Image not found or type unknown
Internal Control
Senior executives have long sought ways to better control the enterprises they run. Internal controls
are put in place to keep the company on course toward profitability goals and achievement of its
mission, and to minimize surprises along the way. They enable management to deal with rapidly
changing economic and competitive environments, shifting customer demands and priorities, and
restructuring for future growth. Internal controls promote efficiency, reduce risk of asset loss, and help
ensure the reliability of financial statements and compliance with laws and regulations. Because
internal control serves many important purposes, there are increasing calls for better internal control
systems and report cards on them. Internal control is looked upon more and more as a solution to a
variety of potential problems.
Internal Control
Internal control means different things to different people. This causes confusion among
businesspeople, legislators, regulators and others. Resulting miscommunication and different
expectations cause problems within an enterprise.
Problems are compounded when the term, if not clearly defined, is written into law, regulation or rule.
This report deals with the needs and expectations of management and others. It defines and
describes internal control to: 1. Establish a common definition serving the needs of different parties. 2.
Provide a standard against which business and other entities--large or small, in the public or private
sector, for profit or not--can assess their control systems and determine how to improve them. Internal
control is broadly defined as a process, effected by an entity's board of directors, management and
other personnel, designed to provide reasonable assurance regarding the achievement of objectives
in the following categories: 1. Effectiveness and efficiency of operations. 2. Reliability of financial
reporting. 3. Compliance with applicable laws and regulations. The first category addresses an entity's
basic business objectives, including performance and profitability goals and safeguarding of
resources.
The second relates to the preparation of reliable published financial statements, including interim and
condensed financial statements and selected financial data derived from such statements, such as
earnings releases, reported publicly. The third deals with complying with those laws and regulations
to which the entity is subject. These distinct but overlapping categories address different needs and
allow a directed focus to meet the separate needs. Internal control systems operate at different levels
of effectiveness. Internal control can be judged effective in each of the three categories, respectively,
if the board of directors and management have reasonable assurance that: They understand the
extent to which the entity's operations objectives are being achieved. 1. Published financial
statements are being prepared reliably. 2. Applicable laws and regulations are being complied with. 3.
While internal control is a process, its effectiveness is a state or condition of the process at one or
more points in time. Internal control consists of five interrelated components.
These are derived from the way management runs a business, and are integrated with the
management process. Although the components apply to all entities, small and mid-size companies
may implement them differently than large ones. Its controls may be less formal and less structured,
yet a small company can still have effective internal control. The components are: Control
Environment The control environment sets the tone of an organization, influencing the control
consciousness of its people. It is the foundation for all other components of internal control, providing
discipline and structure. Control environment factors include the integrity, ethical values and
competence of the entity's people; management's philosophy and operating style; the way
management assigns authority and responsibility, and organizes and develops its people; and the
attention and direction provided by the board of directors. Risk Assessment Every entity faces a
variety of risks from external and internal sources that must be assessed. A precondition to risk
assessment is establishment of objectives, linked at different levels and internally consistent. Risk
assessment is the identification and analysis of relevant risks to achievement of the objectives,
forming a basis for determining how the risks should be managed.
Because economic, industry, regulatory and operating conditions will continue to change,
mechanisms are needed to identify and deal with the special risks associated with change. Control
Activities Control activities are the policies and procedures that help ensure management directives
are carried out. They help ensure that necessary actions are taken to address risks to achievement of
the entity's objectives. Control activities occur throughout the organization, at all levels and in all
functions. They include a range of activities as diverse as approvals, authorizations, verifications,
reconciliations, reviews of operating performance, security of assets and segregation of duties.
Information and Communication
Pertinent information must be identified, captured and communicated in a form and timeframe that
enable people to carry out their responsibilities. Information systems produce reports, containing
operational, financial and compliance-related information, that make it possible to run and control the
business.
They deal not only with internally generated data, but also information about external events, activities
and conditions necessary to informed business decision-making and external reporting. Effective
communication also must occur in a broader sense, flowing down, across and up the organization. All
personnel must receive a clear message from top management that control responsibilities must be
taken seriously. They must understand their own role in the internal control system, as well as how
individual activities relate to the work of others. They must have a means of communicating significant
information upstream. There also needs to be effective communication with external parties, such as
customers, suppliers, regulators and shareholders.
Monitoring
Internal control systems need to be monitored--a process that assesses the quality of the system's
performance over time. This is accomplished through ongoing monitoring activities, separate
evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations.
It includes regular management and supervisory activities, and other actions personnel take in
performing their duties. The scope and frequency of separate evaluations will depend primarily on an
assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control
deficiencies should be reported upstream, with serious matters reported to top management and the
board. There is synergy and linkage among these components, forming an integrated system that
reacts dynamically to changing conditions. The internal control system is intertwined with the entity's
operating activities and exists for fundamental business reasons. Internal control is most effective
when controls are built into the entity's infrastructure and are a part of the essence of the enterprise.
"Built in" controls support quality and empowerment initiatives, avoid unnecessary costs and enable
quick response to changing conditions. There is a direct relationship between the three categories of
objectives, which are what an entity strives to achieve, and components, which represent what is
needed to achieve the objectives.
All components are relevant to each objectives category. When looking at any one category--the
effectiveness and efficiency of operations, for instance--all five components must be present and
functioning effectively to conclude that internal control over operations is effective. The internal control
definition--with its underlying fundamental concepts of a process, effected by people, providing
reasonable assurance--together with the categorization of objectives and the components and criteria
for effectiveness, and the associated discussions, constitute this internal control framework.
What Internal Control
Can Do Internal control can help an entity achieve its performance and profitability targets, and
prevent loss of resources. It can help ensure reliable financial reporting. And it can help ensure that
the enterprise complies with laws and regulations, avoiding damage to its reputation and other
consequences. In sum, it can help an entity get to where it wants to go, and avoid pitfalls and
surprises along the way. What Internal Control Cannot Do Unfortunately, some people have greater,
and unrealistic, expectations.
They look for absolutes, believing that: Internal control can ensure an entity's success--that is, it will
ensure achievement of basic business objectives or will, at the least, ensure survival. Even effective
internal control can only help an entity achieve these objectives. It can provide management
information about the entity's progress, or lack of it, toward their achievement. But internal control
cannot change an inherently poor manager into a good one. And, shifts in government policy or
programs, competitors' actions or economic conditions can be beyond management's control. Internal
control cannot ensure success, or even survival. Internal control can ensure the reliability of financial
reporting and compliance with laws and regulations. This belief is also unwarranted. An internal
control system, no matter how well conceived and operated, can provide only reasonable--not
absolute--assurance to management and the board regarding achievement of an entity's objectives.
The likelihood of achievement is affected by limitations inherent in all internal control systems.
These include the realities that judgments in decision-making can be faulty, and that breakdowns can
occur because of simple error or mistake. Additionally, controls can be circumvented by the collusion
of two or more people, and management has the ability to override the system. Another limiting factor
is that the design of an internal control system must reflect the fact that there are resource
constraints, and the benefits of controls must be considered relative to their costs. Thus, while internal
control can help an entity achieve its objectives, it is not a panacea.
Roles and Responsibilities
Everyone in an organization has responsibility for internal control. Management The chief executive
officer is ultimately responsible and should assume "ownership" of the system. More than any other
individual, the chief executive sets the "tone at the top" that affects integrity and ethics and other
factors of a positive control environment. In a large company, the chief executive fulfills this duty by
providing leadership and direction to senior managers and reviewing the way they're controlling the
business.
Senior managers, in turn, assign responsibility for establishment of more specific internal control
policies and procedures to personnel responsible for the unit's functions. In a smaller entity, the
influence of the chief executive, often an owner-manager, is usually more direct. In any event, in a
cascading responsibility, a manager is effectively a chief executive of his or her sphere of
responsibility. Of particular significance are financial officers and their staffs, whose control activities
cut across, as well as up and down, the operating and other units of an enterprise.
Board of Directors
Management is accountable to the board of directors, which provides governance, guidance and
oversight. Effective board members are objective, capable and inquisitive. They also have a
knowledge of the entity's activities and environment, and commit the time necessary to fulfill their
board responsibilities. Management may be in a position to override controls and ignore or stifle
communications from subordinates, enabling a dishonest management which intentionally
misrepresents results to cover its tracks.
A strong, active board, particularly when coupled with effective upward communications channels and
capable financial, legal and internal audit functions, is often best able to identify and correct such a
problem.
Internal Auditors
Internal auditors play an important role in evaluating the effectiveness of control systems, and
contribute to ongoing effectiveness. Because of organizational position and authority in an entity, an
internal audit function often plays a significant monitoring role. Other Personnel Internal control is, to
some degree, the responsibility of everyone in an organization and therefore should be an explicit or
implicit part of everyone's job description. Virtually all employees produce information used in the
internal control system or take other actions needed to effect control. Also, all personnel should be
responsible for communicating upward problems in operations, noncompliance with the code of
conduct, or other policy violations or illegal actions. A number of external parties often contribute to
achievement of an entity's objectives.
External auditors, bringing an independent and objective view, contribute directly through the financial
statement audit and indirectly by providing information useful to management and the board in
carrying out their responsibilities. Others providing information to the entity useful in effecting internal
control are legislators and regulators, customers and others transacting business with the enterprise,
financial analysts, bond raters and the news media. External parties, however, are not responsible
for, nor are they a part of, the entity's internal control system.
Organization of this Report
This report is in four volumes. The first is this Executive Summary, a high-level overview of the
internal control framework directed to the chief executive and other senior executives, board
members, legislators and regulators. The second volume, the Framework, defines internal control,
describes its components and provides criteria against which managements, boards or others can
assess their control systems. The Executive Summary is included.
The third volume, Reporting to External Parties, is a supplemental document providing guidance to
those entities that report publicly on internal control over preparation of their published financial
statements, or are contemplating doing so. The fourth volume, Evaluation Tools, provides materials
that may be useful in conducting an evaluation of an internal control system.
What to Do
Actions that might be taken as a result of this report depend on the position and role of the parties
involved:
Senior Management
Most senior executives who contributed to this study believe they are basically "in control" of their
organizations. Many said, however, that there are areas of their company--a division, a department or
a control component that cuts across activities--where controls are in early stages of development or
otherwise need to be strengthened. They do not like surprises. This study suggests that the chief
executive initiate a self-assessment of the control system. Using this framework, a CEO, together with
key operating and financial executives, can focus attention where needed.
Under one approach, the chief executive could proceed by bringing together business unit heads and
key functional staff to discuss an initial assessment of control. Directives would be provided for those
individuals to discuss this report's concepts with their lead personnel, provide oversight of the initial
assessment process in their areas of responsibility and report back findings. Another approach might
involve an initial review of corporate and business unit policies and internal audit programs. Whatever
its form, an initial self-assessment should determine whether there is a need for, and how to proceed
with, a broader, more in-depth evaluation. It should also ensure that ongoing monitoring processes
are in place. Time spent in evaluating internal control represents an investment, but one with a high
return.
Board Members
Members of the board of directors should discuss with senior management the state of the entity's
internal control system and provide oversight as needed. They should seek input from the internaland
external auditors.
Other
Personnel Managers and other personnel should consider how their control responsibilities are being
conducted in light of this framework, and discuss with more senior personnel ideas for strengthening
control. Internal auditors should consider the breadth of their focus on the internal control system, and
may wish to compare their evaluation materials to the evaluation tools.
Legislators and Regulators
Government officials who write or enforce laws recognize that there can be misconceptions and
different expectations about virtually any issue. Expectations for internal control vary widely in two
respects. First, they differ regarding what control systems can accomplish.
As noted, some observers believe internal control systems will, or should, prevent economic loss, or
at least prevent companies from going out of business. Second, even when there is agreement about
what internal control systems can and can't do, and about the validity of the "reasonable assurance"
concept, there can be disparate views of what that concept means and how it will be applied.
Corporate executives have expressed concern regarding how regulators might construe public
reports asserting "reasonable assurance" in hindsight after an alleged control failure has occurred.
Before legislation or regulation dealing with management reporting on internal control is acted upon,
there should be agreement on a common internal control framework, including limitations of internal
control.
This framework should be helpful in reaching such agreement.
Professional Organizations
Rule-making and other professional organizations providing guidance on financial management,
auditing and related topics should consider their standards and guidance in light of this framework. To
the extent diversity in concept and terminology is eliminated, all parties will benefit.
Educators
This framework should be the subject of academic research and analysis, to see where future
enhancements can be made. With the presumption that this report becomes accepted as a common
ground for understanding, its concepts and terms should find their way into university curricula.
We believe this report offers a number of benefits. With this foundation for mutual understanding, all
parties will be able to speak a common language and communicate more effectively. Business
executives will be positioned to assess control systems against a standard, and strengthen the
systems and move their enterprises toward established goals. Future research can be leveraged off
an established base. Legislators and regulators will be able to gain an increased understanding of
internal control, its benefits and limitations. With all parties utilizing a common internal control
framework, these benefits will be realized.
Internal Control System of Organization and Performing
Services
The agency theory explains the existence of mechanism in resolving problems that exist in principal-
agent relationships. Internal controls are predominantly operational tools institutions make use of in
addressing the principal-agency problem (Jensen and Payne, 2003). The tools and organs used in
addressing agency issues include audit committees, external auditing, financial reporting, and
budgeting. But studies have shown that agency costs can be reduced by effective internal controls
(see; Abdel-khalik 1993; Barefield et al. 1993).Agency theory suggests that the firm can be viewed as
a nexus of contracts between resource holders. An agency relationship arises whenever one or more
individuals, called principals, hire one or more other individuals, called agents, to perform some
service and then delegate decision making authority to the agents (Shankman, 1999). The primary
agency relationships in business are those between stockholders and managers and secondly
between debt holders and stockholders. These relationships are not necessarily harmonious. Indeed,
agency theory is concerned with the so called agency conflicts, or conflicts of interests between
agents and principals. This has implications for, among other things, corporate governance and
business ethics (Shankman, 1999).The relationship between internal controls and financial
performance has been extensively discussed in the literature. Notable theories regarding this
relationship are the agency theory and the contingency theory. The agency theory explains the
existence of mechanism in resolving problems that exist in principal-agent relationships. This theory
contends that internal audit helps in maintaining cost-efficient contract between owners and
management just like other intervention mechanisms such as financial reporting and external
auditing. As suggested by Adams (1994), the agency theory provides richer and more meaningful
research in the area of internal audit. The responsibility for ensuring that internal control is established
in the organization lies within management. The internal audit is supposed to be the custodian of
internal control by providing assurance to the management that the organization has put in place
adequate and effective internal control system, and must not hesitate to draw management's attention
to lapses observed in the control. A good and viable internal control system increases operational
efficiency, thereby making it more difficult for the preparation of fraud (Mayo, 1993).Internal control is
a management tool used to provide reasonable assurance that the organization's objectives are being
achieved. The responsibility for the adequacy and effectiveness of internal controls rests with
management to ensure that there are adequate and effective internal controls in the organizations
they manage. Accounting officers and/ or management are expected to establish and maintain a
control environment as the foundation for all other components of internal control. They must ensure
that proper internal controls are introduced, reviewed, and updated to keep them effective (Joel,
2013)Contingency theory focuses on the behavioral aspect of an organization in explaining how
contingent factors such as culture, technology, and external environment have an influence in
organizations designing and functioning. It is assumed by the contingency theory that no single type
of organization's structure is equally applicable to all organizations. Rather, the effectiveness of an
organization depends heavily on the type of technology, the size of the organization, environmental
volatility, the features of the organization's structure and the system of information that it is using. The
contingency theory in effect explains the relationship that exists in the effectiveness of internal control
structure given varying contexts as well as organizational performance such as reliability. Simply put,
the type and usage of control systems is contingent upon the context of the organizational setting in
which these controls work (Fisher, 1998). Internal control variables including control environment, risk
assessment, control activities, information and communication and monitoring have remained
operational tools through which organizations achieve varying organizational goals predominantly
income generations and or survival (COSO2013). Cohen et al. (2000) emphasized on the relevance
of control environment following findings from a survey which suggests that management's leadership
and commitment towards integrity and ethical behaviour and their implications on employees behavior
remains the most important element for effective control. In situations where the tone set by
management is weak, fraudulent financial reporting tends to be frequent since the control
environment begins with directors and management who implement organizational policies, behaviors
and effective governance (Rittenberg et al. 2005) Empirical literature reviewDefinition of Internal
controls COSO, 2013 defined internal controls as process affected by entity's board of directors,
management and other personnel, designed to provide reasonable assurance regarding the
achievement of objectives relating to operations, reporting and compliance.Turnbull Report from 1999
was created by London's stock exchange. It was later revised and updated by Turnbull Review Group
established by Financial Reporting Council (FRC). They defined internal control as an internal control
system that encompasses the policies, processes, tasks, behaviors and other aspects of a company
that when taken together facilitate its effective and efficient operation by enabling it to respond
appropriately to significant business, operational, financial, compliance and other risks to achieving
the company's objectives. This includes the safeguarding of assets from inappropriate use of from
loss and fraud, and ensuring that liabilities are identified and managed. It also helps ensure the
quality of internal and external reporting. This requires the maintenance of proper records and
processes that generate a flow of timely, relevant and reliable information within and outside the
organization. Lastly it helps ensure compliance with applicable laws and regulations, and also with
internal policies with respect to the conduct of business. (Chambers and Rand, 2010). McGraw
(2008) defined internal control as a process designed to provide reasonable assurance that the
organization produces reliable financial reports, complies with applicable laws and regulations, and
conducts operations in an effective manner.In 2008, Hightower defined internal controls as program
of activities established to catch and monitor a potential exposure that could result in a significant
error, omission, misstatement, or a fraud.Risks in local authoritiesAccording to Redja (2008), there is
no single definition of risk however it has traditionally been viewed as a condition or uncertainty
leading to loss, misfortune or an adverse deviation from a desired outcome that is expected or hoped
for (Redja, 2008). According to Nexis (2012) risk is inherent in the operating environment within any
entity functions, since the outcome of events cannot always be predicted with accuracy, and a certain
degree of uncertainty in the environment with regards to the future in respect of economy, markets,
products and consumer trends is inevitable. Furthermore, entities are exposed to risks arising from
unexpected events such as fraud, errors, natural disasters and accidents. A good set of internal
control procedures is vital to avoid compliance risks. Compliance risks involve the organisation
breaking local or federal laws or policies for example when they are issuing tenders, procurement
procedures, and obtaining quotations from suppliers. Compliance risks can cause misleading
information within the organisation's financial statements, and problems between the organisation and
the Internal Revenue Service. To avoid this high risk, an organisation need to take preventative
measures. Avoid compliance issues by having knowledgeable, honest employees, and keeping up
with all laws and regulations. Fraud is a common risk in an internal control system. Preventing fraud
involves developing a good system that separates each employee's duties. Employees who accept
payments should be separated from employees making deposits and also an employee who inputs
checking transactions should not also reconcile the checking accounts. Also according to the city of
Tampa a system of appropriate documentation is vital to avoid fraud, all transactions should be
traceable to their origination point. Fraud risk can also be detected through unusual
occurrences.Employees who appear to live beyond their means is often a symptom of fraud, as are
missing or altered documents. Transactions that can't be traced are also a symptom that could be
fraud-related. Previous studies (Ziegenfuss 2001) have documented that fraud is a concern in state
and local governments, and that management and control systems were not well equipped to deal
with it. However, a KPMG survey found that lax controls were the most significant reason for fraud in
government (Wade, 2007).A lack of employee monitoring is a risk often associated with internal
controls. Even with an effective internal control system, risks can occur if employees aren't
periodically monitored. Regular reviews and evaluations should be part of an internal control system.
This includes spot-checking transactions to determine if they comply with regulations and company
policies. Managers must also keep a close eye on financial reporting, always looking for
discrepancies or irregular activity. Managers can also perform surprise cash and asset counts,
holding employees responsible for any discrepancies.Effectiveness of internal controls in local
authorities Effectiveness was proposed by Etzioni, et al, (1985);Mardiasmo (2002) that define
effectiveness as the level of success of the organization in an effort to achieve the objectives and
goals. Effectiveness focuses on outcomes (results), programs, or activities that are considered
effective if the resulting output can meet the desired objectives. Based on the effectiveness of some
sense it can be concluded that the effectiveness of an organization is successful in achieving the
desired objectives or outcomes with a comparison between the output, Devas (1989);(Mahmudi,
2005). Effective internal control system refers to the effective control measures established by an
organization with the aim of safeguarding their assets, ensure the reliability of records both financial
and non-financial as well as compliance with relevant policies and procedure that will ensure the
achievement of organizational objective. The quality of an organization's internal control system has
significant impact on the accuracy of management guidance, likewise organisation's that disclose
ineffective internal controls system have larger tendency of experiencing management errors in their
operation than those organisations that report effective internal controls system (Feng, Li ; McVay,
2009). Therefore, it is the responsibility of management of an organization to ensure that effective
internal control system is put in place that will ensure the achievement of organizational established
objectives. This is because establishment and supervision of effective internal control systems are the
responsibility of management, not auditors (Changchit et al, 2001).As an organization the following
components that is the control environment, control activities, information and communication, risk
assessment and monitoring are taken into account as they determine how effective the internal
control system will be. The control environment sets the tone of an organization influencing the
control consciousness of its people. It is the foundation for all other components of internal control,
providing discipline and structure. Control environment factors include the integrity, ethical values and
competence of the entity's people; management's philosophy and operating style; the way
management assigns authority and responsibility, and organizes and develops its people; and the
attention and direction provided by the management.It has influence over organization goals
achievement (Aldridge ; Colbert, 1994). However, it is the foundation for the other components of
internal control and providing structure (Sudsomboon ; Ussahawanitchakit, 2009). Control
environment assist toward reducing the level fraudulent activities within organizational operation also
the quality of an entity's internal controls system depend on the function and quality of their control
environment (Amudo & Inanga, 2009). Therefore, providing a proper control environment for a local
government is very essential to the effectiveness of their operation.Control activities are the policies
and procedures that help ensure management directives are carried out. (Aikins, 2011; Rezaee, Elam
& Sharbatoghlie, 2001) They help ensure that necessary actions are taken to address risks to the
achievement of the entity's objectives. Control activities occur throughout the organization, at all
levels and in all functions. They include a range of activities as diverse as approvals, authorizations,
verifications, reconciliations, reviews of operating performance, security of assets and segregation of
duties. Proper documentation of policies and procedural guidelines in these aspects help to determine
not only how the control activities are to be executed but also provide adequate information for
auditors examination of the overall adequacy of control design over financial management practices
(Aikins, 2011). These control activities ensure that all necessary actions should be taken with the aim
to address risks so that organizational objectives are achieves.Risk assessment is the identification
and analysis of relevant risks associated with the achievement of the management objectives
(Theofanis, et al 2011), similary (Sudsomboon ; Ussahawanitchakit, 2009) view risk assessment as
the process of identifying and analyzing management relevant risks to the preparation of financial
statements that would be presented fairly in conformity with general accepted accounting principle. In
this situation, management must determine the level of risk carefully to be accepted, and should try to
maintain such risk within determined levels. Therefore, local governments are required to frequently
assess the level of risk their experiencing in order to take necessary actions or to put necessary
controls in place.Information and communication refers to the process of identifying, capturing, and
communicating of relevant information in an appropriate manner and within timeframe in order to
accomplish the financial reporting objectives (Aldridre ; Colbert, 1994). However, effective
communications should occur in a wider sense with information within the various sections of the
organization (Theofanis et al, 2011). Most of the recent literature on internal control system
frameworks gave concerns on information and communication as one of the internal control system
components, because of their importance in influencing the working relationship within the
organization at all levels (Amudo ; Inanga, 2009). Hence, such information must be communicated
throughout the entire organization in order to permit personnel to carry out their responsibilities with
regard to objective achievement.Internal control systems need to be monitored a process that
assesses the quality of the system's performance over time. This is accomplished through ongoing
monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in
the course of operations. It includes regular management and supervisory activities, and other actions
personnel take in performing their duties. Monitoring is usually accepted that internal control systems
need to be adequate monitored in order to assess the quality and the effectiveness of the system's
performance over time. Monitoring provides assurance that the findings of audits and other reviews
are promptly determined (Theofanis et al, 2011), also monitoring of operations ensures effective
functioning of internal controls system (Amudo ; Inanga, 2009). Hence, monitoring determines
whether or not policies and procedures designed and implemented by management are being carried
out effectively by employees.
References
1. Jensen, K. L. (2003). A basic study of agency cost source and municipal use of internal versus
external control. Accounting and Business Research, vol. 35 no. 1, pp. 53-67.
2. Adams, M. B. (1994). "Agency Theory and the Internal Audit". Managerial Auditing Journal, Vol.
9 No. 8, pp. 8-12.
3. Ziegenfuss, D. 2001. The role of control environment in reducing local government fraud,
Journal of Public Budgeting, Accounting ; Financial Management, Vol. 13, No. 3Wade, B. 2007.
Executives say poor controls contribute most to fraud, KPMG survey finds. PR Newswire,
December 12, 1-2.
4. McGraw, R. (2008). Financial Accounting, 5th Edition, Arcata Graphics/ KingsportUnited States
of America.
5. Chambers, A. and Rand, G. (2010). Operational Auditing Handbook: Auditing Business and IT
Processes, 2nd Edit. 2nd ed. John Wiley ; Sons, p.129.
6. Hightower, Rose. Internal Controls Policies and Procedures, edited by Rose Hightower. [ebook]
John Wiley ; Sons, Incorporated, 2008, pp.7, 27
Don't know where to start with your assignment?
HIRE VERIFIED EXPERT
Let our experts help you
