薩班斯-奧克斯利法案404條款的實(shí)施

Sarbanes-OxleySec.404ImplementationFrameworkforEvaluatingDeficienciesTopicstobeCoveredUpdateonrecentLessonsLearnedfromcompletedY2USandFPI404engagementsDefinitionsinAFrameworkforEvaluatingControlsExceptionsandDeficiencies(the“Framework”)FrameworkchartsandexplanationsIllustrativeexceptionsevaluatedthroughtheFrameworkLessonsLearned–FPIFrequentMaterialWeaknessesAccountingdocumentation,policyand/orprocedures.Controlenvironment.Competency,trainingandsufficiencyofaccountingresources.Informationtechnology,software,securityandaccess.Segregationofduties.Presentationandclassificationofthestatementofcashflows.Revenuerecognition.Incometaxaccounting.Derivativefinancialinstruments.Relatedparties.Inventoryandcostofsales.Statistics–MaterialWeaknesses–

LessonsLearned-EvaluationofDeficienciesFrameworkforevaluatingcontrolexceptionsanddeficienciescontinuestobeausefultool:Stillrequiredsignificantjudgmentbymanagementandtheauditor;Additionalpracticalexperiencewillbehelpful.Areaswhichcreatedthemostdifficulties:Interimmateriality;Aggregation;“Couldfactor”;Compensatingcontrols;Wellreasonedposition.LessonsLearned-RemediationPointintimeconceptallowedcompaniestoremediateexistingmaterialweaknesses:Controlsmustbedesigned,inplaceandcapableofoperatingasofyear-end;Mustbeabletodemonstrateoperatingeffectivenessforasufficientperiodoftime.(Seenextslidefordetailsof“sufficientperiod)Remediationtooklongerthanexpected:Numberofcontrolweaknesses;ITremediationwastimeconsuming–particularlyITGC.SignificantamountofremediationinYear1wasa“stopgap”approach;progressmadeYear2,butmoretodoinYear3.Frequency/Minimumtimeframes(*) Includes4thquarterasoneofthequarters.(**) Ifanewcontrolisinplaceforover90days,usenormalsamplesizeguidance.LessonsLearned–MarketReactionAlthoughtherehasbeen“oneoff”reactiontoineffectiveICFRmarketgenerallyhasnotreactedsignificantlytotheactualreportingofthematerialweakness:Itappearsmostcompanieshavedoneagoodjobinprovidingadvancewarningtothemarketaboutmaterialweaknesses(e.g.,pressreleases,Form8Ksannouncingarestatement,etc.)andthereforethemarkethastakenintoaccountthematerialweaknessbeforeactualreportingatyear-end.LessonsLearned–MarketReactionMoody’scontinuestocategorizematerialweaknesses:CategoryA–processspecific:Auditorcanauditaround.CategoryB–pervasive:Muchmoredifficulttoauditaround;Triggersacreditcommitteereviewandratingsdowngradewhenothernegativefactorsarepresent.Approximately1/3ofthematerialweaknessesatcompaniesfollowedbyMoody’sinYear2wereCategoryB.Moody’salsotreatsdelinquentfilersasiftheyreportedaCategoryBmaterialweakness.LessonsLearned–MarketReactionCleartransparentdisclosureofmaterialweaknessesisimportant:Allowsreaderstofullyunderstandthenatureofthematerialweakness;Willpreventinappropriateinvestorreaction.Investorsexpectacomprehensivediscussionofactionsplannedtoremediatethematerialweakness.ApplyingtheFrameworkforEvaluatingControlExceptionsandDeficienciesFrameworkforEvaluatingDeficienciesSummary

Aframeworkforevaluatingcontroldeficiencieshasbeendevelopedbyninefirms,includingthe‘Big4’TheframeworkprovidesaconsistentunderstandingofPCAOBAuditStandard2IndividualControlDeficienciesEachmustbeclassifiedaseitheracontroldeficiency,significantdeficiency,ormaterialweaknessItemstobeclassifiedincludeunremediateddeficienciesandremediateddeficienciesthathavenotbeenre-testedRedundantcontrols,andcompensatingcontrolsthatoperateatthesamelevelofprecisionasthefailedcontrolandreducemagnitudetoinconsequential,containthefailuretoacontroldeficiencyclassificationCompensatingcontrolsthatreducemagnitudeofmisstatementtolessthanmaterialbutmorethatinconsequentialcontainthefailuretoasignificantdeficiencyAggregationofDeficienciesOnceindividualdeficiencieshavebeenevaluated,thentheyareconsideredintheaggregatetodeterminewhethertheycollectivelyresultinsignificantdeficienciesormaterialweaknessesAggregationisbyaccountbalance,financialdisclosureandCOSOcomponentFrameworkforEvaluatingControlExceptionsandDeficienciesChart1-ExceptionsfoundinthetestingofoperatingeffectivenessChart2-Deficienciesinprocess/transaction-levelcontrolsChart3-DeficienciesinITGCsChart4-DeficienciesinpervasivecontrolsotherthanITGCDeficienciesintheaggregate

DefinitionsandOtherBackgroundInformationCompensating,ComplementaryandRedundantControlsCompensatingcontrols–controlsthatoperateatalevelofprecisionthatwouldresultinthepreventionordetectionofamisstatementthatwasmorethaninconsequentialormaterial,asapplicable,toannualorinterimfinancialstatements.Thelevelofprecisionshouldbeestablishedconsideringthepossibilityoffurtherundetectedmisstatements.(Example:Allrequestsforpaymentmustbeapproved.Allapprovalsover$1000requiredepartmentheadaswellassupervisorsignoff.)Complementarycontrols–controlsthatfunctiontogethertoachievethesamecontrolobjective.(AllrequestsforpaymentarereviewedandapprovedbyboththerequestingdepartmentandtheAccountsPayableclerkforaccuracyandcompletenessandmatchedtoaexistingpurchaseorder.)Redundantcontrols–controlsthatachievethesamecontrolobjective.(Example:Severalreviewsofcontrolactivity–threelevelsofreviewofthesamefigures/calculationsbythreeindependentindividuals.)EvaluatingDocumentaryEvidenceSupportingControlPerformancePCAOBASNo.2,para97Thenatureofthecontrolalsoinfluencesthenatureofthetestsofcontrolstheauditorcanperform.Forexample,theauditormightexaminedocumentsregardingcontrolsforwhichdocumentaryevidenceexists.However,documentaryevidenceregardingsomeaspectsofthecontrolenvironment,suchasmanagement'sphilosophyandoperatingstyle,mightnotexist.Incircumstancesinwhichdocumentaryevidenceofcontrolsortheperformanceofcontrolsdoesnotexistandisnotexpectedtoexist,theauditor'stestsofcontrolswouldconsistofinquiriesofappropriatepersonnelandobservationofcompanyactivities.Asanotherexample,asignatureonavoucherpackagetoindicatethatthesignerapproveditdoesnotnecessarilymeanthatthepersoncarefullyreviewedthepackagebeforesigning.Thepackagemayhavebeensignedbasedononlyacursoryreview(orwithoutanyreview).Asaresult,thequalityoftheevidenceregardingtheeffectiveoperationofthecontrolmightnotbesufficientlypersuasive.Ifthatisthecase,theauditorshouldreperformthecontrol(forexample,checkingprices,extensions,andadditions)aspartofthetestofthecontrol.Inaddition,theauditormightinquireofthepersonresponsibleforapprovingvoucherpackageswhatheorshelooksforwhenapprovingpackagesandhowmanyerrorshavebeenfoundwithinvoucherpackages.Theauditoralsomightinquireofsupervisorswhethertheyhaveanyknowledgeoferrorsthatthepersonresponsibleforapprovingthevoucherpackagesfailedtodetect.EvaluatingDocumentaryEvidenceSupportingControlPerformance

PCAOBStaffQuestionsandAnswers-Q53.DoesAuditingStandardNo.2encourageamindsetthatintheabsenceofdocumentationevidencingtheperformanceofacontrol,thecontrolshouldbepresumedtobeineffectiveinitsoperation?No.AuditingStandardNo.2doesnotcontainapresumptionthatacontrolisineffectivesolelybecausethereisnodocumentationevidencingtheoperationofthecontrol.Suchapresumptionmightsuggestanemphasisona"sign-and-file"mentalityformanagement'sapproachtomaintainingeffectiveinternalcontrol—thatasignatureorotherevidenceoftheperformanceofacontrolmightbecomemoreimportantthantheperformanceofthecontrolitself.Rather,AuditingStandardNo.2emphasizestheimportanceofobtainingevidencethatissufficientlypersuasivetosupportaconclusionaboutwhetheracontrolisoperatingeffectively.Accordingly,theabsenceofdocumentationevidencingtheoperationofanindividualcontrolisnotdeterminativethatthecontrolisnotoperatingeffectively.Theauditormustbesatisfied,however,thatthecontrolactuallyoperated.Gross/AdjustedExposureGrossexposureisaworst-caseestimateofthemagnitudeofamountsortransactionsexposedtothedeficiency(e.g.,thedollarvolumeoftransactionprocessedthroughacontrolduringtheperiod)withregardtoannualorinterimfinancialstatements,withoutregardtotheupperlimitdeviationrateorlikelihoodofmisstatement,andbeforeconsideringcomplementary,redundant,orcompensatingcontrols.Adjustedexposureisthegrossexposureadjustedbytheupperdeviationlimit(i.e.,statisticallyderivedestimateofthedeviationratebasedonthesampleresults,forwhichthereisaremotelikelihoodthatthetruedeviationrateinthepopulationexceedsthisrate).Boththegrossexposureandtheadjustedexposurecanbeconsideredwhenestimatingthepotentialmagnitudeofamisstatementofannualorinterimfinancialstatementsofacontroldeficiency.Gross/AdjustedExposureGrossexposure:$3,000,000Inconsequential(pre-taxequivalentbasis):$100,000Material(pre-taxequivalentbasis):$500,000Process:

Expenditures(excludinginventorypurchases)Accounts:

Operatingexpenses,otherassets,fixedassets,accountspayableAssertion:

ExistenceControlobjective:

Amountspostedtoaccountspayablerepresentgoods/servicesreceived.Controlactivity:

Invoicesareproperlyauthorizedforpaymentandaccompaniedbysupportingdocumentation;discrepanciesareinvestigatedandresolvedtimelyGross/AdjustedExposureTestobjective:

Select25disbursementsandtestforproperauthorization,expectingnodeviationstherebyachievinganupperlimitdeviationrateofnomorethan8.8%*(ata90%assurancelevel).Testresults:1exceptionoutof25itemswasconsideredtobenon-negligible(i.e.,inexcessoftheplannedexceptionrate).Theconclusionreachedwasthatthetestobjectivewasnotmetinitially.Furtherqualitativeevaluationindicatedthatadditionaltestingcouldsupportaconclusionthatthedeviationrateisnotrepresentativeofthetotalpopulationrate.Asecondsampleof25itemswastakenand2exceptionswerefound.Theupperlimitdeviationratefor3exceptionsoutof50itemsis12.9%*.Theadjustedexposureiscomputedas$3,000,000x12.9%=$387,000.Theadjustedexposureapproachassumesthatthepotentialformisstatementisinthesameproportionasthedeviationrateinthepopulation.Gross/AdjustedExposureConclusion:Basedontheadjustedgrossexposure,thereismorethanaremotelikelihoodthatapotentialmisstatementtotheannualfinancialstatementscouldbemorethaninconsequential(butlessthanmaterial)and,accordingly,thedeficiencyisclassifiedasasignificantdeficiency.StatisticalSampleSizes–90%accuracyChart1oftheFrameworkJudgmentinChart1Box1.Examineandunderstandcauseandresultsofexceptions.Wasthetestobjectivemet(e.g.,wastheactualdeviationratelessthanorequaltotheplanneddeviationrate)?Negligibleexception,notacontroldeficiency.Nofurtherconsiderationneeded.Box3.Extendtestingandre-evaluate.Wasthetestobjectivemet?ControldeficiencyBox2.Consideringtheresultsofmanagement'sandtheauditor’stestingandtheinformationobtainedinBox1,couldadditionaltestingsupportaconclusionthatthedeviationrateorobservedexceptionisnotrepresentativeofthetotalpopulation?YesNoYesNoNoYesChart1KeyPointsUsedtoevaluateALLcontrolexceptionsfoundintestsofoperatingeffectivenessofkeycontrols.Thatincludestestsofcontrolactivities,testsofITGCs,andtestsofpervasivecontrolsotherthanITGCs.Doesnotapplytoexceptionsrelatedtooperationalcontrols,non-keycontrols,orcontrolsthatdonotrelatetosignificantaccounts.NotnecessarytorecordtheseitemsontheSummaryofDeficienciesChart1KeyPointsBox2:Achievinga“no”answerwouldbetheresultoffindingaminorcontrolerrorthatisrepresentativeofthepopulation.Thisconditionisaresultoftheauditevidenceandauditorjudgmentfromanunderstandingofthecontrolsenvironmentandtestingsampleselectioncriteria.EvaluatingDeficienciesinProcess/transaction-levelControls

(Chart2)

Theexamplesintheseslidesareforillustrativepurposesonly.Theactualfactswillhaveasignificantimpactontheoutcomeoftheevaluation.SignificantjudgmentwillbenecessaryasneitherAS2northeframeworkforevaluatingexceptionsanddeficienciesprovidesprescriptiveguidanceforconsideringandevaluatingdeficiencies.Auditdocumentationthatevidencesawell-reasonedandlogicalthoughtprocessforconsideringandevaluatingdeficiencies,includingdeficienciesintheaggregate,iscritical.Evaluatingprocess/transaction-levelcontroldeficiencies(Chart2A)NoBox1.Isthepotentialmagnitudeinconsequentialtobothannualandinterimfinancialstatements?

DeficiencyBox2.Aretherecomplementaryorredundantcontrolsthatweretestedandevaluatedthatachievethesamecontrolobjective?

NoBox3.Aretherecompensatingcontrolsthatweretestedandevaluatedthatreducethemagnitudeofamisstatementofbothannualandinterimfinancialstatementstoinconsequential?Box7.Wouldaprudentofficialconcludethatthedeficiencyisatleastasignificantdeficiencyconsideringbothannualandinterimfinancialstatements?GotoStep2NoYesNoStep1:DeterminewhetherasignificantdeficiencyexistsYes

Evaluatingprocess/transaction-levelcontroldeficiencies(Chart2B)NoBox4.Isthepotentialmagnitudelessthanmaterialtobothannualorinterimfinancialstatements?

SignificantDeficiencyBox5.Aretherecompensatingcontrolsthatweretestedandevaluatedthatreducethemagnitudeofamisstatementtobothannualandinterimfinancialstatementstolessthanmaterial?

NoBox6.Doesadditionalevaluationresultinajudgmentthatthelikelihoodofamaterialmisstatementofboththeannualandinterimfinancialstatementsisremote?Box8.Wouldaprudentofficialconcludethatthedeficiencyisamaterialweaknessconsideringbothannualandinterimfinancialstatements?MaterialWeaknessNoYesNoStep2:DeterminewhetheramaterialweaknessexistsYesBox1–CalculatingPotentialMagnitudePotentialmagnitudeshouldbecalculatedbasedonbestestimateofpotentialexposure(i.e.,whatcouldoccur)usingallcurrentinformation.Aknownmisstatementissometimesagoodindicationofwhatthepotentialmagnitudecouldbe.“Otherappropriatemeasures”intheguidingprinciplestoBox1oftheFramework.IncludedintheFrameworktoallowcreationofaquantitativemodelthatmarriesmagnitudeandlikelihoodandmirrorsthegross/adjustedexposuremodel.Noonehascreatedamodelanditisbelievedthatthiswouldbeextremelydifficult.Anysuchmodelwouldneedtoevaluatenumerouskindsofdeficienciesalongwithrelatedqualitativefactors.Boxes3&5-CompensatingControlsAssumethereareineffectivecontrolsovertheaccesstocreateandpostmanualjournalentries.ManagementReviewandApproval>$1m

BusinessUnitAnalyticsHighLevelConsolidatedAnalyticsChart2–Step2Determinewhetheramaterialweaknessexists.NoBox4.Isthepotentialmagnitudelessthanmaterialtobothannualorinterimfinancialstatements?

SignificantDeficiencyBox5.Aretherecompensatingcontrolsthatweretestedandevaluatedthatreducethemagnitudeofamisstatementtobothannualandinterimfinancialstatementstolessthanmaterial?

NoBox6.Doesadditionalevaluationresultinajudgmentthatthelikelihoodofamaterialmisstatementofboththeannualandinterimfinancialstatementsisremote?Box8.Wouldaprudentofficialconcludethatthedeficiencyisamaterialweaknessconsideringbothannualandinterimfinancialstatements?MaterialWeaknessNoYesNoYesBox6-MaterialityinEvaluatingDeficienciesThedefinitionofmaterialityisthesameforthefinancialstatementauditandtheauditofinternalcontrols.Mustassessmaterialityusingbothquantitativeandqualitativeconsiderations.Overallmaterialityisusedtoevaluatedeficiencies(i.e.,notplanningmateriality).Applyingmaterialityisverysubjective.Box6–Doesadditionalevaluationreducethelikelihoodofamaterialmisstatementtoremote?Thenatureofthefinancialstatementaccounts,disclosures,andassertionsinvolved;forexample,suspenseaccountsandrelatedpartytransactionsinvolvegreaterrisk.Thesusceptibilityoftherelatedassetsorliabilitytolossorfraud;thatis,greatersusceptibilityincreasesrisk.Thesubjectivity,complexityorextentofjudgmentrequiredtodeterminetheamountinvolved;thatis,greatersubjectivity,complexityorjudgment,likethatrelatedtoanaccountingestimate,increasesrisk.Thecauseandfrequencyofknownordetectedexceptionsintheoperatingeffectivenessofacontrol;forexample,acontrolwithanobservednon-negligibledeviationrateisadeficiency.Theinteractionorrelationshipwithothercontrols;thatis,theinterdependenceorredundancyofcontrols.Thepossiblefutureconsequencesofthedeficiency.Anindicationofincreasedriskevidencedbyahistoryofmisstatements,includingmisstatementsidentifiedinthecurrentyear(AS2.140).Theadjustedexposureinrelationtooverallmateriality.

Chart2KeyPointsBoxes1,2,and3shouldbeconsideredseparately.Adjustedexposureshouldnotbereducedbythequantitativeimpactofthecompensatingandcomplementaryorredundantcontrols.Theprudentofficialconceptissometimesreferredtoasthe“WallStreetJournaltest”.Wouldaknowledgeableandinformedindividualreachthesameconclusionasmanagementandtheauditorthatthedeficiencywasonlyacontroldeficiency,iftherelevantfactsandconclusionwereonthefrontpageoftheWallStreetJournal?Ifacontroldeficiencyexists,itisdifficulttousequalitativefactorstosaythatamisstatementofmorethaninconsequentialisremote.Limitingthemagnitudeofadeficiencytolessthaninconsequentialcangenerallyonlybeaccomplishedbyidentifyingandtestingredundant,complementaryorcompensatingcontrols.Chart3oftheFrameworkChart3-ITGCdeficienciesChart3KeyPointsAllITGCdeficienciesshouldbeassessedonchart3.ITGCsmayalsobeassessedusingchart2iftheyarefunctioningasanapplicationlevelcontrol.(Issuesthatalsodirectlyaffectfinancialapplications,accountsorbalances.)ITGCscontributetotherelianceobtainedonapplicationcontrols,andmanagementreportsusedinthefinancialstatementaudit.Itmaystillbepossibletoobtaincomfortfromapplicationcontrols,dependingontheseverityoftheITGCdeficiency.Whencontrolsworkintandemtoachieveaninformationprocessingobjective,testco-dependent(i.e.,complementary)controls.Box5:DoesadditionalevaluationofthefactorsbelowresultinajudgmentthattheITGCdeficiencyisasignificantdeficiency?Natureandsignificanceofthedeficiency.Thepervasivenessofthedeficiency.Thecomplexityofthecompany’ssystemsenvironment.Therelativeproximityofthecontroltoapplicationsanddata.Aretherelatedaccountssusceptibletofraud?CauseandfrequencyofknownordetectedexceptionsinITGC.HistoryofmisstatementsrelatingtoapplicationssupportedbytheITGCdeficiency.Chart4oftheFrameworkChart4-EvaluatingcontroldeficienciesinpervasivecontrolsotherthanITGCAggregatingDeficienciesandOtherMattersAggregatingDeficienciesAggregatedeficienciesby:SignificantaccountbalanceAccountsPayablePayrollRevenuesDisclosureRevenuerecognitionGAAPdisclosuresCOSOcomponentEachofthe5areasofCOSOAlsoconsidershearnumberofdeficienciesEvaluatingaDeficiencyintheApplicationofGAAPChart2isgenerallyusedtoevaluatedeficienciesthatcoulddirectlyresultinamisstatementtothefinancialstatements.Chart4isgenerallyusedtoevaluatedeficienciesin“softer”COSOcomponentsthatincreasethelikelihoodofamisstatementtothefinancialstatements.IneffectivecontrolsovertheselectionandapplicationofGAAPcandirectlyresultinamisstatementandarepartoftheinformationandcommunicationCOSOcomponent.EvaluatingDeficienciesintheApplicationofGAAPNumberofControlDeficienciesVeryfewauditadjustmentsIsolatedaccountsManyadjustmentsManyaccountsimpactedFewadjustmentsrelatedtononroutineand/orcomplextransactionsAccountlevelmaterialweaknessIneffectivecontrolsovertheapplicationofGAAPtononroutineand/orcomplextransactionsPervasivecontrolissueDeficienciesintheselectionandapplicationofGAAPareaggregatedbytheinformationandcommunicationCOSOcomponent.

Chart2

Chart

4OtherMattersAuditadjustmentsareevidencethatacontroldeficiencyexists-underlyingcontroldeficienciesshouldbeconsideredintheaggregate.Controlsrelianceonautomatedapplicationcontrols,accountingproceduresandreportsiscontingentuponeffectiveITGCs.Keycontrolswhichworkintandemtoachieveaninformationprocessingobjectiveareeachconsideredfortesting.ResponseisrequiredforITGCandtransactionlevelweaknesses.ItemsthatRequireEvaluationNoRemediationRemediated–Retestnotplanned–Correctiveactiontaken,notre-testedRetestfailed?GuidanceforEvaluationDecisiontreesforindividualdeficienciesbakedintooneformProcess/transactionITgeneralcontrolsPervasivecontrolsControlsincertainITareaswillusetheprocess/transactiondecisiontree,e.g.,application&databaselogicalsecurity,changecontrol,thatareeithertransactionalcontrolsorarelinkeddirectlytoapplicationsandtransactionalcontrolsConsiderevaluationtemplatetomirrorguidanceforprocess/transactionandtodocumentfactpatternsasbasisforconclusions(ie:forcharts2and3)ProcessforevaluationReferenceitemsonSADtokeycontroltestedTransferitemstobeevaluatedtoindividualtemplatesIdentifyrisk,transactionalassertion(s)CategorizecompensatingcontrolsprovidedbybusinessRedundant,compensating(samelevelofprecision),compensating(differentlevelofprecision,e.g.reconciliations,varianceanalysis,fluxanalysis,businessperformancereviews)AddothercompensatingcontrolsthatpassedtestingProcessforevaluationCorrelatetoscopinginformation(company,generalledgeraccountlevel)QuantifypotentialmagnitudeCaptureadditionalinformationneededforaggregationTransferinformationbacktoSADAllinformationinhiddencolumnsonSADneedtobecompletedforaggregationEvaluateimpactofdeficienciesbysignificantaccount(10K),disclosure,andCOSOcomponentEvaluationTemplatesPleaserefertoassociatedworddocumentsofevaluatingdeficienciesandinformationneededforevaluationIndividualExamplesforEvaluationExample1ControlDescription:Processesaredocumentedcompletelyandaccurately.Documentationconsistsofanarrativedocumentandaflowchartdocumentwhichclearlyidentifyanddescribedetailsofcontrolactivities.Documentationisagreedtotheactivitiesbyindividualsresponsibleforeachprocesses.Example1WalkthroughorTestingresult:Documentationofcontroldoesnotagreewithactualperformanceofcontrolsbypersonnelorflowchartsofcontroldoesnotmatchactualflowsofcontrols.Example1-EvaluationDocumentationiscorrectandusersareincorrectlyperformingthecontrol.DEFICIENCY.Documentationisincorrectandthecontrolactuallyoperatesinadifferentmannerthandocumented.Ifmanagementmakesappropriatechangesinatimelymannerthereisnoissue–NODEFICIENCY.Ifmanagementdoesnotalterdocumentationtocorrectlymatchcontrolprocedure–DEFICIENCY..Example1–EvaluationChart1–EvaluatingOperatingEffectivenessBox1:Examineandunderstandthecauseandresultsofexceptions.Wastheobjectivemet?No–gotoBox2. Box2:Consideringtheresultsofmanagement’sandauditorstesting–couldadditionaltestingsupportthatthedeviationratearenotrepresentativeofthepopulation?No.Thisisacontroldeficiency.No–gotoBox1–Chart2–EvaluatingProcess/Transaction-LevelControlDeficiencies.Example1-EvaluationChart2–EvaluatingProcess/TransactionDeficienciesBox1:Isthepotentialmagnitudeinconsequentialtofinancialstatements?YESgotoBox7. Box7:Wouldaprudentofficialconcludethatthedeficiencyisatleastasignificantdeficiencyconsideringthefinancialstatements?No-DEFICIENCYGrossexposure=noeffectonfinancials.Documentationissue

Example2ControlDescription:Financialconsolidationamountsarecombined,inter-companybalancesareeliminatedanddetailedcalculationsareperformedandpresentedformonthlyandyearlyfinancialresults.Financialcalculationsarereviewedbyathirdpartyforaccuracyandcompletenesstoensureappropriatedisclosureofentityresults.Grossexposure:$10,000,000Inconsequential(pre-taxequivalentbasis):$100,000Material(pre-taxequivalentbasis):$500,000Example2WalkthroughorTestingresult:Personnelperformingcalculationsoffinancialinformationarealsothereviewerandapproverofthosesamecalculationsatlocallevels.OrSignificantfinancialcalculationsarenotreviewedorapprovedbyathirdpartyatlocallevels.Example2-EvaluationDetailedcalculationsoffinancialinformationthatarenotverifiedandapproved,indetail,byathirdpartyorifthesecalculationsarere-checkedandverifiedbythesamepersonnelperformingtheoriginalcalculationsresultsinaDEFICIENCY.Example2–EvaluationChart1–EvaluatingOperatingEffectivenessBox1:Examineandunderstandthecauseandresultsofexceptions.Wastheobjectivemet?No–gotoBox2. Box2:Consideringtheresultsofmanagement’sandauditors