Principles of Internal Control

Question 1

Control environment — 5 principles

Answer 1

1. Integrity and Ethical Values - “tone at the top”
2. Board of Directors - independence from management; oversees development and monitoring of internal control
3. Management - establish structures, reporting lines, and appropriate authorities and responsibilities to achieve objectives
4. Competence - commitment to attract, develop, and retain competent individuals
5. Accountability - hold individuals responsible for internal control responsibilities (authority, rewards, discipline)

Question 2

Risk Assessment — 4 objectives

Answer 2

1. Objectives - specify objectives with sufficient clarity to enable the identification and assessment of risks that threaten the achievement of objectives
2. Assessment - identify risks to the achievement of objectives across the entity and analyze risks as a basis for determining how the risk should be managed
3. Fraud - consider the potential for fraud in assessing risks to the achievement of objectives
4. Change Management - identify and assess changes in the external environment, business model and organizational leadership that could impact the system of internal control

Question 3

Control Activities — 3 principles

Answer 3

1. Risk Reduction - organizational control activities mitigate the risks to the achievement of objectives to acceptable levels
2. Technology Controls - select and implement general controls over technology which support the achievement of its objectives
3. Policies - establish policies, procedures, responsibility and accountability

Question 4

Information and Communication — 3 principles

Answer 4

1. Quality - relevant, high-quality information supports the internal control processes
2. Internal - internal communication supports internal control processes
3. External - communication with outsiders supports internal control processes

Question 5

Monitoring Activities — 2 principles

Answer 5

1. Ongoing and Periodic - ongoing and separate evaluations evaluate internal control functioning
2. Address Deficiencies - parties responsible for taking corrective action, including senior management and the board of directors, receive timely communication of internal control deficiencies