146/358

Is a discussion meeting held?

What follow up procedures are adopted to

ensure that these are actioned bymanagement?

Are regular staff reviews held to ensure that

morale is good and to deal with anyproblems?



147/358


What resources, particularly financial, is yourdepartment provided with?

What recruitment procedures are adopted for

employing internal auditors? Can you provide details, for all IA, of:

Their qualifications

Any specialised skills which they possess?Training courses taken?

Years of experience?


148/358

What arrangements are made to ensure that

staff are kept technically up to date?

Are personal training records maintainedand staff training needs monitored?

Reports


149/358

Reports

Can EA review reports issued to

management?

What procedures are in place to ensure thatmanagement implement internal audit

suggestions?

Nature if Audit Evidence


150/358

Nature if Audit Evidence

The audit is an expression of opinion.

However, it is the opinion of an expert. As

such it should have been formed after

gathering and examining appropriate

evidence. Unfortunately there is no set way

that evidence can be measured, and the

auditor needs to use his professionaljudgement to decide on how much evidence

he needs to form an opinion.


151/358

The auditor will be influenced by:

1. The materiality of the matter being

examined. The more material the matter is,the more evidence the auditor will wish to

have.

2. The relevance and reliability of evidence.The more relevant and reliable the evidence

is, the less the auditor will need.


152/358

3. The cost and time involved in obtaining

the evidence. If the auditor has 2 pieces of

evidence to choose from, he will gather the

one which takes less time to obtain.

Remember the audit should be as efficient

and cost effective as possible.

Sufficiency & Risk


153/358

Sufficiency & Risk

The auditor should know his business,

example being that the home computer

industry has declined since its peak not so

long ago, and would use this knowledge

when reviewing the stock valuation of a

client producing software for home

computers. In other words this industry isdeemed high risk. More work will be

needed than on a low risk industry.


154/358

Risk of misstatementsmaybe a risk in a

specific area like stock or bad debt

provisions are always subjective and hence

high risk areas. Alternatively it may be a

risk running through the financial

statements as a whole.


155/358

INTERNAL AUDIT

Risk Assessment


156/358

Risk Assessment process is crucial to the

work of the IA.

Risk Assessment includes the followingphases:

Identifying groups of related accounts

Understanding the nature of the accounts Searching for specific risks of error

Pinpointing the risk of error


157/358

When indications of the existence of a

specific risk of material error is found:

1. Evaluate, compliance test, and rely onany controls that reduce such risk or

2. Develop a focused audit response for

such risks to ensure that you obtainadequate assurance that no material errors

are present

Identify Groups Of Related Accounts

Understand Nature Of The Account

-Substance of Transactions

-Accounts having particular significance

-Flow of Transactions


158/358

Flow of Transactions

-Types Of Transactions

Search For Risks

-Risks identified during Business Review

-Risks associated with the accounting process

-History of errors

-Susceptibility of assets to theft or loss

-Risks associated with transaction types

Risks of Error Identified?

Standard Audit Response

-confirmation of the reliability of the system

-Testing controls that mitigate risk, if applicable

-Basic level of substantive testing

Pinpoint The Risk of Error

-Types of transactions

- Assertions

Controls Reducing Risk

-Specific accounting controls

- Administrative controls

Effective Controls?

Focused Audit Response

No

Yes

Yes

No or not considered

Identifying Groups or Related

A


159/358

Accounts

Many accounts or groups are affected

simultaneously by the same transactions or

are interrelated in some way.


160/358

Also certain accounts can be grouped because theyrepresent opposite sides or related parts of the sametransaction. So in assessing risk or obtainingevidence for one account provides us with

information about the others. So primary tests canprovide corollary assurance.

EG Testing Debtors for existence we also gaiassurance about the occurrence of the related sale.

However when risk has been identified we wouldneed to consider whether corollary tests areadequate.


161/358

In some cases accounts can be usefully

considered jointly because they are related

by virtue of the nature of the clients

business. Example income and equipment

of an oil drilling company are related

because of the capacity for income

generation is limited by the amount ofoperational drilling equipment. One account

may therefore provide evidence regarding

the other


162/358


163/358

FORENSIC AUDITING


164/358

Forensic auditing is a blend of traditional

accounting, auditing, and financial detective

work.

Technology has an increasingly important

role to play, with complex data analysis

techniques employed to help flag areas that

warrant further investigation.


165/358

Forensic auditing offers a toolset that companymanagers can use to help detect and investigate variousforms of white-collar financial impropriety andinappropriate or inefficient use of resources.

As company structures and controls become ever more

complex, so too does the scope for employees withspecialized knowledge of the way control systems workto bypass them.

In the past, various forms of auditing have beenemployed after a major control breach has come tolight, but executives are now increasingly looking atforensic auditing to help identify vulnerabilities infinancial control.

Advantages


166/358

g

Forensic auditing strengthens control mechanisms, withthe objective of protecting the business against financialcrimes, be they potentially catastrophic one-off eventsthat could threaten the viability of the business, or

smaller-scale but repetitive misappropriations ofcompany assets over a number of years.

Forensic auditing can play an important role forcompanies under review by regulatory authorities andcan also be invaluable to ensure regulatory compliance.For example, forensic auditing can be useful in helpingcompanies to ensure that their anti-money launderingprocedures are both effective and robust.


167/358

Forensic auditing can help protect organizations fromthe long-term damage to reputation caused by thepublicity associated with insider crimes. A forensicaudit also provides a sound base of factual informationthat can be used to help resolve disputes, and can be

used in court should the victim seek legal redress. Forensic auditing can improve efficiency by identifying

areas of waste.

Forensic auditing can help with the detection andrecording of potential conflicts of interest forexecutives by improving transparency and probity inthe way resources are used, in both private and publicentities.

Disadvantages


168/358

g

A poorly managed forensic audit could consumeexcessive amounts of management time and couldbecome an unwelcome distraction for the business.

Forensic audits can have wide-ranging scope across

the business. Under certain circumstances, the scopeof the audit may need to be extended, with acorresponding increase in the budget.

Some employees can interpret a proactive forensicaudit as a slight on their integrity, rather than as ameans to improve control procedures for the benefitof the business.

To Consider


169/358

Understand your risks, routes to their potentialexploitation, and the tools available to detect

abuses, fraud, or wastage.

Analyze numerical data, comparing actualcosts against expected costs.

Investigate possible reasons for

inconsistencies.


170/358

Consider whether covert detection techniques might bemore appropriate when investigating cases of possiblefraud. Higher-profile full forensic audits can deter futurefraud but could also reduce the likelihood of witnessingthe culprit carrying out a fraudulent act.

External auditing specialists with extensive experienceof complex forensic audits can offer industry-specificexperience, auditing management expertise, andadvanced interviewing techniques. A combination ofthese external specialists and companies internalaccountants/auditors can achieve shorter audittimescales and lower levels of disruption to the business.

Dos and Donts


171/358

Do

Remember that well-resourced forensic auditing processescan help to identify misreporting at many levels of anorganization.

Bear in mind that regular proactive forensic audits can help

businesses to ensure that their processes stay robust. Be prepared to widen the scope of a forensic audit to ensure

maximum effectiveness.

See forensic auditing as a continuous process, rather than aone-off event. On completing one audit, restarting the

process could uncover something relevant that waspreviously overlooked.

Be prepared to share the findings of the forensic audit withother areas of your company, and take into account industrybest practice to improve efficiency and combat fraud.


172/358

Dont Dont lose sight of the objective of a forensicaudit. The cost of a forensic audit can be high, butthe potential cost of not undertaking an audit and

implementing its findings can be even higher. Dont fall into the trap of overlooking theimportance of the forensic element of the audit.With the results of such a process deemed suitablefor inclusion in legal proceedings, the high

potential costs of the forensic audit process couldeasily be recovered from dispute resolution orhigher levels of loss recovery.


173/358

Best Practices in Risk-Based

Internal Auditing


174/358

Agree on a common framework for the risk-basedauditing and monitoring program.

Assess risks across the enterprise and thenprioritize them by looking at the likelihood ofoccurrence and impact for the organization.

Develop a risk-based auditing and monitoringplan from the identified risk priorities.

Execute a corrective action plan developed by

management to mitigate risks and/or resolve risks. Assess the auditing and monitoring process foreffectiveness.

Getting Started


175/358

g

In designing risk-based auditing and monitoringactivities, it is important that the internal auditorworks closely with the organizations seniorleadership and the board, or committee of the

board, to gain a clear understanding of auditing

and monitoring expectations and how theseactivities can be leveraged together to helpminimize and mitigate risks for the organization.

These discussions should also include leadership

from the legal, compliance, and risk managementfunctions, if they are not already a part of thesenior leadership team.


176/358

This process should include performing periodicaudits to determine compliance with respect toapplicable regulatory and legal requirements, andto provide assurance that management controls

are in place for the detection and/or prevention ofnoncompliant behaviour.

Additionally, risk-based auditing and monitoringshould include mechanisms to determine that

management has implemented corrective actionthrough an ongoing performance management

process to address any noncompliance.


177/358

Once the common framework for the risk-basedauditing and monitoring program has beenestablished, four key tasks must be performed:

Assessment and prioritization of risks, conductedenterprise-wide;

Development of a risk-based auditing andmonitoring plan;

Execution of a corrective action plan developed

by management to mitigate risks and/or resolverisks;

Periodic assessment of the overall process foreffectiveness.


178/358


179/358

operational (processes and procedures);

financial (data rolling up to internal/external

statements); regulatory (federal, state, local,

organizational policy);

reputation (institutional).


180/358

There are several ways in which risk assessments inthese areas can be conducted. These include the useof:

focus groups to assist in the identification of risks;

interviews of key leadership and the board; surveys;

reviews of previous audit findings, external auditsconducted in the organization, and identifying what

is occurring within the industry and the localmarket, etc.


181/358


182/358

It is important that senior leadership participate in, andagree with, the determination of the high-risk prioritiesfor the audit and monitoring plan. This will ensuremanagement buy-in and focus on risk priorities.

Also, with managers involved at the development stageof the plan, they will be educated as to the type ofactivities being planned and the resources needed toconduct these activities.

Hence, during the plan year, if there are changes,management will understand the need for additionalresources or a change in focus in the plan as thebusiness environment and priorities may change.

Developing the Plan


183/358

The International Standards for the

Professional Practice of Internal Audit

(IIA), Standard 2120 says The internal

audit activity must evaluate the

effectiveness and contribute to the

improvement of the risk management

processes.


184/358

This is done through the development and

execution of the risk-based auditing and

monitoring plan.

Risk assessments and prioritization are

important elements in the development of

your risk-based auditing and monitoring

plan. Considerations related to the planshould also include:


185/358

Review of other business areas in the organizationwhich may be conducting an audit or monitoringactivity in this area: If so, could you leverage this resource for assistance in

completing the stated activity, or utilize their activity andintegrate the results into the overall plan?

Resources available to implement plan: Do you have the appropriate resources for the subject

matter as needed within your department? (If not, is theresubject matter expertise somewhere else in the

organization?) If subject matter requires outsourcing, budgetconsiderations and overall risk priorities may need to be re-evaluated.


186/358


187/358

IIA Standard 2120.A1 identifies the focus ofthe risk assessment process: The internal

audit activity must evaluate risk exposures

related to the organizations governance,operations, and information systems regarding

the:

Reliability and integrity of financial and

operational information.


188/358

Effectiveness and efficiency of operations. Safeguarding of assets;

Compliance with laws, regulations, and

contracts. The process of risk assessment continuesthrough the execution of the plan where theengagement objectives would reflect the

results of the risk assessment. Risk-basedauditing and monitoring is ongoing anddynamic with the needs of the organization.

Execution of the Plan


189/358

Each activity should have a defined

framework which will provide management

with an understanding of the overall

expectations and approach as you execute

the plan.

The framework for your activities should

include the following actions:


190/358

Set the purpose and goal for the activity

(audit or monitoring):

Identify the scope from the purpose or goal, but

make sure that it is objective, measurable, and

concise.

Before conducting activities in high-risk

priority areas, it is important to considerwhether legal advice may be needed in

establishing the approach to the activity.


191/358

Conduct initial discussion with the businessarea for input related to audit attributes,timing, and process:

Concurrent vs retrospective status may be

determined at this point. (Concurrent is real timeand before the end point of what you are looking athas occurred. Retrospective is after the end pointhas occurred, i.e. the claim has been submitted or

the research has concluded, etc. Milestones shouldbe determined for rationale as to how far back togo, for example, new law, new system, etc.)


192/358

Finalize the approach and attributes:Sampling methodology will be determined largely by

the scope (purpose and goal) of your activity. Forexample, the sample used in self reporting a risk areato an outside enforcement agency may be

predetermined by the precedent that the enforcementagency has set in industry; to determine if education isneeded in a risk area, a small sample only may beneeded, etc.

Consider the audience frame of reference that willreceive the results of activity, and then develop anappropriate format for reporting.


193/358

Conduct the activity. Identify preliminary findings and observations.

Provide an opportunity for findings and

observations to be validated by the businessarea.

Finalize the report.


194/358

Identify processes for the follow-up after

management has taken corrective action

related to activity findings and observations.

Data collection and tracking are critical because

they provide trend analysis and measurement of

progress.

Determine the key points of activity thatmay be provided to leadership and/or in

reporting to the board.


195/358

The overall process of developing the audit andmonitoring plan should be documented. This wouldinclude a description of how the risk assessment wasconducted and the methodology for prioritization of

risks. Working papers to support the audit findings,reports, and corrective action plans should bedocumented and filed appropriately.

Prior to the audit activity, be sure to define anddocument what should be considered as part of theworking papers.

A h d f h l i i i d


196/358

At the end of each plan year, it is important to conductan evaluation of the overall effectiveness of the plan.Questions to consider may include:

Was the plan fully executed?

Were appropriate resources utilized for the plans

execution? Were the activities conducted in a timely manner?

Did the plan make a difference in regard to theorganizations strategy and business?

Did the plan reach the goal of detecting, deterring,and/or preventing compliance research risks fromoccurring?


197/358

Annual evaluations may be conducted throughself reviews or independently of the internal auditfunction by a third party, i.e. peer reviewconducted with auditors from other organizations,

Quality Assessment Review conducted accordingto IIA standards (every 5 years), etc.

However, while self reviews are less resourceintensive, it is recommended that a independent

review be conducted at least every other year toassess the effectiveness of your auditing andmonitoring efforts.


198/358

Eff ti i th d l t d ti f th


199/358

Effectiveness in the development and execution of therisk-based audit and monitoring plan will bedetermined by the integrity and characteristics of theoverall audit and monitoring process.

Effective audit and monitoring activities will assist in

the identification of weaknesses in controls,managements action to correct those weaknesses, andfollow-up to ensure that timely mechanisms have beenput in place to strengthen controls for mitigating thebusiness risks.

Additionally, risks will be detected, deterred and/orprevented with effective auditing and monitoringactivities.


200/358

Best Practices in Risk-Based

Internal Auditing

CASE STUDY


201/358

Scenario: An organization with multiplebusinesses in several geographic locations is

conducting an enterprise-wide risk assessment.

It is noted during the risk assessment that, dueto recent financial losses, the organization is

going through a consolidation of business units

and reduction in force. This has been identified

as a high-risk priority area for the auditing and

monitoring plan for the next fiscal year.


202/358

In planning the audit on the risk area of

business consolidation, the following

considerations should be included:


203/358

The business consolidation could be

impacting the organization in various

wayscustomer base loss, reduced

finances, loss of reputation, loss ofworkforce resulting in loss of controls, etc.

The risk-based audit will focus on areas of

greatest impact: loss of controls in financialareas due to the reduction in workforce.


204/358


205/358

Management may also want to set up its

own monitoring system to ensure that its

corrective actions have resolved any of the

gaps identified.

Part II of the audit would occur after a

negotiated period of time with management

and would allow the corrective actions tohave been in place long enough for their

effectiveness to be determined.


206/358

The overall purpose of this type of risk-basedauditing is to work with management in real

time, to add value to the organization in

regard to its strategic and best business

interest, and to provide input on processes

before they become fixed.


207/358

After management believes it has the

fixes in place, then the second part of the

audit will help to provide assurances that

the risks identified are no longer risks andthat no new gaps or lack of controls have

developed around the process of business

consolidation and reduction in workforce.

End Of Case Study


208/358

Making It Happen


209/358

The development of an effective risk-based auditingand monitoring program includes several keyelements:

1. Performing an enterprise-wide risk assessment thatincludes operational, financial, regulatory, andreputational risk (1-IIA).

2. Prioritizing risks identified through measures suchas likelihood and impact for the organization.

3. Developing a risk-based auditing and monitoringplan from the identified risk priorities.


210/358

4. Determining that corrective action plans

which have been developed by management

to mitigate priority risks or ensure controls

are in place to lower the risk level for theorganization.

5. Conducting follow-up activities that validate,

monitor, or audit corrective actions tomitigate and/or resolve the identified risks.


211/358

6. Re-evaluating risks on an annual basis through a riskassessment process to ensure that the priority risks ofthe organization have been addressed.

7. Conducting a periodic third-party review of risk-basedauditing and monitoring plan to assess whether:

processes are in place to identify risks;

appropriate resources are utilized to audit and/or monitorrisks;

a commitment to reinforcing the need for management toexecute plans to mitigate risks is demonstrated by the board

and senior management.


212/358


213/358

Aligning the Internal Audit Function

with Strategic Objectives

Due to high-profile scandals at the beginning of the century,


214/358

Due to high profile scandals at the beginning of the century,

regulators and the accounting profession worldwide have putforward a series of initiatives to repair the damage and restore faithin corporate governance.

Globally, more companies are adopting corporate governance bestpractice.

An independent internal audit function is widely recognized as anintegral part of a companys strategic objectives, corporategovernance, and risk management.

The internal audit standards issued by the Institute of InternalAuditors serve as authoritative guidance for members of the internalaudit profession.

Internal audits role is to evaluate the appropriateness andeffectiveness of companies systems and processes, and to identifyand manage risks present in the normal course of conductingbusiness activities.


215/358

Given todays complex and rapidly

changing management climate, companies

must implement continuous improvements

to achieve efficiency, and assure investorsand other concerned parties of solid

corporate governance.


216/358

The recent scandals at Enron, Worldcom,Parmalat, and others have raised the profile ofcorporate governance across the globe.

Trust in the process of financial accounting,

corporate governance, and auditing has beenundermined by these high-profile corporatescandals.

In response, regulators and the accounting

profession worldwide have put forward a series ofinitiatives to repair the damage and restore faith incorporate governance.


217/358

Furthermore, companies must continuously implementimprovements to achieve effective and efficientmanagement in order to assure the investors, otherstakeholders, and concerned p

21st Century Accounting

Documents

Transcript of 21st Century Accounting