信息披露制度：内部控制【外文翻译】

财务报告的内部控制【外文翻译】本科毕业论文(设计)外文翻译外文题目 Auditing Internal Control Over Financial Reporting外文出处《 Auditing Internal Control Over Financial Reporting》University of Hawai’i at Hilo 2004(12):100-107外文作者 James E. Hunton原文:Public Company Accounting Oversight Board (PCAOB) Auditing Standard No. 2 , AnAudit of Internal Control Over Financial Reporting Performed in Conjunction With an Audit of Financial Statements, (AS-2) addresses the work that is required to audit internal control over financial reporting and the relationship of that audit to the audit of the financial statements.Since the issuance of AS-2, auditors and other parties have raised questions on a variety of issues about the implications of AS-2. To answer those questions, on June 23, 2004, the Office of the Chief Auditor of the PCAOB issued guidance in the form of questions and answers on issues related to the implementation of AS-2. Refer to the September 30, 2004, and October 15, 2004, GAAS Update Service issues for coverage of the topics previously addressed by the PCAOB staff in its June release, which relate to the following areas: auditor independence;scope and extent of testing; evaluating deficiencies; multi-location issues; using work of others;and serviceorganizations. In response to additional implementation questions that continue to be raised, on October 6, 2004, the PCAOB staff updated its June release, Auditing Internal Control Over Financial Reporting, on frequently asked questions. The updated PCAOB release issued in October 2004 provides additional interpretive and implementation guidance on issues relating to scope and extent of testing, evaluating deficiencies, and service organizations.PCAOB staff questions and answers represent the staff’s opinions on issues related to the implementation of the standards of the PCAOB. They are intended to1provide guidance to auditors on implementing the PCAOB’s standards. However, they are neither rules of the PCAOB nor have they been approved by the PCAOB.Scope and Extent of TestingQ. Does the scope of internal control over financial reporting as it relates to compliance with laws and regulations under AS-2 encompass controls over a broader array of circumstances than those described in AU Section 317, Illegal Acts byClients?A. Yes. AU Section 317, Illegal Acts by Clients, provides that the auditorconsider the laws and regulations that have a direct and material effect on the determination of financial statement amounts. However,paragraph 15 of AS-2 does not use the phrase “direct and materialeffect on the determination of financial statement amounts.” Rather, paragraph 15 of AS-2 provides that operations andcompliance with laws and regulations directly related to the presentation of and required disclosures in financial statements are encompassed in internal control over financial reporting. This provision in AS-2 includes: (1) the “direct and material”effects described in AU Section 317, such as compliance with taxlaws that affect accruals and the amount recognized as expense in the accounting period; and (2)other circumstances that would be classified under AU Section 317 as having only indirect effects on the financial statementsIn the PCAOB staff’s view, internal control over financialreporting encompasses controls over the identification, measurement, and reporting of all material actual loss events that have occurred, including controls over the monitoring and risk assessment of areas in which such actual loss events are reasonably possible. The staff guidance illustrates this point by indicating that, for example, a waste disposal company’s internal control over financial reporting ordinarily would encompass controls for identifying and measuring environmental liabilities for existing and newly acquired landfills, even if there is no governmental investigation or enforcement proceeding underway.The PCAOB staff believes that its interpretation is consistent with the Securities and Exchange Commission (SEC) staff’s views regarding management’s2responsibilities for assessing internal control over financial reporting. According to the SEC staff, while it may be possible to connect the violation of any law, rule, or regulation to the financial statements by observing that if the violation is significant enough it will have a material effect on the registrant’s financial statements, the SEC staff does not believe that compliance with all laws fits within the definition. The SEC’s financial reporting requirements and the Internal Revenue Code are examples of regulations that are directly related to the preparation of the financial statements. Conversely, rules requiring disclosure as to the existence of a code of ethics or disclosure as to the existence of an audit committee financial expert are examples of rules promulgated under the Sarbanes-Oxley Act of 2002 (SOA) that are not directly related to the preparation of financial statementsEvaluating DeficienciesWhat is the effect on the auditor’s evaluation of management’s assessment of internal control and the au ditor’s report in circumstances under which management’s assessment and the auditor’s audit procedures do not include certain controls that should have beenencompassed because neither management nor the auditor has the ability to evaluate those controls?A. There may be circumstances in which there are restrictions on the scope of the auditor’s engagement to audit internal control over financial reporting. For example, both management and the auditor may be unable to obtain evidence of operating effectiveness of controls at a service organization used by the company because a type 2 Statement on Auditing Standards (SAS) No. 70, Service Organizations, (SAS-70) report that is deemed to be necessary under the circumstances is not available. If neither management nor the auditor is able toperform tests of controls at the service organization (e.g., because management does not have a contractual right to do so), a scope limitation exists.An SEC staff interpretation states that, subject to limited exceptions, management cannot issue a report on internal control with a scope limitation. Under paragraph 20 of AS-2, in order for the auditor to satisfactorily complete an audit of internal control over financial reporting, management must fulfill several3responsibilities, including evaluating the effectiveness of the company’s internal control over financial reporting and supporting its evaluation with sufficient evidence. Therefore, if management is unable to assess certain controls over financial reporting that should have been included in its assessment, a control deficiency exists. If the transaction or events subject to controls that management is unable toassess are material to the company’s financial statements, the auditor ordinarily would determine that this control deficiency represents a material weakness. In addition, the auditor would need to determine whether management, under the circumstances, had failed to fulfill its responsibilities to evaluate the effectiveness of the company’s internal control over financial reporting and support its evaluation with sufficient evidence. If the auditor determines that management has not fulfilled its responsibilities, the auditor is required to disclaim an opinion. Also, to the extent that management has willfully decided not to fulfill its responsibilities, the auditor may have additional responsibilities under AU Section 317 and under Section 10A of the Securities Exchange Act of 1934.In making the determination of whether management has fulfilled its respons ibilities to evaluate the effectiveness of the company’s internal control over financial reporting, the PCAOB staff indicates that the auditor could evaluate factors, such as the following: • The date of the contract or other transaction documents that co uld have provided management with the ability to assess controls or otherwise to obtain evidence of the operating effectiveness of relevant controls;• The relative ease or difficulty with which management could renegotiate the contract or transaction documents and the extent to which management has attempted to do so; and• Whether management is able to assess the controls, or obtain evidence of operating effectiveness of relevant controls, in the absence of having access to the controls. The PCAOB staff provides the following examples of how to apply the aforementioned guidance:• Inability to obtain evidence of the operating effectiveness of controls at the4service organization.When the transactions or events subject to the internal controls at the service organization are material to the company’s financial statements, and management is unable to obtain evidence about their operating effectiveness, the auditor ordinarily would determine that a material weakness exists. However, for example,if the servicing contract with the service organization was executed in 2001 (i.e., well before the existence of the SOA) and management already has negotiated with the service organization to provide a suitable type 2 SAS-70 report next year, the auditor might determine that management had fulfilled its responsibilities under AS-2. Accordingly, the auditor might be able to complete the audit of internal control over financial reporting. On the other hand, the auditor ordinarily would determinethat management had not fulfilled its responsibilities under AS-2 in the following circumstances: (1) if management recently renewed its contract with the service organization but did not negotiate either an agreement about obtaining a suitable type 2 SAS-70 report or permission to test controls at the service organization; or (2) if the contract with theservice organization is long-dated and management has not attempted to negotiate to obtain the necessary evidence of operating effectiveness of controls. Accordingly, in these circumstances, the auditor would be required to disclaim an opinion and would need to evaluate his or her additional responsibilities under AU Section 317 and under Section 10A of the Securities Exchange Act of 1934.• Consolidation of variable interes t entities. The SEC allows management tolimit its assessment of internal control over financial reporting by excluding certain entities that are subject to consolidation under FASB Interpretation No. 46, Consolidation of Variable Interest Entities—an Interpretation of ARB No. 51(FIN-46). For example, management is permitted to exclude from the scope of its assessment the controls of an entity in existence prior to December 15, 2003, that is consolidated pursuant to FIN-46, for which the company does not have the right or authority to assess the controls and also lacks the ability to make that assessment. In such situations, according to AS-2, the auditor may limit the audit of internal control over financial reporting in the same manner and report without reference to the scope5limitation. On the other hand, if management is unable to assess the controls of an entity consolidated pursuant to FIN-46 that came into existence subsequent to December 15, 2003, the auditor would concludethat a control deficiency exists; accordingly, if the consolidated variable interest entity is material to the company’sfinancial statements, the auditor ordinarily would conclude thatthis represents a material weakness in internal control over financial reporting. Also, the auditor needs to determine whether management has fulfilled its responsibilities as described in paragraph 20 of AS-2. If the auditor determines that management has not fulfilled its responsibilities, the auditor is required to disclaim an opinion. Also, to the extent that management has willfully decided not to fulfill its responsibilities, the auditor may have additional responsibilities under AU Section 317 and under Section 10A of the Securities Exchange Act of 1934.Service Organizations• By vir tue of the requirement in AS-2 for the auditor to perform at least one walkthrough for each major class of transactions, if a service organization’s services involve the processing of a major class of transactions, should the auditor perform walkthroughs at the service organization?• AS-2 requires the auditor to perform at least one walkthrough for each major class of transactions. In a walkthrough, the auditor traces all types of company transactions and events: (1) from origination; (2) through the comp any’s accounting, information, and financial reporting system; and (3) to their inclusion and disclosure in the company’s financial statements. Because of the importance of walkthroughs and thefact that they accomplish several objectives, AS-2 specifically requires the auditor to: • Perform walkthroughs in each annual audit of internal control over financial reporting;• Perform the walkthroughs directly himself or herself (i.e., the auditor is precludedfrom delegating the performance of walkthroughs to others, e.g., to management or tothe internal auditors); and• Perform at least one walkthrough for each major class of transactions. If theprocessing of a major class of transactions involves the services ofa service6organization, the PCAOB staff advises that auditors would not haveto perform walkthroughs at the service organization, as long as they were able to obtain sufficient evidence to achieve the objectives of the walkthrough by other means, for example through a service auditor’s repor t. In evaluating if the service auditor’s report provides evidence sufficient to achieve the objectives of a walkthrough, the PCAOB guidance indicates that auditors should follow the directions in paragraphs B21 to B24 of AS-2, which indicate:• The audit or may obtain evidence about whether controls that are relevant to management’s assessment and the auditor’s opinion are operating effectively by performing procedures, such as the following:—Performing tests of the user organization’s controls over the activities of the service organization (e.g., testing the user organization’s independent performance of selected items processed by the service organization or testing the user organization’s reconciliation of output reports with source documents).— Performing tests of controls at the service organization.—Obtaining a service auditor’s report on controls placed in operation and tests of operating effectiveness, or a report on the application of agreed-upon procedures that describes relevant tests of controls.• If a service auditor’s report on controls placed in operation and tests of operating effectiveness is available, management and theauditor may evaluate whether this report provides sufficient evidence to support the assessment and opinion, respectively.In evaluating whether such a service auditor’s report provides sufficient evidence, management and the auditor should consider the following factors: — The time period covered by the tests of controls and its relation to the date of management’s assessment;— The scope of the examination and applications covered, the controls tested,and the way in which tested controls relate to the company’s controls; and—The results of those tests of controls and the service auditor’s opinion on the operating effectiveness of the controls.• If the service auditor’s report on controls placed in operation and tests of operating7effectiveness contains a qualification that the stated control objectives might be achieved only if the company applies controls contemplated in the design of the system by the service organization, the auditor should evaluate whether the company is applying the necessary procedures. For example, completeness of processing payroll transactions might depend on the company’s validat ion that all payroll records sent to the service organization were processed by checking a control total. • In determining whether the service auditor’s report provides sufficient evidence tosupport management’s assessment and the auditor’s opinion, management and the auditor should make inquiries concerning the service auditor’s reputation, competence, and independence. The auditor should refer to AU Section 543,Part of AuditPerformed by Other Independent Auditors, for additional guidance. If the companyauditor concludes that information is not available to obtain sufficient evidence to achieve the objectives of the walkthrough, he or she may: (1) consider contacting the service organization, through the user organization, to obtain specific information or to request that a service auditor be engaged to perform the procedures that will providethe necessary information; or (2) visit the service organization and perform the necessary procedures.Source:James E. Hunton, Auditing Internal Control Over Financial Reporting :University of Hawai’i atHilo. December 2004(12):100-1078译文:财务报告的内部控制上市公司会计监督委员会(PCAOB)审计准则第2号，内部审计对财务报告与审计财务报表的控制，解决了所需要的内部控制审计财务报告工作和相关的财务报表的审计。

会计内部控制中英文对照外文翻译文献(文档含英文原文和中文翻译)内部控制系统披露—一种可替代的管理机制根据代理理论，各种治理机制减少了投资者和管理者之间的代理问题（Jensen and Meckling，1976； Gillan，2006）。

传统上，治理机制已经被认定为内部或外部的。

内部机制包括董事会及其作用、结构和组成（Fama，1980；Fama and Jensen，1983），管理股权(Jensen and Meckling，1976)和激励措施，起监督作用的大股东(Demsetz and Lehn，1985)，内部控制系统(Bushman and Smith，2001)，规章制度和章程条款(反收购措施)和使用的债务融资（杰森，1993）。

外部控制是由公司控制权市场(Grossman and Hart,1980)、劳动力管理市场（Fama,1980）和产品市场（哈特,1983）施加的控制。

各种各样的金融丑闻，动摇了世界各地的投资者，公司治理最佳实践方式特别强调了内部控制系统在公司治理中起到的重要作用。

内部控制有助于通过提供保证可靠性的财务报告，和临时议会对可能会损害公司经营目标的事项进行评估和风险管理来保护投资者的利益。

这些功能已被的广泛普及内部控制系统架构设计的广泛认可，并指出了内部控制是用以促进效率，减少资产损失风险，帮助保证财务报告的可靠性和对法律法规的遵从（COSO,1992）。

尽管有其相关性，但投资者不能直接观察，因此也无法得到内部控制系统设计和发挥功能的信息，因为它们都是组织内的内在机制、活动和过程（Deumes and Knechel,2008）。

由于投资者考虑到成本维持监控管理其声称的（Jensen and Meckling，1976）,内部控制系统在管理激励信息沟通上的特性，以告知投资者内部控制系统的有效性,是当其他监控机制（该公司的股权结构和董事会）比较薄弱，从而为其提供便捷的监控（Leftwich et等, 1981）。

内部控制系统披露—一种可替代的管理机制塞尔吉奥-贝里塔会计部门博科尼大学根据代理理论，各种治理机制减少了投资者和管理者之间的代理问题（Jensen and Meckling，1976； Gillan，2006）。

传统上，治理机制已经被认定为内部或外部的。

内部机制包括董事会及其作用、结构和组成（Fama，1980；Fama and Jensen，1983），管理股权(Jensen and Meckling，1976)和激励措施，起监督作用的大股东(Demsetz and Lehn，1985)，内部控制系统(Bushman and Smith，2001)，规章制度和章程条款(反收购措施)和使用的债务融资（杰森，1993）。

外部控制是由公司控制权市场(Grossman and Hart,1980)、劳动力管理市场（Fama,1980）和产品市场（哈特,1983）施加的控制。

各种各样的金融丑闻，动摇了世界各地的投资者，公司治理最佳实践方式特别强调了内部控制系统在公司治理中起到的重要作用。

内部控制有助于通过提供保证可靠性的财务报告，和临时议会对可能会损害公司经营目标的事项进行评估和风险管理来保护投资者的利益。

这些功能已被的广泛普及内部控制系统架构设计的广泛认可，并指出了内部控制是用以促进效率，减少资产损失风险，帮助保证财务报告的可靠性和对法律法规的遵从（COSO,1992）。

尽管有其相关性，但投资者不能直接观察，因此也无法得到内部控制系统设计和发挥功能的信息，因为它们都是组织内的内在机制、活动和过程（Deumes and Knechel,2008）。

由于投资者考虑到成本维持监控管理其声称的（Jensen and Meckling，1976）,内部控制系统在管理激励信息沟通上的特性，以告知投资者内部控制系统的有效性,是当其他监控机制（该公司的股权结构和董事会）比较薄弱，从而为其提供便捷的监控（Leftwich et等, 1981）。

外文翻译原文Regulation by disclosure: the case of internal control Material:/content/351u43877v108j45/author：Laura F. Spira Michael Page…the subject of internal control, once a guaranteed remedy for sleeplessness, has made a spectacular entry onto political and regulatory agendas. (Power 1997: 57) In his analysis of the development of the role of audit, Power observes that internal control has become increasingly important as part of a system of regulation which relies on making internal mechanisms visible through forms of self-validation and disclosure. Corporate governance requirements have frequently been couched in the form of codes of practice on the principle of ‘comply or explain’ rat her than prescriptive legislation. The monitoring role of the board of directors, which forms the apex of the internal control system of an organisation, has been emphasised. The influence of particular interest groups has been important in the negotiation of these developments. Auditors, both internal and external, can claim expertise in internal control, advancing their organisational position in the case of internal auditors (Spira and Page 2003) and increasing the potential for sales of specialised services in the case of external auditors. Regulators and legislators have focused on internal control issues as a policy response to crises (Cunningham 2004).The use of internal control as a corporate governance device reflects a subtle but significant chang e in its conception, moving from the original ‘‘supportive’’ notion that internal control systems were an integral part of the structure of an organization which enabled its goals to be achieved, to the more recent view of internal control as a substantial ly ‘‘preventive’’ system, designed to minimise obstructions to goal achievement and carrying significantly greater expectations of the effectiveness of such systems. As Page and Spira (2004) note, companies have also increasingly taken ‘risk-based’ approac hes to internal control because of the increased pace of organizational change—control systems change too fast to be rigidly documented and companies may not even have full documentation relating to some of their IT based systems. For these reasons there has been an increase in‘delegation’ of control downwards in the organization and there is likely to be no central record of control systems.The emergence of risk-based approaches to internal control has resulted in a confluence of internal control and risk management to the point that an influential publication (Jones and Sutherland 1999) issued at the same time as the Turnbull guidance referred frequently to ‘‘internal control and risk management’’ as a single concept in providing practical assistance for boards in complying with the Turnbull disclosure requirements.The demonstration of ‘‘good’’ corporate governance is a challenge for boards of directors but describing structural mechanisms such as internal control processes may be one way of meeting demands for transparency. Thus, what was once an internal interest becomes a means of demonstrating regulatory compliance.Concerns about internal control in the US and the UK arose initially from a desire to establish the boundaries of external auditor responsibility. The difficulties of defining internal control are illustrated in the earliest US experience, as summarized in a lecture by Mautz (1980). He quotes the 1949 AICPA definition: Internal control comprises the plan of organization and all of the coordinate methods and measures adopted within a business to safeguard its assets, check the accuracy and reliability of its accounting data, promote operational efficiency, and encourage adherence to prescribed managerial policies.and describes the concern of fi rms’ legal counsel about the broadness of this definition. This concern led to a new definition issued in 1958 which split the four parts of the original defi nition between ‘‘accounting control’’ (safeguarding assets and checking reliability and accura cy of accounting data) and ‘‘administrative control’’ (promotion of operational ef ficiency and encouragement of adherence to prescribed management policies) and defi ned auditors’ responsibility as reviewing accounting controls only. A further narrowing took place in 1972 when the US auditing profession limited the two components of ‘‘accounting control’’ even more.Up to this point, the definition was really only of concern to companies and their auditors but the passing of the Foreign Corrupt Practices Act in 1977 changed this. The Act was passed in response to bribery scandals and for the rst time envisaged the use of internal control as regulation. It was based on a narrow conception of internal control newly described as ‘‘internal accounting control’’. It also changed the focus of internal control: whereas the concerns of ‘‘accounting control’’ had been at low organizational levels and clerical procedures, the Act nowshifted attention to controls at board level for the first time.A process for identifying, evaluating and managing the significant risks faced by the Group has been in place throughout the period and is reviewed regularly by the Board. The management of each business is responsible for establishing detailed controls which are embedded within operational and financial procedures in order to manage business risks on a day-to-day basis. Changes in key business objectives which may impact on the risk role of the Group and require changes to existing controls and procedures were monitored during the year by the Chief Executive and Group Finance Director through the established framework of monthly reviews with the Managing Directors and Financial Controllers of each of the business units. The findings and recommendations of internal audit work carried out during the 2004 financial year have been reported to the Audit Committee and a summary of the findings has been presented to the Board. The internal audit program focuses on the key risks inherent in the businesses and the system of control necessary to manage such risks. (Parity Plc)There is little surprise here: in fact it appears to be a series of statements of the obvious. The same impression is gained when reviewing the disclosures of Shaftsbury Plc.The key elements of the Company’s procedur es and internal financial control framework are:1. The close involvement of the executive Directors in all aspects of day-to-day operations, including regular meetings with senior staff to review all operational aspects of the business.2. Clearly defined responsibilities and limits of authority. The Board has responsibility for strategy and has adopted a schedule of matters which are required to be brought to it for decision.3. A comprehensive system of financial reporting and forecasting. Financial accounts are prepared quarterly and submitted to the Board. Profit and cash flow forecasts are prepared at least quarterly, approved by the Board and used to monitor actual performance.4. Regular meetings of the Board and Audit Committee at which financial information is reviewed and business risks are identified and monitored.The company seems to have the kinds of controls that could be expected in a public company. The only context in which ‘risk’ is mentioned is ‘identi fication and monitoring’ that occurs, (in some unexplained way) at regular board and auditcommittee meetings.Both these disclosures are largely ‘statements of the obvious’; while they are apparently company specific there is nothing that surprises, indeed, one would be very surprised if the opposite were stated.Other companies disclosures fall on a continuum of informativeness. For example Electrocomponents plc explains that risk management is ‘an integral part of the system of internal control’ and goes on to give a details of its c ontrol structure and risk processes within a report of average length.Substantive disclosures may include:●descriptions of company structure, particularly relating to committeescharged with risk management responsibilities and their relationship and communications with the board●the role of the audit committee and of the internal audit function, and therelationship between them and with the board●descriptions of risks identified as material●descriptions of risk events and action taken in responseNat ional Grid plc provides a lengthy section ‘‘Risk Factors’’ which identi fies a very extensive range of risks faced by the company.But as one Turnbull Review respondent observed, this is a historical record and current situations may differ.4.5 Effectiveness of internal control and dealing with weaknessesPara 38 of the Guidance sates:In relation to Code Provision D.2.1, the board should summarise the process it (where applicable, through its committees) has applied in reviewing the effectiveness of the system of internal control. It should also disclose the process it has applied to deal with material internal control aspects of any significant problems disclosed in the annual report and accounts.As mentioned previously, reporting on internal control effectiveness was the most contentious of the Cadbury recommendations and the compromise reached in the Combined Code was that companies should report the process that they had undertaken, but not necessarily the results. Only one company expressed a positive opinion on the quality of internal control.The guidance does not ask explicitly that boards indicate the conclusions drawn from the reviews undertaken and only one company does so in a positive fashion The board considers that the measures taken, including physical controls,segregation of duties and reviews by management, provide sufficient and objective assurance.Others tend to frame their conclusions in a negative way:In the opinion of the Board the review did not indicate that the system was ineffective or unsatisfactory.Having reviewed its effectiveness, the directors are not aware of any significant weakness or defi ciency in the Group’s system of internal controls during the year. (Mersey Docks and Harbour Company)Where such a statement is accompanied by a more detailed account of the review process, it appears to have been included as a formality within a substantive, company specific disclosure.In rare cases, actions taken as a result of reviews or incidents are described:Following the significant issues experienced within the implementation of the new supply chain system, the following additional processes have been put in place:●specific management teams were convened to examine the root causeof the supply problems, and to put in place new processes and controls to reduce and eliminate these issues;●management report weekly to the Executive Committee on the progresswith the stabilization of the system and the effectiveness of supply to our customers;●the risk management process outlined below was reviewed andenhanced with the emphasis on ownership, risk mitigation activities and improved monitoring activities to act as early warning indicators of risk occurrence.These activities are designed to strengthen the control environment. (MFIFurniture Group plc)This analysis using the headings derived from the Turnbull guidance (see above) demonstrates the superficiality of disclosures that appear to comply formally with the guidance.译文信息披露制度：内部控制资料来源:/content/351u43877v108j45/作者：Laura F. Spira Michael Page使用内部控制作为公司治理的一种策略，反映了公司治理中一个微妙但是重要的改变。