In this chapter, we talk about three kinds of reports on internal controls:

• Reports to management of significant deficiencies in the design and/or operation of internal controls (reportable conditions) found during an audit

• Opinions on internal control issued to the FDIC, shareholders, and other significant stakeholders

• SysTrust reports on computer controls and operations 

Required:

a. Briefly describe the objective of each report and the scope of activities covered.

b. What are the major differences between the three reports? More specifically, what are the major differences between a SysTrust report and an internal control report?

c. Do all the reports require the testing of internal controls?

d. Assume there is an incremental cost to developing a report on internal controls beyond the cost of conducting an external audit. How would the profession go about assessing the benefits of such reports?