Chapter 5

Question 1

What is internal controls?

Answer 1

The whole system of controls, financial and otherwise established by the management in order to carry out the business of the enterprise in an orderly and efficient manner, ensure adherence to management policies, safeguard the assets, present and detect fraud and errors and secure as far as possible the completeness and accuracy of the records

Question 2

what are information flows

Answer 2

refer to processes by which information is exchanged between people and systems within the entuty

Question 3

what is the purpose of internal controls?

Answer 3

help an organisation to achieve its objectives and mitigate the business risks it faces

Question 4

What are examples of internal controls?

Answer 4

• quality controls
• credit controls- to limit bad debts
• inventory ordering controls
• payroll controls- ensure employees are paid the right amount

Question 5

what are the limitations to internal controls?

Answer 5

• human error
• unusual transactions outside the scope of controls
• collusion
• management override
  -special considerations in small companies:
  informal nature/ lack of documentation
  limited staff

Question 6

what are the reporting rules for internal controls?

Answer 6

Directors of companies applying the UK Corporate Governance Code are required to report on risk management and systems of internal control in the companies annual reports

Question 7

What are the components of internal control set out in ISA 315?

Answer 7

1. Control environment
2. The entity’s risk assessment process
3. Information system and communication
4. Control activities
5. Monitoring

Question 8

what is meant by the control environment?

Answer 8

includes both the governance and management functions of an organisation.

It will focus upon the attitudes, awareness and actions of those responsible within the business for designing, implementing and monitoring internal controls.

Question 9

What would indicate a strong control environment?

Answer 9

• existence of an audit committee
• An internal audit function
• effective documentation of control systems
• the importance of controls communicated to all staff members
• no management override controls

Question 10

What is meant by an audit committee?

Answer 10

subsection of the board of directors which has a particular interest in the accounting and finance activities of the company

Question 11

Effective systems of internal control consist of five integrated elements. These include:

a)control activities.
b)control environment.
c)governance.
d)information and communication.
e)monitoring.

Answer 11

a,b, d, e

Question 12

Which element of an effective systems of internal control is most concerned with the day-to-day procedures put in place to ensure continuation of business processes?
a)control activities.
b)monitoring activities.
c)risk assessment.
d)control environment.

Answer 12

a

Question 13

what is meant by business risk?

Answer 13

Business risk is a risk resulting from significant conditions, events, circumstances, actions or inactions that could adversely affect an entity’s ability to achieve its objectives and execute its strategies, or from the setting of inappropriate objectives and strategies.

Question 15

what can cause risks to arise or change?

Answer 15

• changes in operating environment
• new personnel
• new or revamped information system
• rapid growth or corporate restructuring
• new technology
• new business models, products or activities
• expanded foreign operations.

Question 16

what is meant by information systems and communication?

Answer 16

include the financial reporting system and consist of the procedures established to initiate, record, process and report entity transactions and to maintain accountability for the related assets, liabilities and equity

• examples: ledger, daybooks

Question 17

What information systems and communications are auditors interested in?

Answer 17

• systems for preparing financial statements
• accounting software used
• accounting records and books
• roles and responsibilities allocated to personnel

Question 18

What is meant by control activities?

Answer 18

the policies that help ensure that management directives are carried out

Question 19

what are preventative controls

Answer 19

prevent errors occuring

Question 20

what are detective controls?

Answer 20

identify an error has occurred and correct it

Question 21

what are the 5 control activities the ISA 315 set out? (Examinable topic)

Answer 21

• authorisation and approval
• reconciliations
• verifications
  physical or logical controls
• segregation of duties

Question 22

what is meant by authorisation and approval controls?

Answer 22

affirms that a transaction is valid these can be manual or automated

Question 23

what is an example of authorisation and approval controls?

Answer 23

• supervisor approving an expense report after reviewing
• director reviewing then signing back reconciliations

Question 24

what is meant by reconciliations controls?

Answer 24

Controls that compare two or more data elements. If differences are identified, action is taken to bring the data into agreement

Question 25

what is an example of reconciliation controls?

Answer 25

• comparing sales reports to statement of profit or loss
• comparing bank transactions per the bank statement with those in the cash book

Question 26

what is meant by verification controls?

Answer 26

controls that compare two or more items with each other or compare an item with a policy

Question 27

what is an example of a verification control?

Answer 27

• comparing monthly expenditure to budgeted expenditure
• comparing occupancy rates hotel by hotel for a hotel chain
• agreeing a despatch note signed by the customer to the sales order form

Question 28

What is the difference between verification controls and reconciliation controls?

Answer 28

verification controls may not result in matching items

Question 29

what are physical or logical controls?

Answer 29

controls that encompass the physical security of assets such as secured facilities over access to assets and records, authorisation for access to computer programs and data files

Question 30

what are examples of physical or logical controls?

Answer 30

• physical counting of petty cash
• electronic tagging of inventory
• banking cash immediately

Question 31

what is meant by segregation of duties controls ?

Answer 31

assigning different people the responsibilities of authorising transactions, recording transactions and maintaining custody of assets

Question 33

What is meant by general IT controls?

Answer 33

Controls over the entities IT processes that support the continued operation of the IT environment

Question 34

What are examples of general IT controls?

Answer 34

• testing system performance
• controls over system design, programming and documentation
• staff training
• password protection
• virus checks
• restricting physical access with locks
• back up copies
• disaster recovery procedures

Question 35

What is meant by information processing controls?

Answer 35

These are controls relating to processing of information in IT applications or manual information processes in the information system that directly address risks to the integrity of information

Question 36

What are the information processing control examples?

Answer 36

• controls over input completeness
• controls over input accuracy
• controls over input authorisation
• controls over standing data

Question 37

what are the key risks of an entities IT systems?

Answer 37

• hacking
• theft
• deliberate sabotage
  -viruses, malware and other corruption
• denial of service attacks

Question 38

what does the ICAEW audit insight recommend to combat cyber risks?

Answer 38

• improve communication about cyber risk and how to manage
  -define who is responsible for cyber security
• assign board level accountability
• non executive directors should monitor the actions of the executive related to cyber security

Question 39

why does an auditor need to understand the systems and controls?

Answer 39

• assess the level of control risk
• determine the audit approach

Question 40

what are an auditors options for documenting an organisations systems and controls? what do they do after documenting

Answer 40

• narrative notes
• questionnaires or checklists
• diagrams or flowcharts

After documenting: perform walkthrough tests to confirm their understanding of the system