Components of Internal Control

Components of Internal Control

1. A. Control environment

   • Actions, policies and procedures that reflect attitudes of management
   • Management's philosophy and operating style
   • Organisational struture
   • Assignment of authority and responsibility
   • Internal audit
   • Audit committee participation
   • Human resources

2. B. Risk assessment (SWOT)

   • What is the client's philosophy surrounding risk?
   • How often do they perform risk assessment?
   • Who is involved?
   • What do they do?

3. C. Control activities

   • Policies, procedures, systems
   • Adequate sepeartion of duties
     • different people doing different jobs
     • The custody of assets from accounting
     • The authorisation of transactions from the custody of related assets
     • Operational responsibility from record-keeping responsibility
     • IT duties from duties fo key users outside IT
   • Proper authorisation of transactions and activities
     • General authorisation
       • + Management establishes policies for the organisation to follow + Subordinates are instructed to implement general authorisations by approving all transactions within the limits of the policy
     • Specific authorisation
       • Where management is unwilling to establish a general policy for some transactions
   • Adequate documents and records
     • Pre-numbered consecutively:
       • Control over missing documents
     • Prepared at the time of transaction:
       • + Less chance of misstatement + Simple enough to ensure understanding
     • Designed for multiple uses:
       • To minimise the number of different forms
     • Constructed to encourage correct preparation
     • Chart of accounts
   • Physical control over assets and records
     • Physical precautions:
       • e.g storerooms and fireproof safes
     • Controls related to IT equipment, programs, and data files:
       • + Physical control + Access controls + Backup and recovery procedures
   • Independent checks on performance

4. D. Information and comunication

5. E. Monitoring