Internal Control (Chapter 2) [P2] Flashcards
1
Q
List the types of control
A
- preventative
- detective
- corrective
- directive
2
Q
What are preventive controls?
A
Used to deter or prevent an undesirable event from occurring
Eg. Burglar bars to prevent burglars from breaking in
3
Q
What are detective controls?
A
Used to detect undesirable events that have occurred
Eg. Burglar alarm to detect when someone’s broken into a building
4
Q
What are corrective controls?
A
Used to correct the effects of undesirable events
Eg. Burglar alarm is linked to security company that responds in time to stop the burglars
5
Q
What are directive controls?
A
Used to discourage an undesirable event from occurring or to encourage a desirable event to occur
Eg. A sign warning that a building is protected by burglar alarm is used to discourage burglars from attempting to break in
6
Q
What activities do business operations include?
A
- handling of cash
- buying and selling on credit
- inventory
- debtors
- creditors
- fixed assets
- payroll
7
Q
List three possible risks
A
- error
- fraud
- theft
8
Q
Why do business operations leave businesses vulnerable to risk?
A
They often entail complex procedures, involving several personnel and numerous transactions
9
Q
How can businesses guard against the risks of business operations?
A
By establishing an effective risk management and control system
10
Q
List the components of a risk management and control system
A
- risk management function
- system of internal control
- internal audit function
11
Q
Define risk management
A
The process of identifying, assessing and managing risk
12
Q
Define risk
A
Uncertain future events that may have a negative impact on business operations and a detrimental effect on the business achieving its objectives
13
Q
What activities should the risk management function be responsible for?
A
- establishing risk management policy and strategy of the business
- analysing business operations and procedures to identify risks
- evaluating and assessing potential impact of risks identified
- deciding on appropriate action to be taken in response to each of the risks identified
- developing and implementing appropriate internal control processes to combat risks
- continual reviewing of risk management process and strategy
14
Q
List the four responses of the risk management function
A
- avoid the risk
- control the risk
- transfer the risk
- tolerate the risk
15
Q
Explain avoiding the risk
A
This is likely to be the response if the risk is significant and either cannot be contained or is too costly to control
16
Q
Explain controlling the risk
A
This is normally the response if the risk is significant, but can be cost-effectively controlled
17
Q
Explain transferring the risk
A
This is likely to be the response if the risk is significant, but unlikely to occur
18
Q
Explain tolerating the risk
A
A risk may be tolerated if it’s found that the risk is unlikely to occur and it would have little impact even if it did occur
19
Q
What is the purpose of internal controls in a business?
A
To control risks to help ensure that the business objectives are accomplished
20
Q
What should an effective system of internal controls ensure?
A
- the financial and operational information of a business is reliable and accurate
- employees comply with policies, procedures and rules of business
- employees adhere to the business code of ethics
- business assets are safeguarded
- business resources are used economically and efficiently
21
Q
What is the purpose of internal controls in accounting?
A
The purpose is to control risks to help ensure that the accounting objectives of the business are achieved. They form part of the system of internal controls of a business and are implemented not only to ensure that the transactions of the business are recorded accurately, but also to protect the business against the risk of financial loss due to fraud or error
22
Q
What does an effective system of internal accounting controls ensure?
A
- accounting records are accurate and reliable
- income is received and correctly recorded
- expenses are properly authorized and correctly recorded
- assets are safeguarded and properly recorded
- liabilities are paid timeously and are properly recorded
- errors and irregularities in processing information are detected
23
Q
List the elements of internal control
A
- division of duties
- proper documentation
- authorisation of transactions
- physical controls
- reconciliations
24
Q
Explain division of duties
A
It involves the separation of responsibilities/duties that would, if combined, enable an individual to record and process a complete transaction. This would provide that person with the opportunity to commit fraud by manipulating the transaction irregularly
25
What is the primary objective of division of duties?
To reduce the risk of fraud and errors by limiting opportunities and increasing the element of checking
26
List the functions that should be separated in division of duties
- authorisation
- execution
- custody
- record keeping
27
Explain proper documentation
This requires that proper and accurate documentation is maintained and used to support all transactions. The information relating to each transaction should be recorded accurately and in full detail on the relevant source document. The source documents should be pre-numbered, consecutive and prepared timeously. After the source document has been used to record the transaction in the appropriate subsidiary journal, it should be filed so that it can be used to provide evidence of the transaction
28
Explain the authorisation of transactions
This requires that transactions should only be approved and carried out by personnel acting within the scope of their authority. Authorization policies and procedures clearly identify which personnel have the authority to approve each type of transaction. The restriction of authority is essential to reduce the risk of fraudulent transactions being processed
29
Explain physical controls
These are controls that are used to physically safeguard assets and records (safes, secure storage, cash registers, fireproof filing cabinets, password-protected computer programs). These controls are designed to ensure that access to assets and records is restricted to authorized personnel only. Physical controls are used to reduce risk of theft of business property or fraudulent tampering with business records
30
Explain reconciliations
Process of comparing two sets of records to check that they're in agreement, used to reduce the risk of errors and fraud. If it's found that the records are different, then the differences must be accounted for and necessary adjustments must be processed. Where there's differences that can't be accounted for, further investigation needs to take place and this frequently results in the detection of legitimate errors. However, this investigation can lead to the discovery of fraudulent transactions and expose complex fraud schemes
31
Define internal auditing
An independent assessment of the effect of the risk management and internal control of a business to identify the strengths and weaknesses to the management and control of risk. The resulting information enables management to improve risk management and internal control, helping to ensure that business objectives are achieved
32
What is the purpose of internal auditing?
It is an assurance and a consulting activity.
For the business areas where risk management and internal control are effective, the audit provides "assurance" that risk is being managed and controlled adequately
For the business areas where risk management or internal control are inadequate, audit performs a "consulting" role by providing recommendations for for improving the management and control of risk
33
Explain the meaning of the internal control function
It is normally performed by a team of internal auditors (usually employees) but it can be contracted to specialist internal auditing firms. Internal auditors need to operate independently, be objective of their work and have strong ethical values. It's essential that others within the business can't influence the internal auditors in any way. While they don't need to be accountants, they should have a broad range of skills and expertise in financial and operational areas, and in-depth understanding of the business culture, systems and processes
34
What is the role of the internal auditor?
To evaluate the effectiveness of the risk management and internal control system of the business and report their findings, opinions and recommendations to management
35
List the responsibilities of an internal auditor
- evaluating the adequacy and effectiveness of risk management to identify current risk issues and anticipate potential future areas of concern
- evaluating the adequacy and effectiveness of internal controls to identify deficiencies and provide recommendations for improvement
- reviewing and analyzing the business operations to gain a clear understanding of the various processes and the role they play in achieving the business objectives
- reviewing systems, operations, and procedures to determine whether the business and employees are in compliance with policies, procedures, laws, codes of practice, and regulations
- examining and evaluating the reliability and integrity of financial and operating information
- examining and evaluating the effective and efficient use of the business's resources
- reviewing the means used to safeguard assets and verifying the existence of those assets
- providing management with analyses, appraisals, recommendations, and information concerning the activities reviewed to assist them in the management of risk
36
Summarize the relationship between risk management, internal control, and the internal auditing function
The achievement of business operations is threatened by risks that are identified and evaluated by risk management, which develops and implements internal control. Internal auditing evaluates the effectiveness of risk management and internal control
37
What is a risk-based approach to the internal audit
It involves identifying and focusing on the areas of greatest risk to the business. It aims to maximize the impact of the internal audit by ensuring that internal audit resources are allocated to the areas that matter most
38
List the four phases of an internal audit process
- planning
- fieldwork
- reporting
- following up
39
When does the planning phase begin?
After management has defined the general objectives and scope of the audit
40
Explain the planning phase of an internal audit
1. Internal auditors gather info to gain a thorough understanding of the business activities under review. They do this by:
- reviewing documented policies and procedures
- having discussions with management
- analysing business operations
2. They define objectives of area being audited
3. Risks to achieving objectives will be identified and analyzed to identify areas of significant risk
4. Internal auditors plan the detail and scope of the work to be performed during fieldwork, giving priority to areas of greatest risk
41
List the tests performed during the fieldwork phase
- walkthrough tests
- compliance tests
- substantive tests
42
Explain walkthrough tests
It involves tracing a small sample of transactions through the existing systems from the beginning to the end of the process being assessed. These tests are performed for two main reasons:
- to determine whether the documented internal controls have actually been implemented
- to enable the internal auditors to gain a better understanding of the various control processes
43
Explain compliance tests
Involves reviewing the internal control processes to determine whether the internal controls are working as intended. They're also known as "tests of control," which are used to verify that control procedures are being adhered to and applied correctly or to uncover noncompliance and unclear procedures
44
Explain substantive tests
Involves testing, checking, and verifying the completeness, validity, and accuracy of the financial and operating information. These tests are used to uncover any material errors, irregularities, or inaccuracies and determine whether the objectives of the control processes are being achieved
45
List the internal auditing techniques
- sampling
- inspection
- observation
- enquiry
- re-performance
46
Explain sampling
Due to cost and time implications, it's not possible to test and check every document and record. Therefore, auditors select a representative sample from each process to test. This sample should be large enough to provide the auditors with an accurate account of the business process, yet small enough to be completed in a short period of time
47
Explain inspection
Involves the investigation of documents, records, and reconciliations to ascertain whether internal control procedures are being carried out correctly and are operating efficiently
48
Explain observation
Involves internal auditors observing employees carrying out specific processes and procedures. By monitoring activities being performed, internal auditors can determine whether the internal control procedures are being complied with and can gauge the effectiveness of the processes
49
Explain enquiry
Involves internal auditors interviewing employees and asking them questions related to the performance of their duties. Through interviews, internal auditors can obtain useful information regarding the control environment and can determine the employees' understanding of the control objectives. This helps the internal auditors to identify deficiencies or potential weaknesses in the internal control systems
50
Explain re-performance
Involves re-performing tasks that have already been performed to test for accuracy and completeness. This testing technique involves re-checking calculations, reconciliations, and recordkeeping procedures and enables the internal auditors to evaluate the accuracy and reliability of the information processed through various control systems
51
Define audit evidence
Information gathered and results obtained from internal audit tests and investigations
52
Explain the reporting phase
The aim of the internal auditors report is to provide management with an opinion as to whether the risk management and internal control systems are functioning effectively and managing risks to an acceptable level. The report should provide assurance on the areas of significant risk that are being effectively managed and controlled while at the same time documenting any significant shortcomings or weaknesses identified. The report should also provide recommendations for improvement in areas of significant risks where the management and control of risk were found to be inadequate
53
Explain the follow-up phase
Based on opinions, findings, and recommendations set out in the internal auditors report, management may decide to make changes to the existing risk management and internal control system to address weaknesses identified. The internal auditing function should establish a follow-up process to monitor any corrective action taken by management. This will help to ensure that those actions have been effectively implemented and are managing the associated risks to an acceptable level
