0:00:08.000,0:00:12.000
Okay, I’m going to assume you now have an
idea of what an internal control is.
0:00:12.000,0:00:18.000
In this lesson, we are going to use a framework
to describe a system of internal controls of a
company.
0:00:18.000,0:00:24.066
The COSO Framework of Internal Control
defines entity controls as those that are...
0:00:24.066,0:00:29.000
implemented for multiple transaction cycles or
for the entire organization.
0:00:29.000,0:00:31.066
The control environment consists of:
0:00:31.066,0:00:36.033
1.
Active promotion of ethical values and
integrity throughout the organization.
0:00:36.033,0:00:39.033
2.
A commitment to the establishment of
competence.
0:00:39.033,0:00:43.066
3.
An active and qualified board of the directors
and audit committee.
0:00:43.066,0:00:46.066
The board of eirectors should be independent of
management,
0:00:46.066,0:00:50.033
and exists to challenge management and
scrutinize management’s effectiveness.
0:00:50.033,0:00:54.000
The audit committee has oversight responsibility
for financial reporting,
0:00:54.000,0:00:59.000
and acts as a conduit between management
and the external auditors.
0:00:59.000,0:01:05.066
4.
The control environment is also heavily
influenced by management’s philosophy and
operating style.
0:01:05.066,0:01:12.066
Employees take their cues from the company’s
leaders to determine how seriously internal
controls factor into their priorities.
0:01:12.066,0:01:18.033
5.
Human resource policies are critically
important to ensure the company hires
competent and trustworthy people.
0:01:18.033,0:01:24.033
6.
Business structure, authority and
responsibility and management control methods
factor into the control environment.
0:01:24.033,0:01:29.066
7.
As we’ve discussed, the IT systems have a
pervasive impact.
0:01:29.066,0:01:35.033
8.
The existence and effectiveness of an internal
audit function can greatly enhance the
operations of an entity.
0:01:35.033,0:01:39.000
So there is a lot to evaluate before you can
make an assessment as to whether the
company...
0:01:39.000,0:01:42.066
has an effective control environment or not.
0:01:42.066,0:01:48.000
The other components of the COSO Internal
Control Rramework that get considered after we
have assessed...
0:01:48.000,0:01:50.033
the control environment and include:
0:01:50.033,0:01:52.000
-Preparing risk assessments
0:01:52.000,0:01:56.033
-Designing and implementing control activities to
address risks
0:01:56.033,0:01:59.033
-Providing information and communication to
manage risk
0:01:59.033,0:02:04.066
-Monitoring the control system to ensure
ongoing effectiveness
0:02:04.066,0:02:08.033
A risk assessment requires management to
identify all the risks,
0:02:08.033,0:02:12.066
or said another way- what could go wrong in a
transaction cycle.
0:02:12.066,0:02:19.000
Then management needs to assess the
likelihood and significance of a risk occurring to
identify those which are critical.
0:02:19.000,0:02:26.033
And finally, the company develops a course of
action to reduce risk to an acceptable level by
performing control activities.
0:02:26.033,0:02:32.066
Control activities can include manual,
automated, and computer-assisted controls,
0:02:32.066,0:02:43.000
For example, having a manager review an
exception report of say outstanding, unmatched
purchase orders,
0:02:43.000,0:02:48.066
which by the way, would be a control to address
the completeness and cut off of accounts
payable.
0:02:48.066,0:02:52.066
Automated controls are those that are built in
the IT system.
0:02:52.066,0:03:00.066
For example, if we accept reservations from
guests through our website, how can we ensure
accuracy of that information.
0:03:00.066,0:03:06.033
Well, our reservation system will have various
controls built in to ensure that the customer...
0:03:06.033,0:03:12.000
completes all the fields on the screen to ensure
accuracy before accepting the reservation.
0:03:12.000,0:03:19.066
These sorts of IT controls are called application
controls and they are designed to achieve three
objectives.
0:03:19.066,0:03:25.000
First, that information input into the system is
correct, such as the example I just provided.
0:03:25.000,0:03:32.000
Second, the application control ensures that
information is processed correctly by the
system.
0:03:32.000,0:03:38.033
Thirdly, that the of application controls ensures
that outputs from the system are correct.
0:03:38.033,0:03:42.066
Now before we can safely say that these
application controls are effective,
0:03:42.066,0:03:47.066
we need to ensure that there is overall system
integrity.
0:03:47.066,0:03:51.000
General computer controls are akin to entity
level controls,
0:03:51.000,0:03:55.000
only in a systems sense, in that they are
pervasive across multiple classes of
transactions,
0:03:55.000,0:04:00.033
and across different software applications.
0:04:00.033,0:04:05.033
For example, if someone has the ability to hack
into the system and change the programming
code,
0:04:05.033,0:04:12.000
then it doesn’t matter how many fancy input,
processing, or output application controls there
are,
0:04:12.000,0:04:20.066
because the overall integrity of the system is
jeopardized because the malicious individual
has the opportunity to cover their tracks.
0:04:20.066,0:04:25.033
The key areas for general computer controls can
be summarized into three categories:
0:04:25.033,0:04:39.066
1.
Segregation of duties.
We don’t want people
who have access to the code to also have
access the transactional data.
0:04:39.066,0:04:45.066
2.
Systems acquisition, development, and
maintenance controls in place.
0:04:45.066,0:04:50.000
Any time the IT systems change, for whatever
reason,
0:04:50.000,0:04:56.066
controls must be in place to ensure that data is
transitioned accurately to the new system,
0:04:56.066,0:05:01.066
and that the new system contains all the
necessary controls that the old system had.
0:05:01.066,0:05:11.000
3.
Operational controls and support.
These
controls cover off such things as backup and
recovery procedures,
0:05:11.000,0:05:15.066
and physical and logical access, which are all
very important.
0:05:15.066,0:05:19.000
We don’t want unauthorized users gaining
access to our systems.
0:05:19.000,0:05:26.066
If general computer controls are not effective,
then it’s unlikely you can place much reliance
on application controls.
0:05:26.066,0:05:33.033
This leaves you with only manual controls to
meet the company’s objectives.
0:05:33.033,0:05:36.000
Let’s look at the manual controls next.
0:05:36.000,0:05:40.000
Manual controls fall into a number of broad
categories.
0:05:40.000,0:05:43.033
-Segregation of duties
-Documentation
-Physical controls
0:05:43.033,0:05:47.000
-Independent checks.
Let's look at each of
these now.
0:05:47.000,0:05:52.066
Segregation of duties is one of the fundamental
internal control principles,
0:05:52.066,0:05:59.066
which broadly states that if we design job
positions such that one person cannot control a
transaction in its entirety,
0:05:59.066,0:06:04.033
then it’s more likely to prevent and detect an
error or a fraud from happening.
0:06:04.033,0:06:10.033
Segregation can be a tricky concept to evaluate,
let alone remember, but the golden rules are:
0:06:10.033,0:06:14.066
Segregate the custody of an asset from its
accounting.
0:06:14.066,0:06:19.066
Segregate the operational responsibility from the
accounting.
0:06:19.066,0:06:22.066
Segregate the systems development from the
accounting.
0:06:22.066,0:06:26.066
Segregate computer operations from
accounting.
0:06:26.066,0:06:30.000
Segregate reconciliation and independent
checking from the accounting.
0:06:30.000,0:06:35.033
Segregate the authorization of transactions from
the custody of assets.
0:06:35.033,0:06:42.066
Let’s do a little knowledge check to check you
understanding of segregation of duties.
0:06:42.066,0:06:47.033
Betty maintains the accounts receivable
subledger and she receives the daily cash
receipts so that she can update the records.
0:06:47.033,0:06:49.033
Okay or not?
0:06:49.033,0:06:50.066
[PAUSE]
0:06:50.066,0:06:59.033
No, this is not okay as she has custody of an
asset (cash) and is responsible for the
accounting of that asset (accounts receivable).
0:06:59.033,0:07:01.000
This is fun, let’s do one more.
0:07:01.000,0:07:06.066
Brian is the controller, but from time to time the
system acts up and missposts a journal entry.
0:07:06.066,0:07:12.000
The only way to correct the journal entry is for
Brian to go into the journal entry database and
delete the journal entry.
0:07:12.000,0:07:13.066
Okay or not?
0:07:13.066,0:07:21.000
No, this too is not okay as Brian is now doing
both the computer operations and the
accounting.
0:07:21.000,0:07:28.033
It’s possible that he could manipulate other
journal entries in the database and bypass the
controls over posting journal entries.
0:07:28.033,0:07:31.066
Do you get the idea of what segregation of
duties implies.
0:07:31.066,0:07:37.066
It generally means that one individual does not
have control of transaction from cradle to grave.
0:07:37.066,0:07:41.066
Next, let’s look at what is meant by adequate
documentation.
0:07:41.066,0:07:47.033
This simply means that there should be
adequate records to establish an audit trail that
can followed for each transaction.
0:07:47.033,0:07:51.033
Some principles for the proper design and use of
documentation include using:
0:07:51.033,0:07:56.066
1.
Documents should be prenumbered or
automatically numbered to ensure everything is
recorded and nothing is missing.
0:07:56.066,0:08:03.000
2.
Documents should be prepared at the time
the transaction takes place to eliminate
mistakes from memory lapses.
0:08:03.000,0:08:09.000
3.
Documents should be well designed and
easily understood to encourage correct
preparation.
0:08:09.000,0:08:15.066
Physical controls over assets and records
ensures assets are not stolen, lost, or
damaged.
0:08:15.066,0:08:20.066
Physical controls include such things as locks
on doors and security cameras.
0:08:20.066,0:08:25.000
Logical access is the electronic equivalent using
log on credentials and passwords.
0:08:25.000,0:08:33.066
Protection our electronic assets, such as our
files and customer data, is often just as
important as protecting our tangible assets...
0:08:33.066,0:08:35.033
like cash, inventory and fixed assets.
0:08:35.033,0:08:42.000
And last, but certainly not least, we have
independent checks which are a control activity
that alleviates self-review bias...
0:08:42.000,0:08:50.000
For example, the person who performs the bank
reconciliation is checking to ensure that the
people who have deposited the cash,
0:08:50.000,0:08:54.000
prepared cheques, and accounted for the
transactions have reported them correctly.
0:08:54.000,0:09:01.000
The last two areas of the COSO Internal Control
Framework are the Information and
communication component,
0:09:01.000,0:09:09.033
which is essence the ability of the accounting
system to report the activity of the company in
a manner that allows for management action.
0:09:09.033,0:09:15.066
And lastly, the monitoring component ensures
that the system of internal controls is
periodically...
0:09:15.066,0:09:20.066
and continuously evaluated ensuring it operates
as designed and is effective.
0:09:20.066,0:09:25.000
Monitoring often falls to the internal audit
department who is independent of management,
0:09:25.000,0:09:29.000
and often has a direct reporting relationship to
the Audit Committee.
0:09:29.000,0:09:33.000
So, this has been a rather fulsome discussion of
what internal controls really are.
0:09:33.000,0:09:37.066
What you need to walk away from this lesson
understanding is a few things.
0:09:37.066,0:09:45.033
Recognize that to have effective internal controls
at the transaction level, you first need effective
controls at the entity level
0:09:45.033,0:09:49.000
And the same can be said about automated
controls.
0:09:49.000,0:09:58.033
Before you can rely on application controls, you
need to evaluate general computer controls.
0:09:58.033,0:10:03.000
Next, controls are established by companies to
mitigate risk.
0:10:03.000,0:10:10.066
Control activities mitigate risks specifically and
in turn enable management to make certain
assertions about various...
0:10:10.066,0:10:13.033
transaction cycles and balances.
0:10:13.033,0:10:18.000
In the next lesson, we will talk about how an we
go about auditing internal controls,
0:10:18.000,0:10:22.000
So until then, don’t stop until you get to the top
and when you get to the top, don’t stop.