Internal controls are the client’s procedures which
ensure that all transactions, assets and liabilities are recorded correctly.
ensure that all transactions, assets and liabilities are recorded correctly.
In essence, what auditors need to do when faced
with a new system or a system or a system that has changed significantly is:
with a new system or a system or a system that has changed significantly is:
·
Ascertain
the system;
Ascertain
the system;
·
Record
it;
Record
it;
·
Corroborate
that record with the client;
Corroborate
that record with the client;
·
Review
the overall system for reliability;
Review
the overall system for reliability;
·
Test the
system with some sample checks;
Test the
system with some sample checks;
·
Evaluate
its reliability; and
Evaluate
its reliability; and
·
Form a
conclusion on the adequacy of the client’s system of internal control.
Form a
conclusion on the adequacy of the client’s system of internal control.
The objectives of investigations and recording of
the accounting and internal control systems are to enable the auditor to have
evidence that:
the accounting and internal control systems are to enable the auditor to have
evidence that:
·
The
client maintains adequate books and records-don’t forget this is a secondary
objective of the audit.
The
client maintains adequate books and records-don’t forget this is a secondary
objective of the audit.
·
The
client has a system of internal control over the processing and recording of
transactions such that all transactions are recorded correctly both numerically
and in principle.
The
client has a system of internal control over the processing and recording of
transactions such that all transactions are recorded correctly both numerically
and in principle.
·
The books
of account can be relied on to form a reliable basis for the preparation of the
financial statements.
The books
of account can be relied on to form a reliable basis for the preparation of the
financial statements.
The auditors are primarily looking to rely upon the
system. If the system is satisfactory then they can substitute an investigation
and test of the system for a lot of detailed tests of individual transactions
and balances.
system. If the system is satisfactory then they can substitute an investigation
and test of the system for a lot of detailed tests of individual transactions
and balances.
Only by examining the system can they gather
evidence to prove that all the transactions are recorded correctly and in the
right accounting period.
evidence to prove that all the transactions are recorded correctly and in the
right accounting period.
If, in some areas of the business, internal
controls do not exist or are weak the auditors cannot rely on the controls and
other evidence needs to be sought for the completeness and accuracy of the
records.
controls do not exist or are weak the auditors cannot rely on the controls and
other evidence needs to be sought for the completeness and accuracy of the
records.
There are three basic techniques used when
documenting client’s systems.
documenting client’s systems.
These are:
·
Use of
internal control questionnaires (ICQs).
Use of
internal control questionnaires (ICQs).
·
Flow
charting and documenting the system.
Flow
charting and documenting the system.
·
Use of
internal control evaluation questionnaires (ICEQs)
Use of
internal control evaluation questionnaires (ICEQs)
Internal control questionnaires (icqs)
These documents can have several functions:
·
A method
of ascertainment of the system.
A method
of ascertainment of the system.
·
Enabling
the auditors to review and assess the adequacy of the system.
Enabling
the auditors to review and assess the adequacy of the system.
·
Enabling
the auditors to identify areas of weakness.
Enabling
the auditors to identify areas of weakness.
·
Enabling
the auditors to design a series of tests; in effect this means enabling the
auditors to draw up their audit programme.
Enabling
the auditors to design a series of tests; in effect this means enabling the
auditors to draw up their audit programme.
·
Enabling
audit staff to familiarize themselves with the system quickly and
comprehensively.
Enabling
audit staff to familiarize themselves with the system quickly and
comprehensively.
The advantages of using ICQs are implicit in the
functions just stated but in addition they include:
functions just stated but in addition they include:
·
The use
of standardized ICQs ensures that all the important questions are asked and the
important characteristics of a system are brought out.
The use
of standardized ICQs ensures that all the important questions are asked and the
important characteristics of a system are brought out.
·
The ICQ
is a comprehensive, all in, inclusive method of ascertaining, recording, and
evaluating a system of internal control.
The ICQ
is a comprehensive, all in, inclusive method of ascertaining, recording, and
evaluating a system of internal control.
Next follows an example of a part of an ICQ. Note
the separate columns for:
the separate columns for:
·
Questions.
Questions.
·
Answers-yes/no
Answers-yes/no
·
Reviewer’s
comment which can identify systems weaknesses.
Reviewer’s
comment which can identify systems weaknesses.
Control questionnaire (extract)
Client name:
METALBASH LTD Prepared by JT Date 19/7/20-8
METALBASH LTD Prepared by JT Date 19/7/20-8
Period to 31 December 2-07 Reviewed by DB Date 22/8/20-8
Subject area: PURCHASE ORDERING
|
Process
|
Yes
|
No
|
Comments
|
|
Are all purchases made as a result of written orders?
|
|
|
|
|
Are all orders sequentially numbered?
|
|
√
|
|
|
Do orders have to be authorized by a senior manager?
|
|
|
CEO or
purchasing manager |
|
Are orders only sent to approve suppliers?
|
|
|
|
|
If there are no approved suppliers, is the procedure for approving a
supplier carried out before the order is placed? |
|
|
Only approved
suppliers used |
|
Do all purchase orders show quantities?
Prices?
Terms?
Initials of authorizer?
Date?
|
|
|
|
|
Is there a limit to individual order values?
|
·
|
|
|
|
Are copies of the purchase order sent to purchase ledger department?
|
·
|
|
|
|
Stores?
|
·
|
|
|
|
Are purchase orders matched to invoices?
|
·
|
|
|
|
Are copies of all order retained in the purchasing department?
|
·
|
|
|
The auditor is looking for ‘NO’ answers as these
indicate a possible systems weakness which must be followed up and evaluated.
indicate a possible systems weakness which must be followed up and evaluated.
Flow charts
Flow charts are a method of recording internal
control systems from the auditor’s standpoint. There are two methods of
flowcharting- charting of processes and charting of documents from the basis of
their checking work.
control systems from the auditor’s standpoint. There are two methods of
flowcharting- charting of processes and charting of documents from the basis of
their checking work.
The advantages of flow charts are as follows:
·
Narrative
notes can be lengthy and confusing. Changes in the system usually require the
whole of the notes to be re-written note.
Narrative
notes can be lengthy and confusing. Changes in the system usually require the
whole of the notes to be re-written note.
·
Flow
charts enable the system to be recorded in such a way that it can be understood
by:
Flow
charts enable the system to be recorded in such a way that it can be understood
by:
·
New staff
coming to the audit.
New staff
coming to the audit.
·
Supervisors,
managers and partners.
Supervisors,
managers and partners.
·
Client
staff, which can have weaknesses pointed out more easily.
Client
staff, which can have weaknesses pointed out more easily.
·
The
overall picture of a firm can be seen, and in particular the auditor can be
assured they have the whole picture. Flow lines going nowhere can easily be
spotted.
The
overall picture of a firm can be seen, and in particular the auditor can be
assured they have the whole picture. Flow lines going nowhere can easily be
spotted.
·
Flow
charting is a disciplined method of recording. Full understanding must be
gained to draw them.
Flow
charting is a disciplined method of recording. Full understanding must be
gained to draw them.
·
Flow
charting highlights the relationships between different parts of a system. By
linking charts together even complex systems can be described easily.
Flow
charting highlights the relationships between different parts of a system. By
linking charts together even complex systems can be described easily.
·
Weaknesses
are easier to spot.
Weaknesses
are easier to spot.
·
Superfluous
forms and bottlenecks are relatively easily spotted. Auditors can help their
clients improve efficiencies in this area.
Superfluous
forms and bottlenecks are relatively easily spotted. Auditors can help their
clients improve efficiencies in this area.
·
Flow
charts are a permanent record but are relatively easily updated.
Flow
charts are a permanent record but are relatively easily updated.
·
In
complex cases, flow charting is the only way to gain an understanding of a
system.
In
complex cases, flow charting is the only way to gain an understanding of a
system.
·
There is
computerized flow charting packages available to simplify the process.
There is
computerized flow charting packages available to simplify the process.
The disadvantages of flow charting are:
·
They can
become overcomplicated or confusing if badly drawn.
They can
become overcomplicated or confusing if badly drawn.
·
They have
to be redrawn if the system changes even to a limited extent.
They have
to be redrawn if the system changes even to a limited extent.
·
They are
fine describing accounting processes where documents are moving through a
system, but once documents stop moving they cannot describe controls, e.g. flow
charts can describe procedures for controlling goods inward and outward but not
the controls over stock in the stores.
They are
fine describing accounting processes where documents are moving through a
system, but once documents stop moving they cannot describe controls, e.g. flow
charts can describe procedures for controlling goods inward and outward but not
the controls over stock in the stores.
When preparing flow charts the following points
should be borne in mind.
should be borne in mind.
·
An
organization chart is an essential concomitant.
An
organization chart is an essential concomitant.
·
Simplicity
and clarity are fundamental.
Simplicity
and clarity are fundamental.
·
Flow
charts must not be congested. Use separate charts for sub-procedures,
exceptional procedures etc. small congested charts can be misleading.
Flow
charts must not be congested. Use separate charts for sub-procedures,
exceptional procedures etc. small congested charts can be misleading.
·
Use only
horizontal and vertical lines and standard flow charting symbols.
Use only
horizontal and vertical lines and standard flow charting symbols.
·
Start at
the top left and finish at the bottom right.
Start at
the top left and finish at the bottom right.
·
Charts
must show:
Charts
must show:
·
Initiation
of each document and operation.
Initiation
of each document and operation.
·
Sequence
of all operations on documents and all copies of documents, especially
operations of control, inspecting, checking, comparing and approving.
Sequence
of all operations on documents and all copies of documents, especially
operations of control, inspecting, checking, comparing and approving.
·
The
sections or individuals who perform operations.
The
sections or individuals who perform operations.
·
The
ultimate destination, i.e. where is it filed?
The
ultimate destination, i.e. where is it filed?
·
Explanatory
narrative notes where required.
Explanatory
narrative notes where required.
·
Specimens
of documents could be attached and cross referenced.
Specimens
of documents could be attached and cross referenced.
The objective of a
flow chart is that it is complete in itself and can be read and understood
quickly and comprehensibly. However, this takes practice.
flow chart is that it is complete in itself and can be read and understood
quickly and comprehensibly. However, this takes practice.
Case study 2
Metalbash ltd sales order and invoicing system
A narrative description of the system might be:
·
The
company has a number of separate departments (e.g. sales, credit control).
The
company has a number of separate departments (e.g. sales, credit control).
This is important for
separation of duties.
separation of duties.
·
Orders
are received from customers in various forms.
Orders
are received from customers in various forms.
·
All
orders are transcribed onto pre-numbered official ‘sales order forms’.
Pre-numbering ensures all orders will be fulfilled or discovered as
unfulfilled.
All
orders are transcribed onto pre-numbered official ‘sales order forms’.
Pre-numbering ensures all orders will be fulfilled or discovered as
unfulfilled.
·
The blank
order forms are in duplicate. One copy is attached to the original customer
order and filed in a temporary file.
The blank
order forms are in duplicate. One copy is attached to the original customer
order and filed in a temporary file.
·
The
second copy is sent to credit control. Credit control check that the customer
is credit worthy by reference to their records and the customer’s ledger
account printout (to see the customer is not overdue or has not exceeded their
credit limit).
The
second copy is sent to credit control. Credit control check that the customer
is credit worthy by reference to their records and the customer’s ledger
account printout (to see the customer is not overdue or has not exceeded their
credit limit).
·
If credit
is not approved then a credit approval sub-routine is on another flow chart
which is not included).
If credit
is not approved then a credit approval sub-routine is on another flow chart
which is not included).
·
The order
is then sent to the warehouse. There, the goods on the order is checked for
availability. If the goods are not available then a routine is operated (to order
more from the supplier).
The order
is then sent to the warehouse. There, the goods on the order is checked for
availability. If the goods are not available then a routine is operated (to order
more from the supplier).
·
A
dispatch note in triplicate is made out from the details in the sales order
from. This dispatch note is pre-numbered.
A
dispatch note in triplicate is made out from the details in the sales order
from. This dispatch note is pre-numbered.
·
One copy
of the dispatch note is put with the goods (which are picked off the shelves
and packed) and signed by the goods-out foreman who compares the goods with the
dispatch note.
One copy
of the dispatch note is put with the goods (which are picked off the shelves
and packed) and signed by the goods-out foreman who compares the goods with the
dispatch note.
·
This copy
attached to the sales order form and filed in dispatch note number order in the
warehouse.
This copy
attached to the sales order form and filed in dispatch note number order in the
warehouse.
·
The
second copy of the dispatch note is checked against the goods and sent with the
goods to the customer.
The
second copy of the dispatch note is checked against the goods and sent with the
goods to the customer.
·
The third
copy is used to make out the invoice. It is subsequently attached to a copy of
the invoice and filed in invoice number order in the invoice section. But
before being so attached it is checked for sequence ( to see none are missing,
meaning goods were dispatched but not invoiced) BY THE INVOICE SECTION MANAGER.
The third
copy is used to make out the invoice. It is subsequently attached to a copy of
the invoice and filed in invoice number order in the invoice section. But
before being so attached it is checked for sequence ( to see none are missing,
meaning goods were dispatched but not invoiced) BY THE INVOICE SECTION MANAGER.
·
The
second copy of the prelists is sent to the sales department.
The
second copy of the prelists is sent to the sales department.
·
From the
order forms and the invoice copies, a schedule of outstanding orders is made
out weekly in duplicate.
From the
order forms and the invoice copies, a schedule of outstanding orders is made
out weekly in duplicate.
·
The
matched order forms and invoices are attached to each other and filed monthly
in alphabetical order of customer.
The
matched order forms and invoices are attached to each other and filed monthly
in alphabetical order of customer.
·
The top
copy of the schedule is filed. The second copy is sent to the managing
director.
The top
copy of the schedule is filed. The second copy is sent to the managing
director.
You may well feel that a flow chart explains the
system in a much more digestible manner than the narrative notes above which
are lengthy and difficult to retain.
system in a much more digestible manner than the narrative notes above which
are lengthy and difficult to retain.
Internal control evaluation questionnaires (ICEQs)
ICQs and flow charts are used to ascertain and
record the system.
record the system.
However, it is also necessary to evaluate the
systems strengths and weaknesses. An ideal method of doing this is by means of
an internal control evaluation questionnaire. This is a standardized set of
questions which has the advantage, like the ICQ, of ensuring all the right
questions are asked and the strnghts and weaknesses of a system are brought
out.
systems strengths and weaknesses. An ideal method of doing this is by means of
an internal control evaluation questionnaire. This is a standardized set of
questions which has the advantage, like the ICQ, of ensuring all the right
questions are asked and the strnghts and weaknesses of a system are brought
out.
The basic questions in as ICEQ are called control
questions. An example from the sales area is ‘can sales be invoiced but not
recorded in the bllks?’ each control question requires a ‘No’ answer.
questions. An example from the sales area is ‘can sales be invoiced but not
recorded in the bllks?’ each control question requires a ‘No’ answer.
You will recall that for an ICQ the auditors were
looking for ‘YES’ answers because they were trying to confirm that controls were
operating. Here they are looking for ‘No’ answers as the purpose of the ICEQ is
to see if it is possible to get round the controls in the system. A ‘No’ answer
confirms it is not possible.
looking for ‘YES’ answers because they were trying to confirm that controls were
operating. Here they are looking for ‘No’ answers as the purpose of the ICEQ is
to see if it is possible to get round the controls in the system. A ‘No’ answer
confirms it is not possible.
Example internal control evaluation
questionnaire-extract
questionnaire-extract
Client name: Metalbash ltd Prepared
by JT Date 19/7/20-8
by JT Date 19/7/20-8
Period to 31 December 2-07 Reviewed by DB Date 22/8/20-8
Subject area: goods inward
|
Control question
|
Yes
|
No
|
Comments
|
|
Can goods be accepted without being inspected for damage?
|
|
|
Damaged goods report
|
|
Can goods be delivered without being signed for?
|
|
|
|
|
Can goods be delivered without a goods received note being prepared?
|
|
|
Invoices not paid without copy GRN attached
|
|
Are the individuals who deal with goods inward the same as those who
deal with the security and recording of stock? |
|
|
|
|
Are the individuals who deal with goods inward the same as those who
deal with the security and recording of purchase ordering? |
|
|
|
|
Is it possible for invoices to be paid without goods having been
received? |
|
|
Invoices not paid without copy GRN attached
|
|
Is it possible for goods to be accepted without having been ordered?
|
|
|
Copy order sent to stores
|
|
Are damaged goods stored in the same part of the warehouse as accepted
goods? |
|
|
Quarantine area
|
In this
case the ‘yes’ answer should be followed up to see if it has any internal
control implications
case the ‘yes’ answer should be followed up to see if it has any internal
control implications
Walk-through
tests
tests
Once the
system has been documented, flow charts and notes prepared and reveiwd and ICQs
completed, the final step is to ‘walk through’ the system to ensure that what
is noted on the audit files actually happens in practice.
system has been documented, flow charts and notes prepared and reveiwd and ICQs
completed, the final step is to ‘walk through’ the system to ensure that what
is noted on the audit files actually happens in practice.
The auditor will take a small
number, say two or three only, of actual transactions and trace them through
the system following the system notes as they go. This is called a
‘walk-through test’ and ties the system notes to the actual live system. These
tests will be documented on the audit files as they form part of the compliance
testing of the company’s internal control procedures.
number, say two or three only, of actual transactions and trace them through
the system following the system notes as they go. This is called a
‘walk-through test’ and ties the system notes to the actual live system. These
tests will be documented on the audit files as they form part of the compliance
testing of the company’s internal control procedures.