Karteikarten
Internal Control Weaknesses
Karten in diesem Stapel (24)
- 1Lack of segregation of dutiesImplication: Increases the chance of error and fraud since there are no checks and and balances in place to ensure what the bookkeeper is doing is correct and not fraudulent (-vely affects profitability)
Recommendation: Delegate some duties to someone else, someone other than preparer should review all invoices and reconciliations - 2Lack of segregation of duties (person doing accounting records also signs cheques)Implication: increases risk of theft, negative impact cashflow and profitability
Recommendation: cheques over a certain dollar threshold should require the signature of a Board member, Board member should also review and initial the supporting documentation - 3Bank reconciliations not being completed or regularly reviewedImplication: lose track of outstanding items, cash could be stolen without detection (affects C/F and profitability)
Recommendation: bank reconciliations should be done on a monthly and reviewed by someone other than the preparer - 4Receipts are prepared manuallyImplication: increases the risk of duplicate receipts being issued if there are no numerical controls, manual preparation increases risk of error - could -vely affect profitability
Recommendation: receipts should be pre-numbered - 5The company uses manual accounting records (paper)Implication: increases the risk of errors and misstated info could lead to bad decisions which could negatively impact performance/profitability, poor control environment which will increase audit fees
Recommendation: purchase off-the-shelf accounting software and use to maintain accounting records (backup off site) - 6Owner is not involved in day to day operationsThis means that you cannot suggest any recommendations that involve the owner to address internal control weaknesses (can't suggest they sign cheques, review bank recs)
- 7No approval is made before purchases are madeImplication: staff may make inappropriate purchases, lowering profitability
Recommendation: get staff to fill out purchase requisition and manager should approve - 8All cheques require 1 signatureImplication: Anyone with access to blank cheques can write themselves a cheque which could lead to theft/fraud
Recommendation: require 2 signatures - 9Only one person in the company is involved in the financial processesImplication: if this person took vacation/sickday/quit/died, there is noone available that is aware of the tasks they do
Recommendation: other admin staff should be trained on backup (better segregation of duties) - 10Having a computer system exclusively over the InternetWeakness: Risk of unauthorized access to company's records (hackers)
Implication: financial records leaked to competitors, customer info comprised leading to bad reputation/lost profits, internet connectivity issues
Recommendation: ensure internet connection is secure and info is properly encrypted (enquire the service org which one they have and research the reputation), have alternative arrangements for when internet is down - 11Implication of people having unauthorized access to private/confidential customer informationCould result in damage to company's reputation, lost customers, and legal action against the company
- 12Outsourcing controls to a service organizationImplication: If the service company's control environment is not strong, the entity's entire system could be at risk of losing data, confidentiality issues, lost sales
Recommendation: request a report by an auditor on controls related to a service organization (CSAE 3416) and research background of service org and if there are any complaints - 13Service organization staff can access any of the company's records at any timeImplication: no controls to prevent unauthorized access to company's data/files, meaning authorized changes could be made by service organization staff, which could result in inaccurate financial records/theft/operational impacts
Recommendation: access to system should require authorization by management, review report of access attempts regular to ensure they were authorized - 14Users of the system have access to the entire systemW: users have access to the whole system even though their job may not required access to certain data
I: increases risk of fraud/error (lowering financial resources and profitability)
R: provide access to users based on their roles only (as needed basis) - develop unique user profiles with individual passwords for each person and allow them have an appropriate level of access for their role - 15Systems are fully integrated and all modules use shared databases - data only needs to be entered once and then flows to the restI: If data is incorrectly entered, it will create errors across the entire system causing operational issues
R: Implement system/validity checks for certain data inputs (SINS, dates) to ensure correctly lengh/format, restrict ability to make certain changes to higher management positions (price changes) - 16System allows for backdating of entriesI: Data can be changed by accident or manipulated to commit theft/fraud without anyone noticing, entries could be reported in the wrong period
R: Only allow a limited time for backdating (after month end) and only authorized management members can make changes - 17Data is backed up on the service organization's serversImplication: if damage occurs to service org's servers, this would results in loss info for the company (costly to recreate)
Recommendation: backups should be done regularly and copies should be stored offsite - 18System provides standard reports so there is no need for custom reportsI: Company may want custom reports to better analyze the performance since standard reports may not meet their specific reporting requirements leading to lower quality decisionmaking (poor business decisions)
R: Ask service organization if custom reports are available - 19Public companyPublic companies have a reporting requirement to signoff on whether their internal controls over the financial reporting process are functioning
- 20Purpose of having good internal controlsTo help safeguard company assets, ensure payments are made to vendors and employees that actually provide value to company, and you properly invoice and collect payment from customers
- Basically to protect against fraud and error and loss due to damage/accident - 21Examples of basic controls for a family run business- Segregation of duties (custody of cash s/b separate from billing, preparing payroll separate from signing payroll chqs)
- Access controls (lock doors with key fobs, IT controls like unique passwords for accounting records)
- Approval processes (for sales on credit, signing cheques, purchase approval, hiring)
- Reconcile purchase orders with deliveries
- Use budgets and variance analysis to ensure costs are onside
- Documentation process (formal contracts/invoices)
- Fixed asset controls (keep listing and number each asset for better tracking) - 22Supplier payment processOnly pay those suppliers who provide an early payment discount immediately. Ensure you pay the rest within the payment terms, but don't need to pay right away to effectively manage cash flow to ensure enough money for operating expenses and debt payments.
- 23Inventory not being trackedImplication: inaccurate inventory balance, leading to ordering too much/enough = lost sales, inaccurate costing of jobs = not profitable
Recommendation: inventory request forms to be filled out, approval of inventory over certain $ threshold - 24Employees putting in inaccurate timesheetsImplication: Paying extra money to employees, lowers profitability
Recommendation: implement timecard system where employees punch in and out of work and this is automatically recorded on the time card and can connected to the accounting/payroll system
OR have manager approve timesheets
Informationen
- Beschreibung
- CPA Assurance Karteikarten am Internal Control Weaknesses, erstellt von Lana Tran am 08/08/2016.
- Erstellt von
- Lana Tran
- Aufrufe
- 0
- Bewertung