9 Internal control

Question 1

What is internal control?

Answer 1

Internal control is the process designed, implemented and maintained by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of the entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, and compliance with applicable laws and regulations.

Question 2

What are the 5 components of internal control

Answer 2

• The control environment • The entity’s risk assessment process • The information system relevant to financial reporting • Control activities • Monitoring of controls

Question 3

Give an example of a control environment

Answer 3

Control environment includes the governance and management functions and the attitudes, awareness and actions of those charged with governance and management concerning the entity’s internal control and its importance in the entity.

Question 4

ISA 315 states that auditors shall have an understanding of the control environment. As part of this understanding, the auditor shall evaluate whether:

Answer 4

(a) Management has created and maintained a culture of honesty and ethical behaviour. (b) The strengths in the control environment provide an appropriate foundation for the other components of internal control and whether those components are not undermined by deficiencies in the control environment.

Question 5

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Communication and enforcement of integrity and ethical values

Answer 5

Essential elements which influence the effectiveness of the design, administration and monitoring of controls

Question 6

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Commitment to competences

Answer 6

Management’s consideration of the competence levels for particular jobs and how those levels translate into requisite skills and knowledge

Question 7

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Participation by those charged with governance

Answer 7

• Independence from management • Experience and stature • Extent of involvement and scrutiny of activities • Appropriateness of actions and interaction with internal and external auditors

Question 8

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Participation by Management’s philosophy and operating style

Answer 8

• Approach to taking and managing business risks • Attitudes and actions towards financial reporting • Attitudes towards information processing and accounting functions and personnel

Question 9

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Participation by Organisational structure

Answer 9

The framework within which an entity’s activities for achieving its objectives are planned, executed, controlled and reviewed

Question 10

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Participation by Assignment of authority and responsibility

Answer 10

How authority and responsibility for operating activities are assigned and how reporting relationships and authorisation hierarchies are established

Question 11

The following table illustrates the elements of the control environment that may be relevant when obtaining an understanding of the control environment. Give an example of Human resource policies and practices

Answer 11

Recruitment, orientation, training, evaluating, counselling, promoting, compensation and remedial actions

Question 12

Entity’s risk assessment process. ISA 315 says the auditor shall obtain an understanding of whether the entity has a process for:

Answer 12

• Identifying business risks relevant to financial reporting objectives • Estimating the significance of the risks • Assessing the likelihood of their occurrence • Deciding on actions to address those risks

Question 13

Define the information system relevant to financial reporting component of internal control

Answer 13

The information system relevant to financial reporting is a component of internal control that includes the financial reporting system, and consists of the procedures and records established to initiate, record, process and report entity transactions (as well as events and conditions) and to maintain accountability for the related assets, liabilities and equity

Question 14

The auditor shall obtain an understanding of the information system relevant to financial reporting objectives, including the following areas:

Answer 14

• The classes of transactions in the entity’s operations that are significant to the financial statements • The procedures, within both IT and manual systems, by which those transactions are initiated, recorded, processed, corrected, transferred to the general ledger and reported in the financial statements • The related accounting records, supporting information and specific accounts in the financial statements, in respect of initiating, recording, processing and reporting transactions • How the information system captures events and conditions, other than transactions, that are significant to the financial statements • The financial reporting process used to prepare the entity’s financial statements, including significant accounting estimates and disclosures • Controls surrounding journal entries, including non-standard journal entries used to record nonrecurring, unusual transactions or adjustments

Question 15

Conforming amendments to ISA 315 published in 2015 point out that as well as understanding how information is obtained from within the general and subsidiary ledgers, auditors must gain an understanding of the system relating to information obtained outside of the ledgers. Such information may include information disclosed in the financial statements, which has been derived from:

Answer 15

• Lease agreements disclosed in the financial statements • The entity’s risk management system • Fair value reports produced by management’s experts • Calculations and models developed about accounting estimates, including internal assumptions about assets’ useful lives and external interest rates • Sensitivity analyses performed by management to consider alternative assumptions • The entity’s tax records • Analyses to support management’s assessment of the going concern assumption

Question 16

What are control activities?

Answer 16

Control activities are those policies and procedures that help ensure that management directives are carried out.. Control activities include those activities designed to prevent or to detect and correct errors

Question 17

Give examples of control activities and provide explanations and categorise them: Approval and control of documents

Answer 17

Transactions should be approved by an appropriate person. For example, overtime should be approved by departmental managers. Authorisation

Question 18

Give examples of control activities and provide explanations and categorise them: Controls over computerised applications

Answer 18

Information processing

Question 19

Give examples of control activities and provide explanations and categorise them: Checking the arithmetical accuracy of records

Answer 19

For example, checking to see if individual invoices have been added up correctly. Information processing

Question 20

Give examples of control activities and provide explanations and categorise them: Maintaining and reviewing control accounts and trial balances

Answer 20

Performance review Control accounts bring together transactions in individual ledgers. Trial balances bring together transactions for the organisation as a whole. Preparing these can highlight unusual transactions or accounts

Question 21

Give examples of control activities and provide explanations and categorise them: Reconciliations

Answer 21

Information processing:
Reconciliations involve comparison of a specific balance in the accounting records with what another source says the balance should be; for example, a bank reconciliation. Differences between the two figures should only be reconciling items (resulting from eg timing differences).

Question 22

Give examples of control activities and provide explanations and categorise them: Comparing the results of cash, security and inventory counts with accounting records

Answer 22

Performance Review: For example, in a physical count of petty cash, the balance shown in the cash book should be the same as the amount held.

Question 23

Give examples of control activities and provide explanations and categorise them: Limiting physical access to assets and records

Answer 23

Physical control: Only authorised personnel should have access to certain assets (particularly valuable or portable ones), eg ensuring that the inventory stores locked are unless store personnel are there.

Question 24

Give examples of control activities and provide explanations and categorise them: Segregation of duties

Answer 24

Segregation of duties: Assigning different people the responsibility of authorising transactions, recording transactions and maintaining custody of assets

Question 25

Define Segregation and what has it got to do with fraud

Answer 25

Segregation implies a number of people being involved in the accounting process. This makes it more difficult for fraudulent transactions to be processed (since a number of people would have to collude in the fraud), and it is also more difficult for accidental errors to be processed

Question 26

Segregation should take place in various ways:

Answer 26

(a) Segregation of function. The key functions that should be segregated are the carrying out of a transaction, recording that transaction in the accounting records and maintaining custody of assets that arise from the transaction. (b) The various steps in carrying out the transaction should also be segregated. We shall see how this works in practice when we look at the major transaction cycles in Chapter 10. (c) The carrying out of various accounting operations should be segregated. For example, the same staff should not record transactions and carry out the reconciliations at the period end.

Question 27

What is the monitoring of controls?

Answer 27

Monitoring of controls is a process to assess the effectiveness of internal control performance over time. It includes assessing the design and operation of controls on a timely basis and taking necessary corrective actions modified for changes in conditions

Question 28

the auditor will often choose or be forced to turn to substantive procedures to gain sufficient appropriate audit evidence when auditing a smaller entity. This can often mean use of:

Answer 28

• Confirmations • Agreeing samples related to different financial statement areas to source documents • Analytical procedures where these are considered suitable

Question 29

Any internal control system can only provide the directors with reasonable assurance that their objectives are reached, because of inherent limitations. These include:

Answer 29

• The costs of control not outweighing their benefits • The potential for human error • Collusion between employees • The possibility of controls being bypassed or overridden by management • Controls being designed to cope with routine and not non-routine transactions

Question 30

What are the key factors in the limitations of control systems in smaller companies

Answer 30

These factors demonstrate why auditors cannot obtain all their evidence from tests of the systems of internal control. The key factors in the limitations of control systems are human error and potential for fraud.

Question 31

Auditors are only concerned with assessing policies and procedures which are relevant to the financial statements. Auditors shall:

Answer 31

• Assess the adequacy of the accounting system as a basis for preparing the accounts • Identify the types of potential misstatements that could occur in the accounts • Consider factors that affect the risk of misstatements • Design appropriate audit procedures

Question 32

Recording accounting and control systems. There are several techniques for recording the assessment of control risk; that is, the system. One or more of the following may be used depending on the complexity of the system.

Answer 32

• Narrative notes • Questionnaires • Flowcharts • Checklists

Question 33

In respect of questionnaires, you should note that there are two types, each with a different purpose two types of questionnaires

Answer 33

(a) Internal Control Questionnaires (ICQs) are used to ask whether controls exist which meet specific control objectives. (b) Internal Control Evaluation Questionnaires (ICEQs) are used to determine whether there are controls which prevent or detect specified errors or omissions.

Question 34

What is the purpose of narrative notes?

Answer 34

The purpose of narrative notes is to describe and explain the system, at the same time as making any comments or criticisms which will help to demonstrate an intelligent understanding of the system.

Question 35

What are the advantages of Narrative notes?

Answer 35

They are relatively simple to record and can facilitate understanding by all audit team members
They can be used for any system due to the method’s flexibility.
Editing in future years can be relatively easy if they are computerised.

Question 36

What are the disadvantages of Narrative notes?

Answer 36

Describing something in narrative notes can be a lot more time consuming than, say, representing it as a simple flowchart, particularly where the system follows a logical flow
They are awkward to update if written manually.
It can be difficult to identify missing internal controls because notes record the detail of systems but may not identify control exceptions clearly.

Question 37

Define flowcharts

Answer 37

graphic illustrations of the physical flow of information through the accounting system.

Question 38

Advantages of flowcharts

Answer 38

After a little experience they can be prepared quickly.They eliminate the need for extensive narrative and can be of considerable help in highlighting the salient points of control and any deficiencies in the system. They generally ensure that the system is recorded in its entirety, as all document flows have to be traced from beginning to end. Any ‘loose ends’ will be apparent from a cursory examination. As the information is presented in a standard form, they are fairly easy to follow and review.

Question 39

Disadvantages of flowcharts

Answer 39

They are most suitable for describing standard systems. Procedures for dealing with unusual transactions will normally have to be recorded using narrative notes. Major amendment is difficult without redrawing. Time can sometimes be wasted by charting areas that are of no audit significance.

Question 40

Internal Control Questionnaires (ICQs): The major question which ICQs are designed to answer is ‘How good is the system of controls?’ Although there are many different forms of ICQ in practice, they all conform to the following basic principles.

Answer 40

(a) They comprise a list of questions designed to determine whether desirable controls are present (possible desirable controls are considered for each major transaction cycle in Chapter 10). (b) They are formulated so that there is one list of questions to cover each of the major transaction cycles.

Question 41

Examples of Internal Control Questionnaires (ICQs):

Answer 41

a) Are supplies examined on arrival as to quantity and quality? (b) Is such an examination evidenced in some way? (c) Is the receipt of supplies recorded, perhaps by means of goods inward notes? (d) Are receipt records prepared by a person independent of those responsible for: (i) Ordering functions? (ii) The processing and recording of invoices?

Question 42

Explain Internal Control Evaluation Questionnaires (ICEQs)

Answer 42

This is achieved by reducing the control criteria for each transaction stream down to a handful of key questions (or control questions). The characteristic of these questions is that they concentrate on the significant errors or omissions that could occur at each phase of the appropriate cycle if controls are weak. The

Question 43

Examples of ICEQs

Answer 43

(a) Goods or services could not be received without a liability being recorded? (b) Receipt of goods or services is required in order to establish a liability? (c) A liability will be recorded: (i) Only for authorised items? (ii) At the proper amount? (d) All payments are properly authorised? (e) All credits due from suppliers are received?

Question 44

Advantages of ICQs and ICEQs

Answer 44

If drafted thoroughly, they can ensure all controls are considered. They are quick to prepare. They are easy to use and control. Because they are drafted in terms of objectives rather than specific controls, ICEQs are easier to apply to a variety of systems than ICQs. Answering ICEQs should enable auditors to identify the key controls which they are most likely to test during control testing. ICEQs can highlight deficiencies where extensive substantive testing will be required.

Question 45

Disadvantages of ICQs and ICEQs

Answer 45

The principal disadvantage is that they can be drafted vaguely, hence misunderstood and important controls not identified. They may contain a large number of irrelevant controls. They may not include unusual controls, which are nevertheless effective in particular circumstances.
They can give the impression that all controls are of equal weight. In many systems one NO answer (for example lack of segregation of duties) will cancel out a string of YES answers.
The client may be able to overstate controls.

Question 46

What shares the same benefits as ICQs and ICEQs

Answer 46

Checklist

Question 47

Tests of control are tests performed to obtain audit evidence about the effectiveness of the:

Answer 47

• Design of the accounting and internal control systems, ie whether they are suitably designed to prevent, or detect and correct, material misstatement at the assertion level; and • Operation of the internal controls throughout the period.

Question 48

Tests of control are distinguished from substantive tests which are designed to detect material misstatements in the financial statements. Tests of control may include the following.

What should an Auditor consider:

Answer 48

(a) Inspection of documents supporting controls or events to gain audit evidence that internal controls have operated properly, eg verifying that a transaction has been authorised (b) Enquiries about internal controls which leave no audit trail, eg determining who actually performs each function, not merely who is supposed to perform it (c) Reperformance of control procedures, eg reconciliation of bank accounts, to ensure they were correctly performed by the entity (d) Examination of evidence of management views, eg minutes of management meetings (e) Testing of internal controls operating on computerised systems or over the overall IT function, eg access controls (f) Observation of controls to consider the manner in which the control is being operated.

• How controls were applied • The consistency with which they were applied during the period • By whom they were applied

Question 49

A deficiency in internal control exists when:

Answer 49

a) A control is designed, implemented or operated in such a way that it is unable to prevent, or detect and correct, misstatements in the financial statements on a timely basis; or (b) A control necessary to prevent, or detect and correct, misstatements in the financial statements on a timely basis is missing. A significant deficiency in internal control is a deficiency or combination of deficiencies in internal control that, in the auditor’s professional judgment, is of sufficient importance to merit the attention of those charged with governance.

Question 50

ISA 265 includes examples of matters to consider when determining whether a deficiency in internal control is a significant deficiency.

Answer 50

• The likelihood of the deficiencies resulting in material misstatements in the financial statements in the future • The susceptibility to loss or fraud of the related asset or liability • The subjectivity and complexity of determining estimated amounts • The amounts exposed to the deficiencies • The volume of activity that has occurred or could occur • The importance of the controls to the financial reporting process • The cause and frequency of the exceptions identified as a result of the deficiencies • The interaction of the deficiency with other deficiencies in internal control

Question 51

The ISA also lists examples of indicators of significant deficiencies in internal control, which include the following:

Answer 51

• Evidence of ineffective aspects of the control environment • Absence of a risk assessment process • Evidence of an ineffective entity risk assessment process • Evidence of an ineffective response to identified significant risks • Misstatements detected by the auditor’s procedures that were not prevented, or detected and corrected, by the entity’s internal control • Restatement of previously issued financial statements that were corrected for a material misstatement due to fraud or error • Evidence of management’s inability to oversee the preparation of the financial statements.

Question 52

The auditor shall include the following in the written communication

Answer 52

(a) A description of the deficiencies and an explanation of their potential effects (but there is no need to quantify the effects) (b) Sufficient information to enable those charged with governance and management to understand the context of the communication, in particular that: (i) The purpose of the audit was for the auditor to express an opinion on the financial statements. (ii) The audit included consideration of internal control relevant to the preparation of the financial statements in order to design audit procedures appropriate in the circumstances, but not to express an opinion on the effectiveness of internal control. (iii) The matters being reported are limited to those deficiencies identified during the audit and which the auditor has concluded are sufficiently important to merit being reported to those charged with governance.

Question 53

In addition, the auditor may include the following information:

Answer 53

(a) A statement that if the auditor had undertaken more extensive procedures on internal control, more deficiencies might have been identified or some of the reported deficiencies need not have been reported. (b) The written communication is for the purpose of those charged with governance and may not be suitable for other purposes.

Question 54

Define General IT controls

Answer 54

General IT controls are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continued proper operation of information systems. General IT controls commonly include controls over data centre and network operations; system software acquisition, change and maintenance; access security; and application system acquisition, development and maintenance.

Question 55

Define Application controls

Answer 55

Application controls are manual or automated procedures that typically operate at a business process level. Application controls can be preventative or detective in nature and are designed to ensure the integrity of the accounting records. Accordingly, application controls relate to procedures used to initiate, record, process and report transactions or other financial data.

Question 56

Give examples of Development of computer applications

Answer 56

Standards over systems design, programming and documentation Full testing procedures using test data Approval by computer users and management Segregation of duties so that those responsible for design are not responsible for testing Installation procedures so that data is not corrupted in transition Training of staff in new procedures and availability of adequate documentation

Question 57

Give examples of Prevention or detection of unauthorised changes to programs

Answer 57

Segregation of duties Full records of program changes Password protection of programs so that access is limited to computer operations staff Restricted access to central computer by locked doors, keypads Maintenance of programs logs Virus checks on software: use of anti-virus software and policy prohibiting use of non-authorised programs or files Back-up copies of programs being taken and stored in other locations Control copies of programs being preserved and regularly compared with actual programs Stricter controls over certain programs (utility programs) by use of read-only memory

Question 58

Give examples of Testing and documentation of program changes

Answer 58

Complete testing procedures Documentation standards Approval of changes by computer users and management Training of staff using programs

Question 59

Give examples of Controls to prevent wrong programs or files being used

Answer 59

Operation controls over programs Libraries of programs Proper job scheduling

Question 60

Give examples of Controls to prevent unauthorised amendments to data files

Answer 60

Password protection Restricted access to authorised users only

Question 61

Give examples of Controls to ensure continuity of operation

Answer 61

Storing extra copies of programs and data files off-site Protection of equipment against fire and other hazards Back-up power sources Disaster recovery procedures eg availability of back-up computer facilities Maintenance agreements and insurance

Question 62

Give examples of Controls over input: completeness

Answer 62

Manual or programmed agreement of control totals Document counts One-for-one checking of processed output to source documents Programmed matching of input to an expected input control file Procedures over resubmission of rejected controls

Question 63

Give examples of Controls over input: accuracy

Answer 63

Programmes to check data fields (for example value, reference number, date) on input transactions for plausibility: • Digit verification (eg reference numbers are as expected) • Reasonableness test (eg sales tax to total value) • Existence checks (eg customer name) • Character checks (no unexpected characters used in reference) • Necessary information (no transaction passed with gaps) • Permitted range (no transaction processed over a certain value) Manual scrutiny of output and reconciliation to source Agreement of control totals (manual/programmed)

Question 64

Give examples of Controls over input: authorisation

Answer 64

Manual checks to ensure information input was: • Authorised • Input by authorised personnel

Question 65

Give examples of Controls over processing

Answer 65

Similar controls to input must be in place when input is completed; for example, batch reconciliations Screen warnings can prevent people logging out before processing is complete

Question 66

Give examples of Controls over master files and standing data

Answer 66

One-for-one checking Cyclical reviews of all master files and standing data Record counts (number of documents processed) and hash totals (for example, the total of all the payroll numbers) used when master files are used to ensure no deletions Controls over the deletion of accounts that have no current balance

Question 67

TESTING OF APPLICATION CONTROLS: Manual controls exercised by the user

Answer 67

If manual controls exercised by the user of the application system are capable of providing reasonable assurance that the system’s output is complete, accurate and authorised, the auditors may decide to limit tests of control to these manual controls

Question 68

TESTING OF APPLICATION CONTROLS: Controls over system output

Answer 68

If, in addition to manual controls exercised by the user, the controls to be tested use information produced by the computer or are contained within computer programs, such controls may be tested by examining the system’s output using either manual procedures or computers. Such output may be in the form of magnetic media, microfilm or printouts. Alternatively, the auditor may test the control by performing it with the use of computers

Question 69

TESTING OF APPLICATION CONTROLS: Programmed control procedures

Answer 69

In the case of certain computer systems, the auditor may find that it is not possible or, in some cases, not practical to test controls by examining only user controls or the system’s output. The auditor may consider performing tests of control by using computers, reprocessing transaction data or, in unusual situations, examining the coding of the application program.