Internal control extends beyond auditing financial statements. This system encompasses policies, procedures, delegation of authority, transaction approvals, asset security, technology access controls, and follow-up monitoring.<\/p>\n\n\n\n
Internal Control Summary<\/h2>\n\n\n\n
Some important things to understand about internal control are:<\/p>\n\n\n\n
- \n
- Internal control is a process that involves all parts of the organization.<\/li>\n\n\n\n
- The objectives include operational effectiveness, reporting reliability, and compliance.<\/li>\n\n\n\n
- The COSO framework divides internal control into five main components.<\/li>\n\n\n\n
- Control can be preventive, detective, or corrective.<\/li>\n\n\n\n
- Management is the owner and the main person responsible for control.<\/li>\n\n\n\n
- Internal audit is tasked with independently evaluating the effectiveness of controls.<\/li>\n\n\n\n
- Internal controls provide reasonable assurance, not absolute assurance, that all risks will disappear.<\/li>\n<\/ul>\n\n\n\n
What is Internal Control?<\/h2>\n\n\n\n
Internal control is a set of processes, policies, procedures, and activities designed to help an organization achieve its objectives while managing risks that could hinder that achievement.<\/p>\n\n\n\n
Based on COSO framework or Committee of Sponsoring Organizations of the Treadway Commission<\/em><\/a><\/strong>Internal control is influenced by the board of directors, management, and other personnel. This process is designed to provide reasonable assurance regarding the achievement of the organization's objectives in the areas of operations, reporting, and compliance.<\/p>\n\n\n\n
Thus, internal control is more than just a standard operating procedure (SOP) document. Controls must be thoroughly implemented, documented, tested, and updated as risks and business processes change.<\/p>\n\n\n\n
A simple example of internal control is:<\/p>\n\n\n\n
- \n
- Payment transactions must obtain the approval of authorized officials.<\/li>\n\n\n\n
- The person receiving the money should not be the one recording the transaction.<\/li>\n\n\n\n
- Bank account reconciliation is done periodically.<\/li>\n\n\n\n
- Access to the financial system is restricted based on position.<\/li>\n\n\n\n
- Changes to vendor data must go through a verification process.<\/li>\n\n\n\n
- Inventory is checked through stock taking activities.<\/li>\n\n\n\n
- Audit findings are monitored until corrective actions are completed.<\/li>\n<\/ul>\n\n\n\n
Definition of Internal Control According to Experts<\/h2>\n\n\n\n
In the following we present what the internal control system is in the opinion of some experts in full. <\/p>\n\n\n\n
- \n
- According To Horngren (2009)<\/strong>internal control encompasses all plans and actions taken within an organization to protect assets, ensure employees comply with company policies, maintain the accuracy of accounting records, and improve efficiency in operational processes.
<\/li>\n\n\n\n- Hery (2016)<\/strong> explain that internal control consists of a collection of policies and procedures designed to protect company assets from misuse, ensure the accuracy of accounting information, and ensure that all regulations, laws, and management policies are complied with by all employees.
<\/li>\n\n\n\n- Dasaratha V. Rama dan Frederick L. Jones (2008 film<\/strong> states that internal control is a process that is influenced by the board of Directors, management, and other staff within the company. This process aims to ensure the achievement of several objectives, including operational effectiveness and efficiency, accuracy of financial statements, and compliance with applicable regulations.<\/li>\n<\/ul>\n\n\n\n
<\/p>\n\n\n\n
From this information, it can be concluded that internal control is a set of policies designed to ensure that the company's operational processes run in accordance with established rules and regulations. <\/p>\n\n\n\n
The policy will be standardized into a system in the company known as the internal control system. This system takes the form of a structured framework.<\/p>\n\n\n\n
Why is Internal Control Important for a Company?<\/h2>\n\n\n\n
Company growth typically comes with an increase in transactions, employees, systems, branches, vendors, and compliance obligations. Without adequate controls, this complexity can increase the risk of errors and irregularities.<\/p>\n\n\n\n
Internal control is needed to help companies:<\/p>\n\n\n\n
- \n
- Protect assets from theft, misuse, or loss.<\/li>\n\n\n\n
- Maintain the accuracy and completeness of company data.<\/li>\n\n\n\n
- Reduce the risk of fraud and human error.<\/li>\n\n\n\n
- Ensure transactions are properly authorized.<\/li>\n\n\n\n
- Improve the efficiency of operational activities.<\/li>\n\n\n\n
- Maintain compliance with policies and regulations.<\/li>\n\n\n\n
- Support decision making based on reliable information.<\/li>\n\n\n\n
- Strengthening the accountability of each work unit.<\/li>\n\n\n\n
- Maintaining the reputation and trust of stakeholders.<\/li>\n\n\n\n
- Make it easier the audit process<\/a><\/strong> and management evaluation.<\/li>\n<\/ol>\n\n\n\n
Good internal controls also help companies detect irregularities early before they cause greater losses.<\/p>\n\n\n\n
Purpose Of Internal Control<\/h2>\n\n\n\n
![\"Systematic](\"https:\/\/audithink.com\/wp-content\/uploads\/2024\/10\/2_Pexels_Laporan-Keuangan-Sistemasi-sebagai-Hasil-Dari-Pengendalian-Internal_11zon-2-scaled.webp\" "\\"\\"")
Source: Pexels<\/figcaption><\/figure>\n\n\n\n In general, internal control objectives can be grouped into three main categories.<\/p>\n\n\n\n
1. Increase Operational Effectiveness and Efficiency<\/h3>\n\n\n\n
Internal controls help ensure that company resources are used appropriately, activities are carried out according to procedures, and operational targets are achieved.<\/p>\n\n\n\n
Examples include limiting purchasing authority, evaluating supplier performance, inventory control, and budget monitoring.<\/p>\n\n\n\n
2. Maintaining Reporting Reliability<\/h3>\n\n\n\n
Companies need financial and non-financial information that is accurate, complete, relevant, and available in a timely manner.<\/p>\n\n\n\n
Controls in the recording, reconciliation, journal approval, and report closing processes help reduce the risk of misstatement or manipulation of information.<\/p>\n\n\n\n
3. Ensuring Compliance<\/h3>\n\n\n\n
Internal controls help ensure that a company complies with:<\/p>\n\n\n\n
- \n
- Legislation.<\/li>\n\n\n\n
- Regulatory provisions.<\/li>\n\n\n\n
- Internal policies.<\/li>\n\n\n\n
- Contract agreement.<\/li>\n\n\n\n
- Industry standards.<\/li>\n\n\n\n
- Tax requirements.<\/li>\n\n\n\n
- Data security and protection provisions.<\/li>\n<\/ul>\n\n\n\n
In addition to these three main objectives, control also plays a role in protecting assets, maintaining organizational integrity, and supporting healthy corporate governance.<\/p>\n\n\n\n
Types of Internal Control<\/h2>\n\n\n\n
A. Based On The Benefits<\/h3>\n\n\n\n
This policy is categorized into 3 based on its benefits, namely preventive, corrective, and Detective.<\/p>\n\n\n\n
1. Preventive Control<\/h4>\n\n\n\n
Preventive controls are designed to prevent errors or risks before they occur. This type of Control focuses on trying to minimize the possibility of risks appearing by controlling the activities carried out. Examples of preventive internal controls include:<\/p>\n\n\n\n
- \n
- Automatic application control to prevent incorrect data input or unauthorized activities.<\/li>\n\n\n\n
- Access restrictions where only certain people are authorized to access sensitive data or systems.<\/li>\n\n\n\n
- Validation procedures to ensure that a transaction or process is verified before proceeding.<\/li>\n<\/ul>\n\n\n\n
2. Corrective Control<\/h4>\n\n\n\n
Corrective control is used after an error or problem occurs. This type of Control aims to correct inappropriate or undesirable situations, so that the effects of errors are minimized. Corrective control usually involves:<\/p>\n\n\n\n
- \n
- Change or correct incorrect data after an error is found.<\/li>\n\n\n\n
- Take action to restore compromised systems or data.<\/li>\n\n\n\n
- Provide training for employees after errors are found in the performance of duties.<\/li>\n<\/ul>\n\n\n\n
3. Detective Control<\/h4>\n\n\n\n
Detective Control aims to detect errors or problems after the occurrence of a process. These controls do not prevent errors, but help identify problems so that further action can be taken before they become larger. Examples of Detective control include:<\/p>\n\n\n\n
- \n
- Tax Audit<\/strong><\/a> to periodically check financial statements or systems to detect irregularities.<\/li>\n\n\n\n
- Activity Monitoring to oversee transactions or activities operated<\/em> to detect anomalies.<\/li>\n\n\n\n
- Recheck documents and transactions to make sure there are no errors.<\/li>\n<\/ul>\n\n\n\n
B. By Purpose <\/h3>\n\n\n\n
Internal control by its purpose is divided into accounting and administrative internal control. <\/p>\n\n\n\n
1. Internal Control Accounting<\/h4>\n\n\n\n
Accounting internal control focuses on the management and control of a company's financial data. Its purpose is to ensure that all transactions and financial information generated are reliable, accurate and well protected. <\/p>\n\n\n\n
This process includes a variety of steps, from data verification to separation of duties, to prevent errors and fraud that can harm the company. When the integrity of financial statements is maintained, the company can minimize the risk of financial and reputational losses.<\/p>\n\n\n\n
2. Internal Control Administration<\/h4>\n\n\n\n
Administrative internal control is concerned with the efficiency and effectiveness of administrative management in an organization. This control ensures that administrative processes run optimally to support business objectives<\/p>\n\n\n\n
In addition, administrative internal control also includes regular monitoring and evaluation of existing procedures and policies, so that any potential obstacles can be identified and overcome quickly.<\/p>\n\n\n\n
C. Based On The Coverage<\/h3>\n\n\n\n
Internal control by Scope is divided into general and application categories. <\/p>\n\n\n\n
1. General Control<\/h4>\n\n\n\n
This control includes all activities related to data management<\/strong><\/a> in the computer system. The main goal is to ensure that data is managed securely and regularly. Managed elements include separation of responsibilities and data processing. <\/p>\n\n\n\n
2. Application Control<\/h4>\n\n\n\n
This control focuses on monitoring transactions and application usage. The main elements include transaction recording, authorization, and reporting on the application. This control aims to ensure the accuracy and security of every transaction that occurs through the application. <\/p>\n\n\n\n
Five Components of Internal Control According to COSO<\/h2>\n\n\n\n
The COSO framework divides the internal control system into five interrelated components.<\/p>\n\n\n\n
![\"Communication](\"https:\/\/audithink.com\/wp-content\/uploads\/2024\/10\/3_Pexels_Proses-Komunikasi-untuk-Menerapkan-Pengendalian-Internal_11zon-scaled.webp\" "\\"\\"")
Source: Pexels<\/figcaption><\/figure>\n\n\n\n COSO Components<\/th> Primary Focus<\/th> Examples Of Implementation<\/th><\/tr><\/thead> Control environment<\/td> Culture, integrity, structure and accountability<\/td> Code of ethics, organizational structure, division of authority<\/td><\/tr> Risk assessment<\/td> Risk identification and analysis<\/td> Risk register and fraud risk assessment<\/td><\/tr> Control activities<\/td> Policies and procedures for managing risks<\/td> Authorization, reconciliation, segregation of duties<\/td><\/tr> Information and communication<\/td> Provision and delivery of information<\/td> Internal reporting, complaint channels, dashboard<\/td><\/tr> Monitoring<\/td> Evaluation of control effectiveness<\/td> Internal audit, control self-assessment, follow-up<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n 1. Control Environment<\/h3>\n\n\n\n
The control environment is the foundation of the entire internal control system. This component reflects the leadership's attitude and organizational culture toward integrity, accountability, and the importance of risk management.<\/p>\n\n\n\n
The control environment includes:<\/p>\n\n\n\n
- \n
- Commitment to integrity and ethical values.<\/li>\n\n\n\n
- Oversight by the board of commissioners or audit committee.<\/li>\n\n\n\n
- Organizational structure and division of authority.<\/li>\n\n\n\n
- Employee competency development.<\/li>\n\n\n\n
- Determination of responsibility and accountability.<\/li>\n<\/ul>\n\n\n\n
If management ignores procedures or sets inconsistent examples, other controls risk becoming ineffective even if they are well documented.<\/p>\n\n\n\n
2. Risk Assessment<\/h3>\n\n\n\n
Risk assessment is the process of identifying and analyzing events that may hinder the achievement of organizational goals.<\/p>\n\n\n\n
Risk assessment includes:<\/p>\n\n\n\n
- \n
- Define the organization's goals clearly.<\/li>\n\n\n\n
- Identify operational, financial, compliance, and technology risks.<\/li>\n\n\n\n
- Assess the likelihood and impact of risks.<\/li>\n\n\n\n
- Considering the risk of fraud.<\/li>\n\n\n\n
- Analyze significant business changes.<\/li>\n<\/ul>\n\n\n\n
Examples of changes that need to be considered are the implementation of new systems, opening branches, regulatory changes, changes in key personnel, organizational restructuring, and the use of artificial intelligence technology.<\/p>\n\n\n\n
3. Control Activities<\/h3>\n\n\n\n
Control activities are policies and procedures implemented to help ensure that responses to risks are carried out appropriately.<\/p>\n\n\n\n
Control activities can be:<\/p>\n\n\n\n
- \n
- Transaction approval and authorization.<\/li>\n\n\n\n
- Separation of duties.<\/li>\n\n\n\n
- Data reconciliation.<\/li>\n\n\n\n
- Document verification.<\/li>\n\n\n\n
- System access restrictions.<\/li>\n\n\n\n
- Physical security of assets.<\/li>\n\n\n\n
- Performance check.<\/li>\n\n\n\n
- Control over system changes.<\/li>\n\n\n\n
- Application usage and automatic control.<\/li>\n\n\n\n
- Standardization of procedures through SOPs.<\/li>\n<\/ul>\n\n\n\n
Control activities must have a responsible person, frequency of implementation, documentation method, and auditable evidence.<\/p>\n\n\n\n
4. Information and communication<\/h3>\n\n\n\n
Organizations need relevant and quality information so that every control can run effectively.<\/p>\n\n\n\n
This information needs to be communicated to the right parties, at the right time, and through the right channels.<\/p>\n\n\n\n
Examples of its application include:<\/p>\n\n\n\n
- \n
- Periodic financial and operational reports.<\/li>\n\n\n\n
- Risk monitoring dashboard.<\/li>\n\n\n\n
- Socialization of policies to employees.<\/li>\n\n\n\n
- Issue escalation mechanism.<\/li>\n\n\n\n
- Kanal whistleblowing.<\/li>\n\n\n\n
- Communication with auditors and regulators.<\/li>\n\n\n\n
- Reporting control weaknesses to management.<\/li>\n<\/ul>\n\n\n\n
Ineffective communication can cause employees to not understand the authority, procedures, or actions to be taken when they discover irregularities.<\/p>\n\n\n\n
5. Monitoring<\/h3>\n\n\n\n
Monitoring aims to assess whether internal controls are still designed appropriately and implemented consistently.<\/p>\n\n\n\n
Monitoring can be done through:<\/p>\n\n\n\n
- \n
- Routine supervision by superiors.<\/li>\n\n\n\n
- Periodic check-up.<\/li>\n\n\n\n
- Self-evaluation by work units.<\/li>\n\n\n\n
- Audit internal.<\/li>\n\n\n\n
- Data analysis and exception reporting.<\/li>\n\n\n\n
- Follow-up monitoring of findings.<\/li>\n\n\n\n
- Separate evaluation by an independent party.<\/li>\n<\/ul>\n\n\n\n
Any weaknesses discovered must be communicated to the authorities and followed by measurable corrective actions.<\/p>\n\n\n\n
Understanding the 17 COSO Principles of Internal Control<\/h2>\n\n\n\n
The five COSO components are further broken down into 17 principles.<\/p>\n\n\n\n
Control Environment<\/h3>\n\n\n\n
- \n
- Demonstrate commitment to integrity and ethical values.<\/li>\n\n\n\n
- Carry out supervisory responsibilities.<\/li>\n\n\n\n
- Establish structure, authority, and responsibility.<\/li>\n\n\n\n
- Demonstrate commitment to competence.<\/li>\n\n\n\n
- Enforcing accountability.<\/li>\n<\/ol>\n\n\n\n
Risk Assessment<\/h3>\n\n\n\n
- \n
- Set appropriate goals.<\/li>\n\n\n\n
- Identify and analyze risks.<\/li>\n\n\n\n
- Considering the potential for fraud.<\/li>\n\n\n\n
- Identify and analyze significant changes.<\/li>\n<\/ol>\n\n\n\n
Control Activities<\/h3>\n\n\n\n
- \n
- Select and develop control activities.<\/li>\n\n\n\n
- Select and develop general controls over technology.<\/li>\n\n\n\n
- Implementing controls through policies and procedures.<\/li>\n<\/ol>\n\n\n\n
Information and communication<\/h3>\n\n\n\n
- \n
- Using relevant and quality information.<\/li>\n\n\n\n
- Carry out internal communication.<\/li>\n\n\n\n
- Carry out external communications.<\/li>\n<\/ol>\n\n\n\n
Monitoring<\/h3>\n\n\n\n
- \n
- Conduct ongoing evaluations or separate evaluations.<\/li>\n\n\n\n
- Evaluate and communicate control weaknesses.<\/li>\n<\/ol>\n\n\n\n
A control system can be considered effective if the relevant components and principles are available, functioning, and working in an integrated manner.<\/p>\n\n\n\n
Important Elements in Control Activities<\/h2>\n\n\n\n
Some control elements that are commonly applied in companies include:<\/p>\n\n\n\n
Separation of Duties<\/h3>\n\n\n\n
The tasks of authorization, recording, asset storage, and inspection should not be performed by the same person.<\/p>\n\n\n\n
Segregation of duties can reduce the opportunity for someone to commit and hide errors or fraud.<\/p>\n\n\n\n
Transaction Authorization<\/h3>\n\n\n\n
Each transaction must obtain approval according to the established authority limits.<\/p>\n\n\n\n
The higher the value or risk of the transaction, the higher the level of approval required.<\/p>\n\n\n\n
Adequate Documentation<\/h3>\n\n\n\n
Each transaction must have complete supporting documents and evidence, be easily traceable, and be stored according to the retention period.<\/p>\n\n\n\n
Asset Security<\/h3>\n\n\n\n
Both physical and digital assets must be protected through access restrictions, use of secure storage, inventory, encryption, and backup mechanisms.<\/p>\n\n\n\n
Reconciliation<\/h3>\n\n\n\n
Data from two different sources need to be compared periodically to find differences or discrepancies.<\/p>\n\n\n\n
Independent Review<\/h3>\n\n\n\n
Certain activities need to be reviewed by parties not directly involved in the execution of the transaction.<\/p>\n\n\n\n
Access Control<\/h3>\n\n\n\n
Access to applications and data should be granted based on job requirements or principles. least privilege<\/em>.<\/p>\n\n\n\n
Examples of Internal Control in a Company<\/h2>\n\n\n\n
Here are some examples of internal controls based on business processes.<\/p>\n\n\n\n
Business Process<\/th> Risks<\/th> Example of Control<\/th><\/tr><\/thead> Procurement<\/td> Fictitious or non-needed purchases<\/td> Purchase order approval and vendor evaluation<\/td><\/tr> Payment<\/td> Double or invalid payment<\/td> Three-way matching and tiered authorization<\/td><\/tr> Sale<\/td> Selling to risky customers<\/td> Credit limit approval<\/td><\/tr> Accounts receivable<\/td> Bad debts<\/td> Accounts receivable aging analysis and customer confirmation<\/td><\/tr> What<\/td> Embezzlement of receipts<\/td> Bank reconciliation and separation of cashier functions<\/td><\/tr> Preparation<\/td> Loss or difference in stock<\/td> Stocktaking and warehouse access restrictions<\/td><\/tr> Payroll<\/td> Fictitious employees<\/td> Reconciliation of HR and payroll data<\/td><\/tr> Reporting<\/td> Misstatement of the report<\/td> Journal review and account reconciliation<\/td><\/tr> Information Technology<\/td> Unauthorized access<\/td> MFA, access review, backup, and log monitoring<\/td><\/tr> Data vendor<\/td> Fake account changes<\/td> Independent verification of data changes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Examples of Controls in the Payment Process<\/h3>\n\n\n\n
In the vendor payment process, companies can implement controls in the form of:<\/p>\n\n\n\n
- \n
- Purchase orders must be approved by authorized officials.<\/li>\n\n\n\n
- Goods or services must be confirmed as received.<\/li>\n\n\n\n
- The invoice is compared with the purchase order and proof of receipt.<\/li>\n\n\n\n
- Vendor account changes are independently verified.<\/li>\n\n\n\n
- Payments above a certain limit require two approvals.<\/li>\n\n\n\n
- Proof of payment is stored and can be traced.<\/li>\n\n\n\n
- Bank accounts are reconciled by a party that does not process payments.<\/li>\n<\/ol>\n\n\n\n
How to Implement an Internal Control System<\/h2>\n\n\n\n
The implementation of internal control can be carried out through the following stages.<\/p>\n\n\n\n
1. Set Goals<\/h3>\n\n\n\n
Companies need to determine the objectives of the processes to be controlled, such as reporting accuracy, asset security, compliance, or operational efficiency.<\/p>\n\n\n\n
2. Mapping Business Processes<\/h3>\n\n\n\n
Document the process stages, parties involved, systems used, documents produced, and decision-making points.<\/p>\n\n\n\n
3. Identifying Risks<\/h3>\n\n\n\n
Identify risks that could prevent objectives from being achieved, including risks of error, fraud, non-compliance, system failure, and operational disruption.<\/p>\n\n\n\n
4. Assess the Risk Level<\/h3>\n\n\n\n
Assess each risk based on the likelihood of it occurring and the magnitude of the impact it could cause.<\/p>\n\n\n\n
5. Designing Control Activities<\/h3>\n\n\n\n
Determine appropriate controls to reduce the risk to an acceptable level.<\/p>\n\n\n\n
Each control should have:<\/p>\n\n\n\n
- \n
- Name and purpose of control.<\/li>\n\n\n\n
- Risks handled.<\/li>\n\n\n\n
- Person responsible.<\/li>\n\n\n\n
- Frequency of implementation.<\/li>\n\n\n\n
- Type of control.<\/li>\n\n\n\n
- Proof of implementation.<\/li>\n\n\n\n
- Testing method.<\/li>\n<\/ul>\n\n\n\n
6. Develop Policies and SOPs<\/h3>\n\n\n\n
Control needs to be outlined in policies and SOPs so that it can be understood and implemented consistently.<\/p>\n\n\n\n
7. Conducting Socialization<\/h3>\n\n\n\n
Employees must understand the purpose of control, their individual responsibilities, and the consequences if procedures are not followed.<\/p>\n\n\n\n
8. Testing Control Effectiveness<\/h3>\n\n\n\n
Testing is done to determine whether the control:<\/p>\n\n\n\n
- \n
- Precisely designed.<\/li>\n\n\n\n
- Really implemented.<\/li>\n\n\n\n
- Implemented by the authorities.<\/li>\n\n\n\n
- Have sufficient evidence.<\/li>\n\n\n\n
- Successfully reduced risk.<\/li>\n<\/ul>\n\n\n\n
9. Fixing Weaknesses<\/h3>\n\n\n\n
Each weakness needs to have a recommendation, a person responsible for action, a time target, and a monitoring mechanism.<\/p>\n\n\n\n
10. Conduct Continuous Evaluation<\/h3>\n\n\n\n
Controls must be updated when there are changes in processes, organizational structure, regulations, technology, or risk profiles.<\/p>\n\n\n\n
Simple Control Matrix Example<\/h2>\n\n\n\n
Companies can use risk and control matrix<\/em> to link objectives, risks, and controls.<\/p>\n\n\n\n
Risks<\/th> Control<\/th> Responsible Person<\/th> Frequency<\/th> Proof<\/th><\/tr><\/thead> Fictitious invoice payments<\/td> Three-way matching<\/td> Supervisor Account Payable<\/td> Every transaction<\/td> PO, invoice, and proof of receipt<\/td><\/tr> Unauthorized vendor account changes<\/td> Verify with the vendor's official contact<\/td> Procurement Manager<\/td> Every change<\/td> Verification form<\/td><\/tr> Bank balance difference<\/td> Bank reconciliation<\/td> Finance Supervisor<\/td> Monthly<\/td> Reconciliation document<\/td><\/tr> Former employee access is still active<\/td> User access review<\/td> IT Security<\/td> Monthly<\/td> User access review report<\/td><\/tr> Missing setup<\/td> Stock shot<\/td> Warehouse Supervisor<\/td> Monthly or quarterly<\/td> Stock take minutes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n This type of documentation helps management and auditors understand whether significant risks have adequate controls.<\/p>\n\n\n\n
Ineffective Internal Control Indicators<\/h2>\n\n\n\n
Companies need to be aware of the following signs:<\/p>\n\n\n\n
- \n
- The same audit findings keep repeating themselves.<\/li>\n\n\n\n
- Reconciliation is often late.<\/li>\n\n\n\n
- Many transactions lack supporting documentation.<\/li>\n\n\n\n
- System accounts are shared.<\/li>\n\n\n\n
- Approval is done after the transaction takes place.<\/li>\n\n\n\n
- Inventory discrepancies were not investigated.<\/li>\n\n\n\n
- Access rights are not reviewed periodically.<\/li>\n\n\n\n
- Critical data changes have no audit trail.<\/li>\n\n\n\n
- Corrective action exceeded the target time.<\/li>\n\n\n\n
- Management often ignores SOPs.<\/li>\n\n\n\n
- No party is responsible for any control.<\/li>\n\n\n\n
- Control is only carried out prior to the audit.<\/li>\n<\/ul>\n\n\n\n
Such findings do not necessarily prove fraud, but may indicate that risks have not been adequately managed.<\/p>\n\n\n\n
Limitations of Internal Control<\/h2>\n\n\n\n
Internal controls can reduce risk, but cannot provide absolute assurance.<\/p>\n\n\n\n
Some limitations of internal control include:<\/p>\n\n\n\n
Human Error<\/h3>\n\n\n\n
Employees may misunderstand instructions, make recording errors, or make poor decisions.<\/p>\n\n\n\n
Collusion<\/h3>\n\n\n\n
Two or more parties may work together to circumvent controls that have been implemented.<\/p>\n\n\n\n
Management Override<\/h3>\n\n\n\n
Management has the authority to ignore or bypass procedures.<\/p>\n\n\n\n
Cost and Benefit Considerations<\/h3>\n\n\n\n
The cost of implementing controls needs to be commensurate with the level of risk and the value of the assets being protected.<\/p>\n\n\n\n
Changing Business Conditions<\/h3>\n\n\n\n
Previously effective controls may become irrelevant after changes in systems, processes, regulations, or business models.<\/p>\n\n\n\n
Dependence on Technology<\/h3>\n\n\n\n
Configuration errors, system disruptions, or improper access can reduce the effectiveness of automated controls.<\/p>\n\n\n\n
Due to these limitations, internal controls need to be monitored and evaluated periodically.<\/p>\n\n\n\n
Differences between Internal Control and Internal Audit<\/h2>\n\n\n\n
Internal control and internal audit are closely related, but they are not the same thing.<\/p>\n\n\n\n
- Activity Monitoring to oversee transactions or activities operated<\/em> to detect anomalies.<\/li>\n\n\n\n
- Tax Audit<\/strong><\/a> to periodically check financial statements or systems to detect irregularities.<\/li>\n\n\n\n
- Hery (2016)<\/strong> explain that internal control consists of a collection of policies and procedures designed to protect company assets from misuse, ensure the accuracy of accounting information, and ensure that all regulations, laws, and management policies are complied with by all employees.
- According To Horngren (2009)<\/strong>internal control encompasses all plans and actions taken within an organization to protect assets, ensure employees comply with company policies, maintain the accuracy of accounting records, and improve efficiency in operational processes.