INTERNAL CONTROL

Module 3
 Internal Control
• According to W.W. Biggs “Internal control is best
regarded as indicating the whole system of
controls financial and otherwise, established by
the management in the conduct of a business,
including internal check, internal audit and other
forms of control”
• Methods put in place by a company to ensure
the integrity of financial and accounting
information, meet operational and profitability
targets and transmit management policies
throughout the organization.
 Internal Controls are everywhere:

You exercise internal control principles in your personal life

when you:

• Lock your house when you leave

• Keep copies of important papers in your safety deposit
box
• Balance your checkbook
• Keep your ATM/debit card PIN number separate from
your card
• Make travel plans
 Simple Definition

• Internal control is what we do to see that the

things we want to happen will happen …

• And the things we don’t want to happen won’t

happen.
 Objectives of Internal Controls

– Strategic – high-level goals and objectives,

aligned with and supporting the mission.
– Operational – effective and efficient use of
resources.
– Reporting – integrity and reliability of
reporting.
– Compliance – compliance with applicable
laws and regulations.
– Stewardship – protection and conservation of
assets.
 Characteristics of a Good
Internal Control System
• A well developed plan of Organization
• Scientific system of maintaining books of
Accounts
• A system with healthy practices of
performance of duties
• A thorough understanding of the duties
and responsibilities among the personnel
in the organization
 Basic Principles of Internal
Control
• The work is to be divided in such a
manner that the work done by one person
is automatically checked by another
• The collusion between two people should
be avoided
• The clerk in charge of journal should not
have access to the ledger and vice-versa
• There should be job rotation
• There should be compulsory leave for
employees
 Evaluation of the internal
Control System
• Determining the prevailing control system
in the organization
• Close examination of the transactions
• Evaluation
• Confirming the evaluation
• Recommendations for improvement
• Follow up
 Methods of Evaluation
• Narrative Method
• Check List Method
• Questionnaire Method
• Flow Chart Method
Process/Components of Internal
Control System
 1. Control Environment

▪ Foundation for all other standards of internal control.

▪ Pervasive influence on all the decisions and activities of
an organization.
▪ Effective organizations set a positive “tone at the top”.
▪ Factors include the integrity, ethical values and
competence of employees, and, management’s
philosophy & operating style.
Examples of soft controls:
» Management philosophy
» Organizational structure
» Communication
» Competency of employees
 2. Risk Assessment

▪ Risks are internal & external events (economic

conditions, staffing changes, new systems, regulatory
changes, natural disasters, etc.) that threaten the
accomplishment of objectives.
▪ Risk assessment is the process of identifying, evaluating,
and deciding how to manage these events… What is the
likelihood of the event occurring? What would be the
impact if it were to occur? What can we do to prevent or
reduce the risk?
 3. Control Activities
▪ Tools - policies, procedures, processes - designed and
implemented to help ensure that management directives
are carried out.
▪ Help prevent or reduce the risks that can impede the
accomplishment of objectives.
▪ Occur throughout the organization, at all levels, and in all
functions.
▪ Includes training, approvals, authorizations, verifications,
reconciliations, security of assets, reviews of operating
performance, and segregation of duties.
▪ Types of Controls
– Preventive
– Detective
 4. Communication and Information

▪ Pertinent information must be captured, identified and

communicated on a timely basis.
▪ Effective information and communication systems enable
the organization’s people to exchange the information
needed to conduct, manage, and control its operations.
 5. Monitoring

▪ Internal control systems must be monitored to assess

their effectiveness… Are they operating as intended?
▪ Ongoing monitoring is necessary to react dynamically to
changing conditions…Have controls become outdated,
redundant, or obsolete?
▪ Monitoring occurs in the course of everyday operations,
it includes regular management & supervisory activities
and other actions personnel take in performing their
duties.
• Periodic testing can be done by the process owner,
internal audit and external audit.
 Internal Check:
“A system of internal check is an
arrangement of staff duties whereby, no
one person is allowed to carry through and
to record every aspect of a transaction, so
that without collusion between two or more
persons, fraud is prevented and at the
same time the possibilities of errors are
reduced to the minimum.” – Spicer and
Pegler
 Objectives of Internal Check:
1. Proper division of work
2. Appropriate fixation of responsibility
3. Automatic check on the work done by one
employee
4. Minimization of errors and frauds
5. Strong internal check leads to reliability of
the records, which in turn facilitates sample
checks
6. Preparation of final accounts possible at any
time
 Principles of Internal Check:
1. Clear definition of duties, authority and
responsibility of each and every member of
staff.
2. Capacity and capability to be consider
during allocation of work
3. Avoid duplication and overlap of work
4. Automatic check should take place
5. Due to the implementation of Internal check
there should not be additional financial
burden to the firm
 Principles of Internal Check:
Continued………
6. Job rotation should be in place
7. Clarity in the selection process and appropriate
training provision to be in place
8. Clear cut instructions to be passed on, through
the right channel of communication
9. There should be compulsory leave provisions
for employees
10.Use of software packages should be
encouraged in order to have self balancing
ledgers, inventory control, etc.
 Principles of Internal Check:
Continued………
11.The arrangement of documents such as
vouchers, bank challan counter foils, etc. should
be arranged in chronological order
12.Cash received should be daily deposited in the
bank
13.Effective control to be exercised in case of
purchases, receipts and stores
14.Major assignments to be carried on under strict
supervision
15.Cash, cheques, drafts, shares and securities
received after banking hours should be kept
under the safe custody of a responsible officer
 Principles of Internal Check:
Continued………
16.The clerk in charge of journal should not have
access to the ledger or vice versa
17.No one should be allowed to deal with one
book throughout
18.Trading activities to be suspended for the
purpose of stock verification
19.No clerk should be relied upon too much
20.Correspondence with debtors and creditors
should be done by a responsible person
 Internal control in Specific
Areas:
• General Financial Arrangements
• Cash in hand and bank
• Fixed Assets
• Investments
 Internal control in Specific
Areas:
• General Financial Arrangements
1. Devise an appropriate and properly integrated
system of accounts, accounting records and
appropriate control mechanism
2. Introduce proper forms for overall financial
control and supervision by the management.
3. Precautionary steps for safeguarding and
preserving important records.
4. Proper selection of staff.
5. Rotation of duties and adequate
arrangements to depute personnel.
 Internal control in Specific
Areas:
• Cash in hand and bank
1.Receipts by post and cash sales:
a.Introduce necessary procedures to reduce
risk of interception on incoming mails
between receipts and opening.
b.Appoint a responsible person, other than the
cashier to check and supervise incoming
mails.
c.Ensure that bearer cheques are suitably
crossed and receipts are noted in
 Internal control in Specific
Areas:
• Cash in hand and bank
1.Receipts by post and cash sales:
Continued………
d. In regards to cash sales:
➢ Designate a responsible official to receive cash.
➢ Introduce record to evidence receipt of cash, e.g.
serially numbered cash receipt books, etc.

Continued………
 Internal control in Specific
Areas:
• Cash in hand and bank
1. Receipts by post and cash sales:
Continued………
e. For the purpose of safe custody over the money
received:
➢ Appoint suitable persons for receipt and handling of cash.
➢ Arrange for various collection centers at regular intervals.
➢ Introduce procedure to compare daily cash collections.
➢ Have provisions for unscheduled verifications of physical
cash.
➢ Introduce procedures for recording and investigating cash
shortages or excesses.
Continued………
 Internal control in Specific
Areas:
• Cash in hand and bank
1. Receipts by post and cash sales:
Continued………
f. In regards to accounting and maintaining of records for
moneys received:
➢ Appointment of responsible person to collect cash.
➢ Substitute for cashiers during absence or leave not to be
announced.
➢ Safe custody and retention of receipt counterfoils, paying-
in-slips, etc.
➢ Compulsory leave provision for cashiers.
Continued………
 Internal control in Specific
Areas:
• Cash in hand and bank
1. Receipts by post and cash sales:
Continued………
g. Banking of cash receipts:
➢ Deposits of receipts in full, preferably daily.
➢ Paying-in-slips to be prepared by another person
apart from the cashier.
➢ A separate person other than above two persons to
be appointed for remittances in the bank.

Continued………
 Internal control in Specific
Areas:
• Cash in hand and bank
1. Receipts by post and cash sales:
Continued………
h. In regards to cash balances:
➢Decide the amount of cash floats at various payment
points.
➢Do not allow unauthorized personnel in cash offices.
➢Replenishment of cash to be checked by an internal
auditor.
➢Make arrangements to safeguard cash after office hours.
➢Have insurance covers for cash, as well as officers
handling cash.
➢Have surprise checks for officers handling cash.
 Internal control in Specific
Areas:
• Cash in hand and bank
2. Payments:
i. Cheque payments:
➢ Introduce procedure to check supply and issue of cheque
books and ensure safety of unissued cheques.
➢ Fix a responsible person for preparation of cheques.
➢ Establish a procedure where all the supporting
documents to payments are submitted to the signatory
➢ The names and status of persons authorized to sign
cheques to be determined.
➢ Special precautions to be taken to control the use of
cheques signed mechanically or cheques carrying printed
signatures.
 Internal control in Specific
Areas:
• Cash in hand and bank
2. Payments:
i. Cheque payments:
Continued………
➢ Specify situation and the amount, for which bearer
cheques can be issued.
➢ Establish procedures to dispatch signed cheques and
obtainment of the acknowledgements.
➢ Avail the benefits of cash rebates, etc. on making timely
payments.
➢ See that valid receipts are collected for payments made.

Continued………
 Internal control in Specific
Areas:
• Cash in hand and bank
2. Payments:
Continued………
ii. Cash payments:
➢ Nominate responsible officers to authorize expenditure
and provide the procedure for documentation and
preservation of the same.
➢ Satisfy that paid vouchers are not re-used to effect
payments twice.
➢ Fix limits of payments per transaction through cash.
➢ Introduce necessary rules of cashing personal cheques.
➢ Exercise due care in collecting valid receipts pertaining to
payments made.
Continued………
 Internal control in Specific
Areas:
• Cash in hand and bank
2. Payments:
Continued………
ii. General:
➢ Allocation of duties in such a manner that cashier is not
allowed to write books of accounts.
➢ The cashier should not access to documents such as
shares, title deeds, etc.
➢ As far as possible persons signing the cheques should
not be the same as making the cheques and sundry
debtors/creditors list.
 Internal control in Specific
Areas:
• Fixed Assets:
1. The authorization personnel and procedure for capital
expenditure.
2. Receipt of purchased assets – inspection, evidencing
and the departments involved in doing the same.
3. Personnel to authorize the sale of discarded assets.
4. Personnel to maintain the records pertaining to fixed
assets and the distinction between revenue and
capital expenditure incurred in respect to the same.
5. Existing mechanisms pertaining to maintenance of
fixed assets and frequency of reconciliation of the
same by physical verification.
 Internal control in Specific
Areas:
• Fixed Assets:
Continued…….
6. Effective utilization and maintenance of fixed asset
mechanism in the firm.
7. Depreciation rates determination, authorization and
cross-verification on the calculations of the same.
8. Procedure to initiate self-built assets, procurement of
material and labour for the purpose and accounting
procedures pertaining to the same.
 Internal control in Specific
Areas:
• Investments :
Risk: Unrecorded or unauthorized transactions; transactions
at inappropriate prices or at unfavorable terms; payment of
fictitious or inflated prices.
1. Responsibilities for initiating, evaluation, and approving
investment transactions should be segregated from those
for detail accounting, and other related functions.
2. Responsibilities for initiating a transaction should be
segregated from those for final approvals that commit client
resources.
3. Custodial responsibilities for securities or other documents
evidencing ownership or other rights should be assigned to
someone who has no accounting duties.
 Internal control in Specific
Areas:
• Investments :
Continued……...
4. Adequate physical safeguards and custodial procedures should
exist over investments.
5. Securities should be periodically inspected or confirmed by a
person independent of the investment activity.
6. Detailed accounting records need to be maintained for
investments.
7. Investment earnings should be credited to the fund from which
the resources were provided for the investment.
8. A periodic comparison should be made between income
received and the amount specified by the terms of the security of
publicly available investment information.
9. Procedures should exist for reconciling the detail accounting
records with the trustee statements.
 Internal Audit:

• “Internal Audit is an independent appraisal

activity within an organization for the review
of operations as a service to the management.
It is a managerial control which functions by
measuring and evaluating the effectiveness of
other controls.” – The Institute of Internal
Auditors, U.S.A.
Advantages of Internal Audits

1. The biggest advantage of internal audit is that it

will lead to discovery of errors.
2. Since internal audit is done by the employees of the
company there is no additional cost involved which
again is a big advantage for a company which is
doing internal audit.
3. As internal audit is a constant procedure where
records are checked regularly it ensures that
accounting staff of a company keep the records up
to date.
 Disadvantages of Internal Audits
1. Internal audits report is not accepted by either the
shareholders or tax authorities, it is the external
auditor report which is required to be submitted to
these parties.
2. Since internal audit is done by the employees of the
company chances are that it may be biased and
therefore company cannot depend on such reports.
3. Since an internal audit is not done by the
professional auditor chances of internal auditor not
detecting the errors are high.
 Objects of Internal Audit:
1. Reliability and Integrity of information
2. Compliance with plans, policies, procedures,
laws and regulation
3. Safeguarding of business assets
4. Economical and efficient use of resources
5. Accomplishment of established objectives and
goals for operations
 Important steps for the success of
Internal Auditing:
1. Complete support from the Top Management
2. The chief internal auditor should be responsible to
a top officer to get the required support
3. Specification of the roles and responsibilities of
internal auditor to be written and accepted by the
management
4. The chief internal auditor to report to the BOD or a
specific committee in the form of periodic reports
 Communicating
deficiencies in internal
control to those charged
with governance and
management (SA - 265)
Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)
Scope:
1. This Standard on Auditing (SA) deals with the auditor’s
responsibility to communicate appropriately to those charged
with governance and management deficiencies in internal
control that the auditor has identified in an audit of financial
statements. This SA does not impose additional
responsibilities on the auditor regarding obtaining an
understanding of internal control and designing and
performing tests of controls over and above the
requirements of SA 315 and SA 330. SA 260 establishes
further requirements and provides guidance regarding the
auditor’s responsibility to communicate with those charged
with governance in relation to the audit.
 Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)
Scope:
Continued……….
2. The auditor is required to obtain an understanding of internal
control relevant to the audit when identifying and assessing the
risks of material misstatement. In making those risk
assessments, the auditor considers internal control in order to
design audit procedures that are appropriate in the
circumstances, but not for the purpose of expressing an opinion
on the effectiveness of internal control. The auditor may identify
deficiencies in internal control not only during this risk
assessment process but also at any other stage of the audit.
This SA specifies which identified deficiencies the auditor is
required to communicate to those charged with governance and
management.
3. Nothing in this SA precludes the auditor from communicating to
 Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)

Objective:
• The objective of the auditor is to
communicate appropriately to those charged
with governance and management
deficiencies in internal control that the auditor
has identified during the audit and that, in the
auditor’s professional judgment, are of
sufficient importance to merit their respective
attentions.
 Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)
Requirements:
The auditor shall determine whether, on the basis of the audit
work performed, the auditor has identified one or more
deficiencies in internal control.
If the auditor has identified one or more deficiencies in internal
control, the auditor shall determine, on the basis of the audit
work performed, whether, individually or in combination, they
constitute significant deficiencies.
The auditor shall communicate in writing significant deficiencies
in internal control identified during the audit to those charged
with governance on a timely basis.

Continued……….
 Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)
Requirements:
Continued……….
The auditor shall also communicate to management at an
appropriate level of responsibility on a timely basis
• (a) In writing, significant deficiencies in internal control that
the auditor has communicated or intends to communicate to
those charged with governance, unless it would be
inappropriate to communicate directly to management in the
circumstances; and
• (b) Other deficiencies in internal control identified during the
audit that have not been communicated to management by
other parties and that, in the auditor’s professional judgment,
are of sufficient importance to merit management’s attention.
 Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)
Requirements:
Continued……….
The auditor shall include in the written communication of significant
deficiencies in internal control:
(a) A description of the deficiencies and an explanation of their
potential effects; and
(b) Sufficient information to enable those charged with governance and
management to understand the context of the communication. In
particular, the auditor shall explain that:
(i) The purpose of the audit was for the auditor to express an
opinion on the financial statements;

Continued……….
 Communicating deficiencies in internal control
to those charged with governance and
management (SA - 265)
Requirements:
Continued……….
(ii) The audit included consideration of internal control relevant to
the preparation of the financial statements in order to design audit
procedures that are appropriate in the circumstances, but not for
the purpose of expressing an opinion on the effectiveness of
internal control; and
(iii) The matters being reported are limited to those deficiencies
that the auditor has identified during the audit and that the auditor
has concluded are of sufficient importance to merit being reported
to those charged with governance.