7-24.
A. Name and define the components of internal control.
The components of internal control are:
• Control environment – The core of any business is its people – their individual
attributes,including integrity, ethical values and competence – and the environment in which
they operate. The control environment means the overall attitude, awareness and actions of
directors and management regarding the internal control system and its importance in the
entity. It is the foundation for all other components of internal control, providing discipline and
structure.
• Risk assessment – A company sets objectives of what they wish to accomplish, their mission.
Management then may identify risk to the achievement of their objectives and take the
necessary actions to manage the risks. Because economic, industry, regulation and operating
conditions will continue to change, mechanisms are needed to identify and deal with the special
risks associated with change.
• Control activities/Control procedures – Sometimes referred to as control activities and
sometimes as control procedures, they are those policies and procedures whichmanagement
has established to achieve the entity’s specific objectives. They include a range of activities
including approvals, authorisations, verifications, reconciliations, reviews, checking
arithmetical accuracy and controlling application and environment of computer information
systems. There are potentially many control activities, but they generally fall intofive
categories: (1) adequate separation of duties; (2) proper authorisation of transactions and
activities; (3) adequate documents and records; (4) physical control over assets andrecords; and
(5) independent checks on performance.
• Information and communication – Information is needed at all levels of the organisation:
financial information; operating information; compliance information and information about
external events, activities and conditions. This information must be identified, captured and
communicated in a form and time-frame that enables people to carry out their responsibilities.
Information systems produce reports and make it possible to run and control the business. The
most important information system for internal control is the accounting system.
• Monitoring – The entire control process must be monitored, and modifications made as
necessary. This is accomplished through ongoing monitoring activities, separate evaluations or
a combination of the two.
B. How do the components of internal control affect each other?
Based on Illustration 7.2, the control environment is the atmosphere which pervades the entire
control system. If risk is high in certain areas, more control activities will be required and
monitoring will increase in that area. Control activities are the basis of control operations and
they must be monitored to determine if they are operating. Monitoring (independent checking)
is a control activity in itself. Communication along clear channels connects all the other
components.
C. Discuss the interrelationship of components using as an example a retail clothing store.
Using as an example a retail clothing store, we see the components of internal control. Control
environment is the people at the top and their relationships to the clerks and service people who
run the clothing store. Business risk in retail clothing business includes competition, the ability
to get the best styles, pricing and service to customers. Audit risks would be theft, obsolete
stock, rebates, etc.
Control activities are extensive in retail clothing: (1) Adequate separation of duties can be seen
in the responsibilities of cashiers, who receive the payments, salespeople who ‘move the
merchandise’, accountants who do the recording, independent supervisor personnel and various
physical safeguard controls over merchandise and cash; (2) Proper authorisation of transactions
and activities is illustrated by the requirement that supervisors okay customer checks, online
credit-card authorisation and separate department for merchandise returns and refunds; (3)
Adequate documents and records is illustrated by the special documents for returns, cash
counts, inventory counts, etc.; (4) Physical control over assets and records is pervasive in a
retail clothing store from alarm systems at exits to point of sale controls. At point of sale, there
are cash registers, optical readers, dual cash register tapes (one to the customer, one remains
inside), limited access to cash registers and cash counts; (5) Independent checks on
performance include supervisor checks on cash counts, supervision of inventory counts, etc.
7-26.
A. Why consider the internal control? As in any company, US clothing store auditor Hasse
Nilsson uses assessment of internal control to determine the nature, timing and extent of other
audit procedures and to be able to make helpful suggestions to management for improvements
in controls and operations.
Controls in US Clothing Store are needed to:
• Protect absentee owners Ding and Andersson.
• Assess the effect on Nilsson’s audit if conditions of control are poor, such as possible
qualifications of report and the cost of additional audit work. (US Clothing Store may not be
auditable, or may be auditable only at a prohibitive cost, if general conditions of the control
structure, such as the accounting system and documentation, are poor.)
B. The following table shows the control features that Nilsson could inquire into.
Document the a. General operating policiesb. Duties and responsibilities of each
internal control employeec. Competence of staffd. Books well kept, posted and
structure balancedregularly
a. Budgetsb. Interim financial statementsc. Control by Ding and
Management or
Andersson over Simpson,if anyd. Regular review of accounting
administrative
records bySimpsone. What control is extended by Simpson overcash
controls
receipts, disbursements procedures andcredit approval and purchasing?
Other a. Adequate insuranceb. Physical protection of records
