Overview of Internal Control and Fraud and Error

OVERVIEW OF INTERNAL CONTROL AND FRAUD AND ERROR
INTERNAL CONTROL – the process designed, implemented, and maintained by those charged with
governance, management, and other personnel to provide reasonable assurance about the achievement of an
entity’s objectives
Essential Concepts of Internal Control: Internal control is (a):
1. Process – a means of achieving the entity's objectives

2. Effected by:
a. Those charged with governance: ensure the integrity of accounting and financial reporting systems
through oversight of management
b. Management: design, implement and maintain internal control
c. Staff personnel: perform their respective functions
3. Provides reasonable assurance about the achievement of an entity’s objectives – internal control is be
designed to prevent, or detect and correct problems to help in achieving entity’s objectives
● Inherent limitations of internal control system: Even a well-designed and effective internal control
system cannot eliminate material misstatements, whether due to fraud or error.
Examples of inherent limitations of internal control:
1. Management overriding the internal control.
2. Circumvention of internal controls through the collusion among employees.
3. Cost-benefit considerations (concept of reasonable assurance) – the costs of a control to be established
should not exceed its expected benefits
4. Most controls tend to be directed at routine transactions rather than non-routine transactions.
5. Human error (such as due to carelessness, distraction, mistakes of judgment, the misunderstanding of
instructions, errors in the design or use of automated controls
6. The possibility that procedures may become inadequate due to changes in conditions, and compliance
with procedures may deteriorate.
7. Segregation of duties may be difficult to achieve in a smaller entity.
4. Helps to achieve the entity's objectives - Objectives represent what an entity strives to achieve.
Categories of entity's objectives:
1. Financial reporting objective – this objective relates to reliability of financial reporting
2. Operational objective – this objective is intended to enhance effectiveness and efficiency of
operations
3. Compliance objective – this objective relates to entity’s compliance with applicable laws and
regulations
Benefits of Strong Internal Control:
● Reliability of financial information for decision-making purposes

● Enhances the effectiveness and efficiency of operations
● Assurance of compliance with applicable laws and regulations
● Protection of assets and important documents and records
● Reduced cost of an external audit – because the auditor may rely on the effectiveness of internal control
Classification of Internal Control:
1. According to objectives:
a. Financial reporting controls – controls to achieve reliability of financial reporting objective
b. Operational effectiveness controls – controls to achieve operational effectiveness objective
c. Compliance controls – controls to achieve compliance objective
2. According to functions:
a. Preventive controls – controls that deter problems before they arise (for example, segregation of
incompatible employee functions/duties and control physical access to assets, facilities and information)
b. Detective controls – controls that discover or detect problems as they arise (for example, preparing
bank reconciliation and preparing monthly trial balance)
c. Corrective controls – controls that remedy problems discovered with detective controls (for example,
maintaining backup copies of transactions and master files)
Components of Internal Control:
Obtaining understanding of internal control means obtaining understanding of the five interrelated and essential
components or aspects of internal control as follows:
1. Control environment – it includes the governance and management functions and the attitudes, awareness,
and actions of those charged with governance and management concerning the entity’s internal control and its
importance in the entity
● It sets the tone of an organization, influencing the control consciousness of its people.
● It is a set of characteristics that defined good control working relationships in an entity.
● It is the foundation for effective internal control for it provides an appropriate foundation for other
components of internal control.
Elements of control environment:
1. Communication and enforcement of integrity and ethical values – These influence the effectiveness
of the design, administration, and monitoring of controls.
2. Commitment to competence – Management’s consideration of the competence levels for particular jobs
and how those levels translate into requisite skills and knowledge.
3. Participation by those charged with governance (BOD and audit committee)
4. Management’s philosophy and operating style – Management’s approach to taking and managing
business risks, attitudes and actions toward financial reporting, and attitudes toward information processing
and accounting functions and personnel.
5. Organizational structure – The framework within which an entity’s activities for achieving its
objectives are planned, executed, controlled, and reviewed.
6. Assignment of authority and responsibility – How authority and responsibility for operating activities
are assigned and how reporting relationships and authorization hierarchies are established. Appropriate
methods of assigning responsibility must be implemented to avoid incompatible functions and to minimize
the possibility of errors because of too much workload assigned to an employee.
7. Personnel or Human resource policies and procedures – Policies and practices that relate to
recruitment/hiring, orientation, training, evaluation, counseling, promotion, compensation, and remedial
actions.
2. Entity’s risk assessment process – entity’s own process of identification, analysis, and management of risks
relevant to the preparation and fair presentation of financial statements
3. Information system (including the related business processes, relevant financial reporting and
communication) – information and communication systems support the identification, capture, and exchange of
information in a timely and useful manner
● The information system relevant to financial reporting objectives, which includes the accounting system,
consists of the methods and records established to record, process, summarize, and report entity
transactions (as well as events and conditions) and to maintain accountability for the related assets,
liabilities, and equity.
● Communication involves providing an understanding of individual roles and responsibilities pertaining
to internal control over financial reporting. Communication may take such forms as policy manuals and
financial reporting manuals. Open communications channels help ensure that exceptions are reported
and acted on.
4. Control activities – the policies and procedures that help ensure management’s directives are carried out and
that necessary steps to address risks are taken. Control activities address risks that if not mitigated would
threaten the achievement of the entity’s objectives.
Examples of specific control activities include those relating to:
● Authorization
● Performance reviews
● Information processing
● Physical controls
● Segregation activities
Examples of specific control activities that may be relevant to an audit:

1. Pre-numbering of documents – helps to assure that:
a. All transactions are recorded (completeness).
b. No transactions are recorded more than once (existence).
2. Authorization of transactions – authorization should occur before commitment of resources
3. Independent checks to maintain asset accountability – independent checks involve the verification of
work previously performed by others, such as:
o Review of bank reconciliations
o Comparison of subsidiary records to control accounts
o Comparison of physical counts of inventory to perpetual records
4. Documentation – provides evidence of the underlying transactions and is a basis for establishing
responsibility for the execution and recording of transactions
5. Performance reviews – includes review and analyses of the following:
a. Actual performance versus budgets, forecasts, and prior period performance
b. Relationship between different sets of data to one another, together with analyses of the relationships
and investigative and corrective actions (for example, the management of a sports team might use
attendance data to ascertain the reasonableness of ticket sales).
c. Comparison between internal data and external sources of information, and
d. Functional or activity performance (for example, sales reports, receivable reports, etc., may be used to
analyze performance and to identify errors).
6. Information processing controls – ensure that transactions are valid, properly authorized, and
completely and accurately recorded
a. Application controls – controls which apply to the processing of individual applications
Examples of application controls:
o Checking the arithmetical accuracy of records
o Maintaining and reviewing accounts and trial balance
o Automated controls such as edit checks of input data and numerical sequence checks
b. General controls – controls that relate to many applications and support the effective functioning of
application controls by helping to ensure the continued proper operation of information systems. General
controls apply to information processing throughout the company.
Examples of general controls:
o Program change controls
o Controls that restrict access to programs or data
o Controls over the implementation of new releases of packaged software applications
o Controls over system software that restrict access to or monitor the use of system utilities that
could change financial data or records without leaving an audit trail
7. Physical controls – physical controls for safeguarding assets involve security devices and limited access
to programs and to restricted areas, including computer facilities
a. Physical segregation and security of assets, including adequate safeguards such secured facilities over
access to assets and records.
Examples of physical controls:
o Protective or security devices
o Bonded or independent custodians
o Physical and security of assets:
o Cash – placed in cash boxes, vault or safe deposit boxes
o Cash – deposited in a bank
o Inventory – placed in a warehouse
o PPE items – tagged with non-movable labels
b. Authorization for access to computer programs and data files (for example, requiring password prior
to access)
c. Authorized access to assets and records (such as through the use of computer access codes,
prenumbered forms, and required signatures on documents for the removal or disposition of assets)
d. Required signatures on documents for the removal or disposition of assets
e. Periodic counting and comparison with amounts shown on control records
Examples:
o  Comparing the results of cash, security and inventory counts with accounting records
o  Reconciliations
f. The extent to which physical controls intended to prevent theft of assets are relevant to the reliability
of financial statement preparation, and therefore the audit, depends on circumstances such as when
assets are highly susceptible to misappropriation.
8. Segregation of duties – involves ensuring that individuals do not perform incompatible duties.
o Duties should be segregated such that the work of one individual provides a crosscheck on the work
of another individual.
o A proper segregation of duties (or incompatible functions) requires that one person should not be
responsible for all phases of a transaction. This means that different employees should be assigned to
the following functions:
o Authorizing transactions
o Recording transactions – recordkeeping
o Maintaining custody of assets involved in the transactions
o For example, the responsibilities of the treasury department include handling of cash and custody of
securities but do not include data processing.
o Segregation of duties is intended to reduce the opportunities to allow any person to be in a position
to both perpetrate and conceal errors or fraud in the normal course of the person’s duties.
5. Monitoring – the process to assess the effectiveness (or quality) of internal control performance over time
Management’s monitoring of controls includes:
o Assessing the effectiveness of controls on a timely basis and ta king necessary corrective actions
o Monitoring of controls through ongoing activities
o Using information from communications from external parties such as customer complaints and
regulator comments that may indicate problems, highlight areas in need of improvement
FRAUD AND ERROR
Error refers to unintentional misstatements in the financial statements, including the omission of an amount or
a disclosure, such as:
● Mathematical or clerical mistakes in the underlying records and accounting data
● An incorrect accounting estimate arising from oversight or misinterpretation of facts
● Mistake in the application of accounting policies
Fraud is an intentional act involving the use of deception that results in a material misstatement of the financial
statement
Types of Fraud
1. Financial fraudulent reporting involves intentional misstatements or omissions of amount or
disclosures in the financial statement users. This type of fraud is also known as management fraud
because it usually involves members of management or those charged with governance. This may
involve
o Manipulation, falsification or alteration of records or documents
o Misrepresentation in or intentional omission of the effects of transactions from records or
documents
o Recording of transactions without substance
o Intentional misapplication of accounting policies
2. Misappropriation of assets or employee fraud involves theft of an entity’s assets committed by the
entity’s employees. This may include
o Embezzling receipts
o Stealing entity’s assets such as cash, marketable securities, and inventory
o Lapping of accounts receivables
The Fraud Triangle
● Incentive to commit fraud

● Opportunity to commit and conceal the fraud
● Rationalization – the mindset to justify committing fraud
Responsibility for the Prevention and Detection of Fraud
Management – to establish a control environment and to implement internal control policies and procedures
designed to ensure, among others, the detection and prevention of fraud
Individuals charged with governance – to ensure the integrity of an entity’s accounting and financial
reporting systems and that appropriate controls are in place

Overview of Internal Control and Fraud and Error

Uploaded by

Copyright:

Available Formats

Overview of Internal Control and Fraud and Error

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Overview of Internal Control and Fraud and Error

Uploaded by

Copyright:

Available Formats

What are the essential concepts of internal control?

What are the classifications of internal control according to objectives and functions?

OVERVIEW OF INTERNAL CONTROL AND FRAUD AND ERROR

Essential Concepts of Internal Control: Internal control is (a):

1. Process – a means of achieving the entity's objectives

Benefits of Strong Internal Control:

● Reliability of financial information for decision-making purposes

Components of Internal Control:

Elements of control environment:

Examples of specific control activities that may be relevant to an audit:

FRAUD AND ERROR

The Fraud Triangle

● Incentive to commit fraud

Responsibility for the Prevention and Detection of Fraud

You might also like