Chapter 3 - Internal controls. When you''ve finished studying this chapter, and completing the activities at its conclusion, you should be able to: Define internal control and explain its importance in the accounting information system, explain the basic purposes of internal control and its relationship to risk, describe and give examples of various kinds of risk exposures,...
Trang 1Chapter 3 Internal Controls
Trang 2• COSO framework
Trang 3Learning objectives
1. Define internal control and explain its
importance in the accounting information system
2. Explain the basic purposes of internal
control and its relationship to risk
3. Describe and give examples of various
kinds of risk exposures
Trang 4Learning objectives
4. Prepare a simple risk/control matrix
5. Summarize and explain the importance of
COSO’s 2013 “Internal Control—
Integrated Framework.”
6. Critique existing internal control systems
and design effective internal controls
Trang 5Internal control definition
A process, effected by an entity’s board of
directors, management and other personnel, designed to provide reasonable assurance
regarding the achievement of objectives
relating to operations, reporting and
compliance
From COSO’s 2013 Internal Control
Integrated Framework
Trang 6Internal control definition
• Key elements of the definition
– Process Internal control is not a list of rules
or “boxes to check off.”
– Effected by [various groups] Internal
control is the responsibility of the whole
organization—not just the accounting
function.
Trang 7Internal control definition
• Key elements of the definition
– Reasonable assurance No internal control
ever provides absolute assurance The
benefits of a control must outweigh its costs.
– Objectives relating to:
sales / collection process.
as SOX and the Foreign Corrupt Practices Act.
Trang 8Internal control purposes
cash daily in the bank
as through financial statement audits
Trang 9Internal control purposes
with a procedures manual
management directives, such as by
appropriate training & performance
reviews
Trang 10they can develop and implement internal controls to address them.
• “Address” can refer
to preventive, detective or corrective controls
Identify risk
exposures.
Develop internal controls.
Trang 11– Financial
– Operational
– Strategic
– Hazard
Trang 12• Hazard risk
Directors’ & officers’
liability risk
Trang 13Internal control purpose Comments*
acquisition / payment process Spoiled raw
establish proper
conversion process Dividends paid to
the wrong
internal audit of shareholder
Disclosure of the
database of
employees' Social
data encryption and
human resource process
Granting credit
established procedures for granting credit, including a separate
sales / collection process
Trang 14COSO framework
• Committee of Sponsoring Organizations
of the Treadway Commission on
Fraudulent Financial Reporting
• www.coso.org
• Original internal control framework: 1995
• Updated framework: 2013
Trang 16– Must be established at the top of the
organization (CEO, CFO)
– Often called the “tone at the top” or “tone
from the top”
Trang 17• Control activities
– Specific internal controls to address risks
– Preventive / detective / corrective
– A control may address multiple risks; a single risk may involve
multiple controls.
Identify risk
exposures.
Develop internal controls.
Trang 18COSO framework
• Information and communication
– How the entire internal control plan is
disseminated throughout the organization
– This framework element relates to the plan in
its totality.
• Monitoring
– Ensuring the plan’s ongoing effectiveness
– May be entrusted to the internal audit
department
Trang 19COSO framework example
Control environment:
Open door policy from
CEO / CFO regarding
Trang 20COSO framework
• In the 2013 update, COSO added 17
principles to provide more detail about the five components
Control environment “The board of directors
demonstrates independence from management and exercises oversight of the development and performance of internal control.”
Trang 21321