1. F1 Internal controls, authorisation, security and compliance within business

2. 1. Internal control system
Definition
An internal control is any action taken by management to enhance the likelihood that established objectives and goals will be achieved
The purposes of internal control
a. Facilitating effective and efficient operation to achieve the corporate objectives
b. Ensuring the quality of internal and external reporting
c. Ensuring compliance with laws and regulations

3. 1. Internal control system
Control environment
It is the overall context of control, in particular the attitude of directors and managers towards control
Control procedures
They are the detailed controls in place

4. 2. Internal control environment and procedures
The nature of control environment
The management style, corporate culture and values shared by all employees
The elements of a strong control environment:
a. Clear strategies for detailing with risks
b. Company culture supports risk management
c. A climate of competence, integrity and trust
d. Clear definition of authority and accountability
e. Clear communication to employees
f. People manage risks effectively

5. 2. Internal control environment and procedures
The classification of control procedures
Classification
Comment
Administration
Channels of communication and reporting responsibilities
Accounting
Recording transactions and responsibilities for records
Prevent
Prevent errors from happening in the first place
Detect
Detect errors happened
Correct
Minimising the effect of errors

6. 2. Internal control environment and procedures
Other classifications
a. Discretionary and non-discretionary
b. Voluntary and mandated
c. Manual and automated
d. General
e. Application (prevent, detect and correct errors)
f. Finanacial

7. 2. Internal control environment and procedures
Example question
Some controls are provided automatically by the system and cannot be by-passed, ignored or overridden: for example, having to input a password to enter a computer system. These are classified as_____ controls.
Which term correctly completes the statements?
A. Detect B. Mandated
C. Non-discretionary D. Administrative

8. 2. Internal control environment and procedures
Types of financial control procedure “SPAMSOAP”
a. Segregation of duties
b. Physical
c. Authorization and approval
d. Management
e. Supervision
f. Organization
g. Arithmetical and accounting
h. Personnel

9. 2. Internal control environment and procedures
Internal checks
Internal checks are the checks on the day-to-day transactions.
Arithmetical internal checks include:
a. Pre-list
b. Pro-list
d. Control totals

10. 2. Internal control environment and procedures
Aims of internal checks
a. Segregate tasks
b. Create and preserve the records as confirmation
c. Break down routine procedures into steps
d. Reduce the possibility of fraud and error

11. 2. Internal control environment and procedures
Example question
Which of the following is not an aim of internal controls?
A. To enable the firm to respond appropriately to business, operational and financial risks.
B. To break down routine procedures into steps
C. To help ensure the quality of internal and external reporting
D. To help compliance with applicable laws and regulations

12. 2. Internal control environment and procedures
Characteristics of a good internal control system
Clearly defined organizational structures; Adequate internal checks; Acknowledgement of work done
Physical security; Formal documents should acknowledge the transfer of goods; Pre-view; Clearly defined systems for authorizing transaction; Post-review
Necessary quality of personnel; Effective internal audit

13. 2. Internal control environment and procedures
Limitations on the effectiveness of internal controls
a. Segregation of duties can be avoided by collusion
b. Authorization controls can be abused by the person to authorise
c. Management can override the controls set up themselves

14. 3. Internal audit and internal control
Definition
Internal audits is an independent appraisal activity established within an organization as a service to it. It is a control which functions by examining and evaluating the adequacy and effectiveness of other controls.
Internal audit is part of the internal control system and distinct from the external audit which is carried out for the benefits of shareholders on and examines published accounts.

15. 3. Internal audit and internal control
The objectives of internal audit
a. Review the accounting and internal control system
b. Examination of financial and operating information
c. Review the “3E” of operations
d. Review the compliance with laws, regulation and other requirements
e. Review the safeguards of the assets
f. Review the implementation of corporate objectives
g. Identify and monitor significant risks
h. Special investigation into particular areas.

16. 3. Internal audit and internal control
The features of internal control
a. Independence
b. Appraisal

17. 3. Internal audit and internal control
Types of audit
a. Operational audit
b. Systems audit (Evaluate internal controls, compliance test and substantive test)
c. Transactions audit (Use only substantive test)
d. Social audit
e. Management investigation

18. 3. Internal audit and internal control
Example question
Which type of audit is concerned with the monitoring of management’s performance, concentrating on the outputs of the system and the efficiency of the organization?
A. Systems audit B. Operational audit
C. Probity D. Social audit

19. 3. Internal audit and internal control
Accountability of internal audit
The internal auditors should be accountable to the highest executive level in the organization.
Internal auditors report to audit committee or the board of directors.

20. 4. External audit Definition
External audit is a periodic examination of the books of account and records of an entity carried out by an independent third party to ensure that they have been properly maintained, are accurate and comply with established concepts, principles, accounting standards, legal requirements and give a true and fair view of the financial state of the entity.

21. 4. External audit Differences between internal and external audit
Internal audit
External audit
Reason
Improve operation
Assess financial statements
Accountable to
Audit committee or board of directors
Shareholders or third parties
Relating to
The operations of the firm
The financial records
Relationship with firms
Often employees
Independent people

22. 4. External audit Relationships between external and internal audit
a. Meetings to plan the overall audit to ensure adequate coverage
b. Meetings to discuss matters of mutual interest
c. Mutual access to audit programmes and working papers
d. Exchange of audit reports and management letters
e. Common development of audit techniques, methods and terminology

23. 4. External audit Assessment by external auditors
The following things have to be considered when external auditors wish to rely on the work if internal auditors:
a. Organizational status
b. Scope of function
c. Technical competence
d. Due professional care

24. 5. IT system security and safety
Aspects of security
a. Prevention
b. Detection
c. Deterrence(Computer misuse by personnel)
d. Recovery procedure
e. Correction procedures
f. Treat avoidance

25. 5. IT system security and safety
Physical threats
Fire, water, weather, lightning, terrorist activity, accidental damage
Physical access controls
a. Personnel
b. Door locks
c. Locks combined with a keypad system or a card
d. Intruder alarms

26. 6. Building controls into an information system
Security control
Security is the protection of data from accidental or deliberate threats which might cause unauthorized modification, disclosure or destruction of data, and the protection of the information from degradation or non-availability of service.
These risks may be:
a. Human error
b. Technical error
c. Natural disaster
d. Deliberate actions such as fraud

27. 6. Building controls into an information system
Integrity control
Data will remain its integrity if it is complete which means the input, processing and output controls are adequate.
a. Back-up controls
b. Archiving
c. Passwords and logical access system
d. Administration controls
e. Audit trail

28. 6. Building controls into an information system
Contingency control
An unscheduled interruption of computing services that requires measures outside the day-to-day routine operating procedures
A disaster recovery plan must cover all activities from the initial response to a “disaster”, through to damage limitation and full recovery. Responsibilities must be clearly spelt out for all tasks.

29. 6. Building controls into an information system
Example question
Which of the following would be classed as contingency control in an information system?
A. Password-only access to the system
B. System recovery procedures
C. Audit trial
D. Data validation procedures

30. The end