Internal Control Principles Chapter 1 Introduction to Internal

Internal Control Principles Chapter 1: Introduction to Internal Control Principles 1

Definition Internal Controls are defined as the employment of all means within an organisation to promote, direct, govern and check upon its various activities for the purpose of seeing that its objectives are meet. Internal Control Principles 2

The Importance of Internal Control The objectives of an internal control system are to: • Ensure the integrity, relevance and reliability of information. • Safeguard the entity’s assets. • Detect and deter fraud and error. • Maintain efficient and effective use of resources. • Ensure compliance with both management policies and external regulations. Internal Control Principles 3

Definition Internal control consists of the following components: (a) the control activities (C); (b) the entity’s risk assessment process (R); (c) the information and communication system (I); (d) monitoring of control (M); and (e) control environment (E). This can be remembered using the mnemonic CRIME Internal Control Principles 4

Definition Controls are the result of management’s: • Proper planning. • Organising. • Directing. The term internal control distinguishes between: • A control within the organisation and • An externally existing control, e. g. laws, regulations, etc. Internal Control Principles 5

Achievement of Internal Control • • Some of the means by which organisations achieve internal control are: An organisational structure Policies Procedures Personnel An accounting system Budgeting procedures Reporting mechanisms Internal reviews Internal Control Principles 6

Key Aspects of Internal Control The key aspects of a good internal control system are that all the policies, procedures, practices and methods that are carried out in the organisation to ensure the objectives are met, that assets are safeguarded and that transactions are accurately recorded. These controls will help to minimise fraud and error. Internal controls needed to be analysed and reviewed in line with changing systems Internal Control Principles 7

Components of Internal Control • Control activities - Policies and procedures must be established and executed to help ensure the actions identified by management to address risk are effectively carried out. • Risk assessment - The entity must be aware of and deal with the risks it faces. Both internally and externally. • Information and Communications – This is the identification, retention and transfer of information in a timely manner enabling personnel to execute their tasks • Monitoring - The entire control process must be monitored, and modifications made as necessary. • Control Environment - The control environment is the foundation for all other components of internal controls and provides discipline and structure. Internal Control Principles 8

Audit and Internal Controls What is actually done in an Audit? Auditor – gains knowledge of the system, inspects, observes, talks to staff, inspects documents, looks at current controls, identify weaknesses Results in – Flowcharts, list of weaknesses, suggestions for improvements, advice to management, risk assessment This can be done for a whole system or subsystems, with in that system. Each system (or subsystem) involves three stages; Input, Processing, Output Internal Control Principles 9

Audit and Internal Control The auditor will: – Collect findings in a series of working papers – Carry out preliminary evaluation of controls to determine control risk – Carry out compliance tests on a sample, or perform observation tests and identifying physical assets Internal Control Principles 10

What is Control Risk? Is the risk that a material fraud/error in a transaction/balance will find its way through the control system without being detected If the Internal Control (IC) structure is strong/ adhered to then the risk will be low. If the IC structure is weak/poor the risk is higher and systems design and development will need to be initiated Internal Control Principles 11

Preliminary Evaluation of Internal Controls The auditor, or systems consultant, studies and evaluates the system of internal control to establish which controls they can place reliance on and then decides on the nature, extent and timing of audit procedures to be used during the audit process. Internal Control Principles 12

Preliminary Evaluation of Internal Controls The auditors work has the following stages: – Review and documentation of controls – Preliminary evaluation of the system – Initial report to management on weaknesses and possible fraud/error – Initial estimates of control risk – Compliance tests – Revised estimates of control risk – Report to management on weaknesses found in the compliance stage Internal Control Principles 13

Internal Control System Objectives An Internal Control System has the following key objectives: – – – Completeness of transactions Validity of records Accuracy of records Operational environment Security and adequate safeguards Accountability This refers to the five primary recording objectives in an accounting system Internal Control Principles 14

Things to consider When deciding which controls should be assessed need to consider the following: – Materiality – Size of the entity – Nature and ownership of the entity – The diversity and complexity of the operations – Legal and regulatory requirements – The nature and complexity of systems that are part of the entities internal controls, such as service organisations Internal Control Principles 15

Internal Control Features A good system of internal controls will include: • • • Segregation of duties Authorisation Custody Recording all transactions Reconciliation and checking Extensive documentation Complete audit trial Documentation Job Rotation Internal Control Principles 16

Internal Control Features • • • Accounting records/procedure controls Systems review and maintenance Comparison – stock take, asset stock take Internal Audits Internal checks and verifications Management review of reports Management supervision Personnel controls Security of assets and records Staff Training Internal Control Principles 17

Design of Internal Controls How effective an internal control system is will depend on how it has been designed and whether it meets some of the objectives and features of a good internal control system Evidence that a control procedure is likely to achieve its objectives includes evidence that the procedure is theoretically sound in its design. So on paper it looks good. This is consider a good starting point Internal Control Principles 18

Corporate Governance and Internal Control What is Corporate Governance? A very simple definition that is easy to remember is: corporate governance is the system by which organisations are structured and controlled. It is primarily concerned with accountability of management and directors to the shareholders and regulatory bodies. Internal Control Principles 19

Corporate Governance Management is responsible for creating and maintaining control systems. Corporate governance is critical in the day-to-day running of the business. Risk Management is also important. Sound controls assist in minimising any types of risk. Procedures and Practices need to be documented, legislation needs to be complied with and reporting requirements enforced by the Corporations Law need to be adhered to also. Internal Control Principles 20

Management Accountability Directors are accountable to shareholders and the CEO is responsible to the board for the day-to-day management of the organisation. In Australia the ASX has published the Corporate Governance Principles and Recommendations which companies listed on the stock exchange are expected to adhere to. These require the board and management to take responsibility for the adequacy of internal controls Internal Control Principles 21

Business Risk All businesses face risk. Risk includes: • Cash Flow Risk – Not being able to pay debts. • Risk of changes in tastes/technology – Consumers have changing tastes, products go in and out of fashion • Economic Risk – The risk of a change in the business cycle causing an economic downturn and a drop in sales. • Hazard Risk – These are risks that are not considered economic, such as disasters and terrorist attacks. Internal Control Principles 22

Business Risk • Interest Rate Risk – A rise in interest rates will make debt unsustainable. • Competition Risk – New competitors can undermine sales. Internal Control Principles 23