Chapter 5 - Introduction to internal control

Question 1

Define internal control.

Answer 1

The process designed, implemented and maintained by those charged with governance, management, and other personnel to provide reasonable assurance about the achievement of an entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations and compliance with applicable laws and regulations.

The term ‘controls’ refers to any aspects of one or more of the components of internal control.

Question 2

What are three reasons for internal controls?

Answer 2

minimising the company’s business risks

ensuring the continuing effective functioning of the company

ensuring the company complies with relevant laws and regulations

Question 3

What are the limitations of internal controls?

Answer 3

Question 4

Define the control environment.

Answer 4

The control environment includes the governance and management functions and the attitudes, awareness and actions of those charged with governance and management concerning the entity’s internal control and its importance in the entity. The control environment sets the tone of an organisation, influencing the control consciousness of its people.

It is essentially the environemnt in which the internal controls exist within the business

Question 5

How does the control environemnt influence auditors regarding the internal controls of a business?

Answer 5

The control environment is therefore very important to the auditors and they will evaluate it as part of their risk assessment process. If the control environment is strong, then auditors will be more inclined to rely on the controls system in the entity than if it is weak.

Question 6

What is the audit committee?

Answer 6

The audit committee is an important aspect of the control environment of the company. It is a sub-committee of the board of directors responsible for overseeing an entity’s internal control structure, financial reporting and compliance with relevant laws and regulations.

Question 7

What is the audit committee comprised of?

Answer 7

The audit committee is comprised of non-executive directors. It is a requirement in UK listed companies under the rules of the UK Corporate Governance Code.

Question 8

What are the five components of internal control?

Answer 8

The control environment

The entity’s risk assessment process

The information system

Control activities

Control systems

Question 9

Outline the responsibilities of the audit comitee

Answer 9

To review the integrity of the financial statements of the company and formal announcements relating to the company’s performance.

To review the company’s internal financial controls and the company’s risk management systems

To monitor and review the effectiveness of the company’s internal audit function (if relevant)

To make recommendations to the board in relation to the external auditor.

To monitor the independence of the external auditor.

To implement policy on the provision of non-audit services by the external auditor.

Question 10

Define the entity’s risk management process.

Answer 10

A component of internal control that is the entity’s process for identifying business risks relevant to financial reporting objectives and deciding about actions to address those risks, and the results thereof.

Question 11

Define business risk.

Answer 11

Risk resulting from significant conditions, events, circumstances, actions or inactions that could adversely affect an entity’s ability to achieve its objectives and execute its strategies, or from the setting of inappropriate objectives and strategies.

Internal controls are implemented to minimise business risk.

Question 12

Define Information system relevant to financial reporting.

Answer 12

A component of internal control that includes the financial reporting system, and consists of the procedures and records established to initiate, record, process and report entity transactions (as well as events and conditions) and to maintain accountability for the related assets, liabilities and equity.

Question 13

What aspects of the information system will auditors be interested in?

Answer 13

the classes of transactions that are significant to the entity’s financial statements

the procedures by which transactions are initiated, recorded, processed, corrected and reported

the related accounting records and supporting information

how the information system captures events other than transactions that are significant to the financial statements

the process of preparing the financial statements

Question 14

Define control activities.

Answer 14

They are the policies and procedures that help ensure that management directives are carried out.

Question 15

What are the two main catagories of control activities?

Answer 15

Preventative: prevent an error occuring
Detective: identify that an error has occurred and correct it

Question 16

What are the types of control activities?

Answer 16

Question 17

What are the two types of information processing controls in a computerised environment?

Answer 17

Information Processing controls

General controls

Question 18

Define information processing controls

Answer 18

Manual or automated procedures that typically operate at a business process level. Information processing controls can be preventative or detective in nature and are designed to ensure the integrity of information (completeness, existence and accuracy)

Question 19

Give examples of information processing controls

Answer 19

Question 20

Define general controls

Answer 20

Policies and procedures that relate to many applications and support the effective function of application controls by helping to ensure the continued proper operation of information systems.

Question 21

Give examples of general controls

Answer 21

Question 22

Should general controls be reviewed before application controls?

Answer 22

Yes.

As application controls may be useless when general controls are ineffective, it will be more efficient to review the design of general controls first, before reviewing the application controls.

Question 23

What is the purpose of application controls?

Answer 23

The purpose of application controls is to establish specific control activities over the accounting applications in order to provide reasonable assurance that all transactions are authorised and recorded, and are processed completely, accurately and on a timely basis

Question 24

What should an entity do in terms of monitoring of controls?

Answer 24

An entity should review its overall control system to ensure that it still meets its objectives, still operates effectively and efficiently, and that necessary
orrections to the system are made on a timely basis.

Question 25

What are three types of document which are used for recording the understanding of the business?

Answer 25

Narrative notes

Questionnaires/checklists

Diagrams

Question 26

What are narrative notes good for?

Answer 26

These are good for things like:

• short notes on simple systems
• background information

They are less good when things get more complex when diagrams tend to take over.

Question 27

What are questionnaires and checklists good for?

Answer 27

These are good as aide memoires to ensure you have all the bases covered

but

• can lead to a mechanical approach so that an important extra question is never asked
• tick boxes often get ticked whether the brain is engaged or not

Question 28

What do diagrams include and what are they good for?

Answer 28

These include:

• flowcharts
• organisation charts
• family trees
• records of related parties

Organisation charts and family trees are without doubt the best way of recording relationships, reporting lines, etc.

Flow charts of systems are an excellent and comprehensive way of recording systems, but they are time-consuming to construct and can be difficult for the reader to assimilate.

Question 29

Define walk-through procedure.

Answer 29

A procedure that involves tracing a few transactions through the financial reporting system.

Walk-through procedures would normally be performed near the start of the fieldwork stage of the audit. They involve tracing transactions from the very beginning to the very end, in order to confirm that the auditor has correctly understood how the controls are supposed to operate.

Question 30

Are walk-through procedures tests of controls?

Answer 30

No.

Walk-through procedures aim to test the auditor’s understanding and are not tests of controls.