Auditing internal controls over financial reporting (ICFR)

What is internal control over financial reporting (ICFR)?

ICFR refers to the processes and procedures designed to provide reasonable assurance regarding the reliability of financial reporting, the preparation of financial statements following a financial reporting framework, and the systems and technology used to support financial reporting decisions and booking of transactions.

ICFR controls are designed to reduce the risk of material misstatement and attain the following:

• Transactions are recorded accurately and in a timely manner.
• Unauthorized transactions or misstatements are prevented or detected.
• Financial disclosures comply with regulatory requirements.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Framework is the foundation for most ICFR implementations. Auditing professionals should use this framework as a guide in assessing the design and implementation of their organization’s control framework. 

COSO’s framework emphasizes five key components:

1. Control environment: The organization’s ethical tone and governance structure.
2. Risk assessment: Identifying and assessing risks to financial reporting.
3. Control activities: Policies and procedures to address risks.
4. Information and communication: Systems that ensure timely and accurate information sharing.
5. Monitoring activities: Regular evaluations to maintain control effectiveness.

What is the difference between ICFR and SOX?

The Sarbanes-Oxley Act (SOX) of 2002 is a landmark regulation to improve corporate accountability. SOX compliance focuses on evaluating the effectiveness of ICFR in publicly traded companies, while ICFR refers to the system of controls over financial reporting,

Key differences include:

• Scope: ICFR is a broader concept applicable to both public and private entities, whereas SOX compliance is mandatory only for publicly traded companies in the U.S.
• Documentation requirements: SOX requires extensive documentation of ICFR processes to support management’s assessment of control effectiveness.
• Reporting requirements: Under Section 404 of SOX, management must report on the effectiveness of ICFR, and external auditors must attest to this report.
• Penalties: Non-compliance with SOX can result in severe penalties, including fines and criminal charges for executives.

SOX provides the regulatory framework to assess and certify ICFR’s effectiveness. While only public companies require SOX compliance, all organizations can benefit from internal control over financial reporting.

Is ICFR part of internal audit?

ICFR is intrinsically linked to the internal audit function. While management and those charged with governance are ultimately responsible for designing and maintaining ICFR, internal audit professionals provide independent assurance that these controls are effective. Here’s how internal audit intersects with ICFR:

1. Risk assessment: Internal auditors evaluate financial reporting risks and identify related controls to test effectiveness. Typically, this will start with a materiality assessment to identify significant accounts and classes of transactions that could result in material misstatement.
2. Control testing: Internal audit assesses whether key controls are designed and operating effectively. The controls will include entity-level controls impacting the entire organization, process controls, and IT controls over financial reporting.
3. Documentation: Internal auditors maintain supporting documentation of their ICFR review of internal controls, its effectiveness, compliance with regulatory compliance and industry best practices.
4. Continuous monitoring: Internal audit assists organizations in maintaining ICFR effectiveness through ongoing assessments and recommendations.
5. Collaboration with external auditors: Building strong relationships with management and external auditors is crucial for auditing professionals to complete an ICFR audit successfully.  Many times, external auditors rely on the work done by the internal audit team during their ICFR evaluations. Collaboration among internal and external auditors is essential to the integrity of the financial reporting safeguards.  

Steps to conduct an ICFR audit

Auditing ICFR involves a structured approach to evaluate controls' design and operational effectiveness. Below are the key steps:

1. Planning the ICFR audit - Conducting an ICFR audit involves a systematic and detailed approach to evaluating controls' design and operational effectiveness. The process begins with planning the audit, which requires gaining a thorough understanding of the organization’s business processes and financial reporting environment. Audit leaders should use a risk-based methodology to identify areas with the highest potential for material misstatements, ensuring that the audit scope focuses on significant accounts and key controls. During this phase, it is essential to communicate with stakeholders to align expectations and define objectives.
2. ICFR audit documentation review - The next step is reviewing documentation. This involves evaluating existing records of processes, risks, and controls, ensuring these are comprehensive and current. Flowcharts, risk-control matrices, and process narratives are invaluable for mapping key controls and identifying potential gaps. The documentation must also align with the COSO Framework and SOX requirements to meet compliance standards.
3. ICFR control testing - Auditors move to control testing once the documentation is reviewed. This phase of the ICFR audit includes assessing both the design and operational effectiveness of controls. Design effectiveness testing determines whether controls are appropriately structured to mitigate risks, while operational effectiveness testing verifies controls function as intended through sample testing. Walkthroughs are critical to this stage, as they validate the alignment between control activities and documented processes, providing additional assurance and identifying gaps in processes.
4. Issue identification and remediation - The focus of the ICFR audit shifts to identifying and remediating issues following control testing. Any control deficiencies discovered during testing should be categorized based on their impact, with significant deficiencies and material weaknesses requiring immediate attention. Collaborating with management to develop remediation plans ensures that corrective actions address the root cause of deficiencies. After remediation, controls must be retested to confirm their effectiveness.
5. Reporting - The audit concludes with a reporting phase, where the findings are summarized to assess the effectiveness of ICFR. The report on internal control over financial reporting should identify areas for improvement and offer actionable recommendations to enhance the control environment. This step meets regulatory requirements and provides valuable insights to management and stakeholders for strengthening financial reporting controls.