Chapter 9 - Internal Control Flashcards
What is Internal Control?
It is the process designed, implemented
and maintained by those charged with governance to achieve reasonable assurance of the objectives of organization in regards to reliability of financial reports, operating effectiveness and efficiency and compliance with laws and regulations.
What are the components of IC?
- Control environment
- Risk assessment
- Information system
- Control activity
- Control monitor
What is control environment?
It is the attitude, awareness and actions
of the responsible to design, implement and monitor IC.
What is risk assessment?
It is the procedures to identify risk to
corporate objectives. How it decides to address and results of doing so
What is information system about?
Procedures to record, process transections
to maintain accountability for assets, equity and liability. Related to financial reporting system.
What is control procedure?
Types of control procedures?
It can be administrative or accounting.
Administrative - management decision complied with the standards.
Accounting - accurate records to achieve accountability.
PREVENT, DETECT, CORRECT are the steps.
Types:
- Physical counts
- Segreggation of duty
- Authorization
What is control monitoring?
Ongoing and periodic assessment of IC
done by the IC department.
Checking control deficiencies and so on.
Find out what the system client uses, understand, record, assess and test it.
How do we record though? Flowcharts Questionnaires Narrative notes Checklists
Narrative notes can be flexible and easy,
but it also can be very time consuming
if the system is complex.
Flowcharts are only applicable
for a standard system usually.
What is collusion?
Employees conspire together
to create fraud. There are motivated and competent BUT untrustworthy employees.
Limitations of IC?
Collusion Authorization abuse Staff mistakes Cost over benefit Management over riding controls
Difference between ICQ and ICEQ?
Does it have equal weight?
Can it deal with unusual transactions?
ICQ
Does controls exists that meets
the control objectives?
YES or NO. (close ended)
ICEQ
EVALUATE controls that exist
to detect, prevent and correct SPECIFIC
errors. (Open ended) CAN we do this and why?
Both gives equal weight.
ANY of them cannot deal with unusual transactions and NARRATIVE notes must be used!
General controls VS Application?
General is about overall stability of the system.
Application is about preventing, detecting and correcting errors. It is about transactions. But, remember that both are related.
Cover letter format?
Weakness l Consequence l Recommendation
How do we evaluate IC?
- Inquiry
- Observe
- Inspect
- Re performance
Before issuing to the board IC control deficiencies?
Discuss with the management. There could
be more info to be gained.
General control?
- Disaster
- Protection
- IC
