F1 Internal controls, authorisation, security and compliance within business

1. Internal control system Definition An internal control is any action taken by management to enhance the likelihood that established objectives and goals will be achieved The purposes of internal control a. Facilitating effective and efficient operation to achieve the corporate objectives b. Ensuring the quality of internal and external reporting c. Ensuring compliance with laws and regulations

1. Internal control system Control environment It is the overall context of control, in particular the attitude of directors and managers towards control Control procedures They are the detailed controls in place

2. Internal control environment and procedures The nature of control environment The management style, corporate culture and values shared by all employees The elements of a strong control environment: a. Clear strategies for detailing with risks b. Company culture supports risk management c. A climate of competence, integrity and trust d. Clear definition of authority and accountability e. Clear communication to employees f. People manage risks effectively

2. Internal control environment and procedures The classification of control procedures Classification Comment Administration Channels of communication and reporting responsibilities Accounting Recording transactions and responsibilities for records Prevent Prevent errors from happening in the first place Detect Detect errors happened Correct Minimising the effect of errors

2. Internal control environment and procedures Other classifications a. Discretionary and non-discretionary b. Voluntary and mandated c. Manual and automated d. General e. Application (prevent, detect and correct errors) f. Finanacial

2. Internal control environment and procedures Example question Some controls are provided automatically by the system and cannot be by-passed, ignored or overridden: for example, having to input a password to enter a computer system. These are classified as_____ controls. Which term correctly completes the statements? A. Detect B. Mandated C. Non-discretionary D. Administrative

2. Internal control environment and procedures Types of financial control procedure “SPAMSOAP” a. Segregation of duties b. Physical c. Authorization and approval d. Management e. Supervision f. Organization g. Arithmetical and accounting h. Personnel

2. Internal control environment and procedures Internal checks Internal checks are the checks on the day-to-day transactions. Arithmetical internal checks include: a. Pre-list b. Pro-list d. Control totals

2. Internal control environment and procedures Aims of internal checks a. Segregate tasks b. Create and preserve the records as confirmation c. Break down routine procedures into steps d. Reduce the possibility of fraud and error

2. Internal control environment and procedures Example question Which of the following is not an aim of internal controls? A. To enable the firm to respond appropriately to business, operational and financial risks. B. To break down routine procedures into steps C. To help ensure the quality of internal and external reporting D. To help compliance with applicable laws and regulations

2. Internal control environment and procedures Characteristics of a good internal control system Clearly defined organizational structures; Adequate internal checks; Acknowledgement of work done Physical security; Formal documents should acknowledge the transfer of goods; Pre-view; Clearly defined systems for authorizing transaction; Post-review Necessary quality of personnel; Effective internal audit

2. Internal control environment and procedures Limitations on the effectiveness of internal controls a. Segregation of duties can be avoided by collusion b. Authorization controls can be abused by the person to authorise c. Management can override the controls set up themselves

3. Internal audit and internal control Definition Internal audits is an independent appraisal activity established within an organization as a service to it. It is a control which functions by examining and evaluating the adequacy and effectiveness of other controls. Internal audit is part of the internal control system and distinct from the external audit which is carried out for the benefits of shareholders on and examines published accounts.

3. Internal audit and internal control The objectives of internal audit a. Review the accounting and internal control system b. Examination of financial and operating information c. Review the “3E” of operations d. Review the compliance with laws, regulation and other requirements e. Review the safeguards of the assets f. Review the implementation of corporate objectives g. Identify and monitor significant risks h. Special investigation into particular areas.

3. Internal audit and internal control The features of internal control a. Independence b. Appraisal

3. Internal audit and internal control Types of audit a. Operational audit b. Systems audit (Evaluate internal controls, compliance test and substantive test) c. Transactions audit (Use only substantive test) d. Social audit e. Management investigation

3. Internal audit and internal control Example question Which type of audit is concerned with the monitoring of management’s performance, concentrating on the outputs of the system and the efficiency of the organization? A. Systems audit B. Operational audit C. Probity D. Social audit

3. Internal audit and internal control Accountability of internal audit The internal auditors should be accountable to the highest executive level in the organization. Internal auditors report to audit committee or the board of directors.

4. External audit Definition External audit is a periodic examination of the books of account and records of an entity carried out by an independent third party to ensure that they have been properly maintained, are accurate and comply with established concepts, principles, accounting standards, legal requirements and give a true and fair view of the financial state of the entity.

4. External audit Differences between internal and external audit Internal audit External audit Reason Improve operation Assess financial statements Accountable to Audit committee or board of directors Shareholders or third parties Relating to The operations of the firm The financial records Relationship with firms Often employees Independent people

4. External audit Relationships between external and internal audit a. Meetings to plan the overall audit to ensure adequate coverage b. Meetings to discuss matters of mutual interest c. Mutual access to audit programmes and working papers d. Exchange of audit reports and management letters e. Common development of audit techniques, methods and terminology

4. External audit Assessment by external auditors The following things have to be considered when external auditors wish to rely on the work if internal auditors: a. Organizational status b. Scope of function c. Technical competence d. Due professional care

5. IT system security and safety Aspects of security a. Prevention b. Detection c. Deterrence(Computer misuse by personnel) d. Recovery procedure e. Correction procedures f. Treat avoidance

5. IT system security and safety Physical threats Fire, water, weather, lightning, terrorist activity, accidental damage Physical access controls a. Personnel b. Door locks c. Locks combined with a keypad system or a card d. Intruder alarms

6. Building controls into an information system Security control Security is the protection of data from accidental or deliberate threats which might cause unauthorized modification, disclosure or destruction of data, and the protection of the information from degradation or non-availability of service. These risks may be: a. Human error b. Technical error c. Natural disaster d. Deliberate actions such as fraud

6. Building controls into an information system Integrity control Data will remain its integrity if it is complete which means the input, processing and output controls are adequate. a. Back-up controls b. Archiving c. Passwords and logical access system d. Administration controls e. Audit trail

6. Building controls into an information system Contingency control An unscheduled interruption of computing services that requires measures outside the day-to-day routine operating procedures A disaster recovery plan must cover all activities from the initial response to a “disaster”, through to damage limitation and full recovery. Responsibilities must be clearly spelt out for all tasks.

6. Building controls into an information system Example question Which of the following would be classed as contingency control in an information system? A. Password-only access to the system B. System recovery procedures C. Audit trial D. Data validation procedures

The end