# Presentation: 455882

## Compliance and Internal Controls 

- Effects on the Financial Statement Audit

## Compliance & Internal Controls

- Agency Management is responsible for:
- Establishing and maintaining controls to provide reasonable assurance that the Agency’s objectives are achieved, and
- Establishing policies and procedures for complying with specific laws and regulations and clearly documenting and communicating these policies and procedures to appropriate personnel

## Compliance & Internal Controls

- Financial Statement Auditors are responsible for:
- Evaluating whether internal controls provide reasonable assurance that material misstatements, losses, or noncompliance would be prevented or detected during the period under audit; and
- Reporting on (1) internal controls over financial reporting and (2) compliance with laws and regulations in the audit report, as prescribed by Generally Accepted Government Auditing Standards (GAGAS)

## Compliance & Internal Controls

- Financial Reporting Controls ensure that:
- Transactions (including budgetary) are properly recorded, processed, and summarized to permit the preparation of the financial statements and required supplementary stewardship information (RSSI) in accordance with generally accepted accounting principles (GAAP), and
- Assets are safeguarded against loss from unauthorized acquisition, use, or disposition

## Compliance & Internal Controls

- The following are significant deficiencies and strong indicators that a material weakness in internal control over financial reporting exists:
- Restatement of previously issued financial statements to reflect the correction of a misstatement due to error or fraud, and
- A material misstatement in the current period, identified by the auditor, that was not initially identified by the Agency’s internal control over financial reporting

## Compliance & Internal Controls

- Compliance Controls provide reasonable assurance that transactions are executed in accordance with:
- Laws and regulations that could have a direct and material effect on the financial statements or RSSI
- Laws governing the use of budget authority (i.e, Anti-Deficiency Act), and
- Other laws, regulations, and government-wide policies identified in OMB audit guidance (i.e.,  OMB Circ. A-130)

## Compliance & Internal Controls

- Evaluating Internal Controls generally requires:
- Obtaining knowledge about the design of relevant controls
- Determining whether controls have been placed in operation (vs. written in a manual)
- Assessing the control risk, and
- Testing controls to determine additional procedures needed to opine on Financial Statements

## Compliance & Internal Controls

- Relying on Internal System Controls
- Electronic environment allows auditors to rely more heavily on internal system controls to gain assurances on the financial statements
- Automation allows auditing through the system vs. around the system
- The Automated Cash Reconciliation Worksheet System (ACRWS) is a good example of how auditors gain assurance by testing system controls

## Compliance & Internal Controls

- Automated Cash Reconciliation Worksheet System (ACRWS)
- ACRWS is a database server application developed to facilitate reconciling cash collections and disbursements recorded in USDA’s and Treasury’s accounting system
- Prior audits revealed USDA needed to complete thorough cash reconciliations regularly to ensure complete and accurate recording of cash activity and balances, a long-standing material weakness

## Compliance & Internal Controls

- USDA’s Monthly Cash Reconciliation Process:
- USDA forwards extract of monthly cash collections and disbursements activity (SF 224-Statement of Transactions)
- Treasury compares SF 224 Record Totals to Treasury Record Totals and reports differences (FMS 6652-Treasury’s Statement of Differences)
- ACRWS matches SF 224 to Treasury’s detailed records (by date, schedule number and amount)
- USDA researches unmatched amounts, corrects and clears items on FMS 6652s

## Compliance & Internal Controls

- Causes for Out of Balance Conditions:
- Internal Control Issues
- Data Entry Errors
- Documents Incorrectly or Not Processed
- Incorrect Date or Agency Location Code
- System Issues
- Interface and/or Feeder System Issues
- Requirement Changes
- Posting Model Errors

## Compliance & Internal Controls

- Corrective Actions for Out of Balance Conditions
- Adjusting FFIS data (i.e., date, schedule number, GL account) or to record omitted transactions
- Adjusting Treasury data to correct Agency Location Code or to record omitted transactions
- Contacting the FFIS Project Office for correcting system issues

## Compliance & Internal Controls

- Financial Auditors’ current approach involves evaluating system controls over ACRWS and the related reconciliation control procedures
- Before ACRWS, auditors had to statistically sample all cash collections and disbursements that occurred during the reporting period and trace back to source documentation (labor-intensive for both Agency and auditors)
- With ACRWS, auditors can limit sample and concentrate on system controls and reconciliations

## Compliance & Internal Controls

- Evaluating System Controls typically involves performing walk-thrus to understand and document:
- Manner in which transactions are initiated (deposit tickets, debit and payment vouchers, OPAC, EFT)
- Nature and type of records, journals, ledgers, source documents and accounts (SF 224s, 6652s)
- Processing involved and nature of computer files (Deposit/Disbursement Detail Files), and
- Manner in which files are accessed, updated and deleted (application controls testing)

## Compliance & Internal Controls

- Reviewing Controls of the Reconciliation Process typically includes determining whether:
- Reconciliations are performed timely by qualified staff with segregated duties
- Adjustments are recorded accurately and approved by supervisors
- Causes are properly identified and well documented, and
- System issues are promptly reported for corrective action

## Compliance & Internal Controls

- Results of Controls Testing
- If system controls and reconciliation procedures are in place and working effectively (low risk), limited sampling needs to be performed to gain assurance on the financial statements
- If controls are not in place or working properly (high risk), then a projectable statistical sample of transactions may need to be tested

## Compliance & Internal Controls

- Evaluating compliance with laws & regulations relating to the cash collections and disbursements cycle would include complying primarily with:
- the Debt Collection Improvement Act, Prompt Payment Act, and Anti-Deficiency Act
- Understanding the processing involved is also important in determining whether the financial management systems substantially comply with the Federal Financial Management Improvement Act (FFMIA)

## Compliance & Internal Controls

- Effects on Financial Statement Audit from review of cash collections and disbursements process:
- Qualified audit opinion due to a material misstatement identified from substantive testing of cash transactions
- Material control weaknesses due to reconciliations not performed timely, inaccurate/unsupported adjustments, or system control weaknesses
- Noncompliance with laws and regulations (including budgetary and FFMIA) could be discovered

## Compliance & Internal Controls

- According to GAGAS:
- Reporting on internal controls is a “critical component of monitoring the effectiveness of an organization’s risk management and accountability systems”, and
- Reports on internal controls over financial reporting and compliance with laws and regulations are an “integral part of the financial statement audit and should be considered in assessing the overall results of the audit”