Internal Control (Chapter 2) [P2] Flashcards

1
Q

List the types of control

A
  • preventative
  • detective
  • corrective
  • directive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are preventive controls?

A

Used to deter or prevent an undesirable event from occurring

Eg. Burglar bars to prevent burglars from breaking in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are detective controls?

A

Used to detect undesirable events that have occurred

Eg. Burglar alarm to detect when someone’s broken into a building

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are corrective controls?

A

Used to correct the effects of undesirable events

Eg. Burglar alarm is linked to security company that responds in time to stop the burglars

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are directive controls?

A

Used to discourage an undesirable event from occurring or to encourage a desirable event to occur

Eg. A sign warning that a building is protected by burglar alarm is used to discourage burglars from attempting to break in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What activities do business operations include?

A
  • handling of cash
  • buying and selling on credit
  • inventory
  • debtors
  • creditors
  • fixed assets
  • payroll
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

List three possible risks

A
  • error
  • fraud
  • theft
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why do business operations leave businesses vulnerable to risk?

A

They often entail complex procedures, involving several personnel and numerous transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How can businesses guard against the risks of business operations?

A

By establishing an effective risk management and control system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

List the components of a risk management and control system

A
  • risk management function
  • system of internal control
  • internal audit function
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Define risk management

A

The process of identifying, assessing and managing risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Define risk

A

Uncertain future events that may have a negative impact on business operations and a detrimental effect on the business achieving its objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What activities should the risk management function be responsible for?

A
  • establishing risk management policy and strategy of the business
  • analysing business operations and procedures to identify risks
  • evaluating and assessing potential impact of risks identified
  • deciding on appropriate action to be taken in response to each of the risks identified
  • developing and implementing appropriate internal control processes to combat risks
  • continual reviewing of risk management process and strategy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

List the four responses of the risk management function

A
  • avoid the risk
  • control the risk
  • transfer the risk
  • tolerate the risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Explain avoiding the risk

A

This is likely to be the response if the risk is significant and either cannot be contained or is too costly to control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Explain controlling the risk

A

This is normally the response if the risk is significant, but can be cost-effectively controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Explain transferring the risk

A

This is likely to be the response if the risk is significant, but unlikely to occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Explain tolerating the risk

A

A risk may be tolerated if it’s found that the risk is unlikely to occur and it would have little impact even if it did occur

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the purpose of internal controls in a business?

A

To control risks to help ensure that the business objectives are accomplished

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What should an effective system of internal controls ensure?

A
  • the financial and operational information of a business is reliable and accurate
  • employees comply with policies, procedures and rules of business
  • employees adhere to the business code of ethics
  • business assets are safeguarded
  • business resources are used economically and efficiently
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the purpose of internal controls in accounting?

A

The purpose is to control risks to help ensure that the accounting objectives of the business are achieved. They form part of the system of internal controls of a business and are implemented not only to ensure that the transactions of the business are recorded accurately, but also to protect the business against the risk of financial loss due to fraud or error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does an effective system of internal accounting controls ensure?

A
  • accounting records are accurate and reliable
  • income is received and correctly recorded
  • expenses are properly authorized and correctly recorded
  • assets are safeguarded and properly recorded
  • liabilities are paid timeously and are properly recorded
  • errors and irregularities in processing information are detected
23
Q

List the elements of internal control

A
  • division of duties
  • proper documentation
  • authorisation of transactions
  • physical controls
  • reconciliations
24
Q

Explain division of duties

A

It involves the separation of responsibilities/duties that would, if combined, enable an individual to record and process a complete transaction. This would provide that person with the opportunity to commit fraud by manipulating the transaction irregularly

25
Q

What is the primary objective of division of duties?

A

To reduce the risk of fraud and errors by limiting opportunities and increasing the element of checking

26
Q

List the functions that should be separated in division of duties

A
  • authorisation
  • execution
  • custody
  • record keeping
27
Q

Explain proper documentation

A

This requires that proper and accurate documentation is maintained and used to support all transactions. The information relating to each transaction should be recorded accurately and in full detail on the relevant source document. The source documents should be pre-numbered, consecutive and prepared timeously. After the source document has been used to record the transaction in the appropriate subsidiary journal, it should be filed so that it can be used to provide evidence of the transaction

28
Q

Explain the authorisation of transactions

A

This requires that transactions should only be approved and carried out by personnel acting within the scope of their authority. Authorization policies and procedures clearly identify which personnel have the authority to approve each type of transaction. The restriction of authority is essential to reduce the risk of fraudulent transactions being processed

29
Q

Explain physical controls

A

These are controls that are used to physically safeguard assets and records (safes, secure storage, cash registers, fireproof filing cabinets, password-protected computer programs). These controls are designed to ensure that access to assets and records is restricted to authorized personnel only. Physical controls are used to reduce risk of theft of business property or fraudulent tampering with business records

30
Q

Explain reconciliations

A

Process of comparing two sets of records to check that they’re in agreement, used to reduce the risk of errors and fraud. If it’s found that the records are different, then the differences must be accounted for and necessary adjustments must be processed. Where there’s differences that can’t be accounted for, further investigation needs to take place and this frequently results in the detection of legitimate errors. However, this investigation can lead to the discovery of fraudulent transactions and expose complex fraud schemes

31
Q

Define internal auditing

A

An independent assessment of the effect of the risk management and internal control of a business to identify the strengths and weaknesses to the management and control of risk. The resulting information enables management to improve risk management and internal control, helping to ensure that business objectives are achieved

32
Q

What is the purpose of internal auditing?

A

It is an assurance and a consulting activity.

For the business areas where risk management and internal control are effective, the audit provides “assurance” that risk is being managed and controlled adequately

For the business areas where risk management or internal control are inadequate, audit performs a “consulting” role by providing recommendations for for improving the management and control of risk

33
Q

Explain the meaning of the internal control function

A

It is normally performed by a team of internal auditors (usually employees) but it can be contracted to specialist internal auditing firms. Internal auditors need to operate independently, be objective of their work and have strong ethical values. It’s essential that others within the business can’t influence the internal auditors in any way. While they don’t need to be accountants, they should have a broad range of skills and expertise in financial and operational areas, and in-depth understanding of the business culture, systems and processes

34
Q

What is the role of the internal auditor?

A

To evaluate the effectiveness of the risk management and internal control system of the business and report their findings, opinions and recommendations to management

35
Q

List the responsibilities of an internal auditor

A
  • evaluating the adequacy and effectiveness of risk management to identify current risk issues and anticipate potential future areas of concern
  • evaluating the adequacy and effectiveness of internal controls to identify deficiencies and provide recommendations for improvement
  • reviewing and analyzing the business operations to gain a clear understanding of the various processes and the role they play in achieving the business objectives
  • reviewing systems, operations, and procedures to determine whether the business and employees are in compliance with policies, procedures, laws, codes of practice, and regulations
  • examining and evaluating the reliability and integrity of financial and operating information
  • examining and evaluating the effective and efficient use of the business’s resources
  • reviewing the means used to safeguard assets and verifying the existence of those assets
  • providing management with analyses, appraisals, recommendations, and information concerning the activities reviewed to assist them in the management of risk
36
Q

Summarize the relationship between risk management, internal control, and the internal auditing function

A

The achievement of business operations is threatened by risks that are identified and evaluated by risk management, which develops and implements internal control. Internal auditing evaluates the effectiveness of risk management and internal control

37
Q

What is a risk-based approach to the internal audit

A

It involves identifying and focusing on the areas of greatest risk to the business. It aims to maximize the impact of the internal audit by ensuring that internal audit resources are allocated to the areas that matter most

38
Q

List the four phases of an internal audit process

A
  • planning
  • fieldwork
  • reporting
  • following up
39
Q

When does the planning phase begin?

A

After management has defined the general objectives and scope of the audit

40
Q

Explain the planning phase of an internal audit

A
  1. Internal auditors gather info to gain a thorough understanding of the business activities under review. They do this by:
    - reviewing documented policies and procedures
    - having discussions with management
    - analysing business operations
  2. They define objectives of area being audited
  3. Risks to achieving objectives will be identified and analyzed to identify areas of significant risk
  4. Internal auditors plan the detail and scope of the work to be performed during fieldwork, giving priority to areas of greatest risk
41
Q

List the tests performed during the fieldwork phase

A
  • walkthrough tests
  • compliance tests
  • substantive tests
42
Q

Explain walkthrough tests

A

It involves tracing a small sample of transactions through the existing systems from the beginning to the end of the process being assessed. These tests are performed for two main reasons:
- to determine whether the documented internal controls have actually been implemented
- to enable the internal auditors to gain a better understanding of the various control processes

43
Q

Explain compliance tests

A

Involves reviewing the internal control processes to determine whether the internal controls are working as intended. They’re also known as “tests of control,” which are used to verify that control procedures are being adhered to and applied correctly or to uncover noncompliance and unclear procedures

44
Q

Explain substantive tests

A

Involves testing, checking, and verifying the completeness, validity, and accuracy of the financial and operating information. These tests are used to uncover any material errors, irregularities, or inaccuracies and determine whether the objectives of the control processes are being achieved

45
Q

List the internal auditing techniques

A
  • sampling
  • inspection
  • observation
  • enquiry
  • re-performance
46
Q

Explain sampling

A

Due to cost and time implications, it’s not possible to test and check every document and record. Therefore, auditors select a representative sample from each process to test. This sample should be large enough to provide the auditors with an accurate account of the business process, yet small enough to be completed in a short period of time

47
Q

Explain inspection

A

Involves the investigation of documents, records, and reconciliations to ascertain whether internal control procedures are being carried out correctly and are operating efficiently

48
Q

Explain observation

A

Involves internal auditors observing employees carrying out specific processes and procedures. By monitoring activities being performed, internal auditors can determine whether the internal control procedures are being complied with and can gauge the effectiveness of the processes

49
Q

Explain enquiry

A

Involves internal auditors interviewing employees and asking them questions related to the performance of their duties. Through interviews, internal auditors can obtain useful information regarding the control environment and can determine the employees’ understanding of the control objectives. This helps the internal auditors to identify deficiencies or potential weaknesses in the internal control systems

50
Q

Explain re-performance

A

Involves re-performing tasks that have already been performed to test for accuracy and completeness. This testing technique involves re-checking calculations, reconciliations, and recordkeeping procedures and enables the internal auditors to evaluate the accuracy and reliability of the information processed through various control systems

51
Q

Define audit evidence

A

Information gathered and results obtained from internal audit tests and investigations

52
Q

Explain the reporting phase

A

The aim of the internal auditors report is to provide management with an opinion as to whether the risk management and internal control systems are functioning effectively and managing risks to an acceptable level. The report should provide assurance on the areas of significant risk that are being effectively managed and controlled while at the same time documenting any significant shortcomings or weaknesses identified. The report should also provide recommendations for improvement in areas of significant risks where the management and control of risk were found to be inadequate

53
Q

Explain the follow-up phase

A

Based on opinions, findings, and recommendations set out in the internal auditors report, management may decide to make changes to the existing risk management and internal control system to address weaknesses identified. The internal auditing function should establish a follow-up process to monitor any corrective action taken by management. This will help to ensure that those actions have been effectively implemented and are managing the associated risks to an acceptable level