Question

What are “internal controls”? Who establishes the controls? What role does management play in the
creation and maintenance of a control environment?
What do we mean by:
 “Segregation of duties”?
 “Tone at the top”?
 “Compensating controls”?
 “IT general controls”?
 “IT application controls”?
Provide examples of at least five internal controls and describe how they function within an organization;
that is, how they help to ensure the integrity of the data produced by the company’s accounting
systems/processes.

Answer 1

Internal Control :- Internal Control is the process designed, implemented and maintained by the management and personnel to provide reasonable assurance about the achievement of an entity's objective with regard to reliability of Financial reporting, effectiveness and efficiency of operation, safeguarding of assets as well as compliance with applicable laws and regulations.

Who establishes internal control?

Generally, the top management of the entity or person charged with governance or core management or key managerial person assigned to establish internal control in the entity in accordance with nature, environment, size and other factors of the entity.

What role does management play in the
creation and maintenance of a control environment?

The management plays pivot role in formation of internal control within an entity.

The management consider following key points in creating and maintaining internal control:-

1. Whether the prescribed management policies are being properly interpreted by the employees and are truly implemented.

2. Whether the prescribed procedure need a revision because of changed circumstances or whether they have become obsolete or cumbersome.

3. Whether effective measures are taken promptly when the system appears to break down.

What do you mean by

1. Segregation of duties

Segregation of duties refers as allocation of duties to different personnel where maker and check shall not be same person. In other words, departing duties of individual into many hands such that the chances of making mistakes either by due to fraud or error are low. E.g. person responsible for deposit cash in any customer account shall not be eligible to check customer's ledger.

2. Compensating controls

Controls are basically designed to reduce the probability of threats, which exploits the vulnerability of an asset and cause a loss to that asset. Sometimes, while designing and implementing controls, entity because of different constraints like financial, administrative or operational may not be able to implement appropriate controls. There should be adequate compensating control which may not be as efficient as appropriate control but reduce probability of loss to assets.

3.IT General Controls :- IT general control are basic policies and procedures that ensure entity information systems are properly safeguarded, application program and data are secure and computerized operation be recovered in case if any interruption. The objective of It general control is to ensure proper development and implementation of application, integrity of program and data files as well as computer operations.

4. IT application control :-IT application control includes programmatic routines with the application program code. The objective of the application control is to ensure that data remains complete, accurate and valid during its input, update and storage. The specific controls could include form design, source document contrl, input processing or output control, media identification, data backup and recovery. Any function that works to ensure the processing accuracy of the application can be considered as application control.

Examples of internal control

1. Logging on facilities:- It is necessary to safeguarding Accounting record either present in physical form or electronic form. Hence, entity should ensure whether proper manual logging is maintained while anyone personnel access record in physical form. Additionally, while electronic record is maintained, combination of biometric and electronic security systems should be installed and audit trail of user should be maintained for accessing electronic accounting records for further enquiries, if needed.

2. Source Document Control:- Entity must implement Control procedure over source documents to account for each document issued. Use of pre numbered enable accurate accounting of document usage and provide audit trail for tracing transaction. Source docut should be kept under dual custody and lock system and access to limited authorized personnel only.

3. There should be sequence check between transaction file and master files. synchronization of data uploaded and correct sequence of processing between master file and transaction file is critical to maintain integrity of updating, insertion or deletion of accounting records in master file.

4. Internal control should contain features of using internal tables to perform various functions like gross pay calculations, billing calculations based on price table, bank interest calculation etc. To ensure integrity of such control. Periodic monitoring of such calculating control should be mandatory.

5. There should be system of input output verification if entire entity depends on electronic Accounting records such that it entails by comparing information provided by computer system to input documents are correct and error free.