Internal Controls Everybodys Business

1
Internal Controls Everybodys Business
2
Internal Control - Definition

• Any policy, procedure, process, or practice
  designed to provide reasonable assurance that an
  organizations objectives will be achieved.
  Specifically to ensure,
• - assets are safeguarded against theft misuse
• - operations are efficient and effective
• - financial reporting is reliable and complete
• - compliance with applicable laws regulations

3
Internal Control Framework

• Control environment
• Risk assessment
• Control activity
• Information communication
• Monitoring
• The framework and above components were developed
  by COSO in 1992.

4
Control Environment

• tone at the top
• walk the talk
• Integrity
• Ethical values/code of conduct
• Managements philosophy operating style
• Competence of employees

5
Risk Assessment

• Identifying and analyzing risks associated with
  achieving goals objectives
• External versus internal
• Controllable or beyond our influence
• Cost/benefit analysis of mitigating strategies

6
Types of Control Activities

• Preventative designed to avoid errors or
  irregularities
• Detective designed to identify errors or
  irregularities after they have occurred so that
  corrective action can be taken
• Directive designed to guide actions towards
  desired results

7
Preventative Control Examples

• Edit checks on data entry
• Passwords that limit access to systems, screens,
  files or data
• Safes and lock boxes that restrict access to
  funds
• Cables that secure computers in labs
• Locking cabinets/rooms that contain inventory or
  equipment
• Review authorization of documented expenses
  prior to submission
• Independent verification of data contained in
  reports to external bodies (e.g. government
  agencies)
• Segregating duties to minimize the control an
  individual has over a transaction

8
Detective Control Examples

• Cross check built into Excel spreadsheet
• Periodic spot checks of petty cash, inventory and
  equipment to see if they match records
• Periodic inspections of labs to ensure protective
  measures employed (e.g. goggles, gloves, storage
  of hazardous chemicals, compressed gas cylinders
  secured)
• Smoke alarms
• Periodic inspections of continuity of
  pre-numbered documents
• Checking monthly General Ledger account detail
  printouts for reasonableness or to supporting
  documentation
• Reviewing monthly financial statements to compare
  actual to budget for irregularities
• Bank reconciliations and review of same
• Review of profit margins

9
Directive Control Examples

• Documented policies and procedures that
  communicate requirements and/or restrictions
• Appropriate training provided to staff for
  assigned responsibilities
• No smoking signs
• Waste receptacles marked for recycling

10
Information Communication

• Must be reliable (e.g. system stability, complete
  and accurate data)
• Must be relevant (e.g. appropriate individuals,
  need to know basis)
• Must be effective (e.g. decision making criteria,
  manage expectations, sensitive)
• Must be timely (e.g. miss opportunities)

11
Monitoring

• To ensure internal controls are working properly
  and effectively requires
• Ongoing supervision and management
• Independent review by internal or external
  auditors

12
Good Control Goes Bad

• It can happen when
• Collusion by 2 or more people to circumvent the
  controls
• Management override
• Resource constraints
• Inappropriate decisions/poor judgement