ACCA-F1-Ch9-Control-security-and-auditPPT课件.pptx

Control securityandaudit Chapter9 2020 3 25 1 TOPICLIST 1Internalcontrolsystems2Internalcontrolenvironmentandprocedures3Internalauditandinternalcontrol4Externalaudit5ITsystemssecurityandsafety6Buildingcontrolsintoaninformationsystem 2020 3 25 2 围剿 亚伦窝案 浙江亚伦集团股份有限公司原董事长 总经理王品发坐在被告席上 面无表情 经审理法院认定 王品发利用职务之便先后22次收受他人贿赂折合人民币24 35万元 以受贿罪一审判决王品发有期徒刑14年 剥夺政治权利3年 并处没收财产4万元 至此 对 亚伦窝案 核心人物王品发的审计尘埃落定 浙江亚伦集团系国家二级企业 行业百强 全国造纸行业重点骨干企业 集团有职工2400余人 年上缴利税达2000多万元 在一个财政收入不及一亿元的龙游县 它是财政收入的支柱 在当地经济发展中的作用举足轻重 1993年底 王品发走马上任 成为亚伦集团总经理 党委书记 1995年又兼任集团公司董事长 案发之前 王品发是省 市 县三级人大代表 龙游县委委员 2020 3 25 3 自1998年起 亚伦集团一些离退休 在职职工集体上访 提供王品发及一些公司领导违纪的种种线索 要求上级部门予以清查 1999年3月30日 中共龙游县委组织部要求审计局对亚伦集团主要领导进行经济责任审计 审计组确定了 以经济责任审计履行情况为主要内容 从内控制度人手摸清家底 以群众反映的情况为突破口 以发现大案要案为目标 的审计工作方针 为防止不必要的干扰 审计组采取了送达审计与就地审计相结合的办法 分三组开展查证 第一组负责对王品发任职期间各项经济指标进行核实 重点审查有无重大决策失误和越权行为 第二小组重点审查财务收支 并延伸至下属二三级单位法人 审查其内控制度是否健全有效 第三小组审计期末资产 摸清企业家底 通过对固定资产 存货 应收账款 货币资金的审计 初步核实了资产 2020 3 25 4 经过20多天的审计 审计组初步摸清了集团内部情况 并发现了一系列疑点 审计组决定 从疑点最大 群众反映最突出的实业公司的苹果购销人手 力争一举突破 审计人员发现 从1995年1月到1998年12月 个体商贩陈某几乎垄断了集团的全部水果采购供应生意 总价款近270万元 有的发票存在涂改情况 并与实际所购货物数量出入很大 陈某开具的结账发票连号 不符合正常发票使用规律 部分票据中 钱常棣 实业公司经理 签字审批日期与陈某开票日期相同甚至超前 公司与陈某的货款结算基本上按陈某提供的房地产发票结账 从账面上看 陈无利可图 不合常规 审计人员进行了多次分析 认为陈某以房地产发票与实业公司结账 而未开具当地地方税务发票 涉嫌偷税12万余元 经进一步审查发现 陈某是王品发过去的 战友 与王来往甚密 可以推断 钱常棣与陈某大笔水果交易背后的关键人物 正是亚伦集团的总经理 王品发 2020 3 25 5 审计组立即着手查证第二个疑点 即集团公司对外销售水松纸事项 根据群众举报 公司将水松纸低价销售给任某 年销量几乎被其个人包揽 根据亚伦集团提供的1994一1995年会计核算账册查证 客户深圳某装饰材料公司 共购水松纸961吨 平均售价低于公司年度平均售价约2150元 另一客户深圳某实业公司1995年共购买水松原纸703吨 平均售价低于公司年度平均售价500余元 据查 上述两公司采购各种水松纸后 由任某销售给云南的烟草企业 低价巨额销售 且由一人经手 其中必有蹊跷 幕后交易的可能性很大 后来查明 王品发在进购原材料 基建招投标 发包 职工福利等方面 导演的一出出权钱交易的丑剧 露出了真相 集团内上行下效 上自总经理 副总经理 下至热电分厂煤调度员 采购员等共计20余人因涉嫌受贿 贪污纷纷落马 2020 3 25 6 公司治理问题 采购业务的内部控制制度 销售业务的内部控制制度 2020 3 25 7 1Internalcontrolsystems Aninternalcontrolisanyactiontakenbymanagementtoenhancethelikelihoodthatestablishedobjectivesandgoalswillbeachieved InstituteofInternalAuditors Management objectivesandgoals plans organisesanddirectstheperformanceofsufficientactions control 2020 3 25 8 内部控制的产生与发展 内部牵制阶段 InternalCheck 1940s前 强调职责分工 业务流程及记录的交叉检查 监督控制内部控制制度阶段 1940s 1970s 1972年 AICPA 审计准则公告第1号 内部会计控制 资产的安全完整 会计记录的准确可靠内部管理控制 提高经营效率和效果 与业务授权 决策有关内部控制结构阶段 1980s 1990s 1988年 AICPA 审计准则公告第55号 三个要素 控制环境 会计系统 控制程序 2020 3 25 9 内部控制在近年的发展 内部控制整合框架阶段 1990s 1985年 由AICPA 美国会计学会 AAA 财务经理协会 FEI 内部审计师协会 IIA 和管理会计师协会 IMA 共同赞助成立了全国舞弊性财务报告委员会 即Treadway委员会 该委员会所探讨的问题之一就是舞弊性财务报告产生的原因 其中包括内部控制不健全问题 基于Treadway委员会的建议 其赞助机构又组成了一个专门研究内部控制问题的委员会 COSO委员会 1992年 COSO委员会提出报告 内部控制 整体框架 1994年进行了增补 建议公司披露内控评价报告和由审计师出具的验证报告 支持者甚多 但多年来内部控制始终未成为强制披露的内容 2020 3 25 10 COSO的内部控制整合框架 三目标五要素 2020 3 25 11 内部控制在近年的发展 2001 2002年 安然 世通等财务舞弊案发生 2020 3 25 12 内部控制在近年的发展 美国 萨班斯 奥克斯利法案 SOX 的404条款明确要求 公司对外提供内控报告 且必须经审计师审核 2004年10月 COSO发布 企业风险管理框架 EnterpriseRiskManagement ERM 把内部控制纳入风险管理的框架之中 包括了八大要素 内部环境 目标设定 事项识别 风险评估 风险应对 控制活动 信息与沟通 监控 2020 3 25 13 TheUK TheTurnbullreport 1999 英国的 内部控制框架报告 对分散在英国法律 法规中涉及内部控制的规定进行了归纳和整理 立足英国的法律环境和公司治理特点 建立了具有原则导向性 风险导向性 框架指引性的内部控制指南 2020 3 25 14 Directionofcontrolsystems 三目标 Turnbullguidelines 1999 Facilitateitseffectiveandefficientoperationbyenablingittorespondappropriatelytorisks includingthesafeguardingofassets identifyingandmanagingliabilitiesHelpensurethequalityofinternalandexternalreporting Helpensurecompliancewithapplicablelawsandregulations andinternalpolicies 同样的三目标 经营效率 财务可靠 合法合规 2020 3 25 15 Directionofcontrolsystems Turnbullguidelines 1999 reducesbutdoesnoteliminatethepossibilitiesSystemswillprovidereasonable notabsolute assurancethat butwon tprovidecertainprotectionagainstallpossibleproblems 合理保证 非绝对保证 Why 2020 3 25 16 Internalcontrolframeworks 同样的五要素 controlenvironmentinternalcontrols controlprocedures riskassessmentandresponseprocessessharingofinformationmonitoring internalcontrolsystem 2020 3 25 17 2Internalcontrolsystem 两构成 controlenvironmenttheoverallcontextofcontrol inparticulartheattitudeofdirectorsandmanagerstowardscontrolcontrolproceduresthedetailedcontrolsinplacemaybeincorporatedwithincomputerisedaccountingsystems butextendsbeyondthosematterswhichrelatedirectlytotheaccountingsystem 2020 3 25 18 2 1Internalcontrolenvironment istheoverallattitude awarenessandactionsofdirectorsandmanagementregardinginternalcontrolsandtheirimportanceintheentity encompassesthemanagementstyle andcorporatecultureandvaluessharedbyallemployees 2020 3 25 19 Elementsofastrongcontrolenvironment 2 Thecompany sculture codeofconduct humanresourcepolicies performancerewardsystems 1 Clearstrategiestowardsrisks 3 Seniormanagementcompetence integrity trust 4 employeesCleardefinitionofauthority responsibility accountabilityCommunicationhavingtheknowledge skills tools 2020 3 25 20 2 2Controlprocedures arethosepoliciesandprocedureswhichareestablishedtoachievetheentity sspecificobjectives thesafeguardingofassets thepreventionanddetectionoffraudanderror theaccuracyandcompletenessoftheaccountingrecords thetimelypreparationofreliablefinancialinformation etc 2020 3 25 21 Classificationofcontrolprocedures 1 AdministrationrelatetochannelsofcommunicationandreportingresponsibilitiesAccountingapplytorecordingtransactionsAndestablishingresponsibilitiesforrecords transactionsandassets 2020 3 25 22 Prevent preventerrorsfromhappening Eg checkinginvoicesfromsuppliersagainstgoodsreceivednotesbeforepayingtheinvoicesDetect detecterrorsoncetheyhavehappened Eg bankreconciliationsphysicalchecksofinventoryagainstinventoryrecordsCorrect minimiseornegatetheeffectoferrors Eg back upofcomputerinputattheendoftheday Classificationofcontrolprocedures 2 2020 3 25 23 Discretionary 需决定的 Eg checkingasignatureonapurchaseorder Non discretionary 不需判断的 Eg enteringapinnumberatacashdispensingmachine Voluntarychosenbytheorganization Mandatedrequiredbylawandimposedbyexternalauthorities Classificationofcontrolprocedures 3 2020 3 25 24 Manual 人工控制 humanfunctionsAutomated 自动控制 programmedprocedures Classificationofcontrolprocedures 4 2020 3 25 25 Classificationofcontrolprocedures 5 General 一般控制 reducerisksassociatedwiththecomputerenvironment relatetotheenvironmentwheretheapplicationisoperated Eg changemanagementcontrolsApplication 应用控制 arecontrolsthatprevent detectandcorrecterrors Epletenesschecksofallrecords 2020 3 25 26 Classificationofcontrolprocedures 6 Financial 财务控制 TypesoffinancialcontrolprocedureSegregationofdutiesPhysical custodyofassetsAuthorisationandapprovalManagementSupervisionOrganisationArithmeticalandaccountingPersonnel 2020 3 25 27 2 4Internalchecks 区分 内部牵制 theworkofonepersonisprovedindependentlyoriscomplementarytotheworkofanother Object thepreventionorearlydetectionoferrorsandfraud E g thedelegationandallocationofauthoritythedivisionofworkthemethodofrecordingtransactionstheuseofindependentlyascertainedtotals 2020 3 25 28 Arithmeticalinternalchecks 算术上的IC pre listalistthatisdrawnupbeforeanyprocessingtakesplace post listalistthatisdrawnupduringorafterprocessing controltotalatotalofanysortcomparedwithanothertotalthatoughttobethesame Apre listtotalisacontroltotal Cashisreceivedbypostandapre listprepared Receiptsarerecordedindividuallyinthecashbook Atotalofamountsisobtainedbyaddinguptheindividualentries Thetotalinthecashbookshouldagreewiththepre listcontroltotal Example 2020 3 25 29 Aimsofinternalchecks Segregatetasks responsibilitycanbetracedCreateandpreserverecordsthatactasconfirmationBreakdownroutineproceduresintoseparatestepsorstagestofacilitateanevenflowofworkReducethepossibilityoffraudanderroradivisionofwork theworkofonepersonisprovedindependentlyoriscomplementarytotheworkofanotherperson 2020 3 25 30 小结2 6Characteristicsofagoodinternalcontrolsystem Aclearlydefinedorganisationstructure separate responsibility co ordinationAdequateinternalchecks Separationofduties authorizing custody recordingAcknowledgementofworkdone signature initials rubberstampsProtectivedevicesforphysicalsecurity Formaldocumentsshouldacknowledgethetransferofresponsibilityforgoods 组织结构 内部牵制 签名确认 保安措施 书面记录 2020 3 25 31 Pre reviewsystemforauthorisingtransactionswithinspecifiedspendinglimitsPost reviewauthorisation custodyandre orderingproceduresPersonnelshouldhavethecapabilitiesandqualificationsnecessaryAninternalauditdepartment 事前检查 事后复核 限额审批 分离流程 人力胜任 内部审计 2020 3 25 32 小结2 7Limitationsontheeffectivenessofinternalcontrols segregationofdutiesvs collusionAuthorisationvs AuthorisationabuseManagementoverride 2020 3 25 33 审计的基本分类 1 政府审计政府审计机关执行的审计 亦称国家审计 主体为审计署 厅 局 派出机关等四级国家审计机关 目标 财政支出的合法性 效益性 2 民间审计民间审计组织执行的审计 亦称社会审计 独立审计 主体为会计师事务所 目标 财务报表的合法性 公允性 3 内部审计公司内部审计机构或人员所实施的审计 目标 效益 合法 财务可靠 风险管理 资产安全 2020 3 25 34 3Internalaudit Definition Anindependentappraisalactivityestablishedwithinanorganization Internalauditispartoftheinternalcontrolsystem Itisacontrolwhichfunctionsbyexaminingandevaluatingtheadequacyandeffectivenessofothercontrols appliedtotheanalysisoftheeffectivenessofallpartsofanentity soperationsandmanagement 2020 3 25 35 3 2Theneedforinternalaudit listedcompanies annuallyreviewtheneedtohaveoneExample CompanyABCIt sgrowingintoalargefirmwithdiversifiedbusiness Over10 000employeesHRpromotionplanevery3yearsKeyrisksmovesfrommarketingtomanagementdifficulties Itsinternalcontrolsystemsisdisordered Increasednumberofunexplainedorunacceptableevents DoesCompanyABCneedaninternalauditfunction 2020 3 25 36 3 3Objectivesofinternalaudit Reviewofaccountingandinternalcontrolsystems Reviewoffinancialandoperatinginformation Reviewoftheeconomy efficiencyandeffectivenessofoperations Reviewofcompliancewithlaws regulationsandotherexternalrequirements Reviewofthesafeguardingofassets Reviewoftheimplementationofcorporateobjectives Identificationofbusinessandfinancialrisks monitoringtheorganisation soverallriskmanagementpolicySpecialinvestigationsintoparticularareas 经营效率 财务可靠 合法合规 资产安全 风险管理 内控系统 2020 3 25 37 Howtoassessriskmanagement 3 4 TheadequacyThecontrolcultureThecontrolproceduresTheoperationandeffectiveness Insufficient focusonrecommendinganappropriateframework Thereisaframework focusonauditingtheriskmanagementprocesses 2020 3 25 38 3 5Thefeaturesofinternalaudit AppraisalIndependence 3 9 itisvitalthattheinternalauditorisandisseentobeindependent TheresponsibilitystructureTheauditor smandatoryauthorityTheauditor sownapproachthisappliesjustasmuchtotheinternalauditorastotheexternalauditor 2020 3 25 39 3 6Typesofaudit Aninternalauditdepartmentmaybeaskedbymanagementtolookintoanyaspectoftheorganisation Operationalaudit 经营审计 alsoknownas management efficiency or valueformoney auditsconcentrateontheoutputsandefficiencyoftheorganisationateverylevel 2020 3 25 40 Systemsaudit 系统审计 atestingandevaluationoftheinternalcontrolsCompliancetests 控制测试 theinternalcontrolsarebeingappliedasprescribed Substantivetests 实质性测试 substantiatetheentriesinthefiguresinaccounts ifthecompliancetestsrevealthatinternalcontrolsareworkingsatisfactorily thentheamountofsubstantivetestingcanbereduced 2020 3 25 41 Example Aninternalauditonthetravelclaimswhichareeventuallypaidandrecordedonthegeneralledger Compliancetests lookatthecontrolsinthetravelclaimsection 观察报销程序的过程 询问 抽样检查有无审批 复核记录 E gwhetherthereisaclerkcheckstheadditiononthetravelclaimandinitialsaboxtosaythathehasdoneso Substantivetests Examinethefiguresextractedfromthegeneralledger 抽样 检查数据的准确性 分类正确 2020 3 25 42 TransactionsauditManagementinvestigations probityaudit 经济责任审计 廉正审计 aimstodetectfraudusesonlysubstantivetests 2020 3 25 43 3 8Accountabilityofinternalaudit Theinternalauditorisaccountabletothehighestexecutivelevelintheorganisation preferablytotheauditcommitteeoftheBoardofDirectors Theauditorneedsaccesstoallpartsoftheorganisation TheauditorshouldbefreetocommentTheauditor sreportneedtobeactionedatthehighestlevel 2020 3 25 44 Example Internalcontrolsystemsandinternalaudit TheMidasMailOrderCompanyoperatesacentralwarehouse Allmerchandiseisdistributedbypostorcarriertothecompany s10 000customers Thesalesandcashcollectionsystemissetoutasbelow Statefourobjectivesofaninternalcontrolsystem Listfourmajorcontrolswhichyouwouldexpecttofind Explaintheobjectiveofeachofthesecontrols Foreachcontroldescribetwotestsaninternalauditortocarryout 2020 3 25 45 2020 3 25 46 2020 3 25 47 Answer a FourobjectivesofaninternalcontrolsystemToenablemanagementtocarryonthebusinessinanorderlyandefficientmanner Tosatisfymanagementthattheirpoliciesarebeingadheredto Toensurethattheassetsofthecompanyaresafeguarded Toensurethattheenterprisemaintainscompleteandaccuraterecords 2020 3 25 48 b FourmajorcontrolsControlovercustomers creditworthiness FornewcustomersForexistingcustomersObjective avoidthecompanysupplyinggoodstocustomerswhoareunlikelytobeabletopayforthemControlovertherecordingofsalesandreceivables multipleorderform sequentiallypre numberedcontrolsovertheunusedformsObjective checkthecompletenessofthecompany srecordingproceduresinrelationtotheincomeandreceivables 2020 3 25 49 b Fourmajorcontrols Controlovertheissueofinventoryarecordofinventorymovementsismaintained 2020 3 25 50 b FourmajorcontrolsControlovertheinvoicingofcustomers sequentiallypre numberedinvoicestocontrolthecompletenessofthesequenceallinvoicesarematchedwiththeappropriateorderform Copy2 Objective nogoodsaredespatchedtocustomerswithoutaninvoice 2020 3 25 51 b Fourmajorcontrols Controlovermoniesreceived anadequatesegregationofdutiesbetweenmembersof a staffresponsiblefortheupdatingofthesalesrecords b thosedealingwiththereceipt recordingandbankingofmoniesaregularindependentreviewofageddebtorbalancesObjectives propercontrolsexistwithregardtothecomplete accuraterecordingofmoniesreceived safecustodyoftheassetcash theeffectivenessofcreditcontrolprocedures 2020 3 25 52 c AppropriatetestsControlsovercustomers creditworthinessForasampleofnewaccounts checktoseethat a suitablereferenceswereobtainedbeforethecompanysuppliedanygoodsoncreditterms andthat b thecreditlimitsetwasproperlyauthorisedandofareasonableamount Forasampleofexistingcustomers orders checktoseethattheirinvoicevaluewouldnotgoabovetheiragreedcreditlimit 2020 3 25 53 c Appropriatetests ControlsovertherecordingofsalesandreceivablesOnasamplebasischeckthecompletenessofthesequenceoforderforms unusedinventoryoforderformsaresecurelystored 保证完整性 checktoseethatorderformscanbetracedthroughthesystem incasethattheorderwascancelled 逆查 保证真实性 orthatavalidinvoicewassubsequentlyraised 顺查 保证完整性 2020 3 25 54 c Appropriatetests ControlovertheissueofinventoryandthedespatchofgoodsForasampleofentriesintheinventoryrecords checktoensureavalidorderformexistsAttendtheinventoryroomstoobservetheproceduresandcheckthatgoodsarenotissuedwithoutavalidorderform 2020 3 25 55 c Appropriatetests ControlovertheinvoicingofcustomersOnasamplebasischeckthecompletenessofthesequenceofinvoicesraised andtheunusedinventoryofinvoiceformsaresecurelystoredinvoicesraisedhavebeenproperlymatchedwiththeappropriateorderform copy2 2020 3 25 56 4Externalaudit isaperiodicexaminationofthebooksofaccountandrecordsofanentitycarriedoutbyanindependentthirdparty theauditor toensurethattheyhavebeenproperlymaintained areaccurateandcomplywithestablishedconcepts principles accountingstandards legalrequirementsandgiveatrueandfairviewofthefinancialstateoftheentity 评价财务报表的公允性 评价财务报表的合法性 2020 3 25 57 4 1Differencesbetweeninternalandexternalaudit muchwiderscope 2020 3 25 58 4 2Relationshipbetweenexternalandinternalaudit Co ordinationplantheoverallauditdiscussmattersofmutualinterestMutualaccesstoauditprogrammesandworkingpapersExchangeofauditreportsandmanagementlettersCommondevelopmentofaudittechniques methodsandterminology 2020 3 25 59 4 3Assessmentbyexternalauditors Whentheexternalauditorswishtorelyontheworkoftheinternalauditors theexternalauditorsmustassesstheinternalauditfunction Internalaudit sorganisationalstatusfreeofanyotheroperatingresponsibility Internalaudit sscopeoffunctioncoincidentwiththatofexternalaudit Internalaudit stechnicalcompetenceDueprofessionalcareinternalauditworkisproperlyplanned supervised 2020 3 25 60 Link practiceofexternalauditing 具体审计程序检查记录与文件 InspectionofRecordsorDocuments 检查有形资产 InspectionofTangibleAssets 观察 Observation 询问 Inquiry 函证 Confirmation 重新计算 Re calculation 重新执行 Re performing 分析程序 AnalyticalProcedures 总体审计程序 风险评估 控制测试 实质性程序 获取审计证据 形成审计意见 审计目标存在或发生权利和义务完整性准确性分类截止 2020 3 25 61 theinternalandindependentauditors reviewofinternalcontrolproceduresdifferinpurpose internalauditor torecommendchangestothesystem externalauditors todeterminetheextentofthesubstantiveworkrequired 了解被审单位及其环境 控制测试 实质性测试 评估重大错报风险 评估控制风险 审计意见 重大错报风险越小 固有风险和控制风险越小 实质性测试的范围 样本量 越小 2020 3 25 62 5ITsystemssecurityandsafety Security ininformationmanagementterms meanstheprotectionofdatafromaccidentalordeliberatethreatswhichmightcauseunauthorisedmodification disclosureordestructionofdata andtheprotectionoftheinformations