Flashcards
2 - Internal Control & Risk
Flashcards do conjunto (118)
- 1How does a tight control process contribute to the org's overall improvement?Improve the following areas:
1. Reliability and integrity of financial and operating info
2. Efficiency and effectiveness of ops
3. Safeguarding of assets
4. Compliance with laws, regulations and contracts - 2How does IIA defines control?Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved.
- 3How does COSO define internal controls?Designed to provide reasonable assurance regarding the achievement of objectives in the following:
1. Effectiveness and efficiency of operations
2. Reliability of financial reporting
3. Compliance with applicable laws and regulations - 4Wha are the three primary ways of classifying controls?1. The organisational level at which the controls exist (i.e. corporate, operational, transactional)
2. The type of control
3. Whether the control is manual or automated - 5What are organisational-level controls?Refer to
1. Corporate-level (entity-level) controls - corporate governance
2. Operational-level controls
3. Transaction-level controls - 6What are corporate-level (entity-level) controls?Mostly manual - include general policy statements (which establish core culture), values, and overall monitoring procedures (i.e. risk management committee). Also known as the control environment.
- 7What are operational-level controls?Include both manual and automated controls. Operational-level controls encompass planning and performing monitoring, system of accountability to superiors, and risk evaluation.
- 8What are transaction-level controls?Mostly automated, consisting of complying with specific control procedures and making sure financial information is accurate and complete.
- 9What are the five types of control?1. Preventive control
2. Directive control
3. Detective control
4. Corrective control
5. Compensating control - 10What is a preventive control?Control to avoid the occurrence of an unwanted event (i.e. to deter non-compliance with policies and procedures). Include segregation of duties, suitable authorisation of transactions, physical controls etc.
- 11What is a directive control?A control to cause or encourage a desirable event to occur. Include policies and procedures put in place by executive management, mgmt directives etc.
- 12What is a detective control?A control to detect undesirable events that occurred. Include bank reconciliations, checking for missing document numbers in pre-numbered documents, and perf reporting with variances.
- 13What is a corrective control?A control to correct undesirable events that occurred. Includes procedures put in place in remedy problems discovered by detective controls.
- 14What is a compensating control?A control to compensate for weaknesses in the control system. Includes bank reconciliation, and providing additional independent oversight etc.
- 15How does manual controls operate?Operate through human intervention. More prone to errors than automated controls due to the human factor.
- 16How does automated controls operate?Operate through and within a company's information technology system. Tend to be more efficient than manual controls. However, in complex and dynamic processes where human judgment is required, manual controls may be critical.
- 17What are application controls (in an automated control system(?They are controls to ensure that specific applications will be processed in accordance with management's specifications and in an accurate and timely manner.
- 18What are the three types of application controls?1. Input controls
2. Processing controls
3. Output controls - 19What does input controls do?Help to ensure that only valid, authorised information is entered into a transaction. Includes edit checks, key verifications, redundancy check, echo check, and completeness check.
- 20What does processing controls do?Ensure that data and transmission are valid. Also include physical security of the equipment. Includes posting check, cross-footing, zero-balance check, run-to-run control totals, internal header and trailer labels, concurrency controls, and key integrity checks.
- 21What does output controls do?Used to provide reasonable assurance that input and processing has resulted in valid output. Include output distribution controls, output retention controls, forms control, and error logs.
- 22What are the three types of control with respect to timing?1. Feedforward controls
2. Concurrent controls
3. Feedback controls - 23What are feedforward controls?They identify a problem before it occurs and attempt to prevent it from occurring (i.e. policies and procedures, preventive maintenance)
- 24What are concurrent controls?They operate at the same time as the production process and make ongoing adjustments to the process based upon immediate feedback from the system.
- 25What are feedback controls?They identify when something has already gone wrong.
- 26What is the difference between quantitative controls and qualitative controls?Quantative controls - relates to the number of units produced, hours worked etc.
Qualitative controls - relates to characteristics or requirements of job performance or the finished unit (i.e. quality control standards etc.) - 27What is the difference between planning and controlling?Planning - the process of an org setting forth its goals and objectives
Controlling - a cpy is able to monitor its progress towards those goals and objs - 28What are the characteristics of an effective control system?1. Economical: positive cost/benefit ratio
2. Meaningful: control only important items
3. Appropriate: shld reflect what the org is trying to measure and control
4. Congruent: result shld be useful and in line with what it is measuring
5. Timely: Info must be available in enough time to act upon it
6. Simple - understandable to the ppl using it
7. Operational - provide benefit to real operations - 29When will a control be more effective?When the people affected by the system have some sense of ownership of the process.
- 30What are the benefits of strong internal control?1. More reliable info for the decision-making process
2. Better control over the assets of the cpy
3. Reduced chance of fraud being committed
4. Lower external audit costs
5. Increased investor confidence - 31Who benefits from having a strong internal control system?1. Investors
2. External auditors
.3. Legislative and regulatory bodies
4. Organizations with large numbers of employees
5. Customers - 32Who is responsible for internal control?1. Board of Directors
2. CEO
3. Senior managers delegate responsibility
4. Financial and accounting officers
5. External parties (i.e. independent auditors) - 33How can a control process be established (1st 5 steps)?1. Set the standards
2. Select the times or points at which to collect info abt the activities tt are being measured and controlled
3. Observe the process or collect the samples
4. Record the collected info
5. Compare & measure the results against the expected or standard - 34How can a control process be established (last 5 steps)?6. Evaluate the perf
7. Report any significant deviations or problems to the appropriate lvl of mgmt
8. Implement corrections to the system or processes
9. Follow up to ascertain if the corrections implemented are effective
10. Review and revise the stds of performance as necessary - 35What is a control system?A control system is designed to help the cpy achieve or maintain the desired actions.
- 36What is the six basic elements of a control system?1. input
2.. processing
3. output
4. control
5. feedback
6. corrective action - 37Explain what 'control', 'feedback' and 'corrective action' mean in the context of a control system.1. Control - the process of comparing what was produced against some criteria or std
2. Feedback - compares actual pdn results with planned production expectations
3. Corrective action - makes improvements to existing process - 38What is the difference between an open control system and a closed control system?Differ based on interactions within a control environment.
1. Open system - interacts with its environment; may receive uncontrollable input info from the outside that will in turn affect the system
2. Closed system - does not receive any uncontrollable inputs - 39What are the six elements of a closed control system?1. Setting perf stds
2. Measuring perf
3. Analysing perf
4. Evaluating deviations
5. Correcting deviations
6. Following up - 40What are the five components in the feedback element of the control system?1. Control object - the variable that is being monitored
2. Detector - measures what is happening in the control object
3. Reference point - the std that the control obj is measured against
4. Comparator (analyser) - the comparison between what is happening and what should be happening
5. Activator - the decision-maker - 41What is the difference between a single feedback loop and a double feedback loop?1. Single feedback loop - a cpy pdces an item and then tests it to make sure that it meets quality specifications. If it does not meet, the item is not sold and reasons for the defect are investigated
2. Double feedback loop - a control mechanism that is reviewed at a higher level of snr mgmt and usually results in changes to the stds - 42What are some of the considerations in setting stds?1. set an achievable set of criteria
2. select the times (or control points) in the process at which to measure perf compared to the std
3. statistical sampling
4. that what is being measured has a cause and effect r/p with what it is being used to control
5. standards need to be flexible, reviewed on an ongoing basis, and revised for any changes in circumstances or processes - 43What the ways in which measurement can be performed?1. Self-measurement - builds employee morale and empowerment; cheaper relative to other measurement processes but a risk that not all deviations will be reported
2. Second-party measurement - 44What are the considerations when evaluating results?1. Compare like items to like items
2. some evaluations are measured using subjective rather than objective criteria - trait-based decisions - 45What are the considerations if evaluation is used as a motivational tool?The item that is measured needs to be under the direct control of the person being evaluated. Also needs to be line with the goals and objs of the cpy.
- 46What are the main ideas of internal control?1. Segregate the duties of authorisation
2. Record keeping
3. Custody of the asset or assets - 47What are some ways to achieving control (first 3)?1. Organizational Methods - Segregation of Duties
2. Policies - Directive Control
3. Procedures - actions for carrying out policies (ensure that one's person work is checked by another person or checked internally by a computer); need to be as simple and economical as possible - 48What are some ways to achieving control (last 4)?4. Pre-numbered forms
5. Personnel
6. Accounting
7. Budgeting
8. Reporting - 49What can internal controls do?1. Help an orgn get where it wants to go
2. achieve its perf and profitability goals and prevent loss of resources
3. ensure reliable financial reporting
4. ensure that the org complies with laws and regulaitons - 50What can internal controls not do?1. not a guarantee that the company will achieve its operational, financial reporting, and compliance objectives
2. can only provide reasonable assurance regarding achievement of the entity's objectives
3. must be evaluated in terms of cost-benefit relationship - 51How is a budget used as a management control technique?With a budget, a company transforms its plans and goals into a quantitative (or number) format, and thereby links its present conditions with a strategy for the future
- 52How is a Gantt chart used as a management control technique?It shows when different steps need to be completed. Tasks are colour coded in order to indicate which individuals are supposed to accomplish specific tasks, or they may be colored is as they are completed.
- 53What is the weakness of using a Gantt chart?1. They do not show the interconnection between the different steps of the proj
2. do not show the critical path of the proj - 54How is PERT used as a management control technique?The PERT diagram show every relationship between different activities using lines. A series of lines show interconnected steps that all must be completed in order for the task to be done. Can also show the time that should be required to complete each individual task.
- 55What is a critical path?It refers to the trajectory from start to finish that has the longest time to complete within a project. As it has the longest completion time, any delays in the completion of the steps along this path will cause a delay in completion of the entire proj. If a path is not critical, then it has slack time.
- 56How is Critical Path Method used as a mgmt control technique?Similar to PERT but includes costs in the process of planning and allows crashing - a process whereby as many resources as possible are redirected towards the completion of a project. Activity that should be crashed is one with the lowest cost to speed up the critical process in relation to the amt of time saved.
- 57How is a control chart used as a mgmt control technique?It records observations of an operation taken at regular intervals (also known as sampling). A process is said to be in statistical control if no sample observation falls outside the specified limits.
- 58How is a histogram used as a mgmt control technique?A histogram is a bar graph that represents the frequency of events in a set of data. Can pinpoint problem areas as well as those that are experiencing fewer problems.
- 59How is a Pareto diagram used as a mgmt control technique?It takes all the factors the histogram identifies as causing the problem and ranks them from the highest to lowest frequency. Presumes an 80/20 relationship between causes and effects.
- 60How is a cause-and-effect diagram (Ishikawa diagram) used as a mgmt control technique?It organizes causes and effects visually to sort out root causes and identify relationships between causes. Looks like a fishbone. At the end of the horizontal spine is the quality problem, which connects to the main causes (the ribs). Bones pointing to each rib are contributing factors to that cause.
- 61What are the typical main causes for quality problems in manufacturing?4Ms:
1. Machines
2. Materials
3. Methods
4. Manpower - 62What are the typical main causes of servicing problems in the Service industry?Four Ps:
1. People
2. Policies
3. Procedures
4. Plant (equipment) - 63How is a flowchart used as a mgmt control technique?A technique to understand internal controls and systems development. Pictorial diagram using symbols to describe operations, data flow, equipment and so forth. Advantages are that it gives the auditor a visual grasp of the system and can help highlight areas of audit emphasis.
- 64What are the main types of flowchart?1. Horizontal (systems) flowchart - shows the different department or functions,. Documents the manual and automated processes, and the input, output and processing steps. Identifies specific control points in the system.
2. Vertical (program) flowchart - specific steps
3. Data flow diagram - 65How is a correlation analysis used as a mgmt control technique?It measures the linear relationship between two or more variables. The numbers must stand the test of reason - there needs to be a cause and effect between the numbers for them to be related to each other.
- 66How is a trend analysis used as a mgmt control technique?A regression model in which the independent variable is time. Four components are: trend, seasonal variations, cyclical flunctuations, and irregular variables.
- 67How is special control programs used as a mgmt control technique?Used to educate employees about control requirements. Problem is defined and communicated to the employees. Employees are then given info about how their actions/inaction will impact the number of deviations.
- 68What is the goal of a zero-defect program?To have no defects in a process or the organization
- 69What are the two approaches mgmt can take in the process of control?1. Imposed control - stds are set and employees are measured against them. Corrective action is taken through the people responsible and comes after the event has occurred. Makes imposed controls more detective than preventive.
2. Self-control - where employees are encouraged to take a more active role in the prevention of defects (i.e. MBO) - 70What is the 'people element' involved in order for the system to work well?1. Ppl need to see implementation of system as a positive step / motivation to show that they are performing well.
2. Communication of faults to be done by the apt person and in a '+' manner.
3. If employees are involved in the control process and in the setting of stds, they will support the overall proj. - 71Why must the control system be monitored?This is because over time, the nature, individuals and processes in a business will change. Essential that the control system be able to change with the business as well. Note that no system will be able to prevent all mistakes and deviations due to exogenous variables and involvement of humans in the process.
- 72What are the five interrelated components of the COSO model?1. Control Environment
2. Risk Assessment
3. Control Activities
4. Information and Communication
5. Monitoring - 73What are some factors of Control Environment in the COSO model?1. Integrity, ethical values and competence of employees
2. Mgmt's commitee to competence
3. HR policies & procedures
4. How authority and responsibility is assigned
4. Mgmt's philosophy and operating style
5. Attn and Direction provided by the Board of Directors
6. Organizational structure - 74When are internal controls more likely to function well?If management believes that the controls are important and communicates its support to employees at all levels
- 75How do orgs with effective control environments set a positive "tone at the top"?1. Transmit guidance both verbally and by examples
2. Foster a control consciousness by setting formal and clearly communicated policies and procedures that are to be followed at all times, without exception
3. Specify the competence levels for particular jobs
4. BOD set corporate policy - 76Why is an org structure important?Because it provides the framework for all its activities
- 77What are the key aspects in establishing an org structure?1. Key areas of authority and responsibility should be defined
2. Cpy's org structure should be configured in a manner that suit its needs
3. Authority and responsibility shld be delegated to the extent necessary to achieve the org objs
4. Individuals held accountable - 78What is a risk?Anything that endangers the achievement of an objective
- 79Company's objectives must be established before risk can be assessed. What is the list of objectives that can also relate to the objectives of internal control?1. Operational objs (cpy's mission) - effectiveness and efficiency of the cpy's ops & perf and profit goals + safeguard of cpy resources against loss
2. Financial objs - preparation of external financial statements
3. Compliance objectives - adhering to laws & reputation - 80What are some examples of external risks?1. External risks: changes in technology, changes in the market in which an entity operates, new legislation bringing new requirements, natural disasters, economic changes, a failure of a key supplier, being sued, defrauded or robbed
- 81What are some examples of internal risks?2. Internal risks: employee embezzlement and falsification of records to conceal theft, lack of compliance with government regulations, disruptions to computer systems, poor manageemnt decisions, changes in manageemnt responsibilities
- 82What are control activities?Policies that address the identified risks and the procedures that ensure that management directives are carried out. Designed to limit risk and to protect the organization's ability to achieve risk objectives..
- 83How can control activities be classified?1. It can be directive, preventive, detective or compensating control.
2. can also be grouped according to objectives which they relate: financial reporting, operations and compliance. - 84What are some examples of control activities (part 1)?1. Top-level reviews: review actual results and compares them to budgets/competitors
2. Direct functional or activity management: reviews appropriate performance reports
3. Information processing: to check accuracy, completeness, and authorisation of transactions; control of access and new system development - 85What are some examples of control activities (part 2)?1. Independent checks
2. Performance indicators: relate different sets of data to one another and then unexpected results are investigated
3. Physical controls to safeguard assets: Physical protection measures
4. Documents and records: source documents are pre-numbered in order to account for all documents, reducing the likelihood of fraudulent use - 86What are some examples of control activities (part 3)?1. Authorisation: employees are appropriately empowered to perform tasks etc; authority is validated with a signature or an authorisation
2. Segregation of duties: to ensure that no single individual is given too much responsibility so that no employee is in a position to both perpetrate and conceal irregularities - 87What are the functions that different people must do under segregation of duties?1. Authorise a transaction (authorisation fn)
2. Record the transaction, preparing source documents, maintaining journals
3. Keep physical custody of the related asset (custody fn)
4. Periodically reconcile physical assets to recorded amounts (reconciliation fn) - 88What are some limitations of segregation of duties?1. not enough information
2. collusion - 89What are the important elements that needs to be captured in information and communication?1. Relevant information identified, captured, and communicated timely in a manner that enables people to carry out their responsibilities
2. ongoing communication upstream and downstream; to outside the org and received from external sources - 90What is the purpose of monitoring?To assess the quality of the internal control system's performance over time. Mgmt must also revisit previously identified problems to make sure that they have been corrected.
- 91How can monitoring be performed?1. Ongoing monitoring during normal operations
2. Separate evaluations by management with the assistance of the internal audit function (deficiencies are reported and appropriate remedial action taken and monitored) - 92What are some alternative control frameworks?1. CoCo model
2. Turnbull report - 93What is the CoCo model?It contains four components of control broken down into twenty criteria. The four components are purpose, commitment, capability, and monitoring and learning. Emphasis is on soft controls.
- 94What are the criteria for Purpose in CoCo model?1. Objs established and communicated
2. Significant internal and external risks identified and assessed
3. Policies are designed, communicated and implemented
4. Plans established and communicated to assist in the achievement of objs
5. Measurable perf tgts - 95What are the criteria for Commitment in CoCo model?1. Ethical values established and practiced
2. Human resource policies consistent with the firm's ethical values
3. Authority, responsibility and accountability should be clearly defined and consistent
4. Mutual trust facilitated through the flow of information and communication - 96What are the criteria for Capability in CoCo model?1. Have the knowledge, skills and tools
2. Communication support the values and achievement of objectives
3. Sufficient and relevant information communicated in a timely manner to the right parties
4. Coordinated decision-making
5. Control activities designed and implemented - 97What are the criteria for monitoring and learning?1. Ext and internal environments monitored for feedback on the achievement of objs
2. Perf monitored against tgts and goals
3. Assumptions used should be reviewed periodically
4. Info and comms periodically reviewed
5. Follow-up procedures implemented
6. Periodic review of the effectiveness of control system - 98What does the Turnbull Report say about the internal control system?1. embedded in the operations of the company and its culture
2. be capable of responding quickly to evolving risks
3. procedures for reporting immediately to appropriate lvls of mgmt any sig control failings or weaknesses - 99What are the key tenets of the Turnbull Report?1, Board': appropriate policies on controls, regular assurance and annual assessment
2. Mgmt: identify and evaluate risks faced, while designing, operating and monitoring a suitable system
3. Employee: knowledge, skills, info and authority to establish, operate and monitor the internal control system
4. Adopting a risk-based approach
5. On-going monitoring of risks and controls - 100What is risk?Possibility of an event occurring that will influence the achievment of objectives. Measured in terms of impact and likelihood. Includes pure risk (adverse impact) or speculative risk.
- 101What is risk mgmt?A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the org's objs.
- 102What is risk assessment?The process of identifying, assessing, and analyzing risks that have the potential to prevent the organisation from achieving its objectives.
- 103What is enterprise risk management?A structured, consistent and continuous process across the whole organisation for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives.
- 104What is residual risk?The risk remaining after management takes action to reduce the impact and likelihood of an adverse event, including control activities in responding to a risk.
- 105What is risk appetite?The amount of risk an organisation is willing to accept.
- 106What is risk tolerance?The acceptable levels of variation relative to the achievement of objectives.
- 107What is impact (for risk assessment)?The result, effect, or consequences of an event.
- 108What is pervasive risk?Risk that is found throughout the business environment
- 109What is uncertainty?A condition where the outcome can only be estimated
- 110What is going concern?A business that operates without the threat of liquidation for the foreseeable future (usually within 12 months)
- 111What is enterprise-wide risk management?A process, effected by an entity's board of directors, mgmtand other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity' objs.
- 112What are the primary functions of ERM?1. To identify potentil events that could '-'vely affect the company and to manage these risks within the cpy's risk appetite
2. To be applied when setting strategy, with mgmt considering risks when developing strategies
3. To provide reasonable assurance to mgmt and the board that risk will be identified and managed in a timely manner
4. To embed risk awareness within the org so that employees better undestand risks, their responsibilities regarding risks, and levels of authority they have to deal with risk - 113The objectives of ERM must be aligned with which objectives? - To help mgmt distinguish between objs that are controllable and objectives that are not controllable1. Strategic: aligned with the mission and vision of the org
2. Operations: focus on the effective and efficient use of resources and safeguarding of assets
3. Reporting: relate to the reliability of financial reporting
4. Compliance: org in compliance with applicable laws and regulations - 114What are the eight interrelated components of ERM?1. Internal environment
2. Setting objectives
3. Event identification
4. Risk Assessment
5. Risk Response
6. Control Activities
7. Information and Communication
8. Monitoring - 115What is the internal environment in ERM?The attitude and operating style of mgmt will determine the strength of the control environment.
- 116How should be objectives in ERM be formulated?They should support and be aligned with the organisation's mission and vision; furthermore, it should be consistent with its risk appetite.
- 117What is event identification in ERM?Both internal and external events affecting the achievement of an org's objs must be identified, and distinguished between risks and opportunities.
- 118What is risk assessment?Risks are analysed to ascertain likelihood and impact as bases for for determining how they should be managed. Assessed on an inherent and a residual basis.
Informações
- Descrição
- 1 CIA FlashCards sobre 2 - Internal Control & Risk, criado por Mel Ng em 25-03-2016.
- Criado por
- Mel Ng
- Visualizações
- 3
- Avaliação