3.

a. Describe the role that each of the following areas has in the establishment, maintenance, and
evaluation of internal control:

i. Management

The management is responsible for the establishment of internal controls of the entity. This
includes the design and effectiveness of controls. The management is responsible for making sure that
the right controls are in place and that they are performing as intended. Starting from the managers and
department heads, they recommend procedures or policies that could be utilized as an internal control.
Board of directors would then understand these policies and procedures and ratify them as needed.
Within the managerial ranks, the CEO provides leadership needed to establish and guide and integrated
control framework.

The internal audit team is mostly responsible for the maintenance of internal control but the
management remains accountable for performing and ensuring the effectiveness of control activities
and deciding when it is essential for the control environment to be enhanced.

ii. External auditor

As part of their audit planning process, external auditors evaluate internal controls of an entity.
Under Sarbanes-Oxley Section 404, the external auditor must attest to management’s assertion
regarding the effectiveness of internal controls surrounding financial reporting. The external auditor also
reviews control environment and uses results of risks assessments as input to develop external audit
plan.

iii. Internal auditor

The internal auditor is responsible for the maintenance of internal controls of the entity. One of
the essential elements of integrated internal control framework is monitoring and the internal auditor is
in charge of this function. Monitoring determines whether or not policies and procedures designed are
being conducted effectively by employees. Internal audit can review, document and recommend
changes in the control environment as well as evaluate whether the changes made were effective.

b. To whom should the Director of Internal Audits report? Explain your answer.

The Director of Internal Audits should report to the independent Audit Committee of the Board
of Directors since such reporting enhances internal audit independence. This is in accordance to the
provision of IIA’s Standards for the professional practice of internal auditing that states that the internal
audit activity must be free from interference in determining the scope of internal auditing, performing
work and communicating results. Also, this will avoid the cases that happened to corporations like Enron
and WorldCom.

c. Comment on the audit committee member’s perspective as to the committee’s composition.

 The composition and member qualifications of the Audit Committee were under the provision
of Sarbanes-Oxley Act of 2002. Each member of the Audit Committee shall have accounting or related
financial literate and at least one member of Audit Committee shall have accounting or related financial
management expertise. Thus, even if the committee members have extensive industry experience and
they have all been associated with Nano Circuits in various capacities they should comply to the
Sarbanes-Oxley Act provision that they shall at least have one member who has accounting or related
financial management expertise.