IIA Webcast s302

1
Dave Richards, CIA, CPA Director, Internal
Auditing FirstEnergy Corporation
2
Annual Certificationof Internal Controls The
Internal AuditDepartments Role

• The Institute of Internal Auditors
• Webcast Series on Sarbanes-Oxley
• Session 2 - March 3, 2003

3
The Webcast Series on Sarbanes-Oxleys Impact on
Internal Auditing

• January 28 - Disclosure Controls - Available in
  online archive and on CD Rom
• March 3 - Annual Certification of Internal
  Controls
• April 1 - Coordination of Internal External
  Audit Work
• April 15 - Looking Ahead to Future Changes
  Impacting Internal Auditing
• Tuesdays from 100 - 230 p.m. EST

4
Agenda
100 - 110 Introduction Overview of Annual
Certification of Controls - Dave
Richards 110 - 117 Methodology - Sheryl
Hildebrand 117 - 124 Testing the Controls -
Gary McGuire 124 - 130 FDIC Certification
Experience - Brian Szabo 130 - 145 External
Auditor Attestation - Gary Stauffer 145 -
150 Break 150 - 225 Questions Answers -
Panel 225 - 230 Concluding Remarks - Dave
Richards
5
Requirements (proposed)

• Statement of Managements Responsibilities
  (establishing maintaining)
• An assessment, at end of the most recent fiscal
  year
• Effectiveness of internal controls
• Procedures for financial reporting
• Reporting to audit committee external auditor
  any significant deficiencies and material
  weaknesses in the design or operation of internal
  controls
• External auditor attestation

6
Internal Controls ???

• A Process, Effected by an Entitys Board of
  Directors, Management and Other Personnel,
  Designed to Provide Reasonable Assurance
  Regarding the Achievement of Objectives in the
  Following Categories
• Effectiveness Efficiency of Operations
• Reliability of Financial Reporting
• Compliance with Applicable Laws and Regulations.

Source COSO
7
Control Components
Used to evaluate overall companys
accomplishment of objectives and specific
processes performance

• Control environment
• Risk assessment
• Control activities
• Information and communications
• Monitoring

8
Managements Assessment
Process designed to provide reasonable assurance

• Transactions properly authorized
• Access to assets controlled against unauthorized
  or improper use
• Transactions recorded to
• Permit preparation of FS (GAAP)
• Maintain accountability of assets
• Controls in place to ensure proper reporting for
  external purposes

9
Issues

• Definition of internal controls?
• Financial
• Operational
• Compliance
• What is the level of internal control
  documentation needed?
• How to test evaluation criteria?
• Process or organizational driven?
• Requirements for attestation?

10
Material Weakness

• Impact of control structure on preventing
• Errors
• Fraud
• Not detected in
• Timely manner
• Normal course of work
• Material impact on financial statements
• Material influence decisions made based on
  financial information

11
Agenda
100 - 110 Introduction Overview of Annual
Certification of Controls - Dave
Richards 110 - 117 Documentation Tools -
Sheryl Hildebrand 117 - 124 Testing the
Controls - Gary McGuire 124 - 130 FDIC
Certification Experience - Brian Szabo 130 -
145 External Auditor Attestation - Gary
Stauffer 145 - 150 Break 150 -
225 Questions Answers - Panel 225 -
230 Concluding Remarks - Dave Richards
12
Agenda
100 - 110 Introduction Overview of Annual
Certification of Controls - Dave
Richards 110 - 117 Methodology - Sheryl
Hildebrand 117 - 124 Testing the Controls -
Gary McGuire 124 - 130 FDIC Certification
Experience - Brian Szabo 130 - 145 External
Auditor Attestation - Gary Stauffer 145 -
150 Break 150 - 225 Questions Answers -
Panel 225 - 230 Concluding Remarks - Dave
Richards
13
Agenda
100 - 110 Introduction Overview of Annual
Certification of Controls - Dave
Richards 110 - 117 Methodology - Sheryl
Hildebrand 117 - 124 Testing the Controls -
Gary McGuire 124 - 130 FDIC Certification
Experience - Brian Szabo 130 - 145 External
Auditor Attestation - Gary Stauffer 145 -
150 Break 150 - 225 Questions Answers -
Panel 225 - 230 Concluding Remarks - Dave
Richards
14
Agenda
100 - 110 Introduction Overview of Annual
Certification of Controls - Dave
Richards 110 - 117 Methodology - Sheryl
Hildebrand 117 - 124 Testing the Controls -
Gary McGuire 124 - 130 FDIC Certification
Experience - Brian Szabo 130 - 145 External
Auditor Attestation - Gary Stauffer 145 -
150 Break 150 - 225 Questions Answers -
Panel 225 - 230 Concluding Remarks - Dave
Richards
15
Agenda
100 - 110 Introduction Overview of Annual
Certification of Controls - Dave
Richards 110 - 117 Methodology - Sheryl
Hildebrand 117 - 124 Testing the Controls -
Gary McGuire 124 - 130 FDIC Certification
Experience - Brian Szabo 130 - 145 External
Auditor Attestation - Gary Stauffer 145 -
150 Break 150 - 225 Questions Answers -
Panel 225 - 230 Concluding Remarks - Dave
Richards