CHAPTER TWO - INTERNAL CONTROLS

What Are Internal Controls?

Internal controls are the mechanisms, rules, and procedures implemented by

a company to ensure the integrity of financial and accounting information,
promote accountability, and prevent fraud. Besides complying with laws and
regulations and preventing employees from stealing assets or committing
fraud, internal controls can help improve operational efficiency by improving
the accuracy and timeliness of financial reporting.

1st - it safeguards Assets

2nd -it enables operational efficiency

Example: Selling of an item on cash

Sale a product – prepare order – prepare invoice – delivery order – handover

the item to customer – prepare receipt - collect cash – deposit cash to bank –
record of GL – Strong Internal Control

Example: Sale on account

Create A/R – record on GL – collect cash later – record GL/SL

Internal control – Procedures that you implement in the company

Internal audit – The checking of financial transactions or checking of whether

the Company’s Internal control is functional or not

Purpose of Internal Control

Companies place a high priority on internal control systems to monitor and

control operations. The larger the operations, the more senior management
must delegate responsibilities and rely on formal procedures rather than
personal contact in controlling and knowing all operations of the business.

A well-developed control system can prevent avoidable losses, help managers

plan operations, and monitor company and human performance.

An internal control system is all policies and procedures used to:

1
  Protect assets
 Ensure reliable accounting
 Promote efficient operations
 Encourage adherence to company policies

Important points to note

 The CAR principle: CAR stands for Custody, Authorization, and

Recording of assets. These three duties must always be performed by
separate individuals to strengthen the control environment and reduce
the potential for errors and reduce opportunities for fraud takes place.
A control weakness can be identified when two or more of these tasks
are performed by the same or related individuals.
 WIR Principle - Solving problems related to controls - WIR : To ensure
you provide a full analysis of a control issue it is helpful to identify the
weakness (could be due to a CAR issue), then explain the implication of
how the weak control will cause issues/errors, and provide a
recommendation to re-solve the identified weakness.
Example
Yr Co sells furniture. A customer orders by phone - then comes to
collect against payment (Cash sales) - Receives the item and pays
$1500.00 - then the sales person gave him a receipt. The cashier (sales
person) deposits the money the same day. Thereafter, the cashier
provides the deposit slip to the accountant.
Weakness – No sales invoice
- Receipts prepared & deposit by the same person
- Authorization by the supervisor before deposit

A= Internal Audits

 Internal audits evaluate a company’s internal controls, including its

corporate governance and accounting processes. They ensure
compliance with laws and regulations and accurate and timely financial
reporting and data collection, as well as helping to maintain operational
efficiency by identifying problems and correcting lapses before they are
discovered in an external audit.

2
B= Preventative vs. Detective Controls

Internal controls are typically comprised of control activities such as

authorization, documentation, reconciliation, security, and the separation of
duties. And they are broadly divided into preventative and detective activities.

Preventive control activities aim to deter errors or fraud from happening in

the first place and include thorough documentation and authorization
practices. And the separation of duties ensures that no single individual is in a
position to authorize, record, and be in the custody of a financial transaction
and the resulting asset. Authorization of invoices and verification of expenses
are internal controls. In addition, preventative internal controls include
limiting physical access to equipment, inventory, cash, and other assets

Detective controls are backup procedures that are designed to catch items or
events that have been missed by the first line of defense. Here, the most
important activity is reconciliation, used to compare data sets, and corrective
action is taken upon material differences. Other detective controls include
external audits from accounting firms and internal audits of assets such as
inventory.

C = How Internal Controls Work in Companies/Corporations

 Internal controls have become a key business function for every

company to protect investors from fraudulent accounting activities and
improve the accuracy and reliability of corporate disclosures.
 This has had a profound effect on corporate governance, by making
managers responsible for financial reporting & creating an audit trial.
 As part of an audit, external auditors will test a company’s accounting
processes and internal controls and provide an opinion as to their
effectiveness.
 While internal controls can be expensive, properly implemented
internal controls can help streamline operations and increase
operational efficiency, in addition to preventing fraud.

D= Limitations/Disadvantages of Internal Controls

3
  The effectiveness of internal controls is limited by human judgment. A
business will often give high-level personnel the ability to override
internal controls for operational efficiency reasons, and internal
controls can be circumvented through collusion.
 All internal control policies and procedures have limitations. Probably
the most serious source of limitations is the human element that we
categorize as either human error or human fraud.
 Human error is a factor whenever internal control policies and
procedures are carried out by people. It can occur from negligence,
fatigue, misjudgement, lack of training, or confusion.
 Human fraud involves intent by people to defeat internal controls for
personal gain
 This human element highlights the importance of establishing an
internal control environment that conveys management’s attitude
and commitment to internal control
 Another important limitation of internal control is the cost-benefit
trade-off. This means the cost of internal controls must not exceed their
benefits. Analysis of costs and benefits must consider all factors,
including the impact on morale.
 The bottom line is that no internal control system is perfect and that
managers must establish internal control policies and procedures with
net benefit to the company.

E= The Fraud Triangle (Three Drivers of Fraud)

A study by the Auditor firm KPMG (2016), “Global profiles of the Fraudster:
Technology Enables and Weak Controls Fuel the Fraud” revealed the
following regarding the components of the fraud triangle:

Opportunity

 Frauds were found to frequently occur because of a failure to have basic

control in place, such as checking supporting documentation before
authorizing a transaction.

4
  61% of the frauds committed were facilitated by weak internal
control, with 47% of frauds involving misappropriation of assets.
 22% of frauds were related to fraudulent financial reporting
 Capability: the more senior the executive position held by the fraudster,
the greater ability he or she has to get past the controls. Management’s
ability to override controls is a key area of risk.
 The 2016 study also emphasized technology as a key enabler for 24%
of fraudsters, who took the opportunity to post a journal entry to
camouflage a misappropriation
 Deterrent: A focus on fraud prevention is key; continuously evaluating
the controls in place and strengthening identified weaknesses (including
adequate supervision of employees and technologies such as data
analytics to identify unusual transactions) will help prevent several of
occurrence.

Motivation

 The study shows, out of 750 fraudsters surveyed, 66% claimed to be

motivated by greed, financial gain, &financial difficulty. Approximately
12% were motivated to meet business targets to receive a bonus
 Deterrent: More and more companies are increasing the linkage
between management compensation and their company’s financial
performance and decreasing the portion of their fixed salary.

Rationale

 Fraudsters were found to have a sense of superiority, indicating

fraudsters likely felt they were above the rules regulating the workplace.
 Deterrent: The Auditor firm KPMG International indicated
“technological advances provide more-powerful tools in strengthening
companies’ defenses against fraud.”

Opportunity + Motivation + rationale = 3 drivers of fraud.

F= Internal Control Applications

I - Internal Controls for Cash

5
Cash is divided into two separate functions.

The first is the receipts side of equation. Here all sales and payments on
accounts are received and process. A set of controls is designed to manage this
function.

The company should never use cash receipts from customers for petty cash
or check cashing

The second function is disbursements or cash payments out of the bank

account. Again, here a separate set of controls is designed to ensure proper
disbursement of cash.

For the small business, internal controls begin with the owner. Good
management ethics and integrity lead the staff towards proper handling of
cash in the company.

The following are the different tools every business uses to control cash:

Separation of Duties

Separation of duties is the number one tool endorsed by accounting bodies.

The key to this function is that the staff members receiving or managing the
collection of money does not get involved in the disbursement of money.

Two Person Rule

Another effective internal control is the two person rule. Ideally two people
process the cash receipts together, generate the ledger together and fill out the
forms together. Once the total deposit is calculated, the deposit can be made
by one person. However, the deposit slip is sent back to the other person for
confirmation of the correct deposit amount. If a truly small business, all of
this can be managed by the owner.

Limited Account Signers

Every really business should have one signer for the account and a backup to
sign checks. As the business grows, it will become necessary to have another
signer on the account to fill the void of the owner’s absence.

6
Account Review

In addition to the above forms of internal controls, the owner should access
his cash account each day online and review all the checks processed including
those signed while absent. Modern day online banking allows for the owner to
review the checks as they are processed from day to day. This is absolutely the
best tool available to the owner to discover misappropriation of funds.

Receipt of Cash

Internal control procedures for the receipt of cash help your small business
prevent loss due to employee fraud and accounting errors. These controls are
intended to limit access to cash to specified employees and verify that all
receipts, refunds or transfers are documented correctly and in a timely
manner.

Reconcile bank accounts in a timely manner

The bank reconciliation should be completed in a timely manner by someone

who is independent of the cash disbursement process.

II - Internal Controls for Inventory

These days, keeping an accurate inventory record is a concern for businesses.
It is just as important to provide customers with what they want as it is to
manage inventory levels to avoid overstock and storage costs. Internal
inventory controls are intended to help a company verify that it has sufficient
resources to:

 produce and sell goods to meet demand,

 avoid maintaining excess products, and
 eliminate costs associated with purchasing, producing, and holding
excess.

Inventory financial reporting controls aim to ensure that inventory recorded

in the company’s books in the appropriate quantities and at the correct
values. Some objectives of establishing internal inventory controls are to:

7
  prevent theft and damage loss,
 manage quantities on hand in conjunction with customer demands and
required purchasing/production lead times, and
 make certain that inventory costs are accurately captured and reported.

Inventory Internal Control Procedures

Internal controls are reviews, procedures or guidelines to protect and

safeguard a company’s business and financial information. Business owners
and managers are responsible for developing and implementing internal
controls to keep costs down and minimize or avoid problems. Inventory
represents an expensive and sizable physical asset for most companies.
Internal controls are necessary for inventory, because companies can rarely
survive if they consistently lose inventory to theft, spoilage and obsolescence.

a) Protecting the Records

 Physical protection of inventory starts, if possible, with storing items at

a central, secure location. Implementing perimeter access controls is
critical to preventing theft. A system of physical access controls can help
prevent unauthorized access to both inventory and related
administrative records.

b) Inventory System
 Inventory systems are accounting methods for managing the financial
transactions relating to a company’s physical inventory items. Two
common systems are the periodic and perpetual systems.
 Effective inventory management may require a mechanism that tracks
quantity movements, locations, and (if applicable) stages of production.
An inventory management system consists of a series of procedures,
often aided by a software application that tracks inventory progression
and movement.
 Today, most businesses rely on electronic inventory records of some
sort, such as bar codes and radio frequency identification (RFID).

c) Physical Counts

8
  Regardless of the chosen inventory management system, companies
should adjust their records to be in tune with physical counts. Some
businesses choose to perform a periodic, one-time count. Physical
counts reconcile the company’s accounting ledger with the actual
amount of inventory on hand. Companies typically use cycle counts or
an annual inventory count for this process.

Importance of Computerized Inventory Systems

Inventory management is a specific function that focuses on controlling the
movement of products through a company’s various business systems.
Business owners and managers typically setup systems or processes to aid
them with this function. Using a computerized inventory system is quite
common in the business industry.

Function

Computerized inventory systems help companies order, count, sell and

maintain different products in an organization. Companies often implement
bar code systems--computers and scanners that electronically transfer
information through the company. This allows for real-time purchase
decisions and cost management relating to inventory.

Features

Inventory security is a key feature of computerized inventory systems.

Business owners and managers can install tracking devices to ensure
inventory is not stolen or is traceable if taken from the company. These
systems are found at both the retail and wholesale level of the inventory
chain.

Benefits

Companies often use computerized inventory systems to prevent running out

of inventory stock. These systems can provide a report on needed inventory
or place preapproved electronic orders to suppliers for more inventories,
creating a smooth flow of inventory in the company.

III - Internal Controls for Payroll

9
What are payroll internal controls?

Payroll involves a lot of sensitive and personal employee information. It is

important for employers to keep that information safe. You also need to
prevent payroll fraud. You need to limit who has access to payroll information
and who can make changes to your payroll. Payroll internal controls are the
procedures your business follows to protect its payroll information.

Payroll controls and procedures prevent employees from accessing

confidential information. Internal controls also prevent employees from
stealing money from your business through overpayments and false time
records.

In large businesses, payroll internal controls involve dividing payroll tasks

among departments and employees. Dividing tasks ensures many people have
their eyes on the payroll process, meaning someone has less ability to commit
fraud. With your small business, dividing payroll tasks is probably not
practical. But, there are still things you can do to create internal controls for
payroll processing.

How to implement payroll internal controls in business

Limit access to payroll records: Only the person who runs payroll for your
business should have access to payroll records and processes.

Inspect payroll records: You should regularly inspect your business’s payroll
records to make sure everything is accurate.

Create a separate bank account: Create a bank account dedicated to payroll.

Every time you process payroll or pay payroll taxes, the money should come
out of this dedicated account.

Have time cards approved twice: To make sure a time card is correct; you
and the employee should both approve the time card.

Get your records audited: Have someone periodically audit your payroll
records. The audit makes sure you are running your payroll correctly. The

10
audit also helps make sure you are paying the right amounts to your
employees and tax agencies.

Use security measures: You should lock up your payroll records so

unauthorized people cannot access them. Your electronic records should be
protected behind a strong password.

Familiarize yourself with trends: You should know approximately how much
you spend on payroll each pay period. If you have a pay period that greatly
fluctuates from your average payroll spend, you should investigate it. There
might be an error in the calculations, or someone might have manipulated the
payroll.

Exercise 1 – (Analysing Internal Control)

Panorama Company is a business that has grown rapidly. The Company’s

accountant, who was hired two years ago, left town suddenly after the
Company’s manager discovered that a great deal of money had disappeared
over the past 18 months. An audit disclosed that the accountant had written
and signed several cheques made payable to the accountant’s brother and
then recorded the cheques as salaries expense. The brother, who cashed the
cheques but had never worked for the company, left town with the
accountant. As a result, the Company incurred an uninsured loss of
$84,000.00.

Evaluate Panorama Company’s internal control system and identify

violations of the principles of internal control.

Exercise 2 (Internal control Objectives)

As a member of the city’s internal audit team, you have been instructed to
observe the procedures regarding the collection of coins from the municipally
owned parking meters. You accompany the civic employee on the collection
route. The employee uses a key to open the locked coin compartment of the
meter and empties its contents into a canvas bag that closes with drawstring.
When the bag is full, the employee closes it and places it in the vehicle, which

11
is parked along the route. At the end of the day, the civic employee delivers
the bags to two individuals in a municipal office who are jointly responsible
for counting the contents.

Identify three weaknesses in the above situation. For each weakness, identify
the implication of the weakness and make recommendation. (WIR)

12