Five main components of Internal Controls

• Control environment
• Risk assessment
• Information System
• Control Activities
• Monitoring of Controls

The Control Environment
Control environment is the attitude toward internal control and control consciousness established and maintained by the management and the employees of an organization. It is a product of management’s philosophy, style and supportive attitude, as well as the competence, ethical values, integrity, and morale of the organization’s people. The organization structure and accountability relationships are key factors in the control environment.
Elements of the Control Environment

• Ethical Values and Integrity
• Management’s Operating Style and Philosophy
• Competence
• Morale
• Supportive Attitude
• Mission
• Structure
  Risk Assessment
  Risks are events that threaten the accomplishment of objectives. They ultimately impact an organization’s ability to accomplish its mission. Risk assessment is the process of identifying, evaluating and determining how to manage these events. At every level within an organization there are both internal and external risks that could prevent the accomplishment of established objectives. Ideally, management should seek to prevent these risks. However, sometimes management cannot
  prevent the risk from occurring. In such cases, management should decide whether to accept the risk, reduce the risk to acceptable levels, or avoid the risk. To have reasonable assurance that the organization will achieve its objectives, management should ensure each risk is assessed and handled properly.
• Assessing Risk (Ask the questions…) – What obstacles could stand in the way of achieving your objective? – What can go wrong? – What is the worst thing that could happen? – What is the worst thing that has happened? – Are there new Processes? – Are there processes that have changed? – Are there new goals and legislation? – Are there staffing changes? – What keeps you awake at night?
• Impact – Is generally beyond the organization’s control in the short-to-medium term. Likelihood – Is the main focus of an organization’s internal control
• What are the possible risks in your area of operations and what is the likely impact of each?
• How to Deal With Risk
• Managing Risk

– Accept the risk: Do not establish control activities

– Prevent or reduce the risk: Establish control activities

– Avoid the risk: Do not carry out the function

• Preventing or Reducing Risk

– What is the cause of the risk?

– What is the cost of control vs. the cost of the unfavourable event?

– What is the priority of this risk?
Control Activities
Control activities are tools – both manual and automated – that help prevent or reduce the risks that can impede accomplishment of the organization’s objectives and mission. Management should establish control activities to effectively and efficiently accomplish the organization’s objectives and mission.
Examples of Control Activities

– Documentation

– Approval and Authorization

– Verification

– Supervision

– Separation of Duties

– Safeguarding Assets

– Reporting

– Computer Systems Controls o Backup and Disaster Recovery o Input Controls o Output Controls
Information and Communication Systems
Communication is the exchange of useful information between and among people and organizations to support decisions and coordinate activities. Within an organization, information should be communicated to management and other employees who need it in a form and within a time frame that helps them to carry out their responsibilities. Communication also takes place with outside parties such as customers, suppliers and regulators.
Elements of Communication

– Timeliness

– Sufficient but not excessive detail

– Appropriate to user

– Clear and open horizontal and vertical
Monitoring
Monitoring is the review of an organization’s activities and transactions to assess the quality of performance over time and to determine whether controls are effective. Management should focus monitoring efforts on internal control and achievement of organization objectives. For monitoring to be most effective, all employees need to understand the organization’s mission, objectives, and responsibilities and risk tolerance levels.
Major Areas for Monitoring

– Control Activities

– Mission

– Control Environment

– Communication

– Risks and Opportunities

– Results

Some auditors question the value of the work ISAs require on evaluating the design and implementation of controls. The purpose of this work is to help auditors properly understand the business and, very specifically, to deal with any risks arising from poor internal controls. Performing the same substantive procedures, regardless of whether controls are designed, implemented and operated properly, poorly or not at all, ignores the following:

• ISAs require substantive procedures to be tailored to the assessed risks;
• a substantive approach often involves analytical procedures and if auditors ignore controls, they risk placing undue reliance on the information on which they perform the procedures, if it is produced by a poorly-controlled system;
• auditors may well miss something important in a key area if they do not understand that the controls over them are poor, and they may not be auditing in the most efficient manner possible if they do not understand that controls are good; and
• ISAs require auditors to obtain an understanding of the internal controls relevant to the audit by evaluating the design and implementation of those controls irrespective of the size and complexity of the client and regardless of the audit strategy.

• Deficiency
  The foreman is in a position to set up fictitious employees onto the wages system as he has authority to issue temporary employee numbers. This would allow him to collect cash wages for such ghost employees.
  Recommendation
  The issue of new employee numbers should be authorised by a manager and supported by employee contract letters etc.
• Deficiency
  The two wages clerks are responsible for the set up and maintenance of all employee records. They could therefore, in collusion, set up ghost employees and collect cash wages from them.
  Recommendation
  The list of personnel should be matched with the payroll by a manager and all new employee records should be authorised before being set up on the system.
• Deficiency
  The wages clerks are responsible for making amendments to holidays and illness etc. They could make unauthorised amendments which affect individual staff members’ pay.
  Recommendation
  Any amendments to standing data on the wages system should be done by an authorised manager so that unauthorised amendments are not made. A log of amendments should be regularly reviewed.
• Deficiency
  The computer system calculates gross pay and any deductions but these are hand-written by the wages clerks for the staff pay packets, so errors could be made and incorrect wages issued.
  Recommendations
  A payslip should be generated by the computer system and included in the wage envelopes to reduce the chance of errors in deductions and gross pay being made.
• Deficiency
  The computer automatically calculates gross pay and deductions, however there is no check to ensure the calculations are accurate.
  Recommendations
  One of the wages clerks should check the gross pay and deductions for a sample of employees to gain assurance that the computer is calculating amounts correctly.
• Deficiency
  The foreman distributes cash wages to the employees. He could therefore misappropriate any wages not claimed.
  Recommendation
  The distribution of wages should be overseen by another manager. Unclaimed wages should be noted on a form and returned to the wages department.
• Deficiency
  Cash is delivered by secure courier but there is no mention of a check to verify the amount delivered. Less cash than stated was delivered may actually be delivered.
  Recommendation
  The amount of cash delivered should be verified and signed for by the receiving Third Floor officers and the courier.

Controls Over Cheque Payment
a. Unused cheques should be held in a secure place.
b. The person who prepares cheques should have no responsibility over purchase ledger or sale ledger.
c. Cheque should be signed only when evidence of a properly approved transaction is available. Such evidence may take the form of invoices, pay roll, petty cash book etc.
d. This check should be evidenced by signing of the supporting documentation.
e. In a large concern, those approving the original document should be independent of those signing cheques.
f. Cheque signatories should be restricted to the minimum practical number.
g. Two signatories at least should be required except perhaps for cheque of small amount.
h. The signing of “Blank” cheques and cheques in favour of the signatories should be prohibited.
i. Cheques should be crossed before being signed.
j. Supporting documents should be cancelled as paid to prevent their use to support further cheque payment.
k. Cheques should preferably be dispatched immediately if not, they should be held in a safe place.
l. Return cheques should be obtained from the bank and the sample checked against cashbook entries and supporting documentation.

Controls over bank reconciliation
a. Bank reconciliation should be prepared at least monthly.
b. The person responsible for preparation should be independent of the receipts and payment function or alternatively an independent person should check the reconciliation.
c. If the reconciliation is prepared by an independent person, he should obtain bank statement directly from the bank and hold them until the reconciliation is completed.
d. The preparation should preferably include checking receipts and payment against items on the bank statement.

The points which might be taken into consideration before giving recommendations to a garage proprietor on a system of control for cash sales are as follows:
(i) The type of cash sales which might be made. The garage might, for instance, have cash sales from:
1. Petrol;
2. Sales of spares;
3. Repairs to vehicles;
4. Sale of motor vehicles;
5. Vehicle hire;
6. Sale of items from a shop on the forecourt.
(ii) The size of the garage and the number of staff available. This will affect the division of responsibilities and the possibility of one person’s work being proved independently by another.
(iii) The amount of control exercised by the proprietor over the day-to-day running of the garage.
(iv) The type of business (eg. partnership, sole trader of or company) and the effect which a breakdown in control may have over the need to publish certain information under statute.
(v) The documentation already available in the system and how this can be used to good effect under new recommendations.
(vi) The possibility of discounts being given and how this can be controlled and recorded.
(vii) The need not to overburden non-administrative staff with time-consuming administrative duties but to keep forms (eg. Showing total cash sales) as simple as possible.
(viii) The availability of tills which can accumulate total cash sales during a period.