Corporate Governance and Entity-Level Controls. Escalating Role of Board Members. Corporate Fraud Qualifications of directors and management. Organizational Structure and Corporate Governance. What has an effect on corporate governance? For example, an entrepreneurial structure
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Escalating Role of Board Members • Corporate Fraud • Qualifications of directors and management
Organizational Structure and Corporate Governance • What has an effect on corporate governance? • For example, an entrepreneurial structure • What type of structure would a public company probably have?
Enterprise Risk Management (ERM) • What is ERM • Risk management framework
Auditor Evaluation of Corporate Governance • What is the auditor’s goal? • Typical tools used to understand the components of corporate governance
IT Governance • IT governance is crucial to the evaluation of corporate governance • Definition of IT governance • IT governance is a crucial subset of
Evaluation of IT Governance by the Auditor • Evaluation of IT governance • What does the auditor look at next?
Continuous assessment • Value Management methodologies
Impact of General Information Systems Controls on the Audit There are three general control categories: • organization and management controls • systems acquisition, development, and maintenance controls • operations and information systems support.
Organization and Management Controls • Auditors consider • Key question - Who are the super-users?
Systems Acquisition, Development, and Maintenance Controls • Auditors focus • Typical types of software • Providing user interfaces • Providing security • Managing hardware and software • Information communication
Operations and Information Systems Support • A number of things canb affect the types of controls • Hardware confirguration • Auditor needs to determine • Operating system
Internal vs outsourced support • What is outsourcing? • Internal
Advanced Information Systems • Advanced IS results in high complexity. • Such systems have one or more of the following characteristics: • Strategic information systems • Custom software • Multiple information processing locations • Database management systems • Paperless systems • Integrated computing
Strategic Information Systems • Such systems provide a competitive advantage or improve efficiency within an entity. • The problems? • Such systems can be extremely strategic
Custom Software • Custom software is unique software designed for the entity. • How can it be developed? • The key reasons why such software is chosen by entities
Risks Associated with Custom Software • Such systems are usually very costly • Rigorous testing is required
Audit Impact of Custom Software • Systems development process • Risk of errors or unauthorized programs
Multiple Information Processing Locations • Problems with data processed in multiple locations • Programs could be inaccurate or unauthorized • Access to programs and data • Data sent from one location to another
Databases and Database Management Systems (DBMS) • Many software packages use a database as an underlying file structure. • Key concept of a DBMS • The DBMS
Effects of a DBMS on Internal Controls • Existence of a DBMS • Typical general controls that are affected • Organization and management controls • Systems acquisition, development, and maintenance controls • Operations and information systems support
Organization and Management Controls • The database administrator • Auditor documentation
Systems Acquisition, Development and Maintenance Added controls should exist to ensure that: • Database development • Programs
Operations and Information Systems Support • Data security • Each application cycle needs to be examined for controls over:
Paperless Systems • A wide variety of paperless systems exist. • Typical business data communications • EDI (electronic data interchange) • EFT (electronic funds transfer)
Impact of Paperless Systems on the Audit Engagement • Where there is no paper trail • Without a paper trail
Integrated Computing • Increased leve of complexity • Typical examples • Enterprise Resource Planning (ERP) • Relational databases • The objective of such systems
Some Common Entity-Level Controls Controls related to the control environment Controls over management override The company's risk assessment process Controls to monitor other controls, including activities of the internal audit function, the audit committee, and self-assessment programs Controls over the period-end financial reporting process Policies that address significant business control and risk management practices Whistle-blower hotline Code of conduct IT environment and organizations Self-assessment Oversight by the Board of Senior Management Policies & procedures manual Variance analysis reporting Management triggers embedded within IT systems Internal communication and performance reporting Tone setting Board/audit committee reporting External communication Segregation of duties Accounts reconciliations System balancing and exception reporting Governance Assignment of authority and responsibility Hiring and retention practices Fraud prevention/detection controls and analytical procedures
The Effects of Entity-Level Controls • What can be affected? • Any one of the control levels being absent or not properly implemented
Relationship between Entity-Level Controls and Specific Audit Objectives Entity-level controls can affect
Problem 10-21, Canadian 11th. Edition, Page 342 Friggle Corp. is a leasing and property management company located in Alberta. It provides financing to organizations wishing to purchase equipment or property and manages apartments and condominium properties. The company decided that it was time to upgrade its local area network. It decided to also purchase new accounting software but wanted to retain its old unit maintenance software, which, although 10 years old, had an easy-to-use interface that allowed maintenance personnel to track the maintenance work that they did in each unit. The controller, Joe, decided that the company should purchase the software from Midland Computers, which was owned by his brother-in-law, Tom. The prices were comparable with those of other computer networks that he priced, and Midland happened to be close by. Using materials from industry magazines, Joe decided that the best property management software to buy would be from Quebec; the software had received rave reviews about being easy to use. The implementation was scheduled for the weekend after the June month-end close so that systems could be up and running by the following Monday. To Joe’s horror, when he arrived at work on Monday, computers were still being unpacked and installed. Tom had difficulty following the installation instructions for the accounting software, which was not up and running until the end of the week. General ledger details had to be manually entered, since the software could not handle the structure of the old accounts. At the end of two weeks, Joe had the old system put back up so that Friggle could catch up on transactions and get some work out the door. It took three months of 12-hour days for all accounting staff to get the new system operational. Unfortunately, the old maintenance systems would not work with the new operating system, and a new maintenance system had to be evaluated and purchased. Required Assess the IT governance at Friggle Corp. For weaknesses that you identify, provide recommendations for improvement.
Problem 10-22, Canadian 11th. Edition. Page 342 Turner Valley Hospital plans to install a database management system, Hosp Info, that will maintain patient histories, including tests performed and their results , vital statistics, and medical diagnoses. The system will also manage personnel and payroll, medical and non-medical supplies, and patient and provincial health-care billings. The decision was taken by the board of the hospital on the advice of a consultant who was a former employee of Medical Data Services Inc., the developer of Hosp Info. Turner Valley Hospital’s chief information officer has come to your accounting firm to ask for advice on what general controls she should ask Medical Data Services Inc. to install to preserve the integrity of the information in the system and to deal with privacy issues. The system would permit data about patients to be entered by doctors, nurses, and medical technologists. Required • Describe in general terms the controls you would suggest for the system as a whole. • Considering the nature of Turner Valley Hospital, describe the potential risks the hospital should be concerned about with respect to Hosp Info. • What are the advantages of such a database management system? • How would the quality of general controls at the hospital affect your audit?