Internal control and auditing

CIMA-P3 · Chapter 6

Internal control and auditing

1 Internal control: what it is and what it is for

Internal control:

‘The management system of controls, financial and otherwise, established in order to provide reasonable assurance of: (a) effective and efficient operation (b) internal financial control (c) compliance with laws and regulations’

(CIMA Official Terminology, 2005)

Examples of the three areas of internal control mentioned in this definition are:

Internal control area	Examples
Effective and efficient operation	Enough inventory to meet production requirements Low wastage Full use of machinery through clever scheduling
Internal financial control	Safeguarding assets Collecting receivables on time Paying suppliers and employees the correct amounts
Compliance with laws and regulations	Ensuring working time and minimum wage laws are not broken Paying the correct amount of tax on time Ensuring health and safety laws are complied with

Note that the term encompasses more than just financial controls - though it is financial controls that auditors will concentrate on.

About the lectures for this chapter.

The first covers §§1–12 and is embedded below. The recording on the internal audit report, outsourcing and fraud is embedded at §13. The first predates the 2027 syllabus; it is sound on what it covers, but carry two things with you.

COSO: straight after the five ISA 315 elements it walks through the components on the front of COSO’s 2004 enterprise risk management cube, from internal environment to monitoring. That framework was replaced in 2017 and is not the one the syllabus names (§3.1). Learn the five components in §3.2: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.

Notes-only: the 2017 components and principles (§§3.2–3.4), the risk manager and the internal auditor (§4.2), and assessing control weakness and compliance failure (§5.1).

YouTube video

2 The elements of an internal control system

The five elements below are those set out in International Standard on Auditing 315. They are the auditor’s description of a control system — what an auditor expects to find, and what an auditor tests.

The control environment. This refers to the culture of the organisation: Is good internal control valued and encouraged?

The risk assessment process. Where is the organisation vulnerable? For example, a jewellery shop will need very good control over its inventory.

The information system. How does management receive information that might indicate that internal control is failing? For example, comparing budgets to actual results might indicate a problem.

The control activities: For example authorisation, reconciliations, comparisons, physical controls, numerical sequence control

Monitoring: is the internal control system being kept up to date with respect to business developments? Is it operating properly?

3 The COSO enterprise risk management framework

P3C2a names the framework by its full title: the Committee of Sponsoring Organisations of the Treadway Commission (COSO) internal control and risk management framework. COSO is a private-sector body formed by five accounting and finance institutes, and its frameworks are the most widely used descriptions in the world of what a control system and a risk management system should contain.

3.1 Two COSO frameworks — do not confuse them

COSO publishes two frameworks, and candidates routinely mix them up:

	Internal Control — Integrated Framework	Enterprise Risk Management — Integrating with Strategy and Performance
Current version	2013	2017
Question it answers	Is there a sound system of internal control over operations, reporting and compliance?	Is risk considered when the strategy is set, and is performance managed against the risk taken to achieve it?
Components	5	5
Principles	17	20
Scope	Control over the objectives the organisation has already chosen.	The choice of objectives itself — including the risk that the wrong strategy is chosen.

The two are complements, not rivals. The 2013 framework is the one an auditor reaches for when testing controls; the 2017 framework is the one a board reaches for when asking whether the strategy it has chosen carries risk it did not intend to take. It is the 2017 framework the P3 syllabus lists — its five components are reproduced word for word in P3C2a's topics to be covered.

Older material — including some still in circulation — teaches COSO's 2004 enterprise risk management framework as a cube with eight components (internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, monitoring). That framework was superseded in 2017 and is not what the syllabus asks for. It is named here once, as history, so that you recognise it if you meet it. Learn the five components below.

3.2 The five components

The 2017 framework's central claim is that enterprise risk management is not a separate compliance activity bolted on at the end. It runs alongside the whole cycle by which an organisation decides what it is for, chooses a strategy, sets objectives, performs and creates value:

Governance and culture — the board's risk oversight, the operating structures through which responsibility for risk is allocated, and the culture and behaviour the organisation actually rewards. Culture is placed first because it determines whether everything below it is done honestly.
Strategy and objective-setting — analysing the business context, defining risk appetite, and evaluating alternative strategies before one is chosen. This is what makes the 2017 model a strategic one rather than a control checklist: risk is considered while the strategy is still being chosen, not after.
Performance — identifying risks, assessing their severity, prioritising them, choosing responses, and building a portfolio view of risk across the whole organisation rather than a list of departmental risks.
Review and revision — assessing substantial change, reviewing risk against performance, and improving the risk management process itself.
Information, communication and reporting — using information and technology to capture risk data, communicating it to the people who must act, and reporting on risk, culture and performance.

3.3 The twenty principles

Each component is supported by principles — twenty in all. They are the level at which an examiner can ask you to say what is missing from an organisation's arrangements, so it is worth being able to place a weakness under the right one.

Component	Principles
Governance and culture	1 Exercises board risk oversight · 2 Establishes operating structures · 3 Defines desired culture · 4 Demonstrates commitment to core values · 5 Attracts, develops and retains capable individuals
Strategy and objective-setting	6 Analyses business context · 7 Defines risk appetite · 8 Evaluates alternative strategies · 9 Formulates business objectives
Performance	10 Identifies risk · 11 Assesses severity of risk · 12 Prioritises risks · 13 Implements risk responses · 14 Develops portfolio view
Review and revision	15 Assesses substantial change · 16 Reviews risk and performance · 17 Pursues improvement in enterprise risk management
Information, communication and reporting	18 Leverages information and technology · 19 Communicates risk information · 20 Reports on risk, culture and performance

3.4 Using the framework in an answer

The framework earns its marks as a diagnostic checklist. Given a scenario in which something has gone wrong, work through the five components and ask what was missing:

did anyone at board level own the risk, and did the culture allow it to be raised? (governance and culture)
was the appetite for this risk ever defined, and were alternative strategies compared? (strategy and objective-setting)
was the risk identified, sized, prioritised and responded to — and was it aggregated with everything else the organisation was carrying? (performance)
did anything change that should have triggered a re-assessment? (review and revision)
did the information reach the person who could act, in time to act? (information, communication and reporting)

Notice how closely this maps onto the ISA 315 elements of §2. The auditor's five elements describe a control system from the outside, looking for the risk of material misstatement; COSO's five components describe risk management from the inside, looking for the risk that objectives are not achieved. They are two views of the same machinery, which is why an internal auditor can use either as a framework for an assignment.

Placing a failure under the right component

D Group manufactures household appliances. During the year it launched a connected “smart” product range. After launch the following came to light:

No one had asked how much reputational and regulatory exposure the group was prepared to accept from holding customers’ usage data; the range was approved on its sales forecast alone.
Three divisions each ran their own cyber assessment. Nobody added them together, so the group total was never known.
A serious vulnerability was found by a junior engineer in March and reported by email to a manager who left in April. It reached the risk function in September.
A competitor was fined heavily in June for a similar data breach. D Group made no reassessment.

Required

For each of the four failures, name the COSO 2017 component it sits under and the principle that was not applied.

Placing a failure under the right component

Failure	Component	Principle not applied
(a) Appetite for data-related exposure never defined; the strategy was approved on the forecast alone.	Strategy and objective-setting	7 Defines risk appetite (and 8 Evaluates alternative strategies — no alternative to holding the data was considered).
(b) Three divisional assessments never aggregated.	Performance	14 Develops portfolio view. Each division may have been within its own tolerance while the group was far outside its own.
(c) A known vulnerability took six months to reach the risk function.	Information, communication and reporting	19 Communicates risk information. The risk was identified — principle 10 worked — and then failed to travel.
(d) A competitor’s fine triggered no reassessment.	Review and revision	15 Assesses substantial change. An external event of that size is exactly the trigger this principle exists for.

A fifth mark is available for the observation that failures (b) and (c) together point at governance and culture — principle 2, operating structures: if three divisions can each assess the same risk without anyone owning the total, and if a vulnerability report can die in a departed manager’s inbox, responsibility for risk has not been allocated.

4 Responsibilities for internal control

4.1 The board and its committees

Responsibility for internal control runs downwards from the board and assurance runs back upwards to it. Governance codes put the duty on the board and allow it to delegate the review work to a committee — they do not allow it to delegate the responsibility.

The UK Corporate Governance Code states that it is the responsibility of the board of directors to establish procedures to manage risk, oversee the internal control framework and determine the nature and extent of the principal risks that the company is willing to take in order to achieve its long-term strategic objectives.

It is then the responsibility of the audit committee (a sub-committee of the board) to review the company’s internal financial controls and internal control and risk management systems unless expressly addressed by a separate board risk committee composed of non-executive directors or the board itself.

The audit committee should review the effectiveness of the company’s internal audit function or, if there is not one, to consider annually whether one is needed and make a recommendation to the board.

The audit committee must also review the effectiveness of the external audit process.

Under the current (2024) edition of the UK Code the board must go further and declare in the annual report whether the company’s material controls were effective at the balance sheet date, describing any that were not and what is being done about them. Chapter 5, Corporate governance, sets out the requirement; its consequence for this chapter is practical. A declaration of that kind has to be supported by evidence that somebody independent has tested the controls concerned, which raises the value of a properly resourced internal audit function and makes the quality of the work in §§6 to 13 a board-level exposure rather than a departmental one.

4.2 The risk manager and the internal auditor

P3C1a names one distinction explicitly: the role of the risk manager as distinct from the internal auditor. They are easy to confuse, because both spend their working lives on risk and controls and both report upwards. They are opposite ends of the same process.

The short version: the risk manager runs the risk management process; the internal auditor gives independent assurance that the process works. One is part of management, the other must not be.

	Risk manager (or risk function)	Internal auditor
Role	Designs, operates and maintains the risk management process — the risk register, the risk assessment methodology, the reporting cycle, the risk appetite proposals.	Examines and evaluates the adequacy and effectiveness of controls, including the controls the risk manager has put in place.
Position	Part of management. It advises and challenges the business, but it owns a process.	Independent of the management of the activities it audits. Independence is its defining requirement, not a nice-to-have.
Reports to	Management, and usually to the risk committee of the board (Chapter 5).	The audit committee, with a right of access to the board and to the chair.
Owns controls?	Yes — it works with line management to design and implement risk responses.	No. An internal auditor who designs or operates a control cannot later give assurance on it: that is the self-review threat.
Coverage	The risks the organisation faces, whether or not they are controlled.	Whether controls exist, are adequately designed, and are actually complied with.
Typical output	Risk register, risk appetite statement, risk reports to the committee and the board, mitigation plans.	Audit reports setting out deficiencies, their possible effects, and recommendations (§13).
Success looks like	Risks are identified, sized, owned and responded to within appetite.	Somebody outside the process can say, with evidence, that it is working.

Two consequences follow, and both are examinable:

The roles must not be held by the same person or the same team. If the risk manager also audits the risk process, the organisation is assuring its own work and nobody outside the process ever tests it. In a small organisation the two roles are sometimes combined for cost reasons; that is a control weakness to name in an answer, and the usual mitigation is to buy the assurance work in from an independent third party (§14.3).
Neither of them is responsible for managing risk. Risk is owned by line management, and ultimately by the board. The risk manager provides the framework and the challenge; the internal auditor provides assurance; the manager who runs the warehouse still owns the risk of losing the inventory.

This is the distinction the IIA’s Three Lines Model (2020) sets out formally: line management as the first line, risk and compliance functions as the second, and internal audit as an independent third line reporting to the governing body. The model itself is taught in Chapter 2, Responses to risk, alongside assurance mapping; this section covers only the two roles P3C1a names. At board level the counterpart structures are the audit committee and the risk committee, in Chapter 5, Corporate governance.

5 Internal control systems and control activities

Most auditing relies on testing the system of internal control. This is the system put in place to prevent or detect errors. Typical controls are:

Segregation of duties: split up the stages of a transaction so that one person doesn’t carry out every step. This helps to stop fraud and also means that several minds are involved in ensuring the transaction is correct.
Physical: for example, lock cash and inventory away.
Authorisation and approval: for example, overtime claims are signed by managers as approval.
Management and supervision: managers and supervisors keep an eye on what’s going on.
Organisation: for example, ensuring that the sales team can’t decide on sales prices to boost demand and their commissions.
Arithmetic and accounting: reperform calculations. Carry out reconciliations.

Internal control systems should be set out in a procedures manual and internal auditors will assess:

Are the procedures adequate?
Are the procedures being carried out as they should be?

Examples of poor internal control include:

Not cancelling suppliers invoices when posted/paid (they could go round the system again).
Employees self-certifying time sheets and expense claim forms
Ability of junior staff to write off debts (or to carry out other journal entries).
Not ensuring that cash receipts are promptly banked
Not establishing credit limits for customers and not following up slow payers
Not approving orders for material so that too much of the wrong type can be ordered

5.1 Assessing control weakness and compliance failure

P3C2b and P3C2c ask you to assess a control weakness and a compliance failure. That is a discipline rather than a list, and the same five steps work for both:

What was the control objective? What was this part of the system supposed to achieve or prevent?
What control should have been there to achieve it?
What is the deficiency — is the control missing by design, or present but not complied with?
What could go wrong as a result, and how much is at stake?
What is the recommendation, and is it proportionate to the exposure?

Step 3 carries the mark most often lost. A control that was never designed is fixed by designing one. A control that exists and is ignored is a supervision and culture problem, and bolting a second control on top of the first will not fix it — it will be ignored too. The remedy for a compliance failure is authorisation, review, monitoring and consequence, not more paperwork.

A compliance failure is a particular kind of control failure: the organisation has broken a law, a regulation, a contractual obligation or its own policy. Assess it by asking what obligation was breached; who found it — if the regulator found it before the organisation did, that is a second and larger finding about the control system; whether the breach was isolated or systematic; what the consequences are, in fines, licence conditions, remediation cost and the strategic damage set out in Chapter 5; and whether the control that failed was a design failure or a compliance failure, because that determines the remedy.

Control weaknesses in a purchases cycle

At K Ltd, a medium-sized distributor, the same purchasing clerk selects the supplier, raises the purchase order, records the goods as received, and approves the supplier’s invoice for payment. Invoices are not marked once paid. Any member of the accounts team can raise a credit note. Supplier statements are filed unopened because “the ledger is on the system anyway”.

Required

Identify four weaknesses in K Ltd’s internal control, state the risk each creates, and recommend a control.
K Ltd’s finance director proposes that the company’s risk manager should also carry out the internal audit of the purchases cycle, to save the cost of an internal auditor. Comment.

Control weaknesses in a purchases cycle

(a) Weaknesses, risks and controls

Weakness	Risk	Control
One clerk orders, receives and approves for payment — no segregation of duties.	Fictitious suppliers, goods ordered for personal use, invoices approved for goods never received. A single person can complete a fraud without anyone else’s knowledge, and an honest error goes unnoticed because nobody else sees the transaction.	Split the cycle: one person raises the order, a second receives and inspects the goods, a third matches order, goods received note and invoice and approves payment.
Invoices are not cancelled when paid.	The same invoice re-enters the system and is paid twice. The loss is quiet, recurring and hard to spot in a large ledger.	Stamp or perforate every invoice “PAID” on payment; in a computerised ledger, flag the invoice and have the system reject a duplicate supplier reference.
Any member of the accounts team can raise a credit note.	A credit note can be used to conceal a misappropriation or to write off a balance that should have been collected — the same abuse as an unauthorised bad-debt write-off.	Require credit notes above a threshold to be authorised by someone independent of the ledger, and report all credit notes raised to the financial controller monthly.
Supplier statements are not reconciled.	Errors and omissions in the payables ledger are never independently corroborated — unrecorded liabilities, duplicate payments and missing credits all survive.	Reconcile supplier statements to the payables ledger monthly, by someone who does not post purchase invoices, and have the reconciliations reviewed.

(b) The finance director’s proposal

It should be refused. It merges the two roles §4.2 keeps apart: the risk manager would be giving assurance on the risk responses and controls that the risk manager designed. That is the self-review threat in its purest form — nobody outside the process would ever test it, and the assurance the audit committee received would be worth nothing, because a person cannot credibly report that their own work is inadequate.

There is a second objection. The internal auditor needs a reporting line to the audit committee that does not run through the finance director. This proposal comes from the finance director and would place the assurance function inside the management structure the finance director controls — which is the arrangement §6 explains internal audit was moved away from.

If cost is genuinely the constraint, the answer is to outsource the internal audit of the purchases cycle to an independent firm (§14.3), which buys independence and specialist skill without the fixed cost of a permanent department.

6 External and internal audit

External audit:

‘A periodic examination of the books of account and records of an entity carried out by an independent third party (the auditor), to ensure that they have been properly maintained, are accurate and comply with established concepts, principles, accounting standards, legal requirements and give a true and fair view of the financial state of the entity.’

(CIMA’s Management Accounting Official Terminology)

There is a statutory requirement for all but the smallest companies to have an external audit each year. This reports to the members (shareholders) on whether or not the financial statements (in the opinion of the auditor) show a ‘true and fair’ view.

Internal audit:

‘An independent appraisal activity established within an organisation as a service to it. It is a control which functions by examining and evaluating the adequacy and effectiveness of other controls; a management tool which analyses the effectiveness of all parts of an entity’s operations and management.’

(CIMA’s Management Accounting Official Terminology)

CIMA members and the P3 exam are primarily focussed on internal audit.

Whereas external auditors are employed by an independent firm (such as one of the ‘big four’: PwC, KPMG, EY and Deloitte) internal auditors (IA) are usually employees of the company (though the process of internal audit can be outsourced) and this can interfere with the independence of the internal audit function. IA might fall under the control of the finance director and then IA staff would potentially have to report problems with financial internal control to the director who has prime responsibility for internal control. It is easy to see how the finance director might like problems to be minimised or ‘hushed up’. It is therefore strongly recommended that IA reports to the audit committee, chief executive officer and board of directors rather than to the finance director.

CIMA guidance for internal auditors is:

The aims of internal audit should be agreed by the board.
Should cover all controls, not just accounting.
There should be full access to people and documents.
There should be clear access to the CEO, chairman and the audit committee.
Internal audit should report to a senior director or the audit committee.
Internal audit should be independent of executive management so as to maintain their independence.
Best practice for auditing methodologies and the latest auditing standards should be used.
Internal audit should be consulted on all major business changes so that suitable controls can be implemented promptly.
The internal auditors should have no operational involvement elsewhere in the organisation.
There must be clear communication of findings.
The performance of internal audit should be regularly assessed.

7 Internal audit — forms of assignment

Compliance audits: testing whether the organisation is actually doing what a law, a regulation, a licence condition, a contract or its own policy requires of it — health and safety procedures, anti-money-laundering checks, the conditions attached to a grant, the data-protection procedures of Chapter 8. The output is a statement of whether the requirement is being met and a list of the instances where it is not. It is the assignment that most often follows a change in the law, and it is the one management is most exposed on, because a compliance failure is not a matter of judgement: either the requirement was met or it was not.
Transactions audit: tracing transactions through the system, often from start to finish, to see if they are treated correctly.
Systems audit: an information technology or information systems audit, is an examination of the management controls within an Information technology (IT) infrastructure.
Risk-based audits: an internal audit which is primarily focused on the inherent risk involved in the activities or system and provide assurance that risk is being managed by the organisation to the defined risk appetite level.
Accounting systems audit: ensuring, for example, that the proper accounting controls are being applied consistently.
Operational audits: a systematic review of effectiveness, efficiency and economy of operation. For example, examining how customer complaints are dealt with.
Value for money and best value. Usually associated with public or non-profit organisations. Its purpose is to assess the effectiveness and efficiency of its use of public funds.
Management audits: analysis and assessment of competencies, abilities and capabilities of a company's management in order to evaluate their effectiveness, especially regarding the strategic objectives and the implementation of the policies of the business.
Social and environmental audits: A social and environmental audit looks at factors such as a company's record of charitable giving, volunteer activity, energy use, recycling waste, diversity in recruitment, non-discrimination in appointments, the standard of the work environment, workers’ remuneration to evaluate the social and environmental impact the company is having.
Special assignments such as investigating a case of fraud.
Assisting the external auditors.

8 Comparison of internal and external audit

	Internal audit	External audit
Reports to	Management – must have a clear route to the board though day-to-day reporting to the audit committee.	Shareholders
Appointed by	Management	Shareholders
Power from	Management	Statute – allows external auditors to insist on seeing all documents and to be given full explanations.
Employed by	Company (unless outsourced)	External firm
Coverage	All categories of risk and investigation	Financial statements: true and fair view
Responsibility for improving the organisation	A major function of internal audit	Will report to management on internal control weaknesses

9 The audit risk model

The audit risk model sets out the current, risk-based approach to auditing. Audit risk is the risk that the auditor comes to a wrong conclusion about a figure in the financial statements or in the accounting system — most importantly, that the auditor concludes an amount is correct when in fact it is materially wrong.

For that to happen, three things must go wrong in sequence, and the model multiplies them together:

AR = IR × CR × DR

Component	What it is	What raises it	Can the auditor change it?
Inherent risk (IR)	The risk that an error is made in the first place, before any control is applied.	Inexperienced staff · time pressure · complex transactions · figures needing a high degree of estimation · pressure to make results look good · assets that are attractive and portable, such as cash	No, not in the short term. It is a property of the business.
Control risk (CR)	The risk that the organisation’s system of internal control fails to prevent or detect that error.	Weak segregation of duties · no supervision or review · controls that can be overridden · controls that exist on paper but are not applied	Not in the short term. In the long term the auditor’s recommendations should reduce it.
Detection risk (DR)	The risk that the auditor’s own work fails to find the error that got through. It is the last line of defence.	Small samples (sampling risk) · inexperienced, poorly supervised or poorly reviewed auditors (non-sampling risk)	Yes. This is the only one the auditor controls, and it is controlled by doing more or better work.

That asymmetry is the whole point of the model. The auditor must hold audit risk at an acceptably low level, cannot change inherent or control risk for the period under audit, and therefore has exactly one lever: if inherent and control risk are assessed as high, detection risk must be driven low, which means more audit work — larger samples, and more experienced staff on the assignment. Where inherent and control risk are low, the auditor can accept a higher detection risk and do less work while still reaching a reasonable level of assurance.

Detection risk has two parts, and they need different remedies:

Sampling risk — the sample chosen was too small, or unrepresentative, so the errors were simply not in it. Reduced by increasing sample sizes or by selecting more intelligently, for example with audit software (§12.2).
Non-sampling risk — the auditors were inexperienced, badly supervised or their work poorly reviewed. A sample of 100% is no help if the auditor does not recognise an error on sight. Reduced by staffing, training, supervision and review.

Using the audit risk model to plan

An internal audit team is planning its work on N Co’s payroll cycle. It assesses inherent risk at 0.8 and control risk at 0.5, and the head of internal audit wishes to hold overall audit risk at 0.05.

During the following year N Co introduces electronic authorisation of timesheets and a monthly payroll reconciliation. The team reassesses control risk at 0.25. Inherent risk and the target audit risk are unchanged.

Required

Calculate the maximum detection risk the team can accept in each of the two years.
Explain what the change means for the audit plan.

Using the audit risk model to plan

(a) Maximum detection risk

Rearranging AR = IR × CR × DR gives DR = AR ÷ (IR × CR).

	Year 1	Year 2
Target audit risk (AR)	0.05	0.05
Inherent risk (IR)	0.8	0.8
Control risk (CR)	0.5	0.25
IR × CR	0.40	0.20
Maximum detection risk (DR)	0.05 ÷ 0.40 = 0.125	0.05 ÷ 0.20 = 0.25

(b) What it means for the plan

The acceptable detection risk has doubled, from 0.125 to 0.25. The controls now catch a larger proportion of the errors that occur, so the auditor is permitted to let a larger proportion of what survives them go undetected and still hold overall audit risk at 0.05. In practice that means less substantive testing — smaller samples of individual payroll transactions — provided the team first does the work that justifies the new control risk assessment: it must test the new controls to establish that electronic authorisation and the monthly reconciliation actually operate.

Two cautions worth a mark each. First, the figures are a way of thinking, not a formula to be applied mechanically: assessments of 0.8 and 0.5 are judgements. Second, inherent risk is unchanged at 0.8 — payroll is still a cycle with standing data, real cash and an incentive to manipulate it — so the audit cannot be reduced below the level that inherent risk alone demands.

10 Audit planning

The first step in any audit is to plan: what are the main risks? How will they be addressed? How many auditors do we need and with what experience? How long will it take? How many locations do we need to visit?

Risk can be assessed by:

Knowledge of the business. For example, a jewellery business will have high risk in inventory (small, high-valued items).

Talking to staff. For example, they might tell the auditor of an accounting problem or that the new IT system was giving problems.
Analytical procedures or analytical review. Compare this period’s results with last period’s results and with budgets. Analytical reviews are quick to carry out and can be used to highlight areas where something might have gone wrong and therefore where risk is high. For example, if receivables collection periods have increased from 34 days to 56 days the auditors need to know why. Is it a deliberate change to the credit terms? Are there more export customers where the transportation of the goods can take time so that payment is delayed? Has the credit control department become sloppy? Is it an error? Is there a large unrecoverable amount that should perhaps be written off? Another example would be if the gross profit percentage had risen from 30% to 40%. How can that happen in a competitive market? Perhaps the company had a technical breakthrough so that it could make and sell a uniquely good product? However, it might be more likely that an accounting error or change in accounting policy is the cause. Remember, supermarkets get quite excited if their like for like sales rise by just a few percentage points over a year so a GP% jump from 30% to 40% is remarkable..

11 Collecting audit evidence

Auditors collect evidence in the following ways (AEIOU):

Analytical procedures – ratios and comparisons as explained above.
Enquiry and confirmation: for example, ask employees how they carry out certain operations. Write to customers and ask how much they think they owe.
Inspection: for example, inspect orders to ensure they have been properly authorised
Observation: for example, watch operations in the receiving bay to ensure that personnel count and inspect the goods delivered.
RecalcUlation and reperformance. For example, redo a bank reconciliation to ensure that it was carried out correctly.

12 Computer assisted audit techniques

12.1 Why CAATs are needed

Even very small businesses will usually maintain their accounting records on computer. There are many advantages to this, not least that trial balances will usually balance and control accounts will reconcile to the underlying detailed records. However, the absence of hand-written records and documents can make auditing more difficult. For example, it can be difficult to test whether a computer is carrying out a procedure correctly and it can be more difficult to ‘see’ and examine the information and records than in a manual system.

Computer Assisted Audit Techniques (CAAT) have been developed to assist the auditor when the client maintains computerised records.

12.2 Audit software

Audit software (or audit programs) is software developed and used by auditors. Audit software allows clients’ accounting data files to be read and examined.

The processes carried out by the auditor’s software commonly include:

Adding up the records. For example, inventory values and receivables balances. The totals are the amounts that should appear in the statement of financial position.
Performing calculations for analytical reviews.
Identifying and printing details of unusual items for further investigation, such as credit balances on a receivables ledger or negative inventory balances.
Picking samples. For example, that audit software can be programmed to create a stratified sample or a pure random sample.
Picking all items with particular characteristics, such as all sales orders approved by a certain employee.

Once it is set up, audit software can quickly, efficiently and economically examine every item on a data file. This would often be difficult or impossible if attempted manually. It can greatly speed up audit completion and reduce costs.

12.3 Test data

Test data is auditor’s data that is operated on by client’s program. It is used to test the workings and resilience of programs.

The results produced by client programs are compared with predictions of what should happen and any discrepancies are investigated.

Test data is designed to:

Test that calculations are carried out correctly by client software. For example, enter time sheet data of 50 hours worked and ensure that the correct wages and tax are calculated.
Test that programmed controls and procedures are carried out correctly. For example, if a client’s system should reject orders from customer over their credit limit, test that such orders are indeed rejected by entering an order that should be rejected. Another example of a programmed control would be testing that only staff members who are allocated certain privileges can log-on and change someone’s salary: log-on with what should be inadequate rights and ensure that you cannot change a salary.
Test how resilient software is against input errors. For example, test what happens if an account number is entered incorrectly, or a negative quantity of inventory is ordered, or an impossible date is entered.

Test data might be the only way in which certain controls can be verified. For example, a company web-site might properly reject an order from a customer, but there might be no permanent record available to the auditors to verify that this control is happening.

12.4 Problems with CAATs

Technical/set-up problems. Initially, additional time and technical expertise will be needed to set up audit software and test data properly. The time and expenses of this should be repaid in subsequent years.
Clients or departments can be reluctant to let auditors interfere with their computer records. This is more of a problem with test data where deliberately false transactions are processed to test the system. The normal way round this is for the auditor to use a copy of the system and to process their test data against that. This technique is known as ‘dead’ test data. There is a risk, of course, that the programs being used are different to the copies being used by the auditor.

13 The internal audit report

The second recording covers this section, outsourcing (§14.3) and fraud (§15). It is current, with two small corrections:

it describes the separation of chief executive and chair as “a rule for listed companies”. In the UK it is a Code provision, not a statutory rule: a company may depart from it provided it explains the departure. See Chapter 5, §4.
it predates the 2024 requirement for the board to declare that the company’s material controls were effective (§4.1). That declaration changes what an internal audit report now feeds into, and the recording does not mention it.

YouTube video

At the end of the audit process, internal auditors will issue a report that will detail:

Deficiencies in the internal control system’s design
Incidents where the internal control system was not complied with
Errors discovered

The report is normally laid out in three columns — the deficiency, what could happen because of it, and what should be done about it:

Deficiency	Possible effect	Recommendation
Supplier invoices are not cancelled when they are paid.	The same invoice may re-enter the system and be paid a second time. The loss is recurring and hard to detect from the ledger alone.	Stamp every invoice “PAID” on payment, and configure the purchase ledger to reject a duplicate supplier invoice reference.
Timesheets for the night shift were not authorised by a manager in three of the twenty weeks tested.	Overtime may be paid that was never worked or never approved. Payroll cost is overstated and the authorisation control cannot be relied on by the external auditor.	Require a manager’s authorisation before a timesheet can be submitted to payroll, and report exceptions to the financial controller weekly.

The third column is what makes the report useful. A list of deficiencies is a complaint; a deficiency with its consequence and a workable recommendation is something the audit committee can act on, and it is what an examiner is looking for.

Where the assignment was not a review of internal control — an investigation into a suspected fraud, for example — the report follows the terms of reference it was given instead: how the fraud was carried out, who was involved, when it started, how much has been lost, and how it can be prevented from happening again.

14 Internal audit: status, resourcing and outsourcing

14.1 What the directors remain responsible for

Note that directors are responsible for:

Maintaining sound risk management and internal control systems
Setting the control environment (a culture where there is an appreciation of the benefits and importance of controls, internal control procedures and their operation
The effectiveness of these elements should be regularly reviewed.
Keeping the needs for internal audit under regular review
Listed companies must report on internal control in their annual reports.

14.2 Status and qualifications

Internal auditors should be:

Qualified
Experienced
Independent
Professional

Although ultimately they report to the board this will often be through the audit committee. Even then, because of the employer/employee relationship it might be difficult for internal auditors to criticise internal controls set up by the finance director.

14.3 Outsourcing internal audit

It is increasingly common for the internal audit function to be outsourced (ie internal audit functions are externally supplied). Advantages and disadvantages of this are as follows:

Advantages	Disadvantages
No recruitment, staffing or training worries	Less knowledge and expertise about the business
Specialist services will be available from large external suppliers that might be difficult to provide in-house eg forensic investigations	Cost – external providers will charge quite high hourly rates.
Flexibility to carry out special investigations that are urgent	There can be ethical complications if external auditors are used in an internal audit function
Quicker to set up initially
Appropriate amounts of time can be spent. A company might not be large enough to keep an internal audit team fully employed (and a team is needed to provide mutual strength).
Greater independence

15 Fraud

15.1 What fraud is

Fraud is an intentional act involving deception to gain unjust or illegal advantage.

There are two types:

Fraudulent financial reporting. For example, overstating profits to generate high directors’ bonuses, boost the share price or to achieve a good sale price for the company.
Misappropriation of assets. For example theft of cash or inventory.

Managers and those charged with governance are responsible for the prevention or detection of fraud. Auditors should always be aware of an organisation’s susceptibility to fraud.

Fraud can be difficult to detect because:

It is often carried out by repeatedly misappropriating small amounts that escape individual scrutiny.
Fraudsters take steps to conceal their actions, for example, forging documents. These can be very difficult to identify.

15.2 The pre-conditions for fraud

Three conditions or risk factors are necessary for fraud to be committed:

Incentive
Opportunity
Attitude/dishonesty

Risk factor	Examples relating to fraudulent financial reporting	Examples relating to the misappropriation of assets.
Incentive	Pressure from shareholders to perform Fear of losing job Incentives related to performance	Personal financial pressure Greed Dislike of the employer (I’ll get my own back!)
Opportunity	Poor internal control Poor corporate governance eg a dominant chief executive who is also chairman Results dependent on many estimates and a high degree of judgement	Poor internal control High-value portable inventory Cash-based business Poor supervision
Attitude	Poor ethics Poor morale Excessively aggressive targets	Poor ethics Dislike of the employer Other employees’ behaviour (and you become convinced that the ‘fiddle’ is normal and therefore acceptable)

15.3 An anti-fraud strategy

An anti-fraud strategy has three elements:

prevention
detection
response

CIMA shows that these interrelate as follows:

(Fraud risk management: a guide to good practice, CIMA)

Deterrence is the result of prevention (too difficult to get to the inventory to steal it), detection (you will be subject to random searches as you leave the factory), response (you will definitely be prosecuted).

Surrounding these specific anti-fraud strategies there are:

Legislation: for example, what types of actions (such as insider trading) are illegal?

Risk management: an awareness by the organisation’s senior managers and directors of where the main dangers of fraud lie and then suitable controls being put in place.

Corporate governance. For example, non-executive directors providing independent advice about behaviour. Audit committee being available to support internal audit and whistleblowers.

Ethical culture: for example, making it clear that ‘shady’ practices are wrong and will not be tolerated by the company. Training in ethical behaviour will be important.

16 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.

Answer the questions one at a time. Your progress is saved so you can leave and come back.

Open chapter practice