Vol. 3 ('24.3Q)
The Frontline
HMC Internal Control over Financial Reporting Newsletter
We offer a quarterly newsletter to help you gain an understanding and insight into the ICFR(Internal Control over Financial Reporting).
We hope to provide you with the opportunity to gain familiarity with ICFR through various contents, and your active attention to ICFR is highly appreciated.
- Finance & Accounting Planning Team -
News
[Summary of the articles]
We have summarized articles related to fraud, embezzlement accidents, and ICFR trends that are of issue recently. Through this, we hope to raise the company's awareness on fraudulent accidents and ICFR.
(Please note that the full text of the article inevitably appears as it is in Korean.)
Column
We provide insight for effective and strengthening measures through internal control issues and case analysis.
Internal Accounting? Internal Control? What's the difference?
Seonghoon Moon, Finance & Accounting Planning Team, HMC
There is continuous news reported about poor internal controls in Korean companies. Interestingly, most companies that had financial frauds due to weak internal controls received unqualified opinions in their external audits of internal accounting, and no operational deficiencies were reported.
Opinion
Through the opinions of experts, we consider the direction of effective internal control improvement and derive solutions.
Suggestions for Internal Control Disclosure to Prevent Embezzlement and Fraud
Jeong-hoon Shim, Managing Director of IA Division, Samjong KPMG
It has been nearly five years since the audit system for internal control over financial reporting(ICFR) was introduced. Some argue that the strengthened ICFR contributes to corporate accounting transparency, while others contend that it places an excessive burden on companies, particularly when considering the...
Knowledge Hub
We will briefly summarize and inform you of the knowledge related to ICFR. We hope it will be an opportunity to understand unfamiliar concepts and terms for ICFR.
[Internal Control over Financial Reporting Sampling Criteria]
-
The ICFR operating effectiveness test is conducted based on the External Audit Act and uses a systematic sampling method to ensure reliability
- The sample size is determined according to the control frequency, population size, and risk level (Low/Normal/High). For individual occasional controls, practical considerations are made, such as using annualized figures to reduce the burden on operations.
- The sample size follows the best practice guidelines for the ICFR, with the company and auditors independently selecting and evaluating samples.
- The operating effectiveness test is conducted three times a year, with most controls, including individual occasional controls, being completed by the second operational evaluation.
- 1st : August (Covering January to July)
- 2nd : November (Covering August to September)
- 3rd : Next year january (Covering November to December and anuual controls)
※ Based on FAQ 34 of the ICFR Best Practice Guidelines
※ Definition of Population
-
The total number of occurrences of the business process to be evaluated over a one-year period
- For example, the population of a 'monthly report review control' refers to the 12 monthly reports prepared over a year.
- The size of the population varies depending on the nature and frequency of the control, and this is used as a basis for determining the appropriate number of samples for evaluation.
※ Risk Level Classification
-
Control risk levels are mainly classified into three stages (Low, Normal, and High), determined by considering the significance of the impact on the financial statements if the control fails and the complexity of the control.
- Low risk : Simple and repetitive controls with relatively little impact on financial statements
- Normal risk : Routine but important controls that can have a certain level of impact on financial statements
- High risk : Complex and critical controls that can have a significant impact on financial statements
※ Examples of sample size calculations for each evaluation stage (Individual occasional controls)
> Population size for January to July : 3,102
> Control risk level : Normal
-
Company
1. Confirm the population size that occurred during the first operating effectiveness test period and the risk level of the control defined by the company
2. Check the sample size criteria suggested in the ICFR Best Practice Guidelines : 45
3. Calculate the number for the 1st operating effectiveness test : 45 * 7 (Jan to Jul) / 10 (Jan to Oct, excluding Nov-Dec as routine controls) = 32
4. Calculate the number for the 2nd operating effectiveness test : 45 - 32 = 13 (from Aug to Oct occurrences)
-
Auditor
1. Confirm the population size that occurred during the first operating effectiveness test period
2. Based on the judgment that the control environment is stable from previous year operating effectiveness test, check the minimum sample size criteria : 25
3. Calculate the number for the 1st operating effectivenes test : 25 * 7 (Jan to Jul) / 10 (Jan to Oct, excluding Nov-Dec as routine controls) = 17
4. Calculate the number for the 2nd operating effectivenes test : 25 - 18 = 8 (from Aug to Oct occurrences)
Number of evidence requests for the first operating effectiveness test : 49 (32+17)
Number of evidence requests for the second operating effectiveness test : 21 (13+8)
Annual Operation & Schedule
