Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ICAEW - CERTIFICATE LEVEL 1 - ASSURANCE > Chapter 5 - Introduction to internal control and information flows > Flashcards

Chapter 5 - Introduction to internal control and information flows Flashcards

1
Q

What is the definition of internal control?

A

Internal control: ‘The process designed, implemented and maintained by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of an entity’s objectives with regard to:
 Effectiveness and efficiency of operations
 Reliability of financial reporting,
 Compliance with applicable laws and regulations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 3 main reasons for implementing internal controls?

A

These are our objectives
Internal controls minimise business risks, ensure the effective functioning of the company, and help the company comply with laws and regulations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are some inherent limitations of internal control? (4)

A

CHEW

COLLUSION
HUMAN ELEMENT
EXPENSE
WEIRD TRANSACTION

Collusion - 2 or more people working together to bypass a control
Human element - Some controls are only as good as the people operating them. If a mistake is made on implementing the control, the control may be ineffective e.g. mistyping, leaving door open
Expense - Controls can be expensive, is it worth having the control. Some controls are only as good as the people operating them. If a mistake is made on implementing the control, the control may be ineffective
Weird Transactions - Controls are generally designed to deal with what routinely happens. For an unusual transaction the control may not be relevant or exist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How is collusion an inherent limitation of internal control?

A

Collusion - 2 or more people working together to bypass a control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How is human element an inherent limitation of internal control?

A

Human element - Some controls are only as good as the people operating them. If a mistake is made on implementing the control, the control may be ineffective e.g. mistyping, leaving door open

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How is expense an inherent limitation of internal control?

A

Expense - Controls can be expensive, is it worth having the control. Some controls are only as good as the people operating them. If a mistake is made on implementing the control, the control may be ineffective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How is weird transaction an inherent limitation of internal control?

A

Weird Transactions - Controls are generally designed to deal with what routinely happens. For an unusual transaction the control may not be relevant or exist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

CHEW

A

These are the 4 limitations of internal controls

COLLUSION
HUMAN ELEMENT
EXPENSE
WEIRD TRANSACTION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the control environment, and why is it significant?

A

The control environment includes governance functions and management’s attitudes, setting the tone of an organisation and influencing the control consciousness of its people. It is fundamental in supporting a robust internal control system.

3 A’s = Attitudes, Awareness and Actions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the 5 components of internal controls?

A

CRIME

CONTROL ACTIVITIES
RISK ASSESSMENT
IT SYSTEM + COMMS
MONITORING
ENVIRONMENT

CONTROL ACTIVITIES
RISK ASSESSMENT
IT SYSTEM + COMMS
MONITORING
ENVIRONMENT
- control environment on 3A’s
- audit committee

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

CRIME

A

These are the 5 components of internal controls

CONTROL ACTIVITIES
RISK ASSESSMENT
IT SYSTEM + COMMS
MONITORING
ENVIRONMENT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

crimE - ENVIRONMENT
What importance does the strength of a control environment have on auditors?

A

The control environment is therefore very important to the auditors and they will evaluate it as part of their risk assessment process. If the control environment is strong, then auditors will be more inclined to rely on the controls system in the entity than if it is weak.

WEAK = MORE SUBSTANTIVE TESTING

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

crimE - ENVIRONMENT
Do all companies have an audit committee?

A

It is required for listed companies and is a best practice for large companies to ensure proper oversight.

Rules are generally stricter for limited companies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

crimE - ENVIRONMENT
What role does an audit committee play in the control environment?

A

An audit committee, a subcommittee of the board, oversees the internal control structure, financial reporting, and compliance with laws, often supporting both internal and external audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

crimE - ENVIRONMENT
Who typically comprises the Audit Committee?

A

The Audit Committee is made up of Non-Executive Directors (NEDs).

These are independent people who advise. Usually paid a fixed fee, not employed full time. Do not participate in daily management but provide independent oversight and advice. Their role is to challenge and provide objective perspectives on management’s decisions. Are expected to remain independent and objective, as they provide an external viewpoint to avoid potential conflicts of interest. Represent shareholder interests and focus on governance, risk management, and ensuring accountability. They may chair subcommittees like the Audit, Remuneration, or Nomination Committees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

crimE - ENVIRONMENT
What is the difference between an executive vs non-executive director?

A

Executive Director - Employees, standard pay e.g. CEO, CFO, COO, CIO, CTO
Are involved in the day-to-day management of the company and are responsible for executing the company’s strategic goals. May not be as independent due to their direct involvement in the company’s operations. Represent the management’s perspective and bring insights into operational and strategic issues.

Non-Executive Director - These are independent people who advise. Usually paid a fixed fee, not employed full time. Do not participate in daily management but provide independent oversight and advice. Their role is to challenge and provide objective perspectives on management’s decisions. Are expected to remain independent and objective, as they provide an external viewpoint to avoid potential conflicts of interest. Represent shareholder interests and focus on governance, risk management, and ensuring accountability. They may chair subcommittees like the Audit, Remuneration, or Nomination Committees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

crimE - ENVIRONMENT
What is one of the key responsibilities of the Audit Committee concerning financial statements?

A

Ensuring the integrity of the financial statements, often with the help of an external auditor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

crimE - ENVIRONMENT
What is the Audit Committee’s role in internal controls?

A

They ensure that internal controls and risk management systems are robust, often with the assistance of an internal auditor.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

crimE - ENVIRONMENT
How does the Audit Committee assess the objectivity of the external auditor?

A

By reviewing the length of service, remuneration, and any non-audit services provided.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

crimE - ENVIRONMENT
What is one of the Audit Committee’s responsibilities related to external auditors?

A

They recommend the appointment and removal of external auditors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

crimE - ENVIRONMENT
What aspects of the internal audit does the Audit Committee monitor and review?

A

The committee reviews the internal audit’s skill and experience, resources, and independence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

cRime - RISK ASSESSMENT
What is the purpose of a company’s risk assessment process?

A

Risk assessment involves identifying business risks that could impact the entity’s objectives and determining actions to mitigate those risks.

BUSINESS RISK A risk resulting from significant conditions, events, circumstances, actions or inactions
that could adversely affect an entity’s ability to achieve its objectives and execute its strategies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

cRime - RISK ASSESSMENT
Define “Business Risk.”

A

A risk resulting from significant conditions, events, circumstances, actions or inactions
that could adversely affect an entity’s ability to achieve its objectives and execute its strategies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

cRime - RISK ASSESSMENT
What are the process of a risk assessment? (4) Who would establish the process? (1)

A

Those charged with governance (TCWG) should establish the following process:
1. Identification of business risk
2. Estimate Impact
3. Assess likelihood
4. Actions to manage

  1. Identification of business risk
    - Risk register
  2. Estimate Impact
  3. Assess likelihood
  4. Actions to manage
25
Q

cRime - RISK ASSESSMENT
Why are auditors interested in business risks?

A

Because business risks that threaten the business can also pose a risk of financial statement misstatements.

26
Q

crIme - IT SYSTEM + COMMS
What is the purpose of the information system and communication in internal control?

A

It includes the financial reporting system and consists of procedures by which transactions are initiated, recorded, processed, corrected, and reported.

27
Q

crIme - IT SYSTEM + COMMS
Why is the information system important to auditors?

A

Auditors are concerned with the reliability of the information system as it impacts the accuracy and integrity of financial statements.

28
Q

crIme - IT SYSTEM + COMMS
What does ‘Initiated’, ‘Recorded’, ‘Processed’, ‘Corrected’ and ‘Reported’ mean in the context of information systems?

A

INITIATED - It refers to how a transaction is known to have occurred, requiring a source document like an invoice as evidence.
RECORDED - It ensures that debits and credits are posted correctly, and checks if the system verifies correct entries.
PROCESSED - Information flows from the nominal ledger to the trial balance to the financial statements, and the system’s ability to maintain accuracy throughout is assessed.
CORRECTED - It involves ensuring that journal entries are approved, authorised, and any manual postings have restrictions to maintain accuracy.
REPORTED - It is the final stage where the financial statements are generated from the processed information.

29
Q

crIme - IT SYSTEM + COMMS
What are information processing controls, and why are they important?

A

These are automated or manual procedures at the business process level that ensure data integrity, covering completeness, existence, and accuracy. Exist WITHIN your system.
They relate to input, processing, or output data.

30
Q

crIme - IT SYSTEM + COMMS
What do information processing controls relate to?

A

They relate to input, processing, or output data.

31
Q

crIme - IT SYSTEM + COMMS

A
32
Q

crIme - IT SYSTEM + COMMS
What are controls over input completeness?

A

They ensure all data is captured, such as one-for-one checking of processed output to source documents and running exception reports.

33
Q

crIme - IT SYSTEM + COMMS
What are controls over input accuracy/integrity?

A

These include programs to verify data fields with checks like digit verification, reasonableness tests, existence checks, character checks, and permitted ranges.

 Digit verification (eg reference numbers are as expected)
 Reasonableness test (eg VAT to total value)
 Existence checks (eg customer name)
 Character checks (no unexpected characters used in reference)
 Permitted range (no transaction processed over a certain value)

34
Q

crIme - IT SYSTEM + COMMS
What are controls over input authorisation?

A

They ensure information input is authorised, such as requiring digital signatures or passwords from authorised personnel.

35
Q

crIme - IT SYSTEM + COMMS
What are controls over processing of inputs?

A

Controls that ensure processing is completed, like screen warnings to prevent logging out before processing is done.

36
Q

Crime - CONTROL ACTIVITIES
Define control activities in an internal control system

A

Control activities are actions by management to prevent or detect fraud and errors, safeguarding assets and ensuring accurate financial reporting

37
Q

Crime - CONTROL ACTIVITIES
PARIS V

A

Physical or logical controls e.g. security
Authorisation procedures e.g. journals/time sheets
Reconciliations e.g. bank
Information processing and general IT controls e.g. passwords
Segregation of duties
Verifications

See Ch 3 for more FCs

38
Q

Crime - CONTROL ACTIVITIES
What are general controls in information systems?

A

AROUND THE SYSTEM

General controls: Policies and procedures that relate to many applications and support the effective function of the information processing controls by helping to ensure the continued proper operation of information systems.

Policies and procedures that support the function of information processing controls and ensure the continued proper operation of information systems.

39
Q

Crime - CONTROL ACTIVITIES
What are some controls involved in the “Development of computer applications”?

A

Standards for systems design, full testing procedures, approval by users and management, and staff training in new procedures.

Standards over systems design, programming and documentation
 Full testing procedures prior to use
 Approval by computer users and management
 Training of staff in new procedures

40
Q

Crime - CONTROL ACTIVITIES
What is a key control to prevent or detect unauthorised changes to programs?

A

Password protection, restricted access to the central computer, and use of virus checks.

 Password protection of programs so that access is limited to computer operations staff
 Restricted access to central computer by locked doors, keypads
 Virus checks on software: use of anti-virus software and policy prohibiting use of non-authorised programs or files

41
Q

Crime - CONTROL ACTIVITIES
Why is “Testing and documentation of program changes” important in general controls?

A

To ensure new systems work correctly, with testing, proper documentation, and approval by users and management.

 Complete testing procedures
documentation of program changes
 Documentation of new systems
 Approval of changes by computer users and management

42
Q

Crime - CONTROL ACTIVITIES
What is an example of a control to prevent unauthorised amendments to data files?

A

Using passwords and built-in controls to prevent unauthorised data changes.

43
Q

Crime - CONTROL ACTIVITIES
How can a company ensure continuity of operations through general controls?

A

By storing extra copies of programs off-site, protecting equipment, having backup power sources, and maintaining disaster recovery procedures.

44
Q

Crime - CONTROL ACTIVITIES
What are some backup measures included in general controls?

A

Back-up power sources, back-up copies of programs stored off-site, and emergency procedures.

45
Q

Crime - CONTROL ACTIVITIES
What types of maintenance agreements are part of ensuring continuity of company operations?

A

Agreements for regular maintenance and insurance to protect against loss or damage.

46
Q

criMe - MONITORING
Why should an entity review its overall control system?
What happens if an entity’s control system is not reviewed and corrected as needed?

A

To ensure it still meets its objectives, operates effectively and efficiently, and allows timely corrections if needed.
The control system may not operate optimally, potentially leading to inefficiencies and risks.

47
Q

criMe - MONITORING
This is often a role of the internal audit department within the company.

A

This is often a role of the internal audit department within the company.

48
Q

criMe - MONITORING
What is a management report in the context of an audit?
What does this look like?

A

A report produced by auditors at the end of an audit, outlining any deficiencies observed in the internal controls.

Looks like
1. Deficiency - This is the weakness
2. Consequence - What could happen as a result of the deficiency (COULD)
3. Recommend - What would you recommend (SHOULD)

49
Q

criMe - MONITORING
What is the responsibility of auditors regarding control deficiencies according to ISAs?

A

Auditors are required to identify control deficiencies and communicate them to those charged with governance.

50
Q

How do auditors obtain information about internal controls?

A

Through company manuals, records from previous years (e.g. management letter), discussions with internal control personnel, and observation of control activities.

Records from previous years - It helps auditors understand the historical context of controls and identify any recurring issues.

51
Q

What role does observation play in understanding internal controls?

A

Auditors observe operations to see control activities being implemented in practice, which helps validate their effectiveness.

52
Q

What are the three types of documents used for recording internal controls?

A

Narrative notes, questionnaires and checklists, and diagrams.

NN - They are good for simple systems and providing background information but are less effective for complex systems.
Q&C - They ensure all bases are covered as an aide-memoire but can be mechanical, causing important questions to be missed or simply ticked off.
D - They are useful for complex systems, like flowcharts for processes, organizational charts, and family trees for related party transactions.

53
Q

When are “Narrative Notes” useful for recording internal controls?

A

They are good for simple systems and providing background information but are less effective for complex systems.

54
Q

What are the advantages and limitations of using “Questionnaires and Checklists” for recording internal controls?

A

They ensure all bases are covered as an aide-memoire but can be mechanical, causing important questions to be missed or simply ticked off.

55
Q

In what scenarios are “Diagrams” most helpful for recording internal controls?

A

They are useful for complex systems, like flowcharts for processes, organizational charts, and family trees for related party transactions.

56
Q

What is a walk-through test in internal control evaluation?

A

A walk-through test involves tracing a few transactions through the financial reporting system to verify the auditor’s understanding of controls.

57
Q

Which one of the following is a reason that organisations have effective systems of control? To assist the organisation in:
A Maximising profitability
B Maximising operating efficiency
C Reducing time required for the statutory audit
D Minimising audit risk

A

B Maximising operating efficiency

58
Q

The following are examples of internal controls which operate at Searson plc. For each example, select the one type of control activity which it illustrates.
Authorisation
Reconciliation
Information processing
Physical

(1) The financial controller investigates the exception report of unmatched transactions from the electronic banking system

(2) Searson regularly counts its high risk/high value inventory on a monthly basis and compared with amounts in the accounts

(3) Searson regularly compares its trade payable ledger to supplier statements, discrepancies are resolved to make sure they agree

A

(1) The financial controller investigates the exception report of unmatched transactions from the electronic banking system
INFORMATION PROCESSING

(2) Searson regularly counts its high risk/high value inventory on a monthly basis and compared with amounts in the accounts
PHYSICAL

(3) Searson regularly compares its trade payable ledger to supplier statements, discrepancies are resolved to make sure they agree
RECONCILIATION

59
Q

Most entities use IT systems for financial reporting and operational purposes. Controls operating in an IT environment can be split into general controls and information processing controls.
Which two of the following are information processing controls?
A Permitted range
B Digit verification
C Passwords
D Virus checks

A

A Permitted range
B Digit verification

ICAEW - CERTIFICATE LEVEL 1 - ASSURANCE (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions