Study Notes: Internal Controls in Accounting

These notes are based on the content from the provided PDF files, "Chapter-11-Auditors-
Consideration-of-Internal-Control.pdf" and "Chapter-12-Specific-Control-Procedures-Test-of-
Controls-Part-1.pdf" and "Chapter-13-Specific-Control-Procedures-Test-of-Controls-Part-2.pdf"

1. Auditor's Consideration of Internal Control

Purpose:
- Primary: To gain knowledge for audit planning and control risk assessment.
- Secondary: To inform management and those charged with governance about significant
internal control deficiencies.

Steps:
1. Obtain Understanding: Understand the client's internal controls relevant to the audit.
2. Preliminary Assessment: Assess control risk and inherent risk to determine the risk of
material misstatement.
3. Determine Procedures: Design audit procedures based on assessed risks.
4. Revise Assessment: Revise the preliminary risk assessment if necessary.
5. Finalize Strategy: Finalize the audit strategy, plan, and program.

Control Risk:
- The risk that material misstatement will not be prevented, detected, or corrected by internal
controls.
- Assessed at either high (no test of controls) or low (tests of controls are performed).

Test of Control:
- Audit procedures to evaluate the effectiveness of controls in preventing or detecting material
misstatements.
- Performed when:
- Controls are expected to be effective.
- Substantive procedures alone are insufficient.

Types of Tests of Control:

- Inquiries of client personnel.
- Inspection of documents and reports.
- Observation of employees performing procedures.
- Reperformance of client procedures.
- Walk-through tests.
Extent of Tests of Control:
Determined by factors such as:
- Frequency of control performance.
- Length of reliance period.
- Expected deviation rate.
- Reliability of audit evidence.
- Extent of testing other related controls.

Timing of Tests of Control:

- Usually performed at an interim date.
- Additional tests may be performed during the remaining period based on factors like risk
assessment and control changes.

Deviations:
When deviations from controls are detected, the auditor should:
- Investigate the cause and consequences.
- Determine if additional tests are necessary.
- Consider adjusting substantive procedures.

Documentation:
The auditor should document:
- Understanding of internal controls.
- Control risk assessment (high or less than high).
- Basis for control risk assessment (if less than high).

2. Specific Control Procedures - Test of Controls (Part 1)

Transaction Cycles:
- Revenue/Receipt Cycle:
- Customer orders and sales.
- Delivery of goods and services.
- Accounts receivable accounting.
- Cash collection and deposit.
- Bank statement reconciliation.
- Expenditure/Disbursement Cycle:
- Acquisition of goods and services.
- Receipt of goods.
- Liability recording.
- Cash disbursement.
Control Procedures by Department:

Customer Order Department:

- Clear policies for order acceptance and approval.
- Consecutively numbered sales orders.
- Proper control and accounting for sales orders.
- Copies of sales orders sent to relevant parties.
- Proper control of back orders.
- Communication of important information to customers.
- Credit Department:
- Independence from accounting, billing, sales, and cash receipts.
- Proper examination of customer credit before approval.
- Information about past due accounts.
- Copy of approved sales order sent to inventory control.
- Credit manager reviews receivables and investigates past due accounts.
- Inventory Control Department:
- Review of sales orders to confirm stock availability.
- Release of goods to shipping only with approved credit and legitimate orders.
- Tracking and updating stock on hand.
- Ordering necessary items through purchasing.
- Shipping Department:
- Independence from billing, cash receipts, and accounting.
- Shipping only with approved sales orders.
- Preparation of shipping documents (bill of lading).
- Inclusion of packing slip with shipments.
- Reconciliation of shipping documents with sales invoices.
- Careful counting and checking of goods shipped.
Billing Department:
- Preparation of consecutively numbered sales invoices.
- Independence from credit and cash receipts.
- Accounting for all sales invoices.
- Retention of voided sales invoices.
- Preparation of invoices only after matching sales orders and shipping documents.
- Examination of credit terms, quantities billed, prices, extensions, and footings.
- General Accounting Department:
- Preparation of sales summaries.
- Preparation of pre-numbered credit memos for returned goods.
- Periodic reconciliation of accounts receivable subsidiary ledger with the general ledger.
- Regular sending of billing statements to customers.
- Review and mailing of monthly statements by an independent employee.
- Approval of accounts receivable write-offs by an independent employee.
- Preparation of monthly aging schedule of accounts receivable by an independent employee.
Mailroom:
- Opening of collections by a receptionist independent of shipping, billing, and accounting.
- Preparation of a list of receipts (remittance advice).
- Restrictive endorsement of checks.
- Prompt forwarding of collections to the cashier.
- Cash Receipts Department:
- Separation of cash receipts from cash disbursements.
- Daily recording and deposit of all cash receipts.
- Bonding of cash handlers.
- Centralization of cash collection.
- Preparation of deposit slips by the cashier.
- Preparation of cash summaries.
- Use of cash registers for cash sales.
- Verification of cash register totals by independent personnel.
- Monthly bank reconciliation by an independent person.
- Use of lockbox system if feasible.

3. Specific Control Procedures - Test of Controls (Part 2)

Personnel and Payroll Cycle:

- Activities: Hiring and terminations, maintenance of personnel records, payroll preparation,
and paycheck distribution.
- Departments: Personnel/HR, Payroll, Cash Disbursements.

Control Procedures:

Personnel Department:
- Responsibility for employee hiring, promotion, transfer, and termination.
- Initiation and updating of personnel records.
- Authorization of salary/wage rates and payroll deductions.
- Restriction of access to personnel records for payroll personnel.
- Prompt notification of termination settlements to payroll.
Payroll Department:
- Use of clock cards, magnetic identification cards, or job time tickets to track hours worked.
- Approval of payroll by supervisors.
- Collection of clock cards, pay rates, and deductions to compute payroll.
- Independence from personnel and treasurer's departments.
- Processing of gross and net earnings.
- Preparation of payroll register.
- Posting of payroll to appropriate accounts.
- Maintenance of separate payroll bank account.
- Monthly reconciliation of payroll bank account.
- Preparation of employee earnings records.
- Preparation of government reports on earnings and taxes.
- Review of payroll for reasonableness by management.
Cash Disbursements Department:
- Use of pre-numbered checks.
- Comparison of checks with payroll register.
- Signing of checks by the treasurer.
- Distribution of paychecks by a paymaster independent of operating and payroll departments.
- Employee identification verification.
- Receipt signing for cash payroll.
- Forwarding of unclaimed paychecks to the treasurer.
- Deposit of unclaimed cash paychecks.
- Preparation of payroll summary for general accounting.
- Bonding of cash handlers.

Conversion Cycle:
- Activities: Production of finished goods, inventory maintenance, fixed asset control, and
depreciation allocation.

Control Procedures:

Inventories:
- Statements of criteria for product production and quantities.
- Inventory processing manual.
- Restricted access to physical inventory.
- Prenumbered material release forms, production orders, and inventory movement logs.
- Perpetual inventory records for large items.
- Standard cost system.
- Physical controls over inventories.
- Bonding of employees handling valuable inventory.
- Adequate insurance coverage.
- Segregation of inventory handling, recording, and accounting.
- Physical controls over unused forms and records.
Fixed Assets:
- Written procedures for additions, disposals, and retirements.
- Procedures for operating, moving, and controlling fixed assets.
- Restricted access to movable fixed assets.
- Detailed fixed asset records.
- Reconciliation of fixed asset records with general ledger accounts.
- Investigation of variances.
- Policies for depreciation methods and calculations.
- Physical control over unused fixed assets.
- Segregation of custody and record-keeping.
- Safeguarding of fixed assets from deterioration and theft.
- Insurance coverage for major assets.
- Policies for capitalizing expenditures.

Investing Cycle:
- Activities: Acquisition, disposal, valuation, custody, and recording of investments.

Control Procedures:

Investments:
- Segregation of investment approval, accounting, and custody.
- Authorization of investment transactions by board or committee.
- List of authorized investments.
- Registration of securities in the company's name.
- Independent trust agents for custody.
- Bonding of personnel with access to securities.
- Record of visits to safe deposit boxes.
- Perpetual record of security additions and removals.
- Periodic comparison of securities with records.
- Recalculation and verification of interest and dividend income.

Financing Cycle:
- Activities: Issuance and repurchase of debt and equity, interest and dividend payment.
Control Procedures:

Debt and Equity:

- Authorization of transactions by the board of directors.
- Independent trustee for bond transactions.
- Schedule of interest and loan payment due dates.
- Cancellation of retired debt instruments.
- Defacing of canceled stock certificates.
- Independent stock registrar and transfer agent for share capital.
- Consecutive numbering and control of unissued bonds, notes, and stock certificates.
- Policies for obtaining capital funds.
- Physical barriers over forms and records.
- Detailed share capital records maintained independently.
- Proper control and accounting for treasury shares.
General Questions: 4. What is the purpose of performing a "test
of control" during an audit?

- a) To determine if the financial statements

1. What is the primary purpose of an
are free from material misstatement.
auditor's study and evaluation of a client's
internal control? - b) To evaluate the operating effectiveness
of controls in preventing or detecting
- a) To express an opinion on the
misstatements.
effectiveness of internal control.
- c) To identify and assess the risks of
- b) To identify and assess the risks of
material misstatement.
material misstatement.
- d) To express an opinion on the
- c) To design and implement internal
effectiveness of internal control.
controls for the client.
5. What is a "significant deficiency" in
- d) To provide assurance that the financial
internal control?
statements are free from material
misstatement. - a) Any deficiency that the auditor believes
is important enough to communicate to
2. Which of the following is NOT a factor
management.
relevant to the auditor's judgment about
whether a control is relevant to the audit? - b) A deficiency that is likely to result in a
material misstatement in the financial
- a) Materiality of the related risk
statements.
- b) Size of the entity
- c) A deficiency that is not likely to result in
- c) Nature of the entity's business a material misstatement, but is still
important enough to communicate to
- d) The auditor's personal opinion about management.
the control's effectiveness
- d) A deficiency that is not likely to result in
3. What are the two main levels of control a material misstatement, and is not
risk assessment? important enough to communicate to
- a) High and Low management.

- b) Significant and Insignificant

Specific Questions (Revenue/Receipt Cycle):
- c) Material and Immaterial

- d) Effective and Ineffective

6. Why is it important for the credit 13. Why is it important for a company to
department to be independent from the register its securities in its own name?
sales and cash receipts departments?
14. What are the key control procedures for
7. What is the purpose of a "packing slip" in safeguarding investments in a bank safe
the shipping department? deposit box?

8. What are the benefits of using a lockbox

system for cash management?
Specific Questions (Financing Cycle):

Specific Questions (Personnel/Payroll

15. Why is it important for bond
Cycle):
transactions to be handled by an
independent trustee?

9. Why is it important for the payroll 16. What are the key control procedures for
department to be independent from the ensuring the proper control and accounting
personnel and treasurer's departments? for treasury shares?

10. What is the purpose of a "paymaster" in

the cash disbursements department?
Questions about Service Organizations:

Specific Questions (Conversion Cycle):

17. What is a "service organization" in the
context of an audit?

11. What are the key control procedures for 18. What are the two types of reports that a
maintaining physical control over service auditor may issue in relation to a
inventories? service organization's internal controls?

12. Why is it important to segregate the 19. What should a user auditor do if they
responsibility for handling fixed assets from are unable to obtain a sufficient
the responsibility for fixed asset records? understanding of the services provided by a
service organization?

Specific Questions (Investing Cycle):

Answers: 11. Key control procedures include physical
barriers, restricted access, inventory counts,
1. b) To identify and assess the risks of
and segregation of duties.
material misstatement.
12. Segregation of duties helps prevent
2. d) The auditor's personal opinion about
fraud and errors related to asset
the control's effectiveness
acquisition, disposal, and recordkeeping.
3. a) High and Low
13. Registering securities in the company's
4. b) To evaluate the operating name prevents unauthorized transfer or
effectiveness of controls in preventing or loss and provides clear ownership.
detecting misstatements.
14. Key procedures include dual control
5. c) A deficiency that is not likely to result over access to the safe deposit box, periodic
in a material misstatement, but is still reconciliation of securities, and
important enough to communicate to maintenance of a record of visits.
management.
15. An independent trustee provides
6. Independence helps prevent fraud and oversight and protection against fraud or
errors related to credit approvals, sales misuse of bond proceeds.
transactions, and cash collections.
16. Key procedures include consecutive
7. A packing slip provides a detailed list of numbering and control of treasury shares,
items shipped to the customer, ensuring segregation of duties, and periodic
accuracy and reducing disputes. reconciliation of treasury share records.

8. A lockbox system improves cash flow, 17. A service organization is a third-party

reduces the risk of theft or loss, and entity that provides services to a user entity
enhances internal control over cash that are part of the user entity's
receipts. information systems relevant to financial
reporting.
9. Independence helps prevent fraud and
errors related to payroll calculations, 18. The two types of reports are Type 1
employee records, and cash disbursements. (description and design of controls) and
Type 2 (description, design, and operating
10. A paymaster, independent of the effectiveness of controls).
operating and payroll departments, helps
prevent fraud and ensure paychecks are 19. The user auditor should attempt to
distributed securely and accurately. obtain a Type 1 or Type 2 report, contact
the service organization, visit the service
organization, or use another auditor to - c) To monitor the effectiveness of internal
perform procedures. control.

- d) To communicate information about

risks to management.
General Questions:
4. What are control activities?

- a) Policies and procedures that help

1. Which of the following is NOT a
reduce risks of material misstatement.
component of internal control?
- b) The process of monitoring the
- a) Control environment
effectiveness of internal control.
- b) Risk assessment
- c) The communication of information
- c) Control activities about risks and controls.

- d) Information and communication - d) The foundation for the other

components of internal control.
- e) Monitoring activities
5. What is the purpose of monitoring
- f) Financial reporting activities?
2. What is the primary purpose of the - a) To identify and assess risks of material
control environment? misstatement.
- a) To identify and assess risks of material - b) To design and implement control
misstatement. activities.
- b) To establish a foundation for the other - c) To evaluate the effectiveness of internal
components of internal control. control.
- c) To design and implement control - d) To communicate information about
activities. risks and controls.
- d) To monitor the effectiveness of internal
control.
Specific Questions (Revenue/Receipt Cycle):
3. What is the purpose of risk assessment?

- a) To identify and analyze risks of material

misstatement. 6. Which of the following is NOT a control
procedure for the customer order
- b) To design and implement control department?
activities to mitigate risks.
- a) Consecutive numbering of sales orders Specific Questions (Personnel/Payroll
Cycle):
- b) Proper control and accounting for sales
orders

- c) Distribution of copies of sales orders to 9. Which of the following is NOT a control

relevant departments procedure for the payroll department?

- d) Approval of customer credit by the sales - a) Use of clock cards or magnetic

department identification cards

7. Which of the following is NOT a control - b) Approval of payroll by supervisors

procedure for the shipping department?
- c) Collection of clock cards and pay rates
- a) Shipment of goods only with approved
- d) Preparation of a payroll register
sales orders
- e) Distribution of paychecks by the payroll
- b) Preparation of shipping documents
department
- c) Inclusion of packing slips
10. Which of the following is NOT a control
- d) Reconciliation of shipping documents procedure for the cash disbursements
with sales invoices department (payroll)?

- e) Verification of customer credit by the - a) Use of pre-numbered checks

shipping department
- b) Comparison of checks with the payroll
8. Which of the following is NOT a control register
procedure for the cash receipts
- c) Signing of paychecks by the treasurer
department?
- d) Distribution of paychecks by an
- a) Separation of cash receipts from
independent paymaster
disbursements
- e) Approval of payroll by the cash
- b) Daily recording and deposit of receipts
disbursements department
- c) Bonding of cash handlers

- d) Preparation of deposit slips by the

Specific Questions (Conversion Cycle):
cashier

- e) Verification of customer credit by the

cash receipts department
11. Which of the following is NOT a control - c) Registration of securities in the
procedure for maintaining physical control company's name
over inventories?
- d) Use of independent trust agents
- a) Physical barriers
- e) Approval of investments by the finance
- b) Restricted access department

- c) Inventory counts 14. Which of the following is NOT a control

procedure for safeguarding investments in a
- d) Segregation of duties
bank safe deposit box?
- e) Approval of inventory purchases by the
- a) Dual control over access to the safe
production department
deposit box
12. Which of the following is NOT a control
- b) Periodic reconciliation of securities
procedure for fixed assets?
- c) Maintenance of a record of visits
- a) Written procedures for additions,
disposals, and retirements - d) Approval of access to the safe deposit
box by the finance department
- b) Procedures for operating, moving, and
controlling assets

- c) Restriction of access to movable assets Specific Questions (Financing Cycle):

- d) Detailed fixed asset records

- e) Approval of fixed asset purchases by the 15. Which of the following is NOT a control
production department procedure for debt and equity?

- a) Authorization of transactions by the

board
Specific Questions (Investing Cycle):
- b) Handling of bond transactions by an
independent trustee
13. Which of the following is NOT a control
- c) Preparation of a schedule of interest
procedure for investments?
and loan payment due dates
- a) Segregation of investment approval,
- d) Cancellation of retired debt instruments
accounting, and custody
- e) Approval of debt and equity
- b) Authorization of transactions by the
transactions by the finance department
board or investment committee
16. Which of the following is NOT a control - a) Obtain a Type 1 or Type 2 report from
procedure for ensuring the proper control the service auditor.
and accounting for treasury shares?
- b) Contact the service organization
- a) Consecutive numbering and control of directly.
treasury shares
- c) Visit the service organization and
- b) Segregation of duties perform procedures.

- c) Periodic reconciliation of treasury share - d) Use another auditor to perform

records procedures.

- d) Approval of treasury share transactions - e) Review the service organization's

by the finance department financial statements.

Questions about Service Organizations: Answers:

17. Which of the following is NOT a reason 1. f) Financial reporting (Financial reporting
why a user auditor might need to obtain an is the result of internal controls, not a
understanding of the services provided by a component of it.)
service organization?
2. b) To establish a foundation for the other
- a) The services affect the user entity's components of internal control.
information systems relevant to financial
3. a) To identify and analyze risks of
reporting.
material misstatement.
- b) The services are material to the user
4. a) Policies and procedures that help
entity's financial statements.
reduce risks of material misstatement.
- c) The services are provided by a company
5. c) To evaluate the effectiveness of
that is related to the user entity.
internal control.
- d) The services are provided by a company
6. d) Approval of customer credit by the
that is not related to the user entity.
sales department (Credit approval is
18. Which of the following is NOT a typically handled by a separate credit
procedure that a user auditor might use to department.)
obtain an understanding of the services
7. e) Verification of customer credit by the
provided by a service organization?
shipping department (Credit verification is
typically done by the credit department 15. e) Approval of debt and equity
before shipment.) transactions by the finance department
(Debt and equity transactions are typically
8. e) Verification of customer credit by the
approved by the board of directors.)
cash receipts department (Credit
verification is typically done by the credit 16. d) Approval of treasury share
department before goods are shipped.) transactions by the finance department
(Treasury share transactions are typically
9. e) Distribution of paychecks by the
approved by the board of directors or a
payroll department (Paychecks are typically
designated treasury share committee.)
distributed by a separate cash
disbursements department or an 17. c) The services are provided by a
independent paymaster.) company that is related to the user entity.
(The relationship between the service
10. e) Approval of payroll by the cash
organization and the user entity is not a
disbursements department (Payroll
primary factor in determining whether the
approval is typically done by supervisors or
user auditor needs to obtain an
a designated payroll authority.)
understanding of the services.)
11. e) Approval of inventory purchases by
18. e) Review the service organization's
the production department (Inventory
financial statements. (While reviewing the
purchases are typically approved by a
service organization's financial statements
separate purchasing department.)
might be helpful, it is not a primary
12. e) Approval of fixed asset purchases by procedure for obtaining an understanding
the production department (Fixed asset of the services provided.)
purchases are typically approved by a
separate capital expenditure committee or
management.)

13. e) Approval of investments by the

finance department (Investment approvals
are typically made by the board of directors
or an investment committee.)

14. d) Approval of access to the safe deposit

box by the finance department (Access to
the safe deposit box should be restricted to
authorized personnel, typically with dual
control.)