Module 3: Internal Control Systems

Question 1

Reason for Sound system of internal control

Answer 1

To provide reasonable assurance over:
1. Realisability of financial reporting
2. Effectiveness and efficiency of operations
3. Compliance with applicable laws and regulations

Question 2

Components of sound internal control (CRIME)

Answer 2

1. Control environment: tone at the top.
2. Risk assessment process: where business risks are identified and managed
3. Information system: used to record financial and non financial data
4. Control activities: policies and producers management put in place to ensure their directives carried out and mitigate risks
5. Monitoring of controls: ongoing assesments of performance of internal control system

Question 3

Accounting Info System

Answer 3

• prepare accurate FS to meet requirements and to share info with stakeholders
• prepare internal management info for purpose of informing board and aid make strategic decisions
• used by entity to collect, store and process financial and accounting data

Question 4

Control Activites

Answer 4

Policies which establish what should be done and procedures is what is required to implement it

2 types preventative and detective

Question 5

5 Categories of Control Activities (APIPS)

Answer 5

1. Authorisation control
2. Performance review
3. Information Processing Controls:

• ITGCs: policies and procedures relating to all application. Support effective functioning of application controls by ensuring the continued operation of IS
• Application controls: operate at transaction level. Involve both manual and auto. Ensure all transactions are genuine accurate and complete.

4. Physical controls
5. Segregation of duties

Question 6

Limitation of internal control

Answer 6

• relevancy
• cost
• collusion
• human error
• management override
• unusual transactions

Question 7

ITGC

Answer 7

• bubble around IT systems and controls
• help while IT system work effectively
• can be manual/ automated

Question 8

ITGCs key areas

Answer 8

• access to program and data: awareness of security policies and restriction of access
• program changes and dev: made appropriately and do not negatively affect the business. (Auth, dev, testing, approval)
• computer operations: day to day procession of info. Ensures firm efficient as possible and achieve objectives of firm. (Example; job processing, back up and recovery, incident and problem management)

Continuity of operations: ability to carry on trading after disaster. DRP