chapter 4 - content

what is an internal control

A system designed to provide reasonable assurance that the organisation:

✅ reports correctly

✅ operates effectively and efficiently

✅ complies with laws and regulations

examples of risks and their internal controls

• Risk: customer doesn’t pay

control = credit checks before sale

• risk = poor quality products

control = quality control inspections

• risk = paying too much for inventory

control = compare supplier prices

what are limitations of internal controls

• human error = people make mistakes

• collusion = two or more employees work together to bypass controls

• unusual transactions = controls designed for routine activities

• management override = directors can bypass controls

(HCUM)

what are the 5 components of internal control

1) control environment

2) risk assessment process

3) information system and communication

4) control activities

5) monitoring

C R I C M

what is meant by control environment + examples

1. Control Environment

The culture of the company.

Think:

"Does management care about controls?"

Strong environment:

✅ audit committee

✅ ethical culture

✅ controls taken seriously

what is meant by risk assessment process

Identify risks.

Evaluate risks.

Respond to risks.

what is meant by information system and communication

The system producing financial information.

Examples:

• Accounting software

• Ledgers

• Financial statements

what is meant by control activities

The actual controls.

what is meant by monitoring

Checking controls still work.

Example:

Internal audit reviews controls.

what is a preventative control

Stops problem happening.

Example:

Manager approval before payment.

what is a detective control

Finds problem after it happens.

Example:

Bank reconciliation.

preventative control vs detective control

Easy Example

Preventive: ✅ Password on payroll system (BEFORE)

Detective: ✅ Review payroll error report (AFTER)

what are control activities

• authorisation

• reconciliation

• verification

• physical controls

• segregation of duties

what is meant by authorisation

Someone approves something.

Examples:

✅ Manager signs purchase order

✅ Director approves overtime

what is meant by reconciliation

Compare records and investigate differences.

Examples:

✅ Bank reconciliation

✅ Supplier statement reconciliation

what is meant by verification

Compare something with expectation/policy.

Examples:

✅ Compare actual spend with budget

✅ Review customer balances exceeding credit limits

reconciliation vs verification

• reconciliation = make two records agree (e.g. bank statement vs cash book)

• verification = check reasonable (customer above credit limit - investigate)

what is meant by physical controls

Protect assets.

Examples:

✅ Locks

✅ Inventory counts

✅ Passwords

✅ Security cards

what is meant by segregation of duties

Different people perform different tasks.

Examples:

Person A orders inventory.

Person B receives inventory.

Person C pays supplier.

examples of general IT controls

Controls over the whole IT environment.

Examples:

✅ Passwords

✅ Virus checks

✅ Staff training

✅ Backups

✅ Disaster recovery

✅ Program libraries

"Keeps the IT system safe."

information processing controls

Controls ensuring transactions are accurate and complete.

Examples:

✅ Document counts

✅ Record counts

✅ Hash totals

✅ Digit verification

✅ Range checks

✅ Reasonableness checks

✅ One-to-one checking

"Checks the data."

what is an audit committee made of and their responsibilities

Made up of:

✅ Non-executive directors

Responsibilities:

✅ Internal controls

✅ Financial statements

✅ Internal audit

✅ External audit

what are the steps and order of a business risk process

Step 1 - Identify risks

Step 2 - Assess significance

Step 3 - Assess likelihood

Step 4 - Respond

what is the definition of a walkthrough test

Trace a transaction from start to finish.❌ NOT a test of controls.

✅ Test of auditor's understanding.

what is the purpose of a walkthrough test

✅ Confirm auditor understands system.

❌ NOT a test of controls.

✅ Test of auditor's understanding.