Answer the following question briefly and concisely.
1. Explain the importance of internal controls to a business and describe
management’s responsibilities regarding these controls.
It ensures the reliability and integrity of financial information. Internal controls
provide accurate, timely, and complete information, including accounting
records, to plan, monitor, and report business operations. Ensure compliance.
Internal controls help ensure the University complies with the many federal,
state, and local laws and regulations affecting the functions of our business. It
also promotes efficient and effective operations - Internal controls provide an
environment in which managers and staff can maximize the efficiency and
effectiveness of their operations. And the accomplishment of goals and
objectives - Internal controls system provides a mechanism for management
to monitor operational goals and objectives. Administrative management is
responsible for maintaining an adequate system of internal control.
Management is responsible for communicating the expectations and duties of
staff as part of a control environment. They are also responsible for assuring
that the other major areas of an internal control framework are addressed.
2. Describe the COSO control framework and discuss each of the five
components.
The framework of a good internal control system includes:
Control environment: A sound control environment is created by
management through communication, attitude and example. This includes
a focus on integrity, a commitment to investigating discrepancies,
diligence in designing systems and assigning responsibilities.
Risk Assessment: This involves identifying the areas in which the
greatest threat or risk of inaccuracies or loss exist. To be most efficient,
the greatest risks should receive the greatest amount of effort and level of
control. For example, dollar amount or the nature of the transaction (for
instance, those that involve cash) might be an indication of the related
risk.
Monitoring and Reviewing: The system of internal control should be
periodically reviewed by management. By performing a periodic
assessment, management assures that internal control activities have not
become obsolete or lost due to turnover or other factors. They should also
be enhanced to remain sufficient for the current state of risks.
Information and communication: The availability of information and a
clear and evident plan for communicating responsibilities and expectations
is paramount to a good internal control system.
Control activities: These are the activities that occur within an internal
control system. These are fully described in the next section.
3. Explain the link between risk management and internal control.
Basically, internal controls provide reasonable assurance that risks to the
achievement of organizational objectives are at acceptable levels. (The
organizational objective when it comes to financial reporting is to provide
financial statements that are free of material omission or error.)
4. Describe the different types and categories of control that exist in most
large organizations and explain what could go wrong, even where controls
are meant to be in place.
There are two basic categories of internal controls – preventive and detective.
An effective internal control system will have both types, as each serves a
different purpose. As you perform routine processes, or when you are thinking of
implementing a new procedure or process, it is important to ask the following
questions to help determine the appropriate control: What could go wrong? What
steps have been taken to ensure that something does not go wrong? How can
you verify that nothing went wrong? The answers to these questions will enable
you to better target the type of control that is needed. Preventive controls aim to
decrease the chance of errors and fraud before they occur, and often revolve
around the concept of separation of duties. From a quality standpoint, preventive
controls are essential because they are proactive and focused on quality.
Detective controls are designed to find errors or problems after the transaction
has occurred. Detective controls are essential because they provide evidence
that preventive controls are operating as intended, as well as offer an after-the-
fact chance to detect irregularities.
5. Discuss the view that controls can only provide reasonable assurance and
not absolute assurance that objectives will be achieved.
Effective internal control over financial reporting provides reasonable
assurance regarding the reliability of financial reporting and the preparation of
financial statements for external purposes. The auditor must plan and perform
the audit to obtain appropriate evidence that is sufficient to obtain reasonable
assurance about whether material weaknesses exist as of the date specified in
management’s assessment.
