Internal control

1 Introduction

The function of internal controls is to prevent or detect and correct errors in the accounting system. The main control objectives aim to ensure that:

• All assets are safeguarded.
  

• All revenue is recorded.
  

• Only legitimate expenses are incurred
  

• All costs are properly recorded
  

• All liabilities are recognised
  

This chapter looks at the components of internal control.

2 Components of internal control

2.1 The five components

• The control environment

• The entity’s risk assessment process

• The entity’s process to monitor the system of internal control

• The information system and communication

• Control activities

2.2 The control environment

The control environment refers to the culture of the organisation:

• Are internal controls regarded as being important?
  

• Does management like a well-disciplined office and careful records?
  

• Does management appreciate good accounting information?
  

• Does management require careful recording of events and transactions?
  

All of these give a favourable control environment.

Contrast this with an organisation which:

• Is careless with its records
  

• Is lax about recording transactions
  

• Has an untidy office
  

• Has an attitude that internal controls are unnecessary, a nuisance and actually interfere with the business’s operations.
  

All of these give an unfavourable control environment.

2.3 The entity’s risk assessment process

The purposes of internal control are to prevent errors, detect errors and fix errors. To accomplish this effectively, management must be aware of where errors could occur and, in particular, where they are likely to occur. High risk of errors implies that controls are necessary to counter that risk.

Furthermore, businesses do not stand still. They change and evolve as they try to remain successful or to increase profits. As businesses change new risks will emerge and management has to devise new controls.

For example:

1. A business starts to export. Therefore there will be additional risks arising from exchange rate fluctuations and that goods are damaged in transit.
   

2. A business starts to trade over the internet. Therefore there are additional risks posed by hackers and credit card fraud.
   

New risks imply new controls.

2.4 The information system and communication

Examples of records in an information system which are relevant to financial reporting include

1. Monthly management accounts
   

2. Aged receivables listings
   

3. Aged inventory listings
   

These records and related procedures contribute to internal control as follows:

• Monthly management accounts allow comparisons to be made between actual and budget. If actual expenses are running much higher, this might indicate an accounting error, or even fraud.
  

• Aged receivables listings help with credit control and might prevent more goods being sent to customers who are credit risks.
  

• Aged inventory listings will indicate which goods should be marked down for a quick sale and which should not be ordered again.

The information system records, processes and reports transactions and supports the preparation of the financial statements. Communication makes staff aware of their financial-reporting and control responsibilities and ensures important matters reach management and those charged with governance. For example, staff must know how to report an unusual transaction or a failure to reconcile a ledger; producing a report that nobody acts on does not achieve the control objective.

2.5 Control activities

Generally, control activities relevant to an audit include the policies and procedures that relate to:

• Authorisation and approval

• Reconciliations

• Verifications

• Physical or logical controls

• Segregation of duties

Segregation of duties

‘Segregation of duties’ means that the authorisation of transactions, the recording of transactions and the custody of assets should be assigned to different people. Therefore, for a purchase transaction, each of the following should be done by a separate person:

• Authorising the purchase order
  

• Receiving the goods
  

• Posting the invoice
  

• Paying suppliers
  

Similarly, the following should be carried out by different people:

• Authorising salary levels
  

• Authorising overtime
  

• Paying salaries
  

Segregation of duties has two advantages:

• More than one person is involved so the errors of one are more likely to be identified by another.
  

• Fraud is more difficult because it would require cooperation (collusion) between several people.
  

Segregation of duties can be difficult for small businesses to achieve because they simply do not have enough staff to allow transactions to be divided up. In small businesses more emphasis is placed on the close supervision of owners and/or management.

Authorisation and approval

For example, the following should all be authorised:

• Purchases of non-current assets
  

• Changes to wages and salaries
  

• Writing-off a bad debt
  

• Setting a credit limit
  

• Paying invoices
  

Authorisation is usually carried out by someone in authority signing or stamping a document. In a computer system, a person’s log-on details can give them authority to approve transactions.

Reconciliations

Compare two independent records, identify differences and investigate them. For example, reconcile the cash book to the bank statement and the receivables control account to the customer ledger.

IT controls

General IT controls operate over the IT environment and support the continued proper operation of information processing controls and the integrity of data. They include:

• Taking regular backups
  

• Keeping passwords secure
  

• Physical security of the server
  

• Controls over the implementation of software upgrades
  

Information processing controls directly address completeness, accuracy and validity of information as it is processed, manually or in IT applications. Controls within a particular application are often called application controls. Examples include:

• Sequence checks (ie ensuring completeness of input documents)
  

• Edit checks (eg checking that input is in the required format or range of values)
  

• One-for-one matching (eg checking that there is a clockcard for every employee on the payroll)
  

• Control or batch totals (ie to agree an output total to a pre-determined input total)
  

Verifications

Check information against supporting evidence. Examples include checking an invoice to the goods received note and reviewing unexpected variances before following them up.

• Comparing actual performance against budgets, forecasts and prior periods
  

• Relating different sets of data (eg production volume against costs)
  

• Investigative and corrective actions (eg through variance analysis)
  

Physical or logical controls

• Ensuring that inventory is kept securely
  

• Banking cash regularly
  

• Locking laptops away in the evenings
  

• Periodic inspection of assets and comparison with related records (eg inventory records and non-current asset register)
  

• Also safeguarding of records of assets
  

Logical controls restrict access to systems and data to authorised users, for example through access permissions and passwords.

2.6 The entity’s process to monitor the system of internal control

These controls assess the effective operation of internal control over time. They include regular management and supervisory activities. For example:

• Management should review whether bank reconciliations are properly prepared on a timely basis. (If not monitored, staff are more likely to stop preparing them.)
  

• Internal audit will typically evaluate the effectiveness of internal control, report deficiencies and make recommendations for improvements.
  

3 Control deficiencies

3.1 Introduction

A control deficiency (weakness) can arise because a control has not been properly designed or not properly carried out or is missing.

The auditor shall communicate in writing on a timely basis significant deficiencies in internal control identified during the audit to those charged with governance and, unless inappropriate, to management.

The auditor shall also communicate to management at an appropriate level of responsibility on a timely basis other deficiencies in internal control that, in the auditor’s professional judgment, are of sufficient importance to merit management’s attention.

A significant deficiency is a deficiency, or combination of deficiencies, important enough in the auditor’s professional judgment to merit the attention of those charged with governance.

Examples of matters that the auditor may consider in determining whether a deficiency or combination of deficiencies in internal control constitutes a significant deficiency include:

• The likelihood of the deficiencies leading to material misstatements in the financial statements in the future.
  

• The susceptibility to loss or fraud of the related asset or liability.
  

Example: the same clerk creates suppliers, records invoices and approves payments, and nobody reviews supplier changes or payments. This defeats segregation and could allow fictitious suppliers and material fraudulent payments. Check for any effective compensating review before judging severity. If none exists, the combination is likely significant: recommend separating these duties and independent review of supplier changes and payment batches, and communicate it in writing to those charged with governance.

3.2 Management letters

The written communication of deficiencies in internal control is often by way of what is called a management letter. This is a letter from the auditor to management and it is often set out with a covering letter and an appendix in the following format: