An internal audit control system is like a good diet and exercise plan. Like the measures you take to protect your health, it consists of all the policies and procedures you have in place to protect your business’s assets. Assets include the premises, furnishings, equipment and, of course the money. Intangibles like your business’s reputation and name recognition are also assets. Show
There are two main types of internal audit systems; preventive and detective. Preventive systems are designed to prevent problems. They’re the vitamins, healthy diet and exercise part. Detective systems are designed to identify problems that have already occurred like the diagnostic tests your doctor runs when you’re sick. The best internal audit systems include both.
Proactive preventive measures are critical to control losses. But your system also has to have a detective component in case a problem arises. The detective component is a set of guidelines for how to resolve problems. Detection should be ongoing because it provides proof that the preventive controls are working the way they’re supposed to.
A good internal control system does the following:
Some famous internal control problems examples are the Enron and Lehman Brothers scandals. Both big companies went bankrupt but not before damaging untold numbers of lives through their losses.
More recently, Kenya Airlines lost an estimated $21.7 million because of incorrect billing and not charging the correct amount for excess baggage.
While the best course of action is to build a strong internal control system in the first place, weaknesses in internal audit control systems are usually pretty easy to fix. But first you have to know what they are. If your internal control system is missing any of the following elements you have internal control deficiencies:
This list may seem a bit daunting but time spent developing a strong internal audit control system is time well spent. It can save you a lot of money in the long run by preventing losses as much as possible, and identifying them and resolving them quickly when they happen.
Tool are available online to help you develop your own system. Following a template or outline, along with a quick study of internal control problems examples will set you on the right track.
The U.S. Department of Housing and Urban Development’s website contains information and tools designed to help recipients of federal funding develop their internal audit control systems. But they’re generic enough to apply to any business.
Start with their Internal Control Questionnaire and Assessment. It will help you figure out where to begin. Then use their Implementing the Five Key Internal Controls publication to build your system. This document contains an excellent visual aid in the form of a flowchart entitled “Summary of Internal Control Standards.”
Auditors often fail to capture and communicate internal control weaknesses, even though such communications are required by the audit standards. But making our clients aware of control weaknesses can help them. How? It allows them to improve their accounting system. The result: prevention of future fraud and errors. In this article, I’ll show you how to capture and communicate internal control deficiencies. By doing so, you’ll add value to your audit services and you’ll help your client protect their business. At the end of the post, you’ll also see a video that summarizes this information.
A Common End-of-Audit ProblemYou are concluding another audit, and it’s time to consider whether you will issue a letter communicating internal control deficiencies. A month ago you noticed some control issues in accounts payable, but presently you’re not sure how to describe them. You hesitate to call the client to rehash the now-cold walkthrough. After all, the client thinks you’re done. But you know that boiler-plate language will not clearly communicate the weakness or tell the client how to fix the problem. Now you’re kicking yourself for not taking more time to document the control weakness (back when you initially saw it). Here’s a post to help you capture and document internal control issues as you audit. Capture and Communicate Internal Control DeficienciesToday, we’ll take a look at the following control weakness objectives:
As we begin, let’s define three types of weaknesses:
As we look at these definitions, we see that categorizing control weaknesses is subjective. Notice the following terms:
Now let’s take a look at discovering, capturing, and communicating control weaknesses. 1. Discover Control WeaknessesCapture control weaknesses as you perform the audit. You might identify control weaknesses in the following audit stages:
A. Planning StageYou will discover deficiencies as you perform walkthroughs which are carried out in the early stages of the engagement. Correctly performed walkthroughs allow you to see process shortcomings and where duties are overly concentrated (what auditors refer to as a lack of segregation of duties). Segregation of DutiesAre accounting duties appropriately segregated with regard to:
Notice the first letters of these words spell CRAB (I know it’s cheesy, but it helps me remember). Auditors often make statements such as, “Segregation of duties is not possible due to the limited number of employees.” I fear such statements are made only to protect the auditor (should fraud occur in the future). It is better that we be specific about the control weakness and what the potential impact might be. For example: The accounts payable clerk can add new vendors to the vendor file. Since checks are signed electronically as they are printed, there is a possibility that fictitious vendors could be added and funds stolen. Such amounts could be material. Such a statement tells the client what the problem is, where it is, and the potential damage. Fraud: A Cause of MisstatementsWhile I just described how a lack of segregation of duties can open the door to theft, the same idea applies to financial statement fraud (or cooking the books). When one person controls the reporting process, there is a higher risk of financial statement fraud. Appropriate segregation lessens the chance that someone will manipulate the numbers. Within each transaction cycle, accounting duties need to be performed by different people. Doing so lessens the possibility of theft. If one person performs multiple duties, ask yourself, “Is there any way this person could steal funds?” If yes, then the client should add a control in the form of a second-person review. If possible, the client should have a second person examine reports or other supporting documentation. How often should the review be performed? Daily, if possible. If not daily, as often as possible. Regardless, a company should not allow someone with the ability to steal to work alone without review. The fear of detection lessens fraud. If a transaction cycle lacks segregation of duties, then consider the potential impact from the control weakness. Three possible impacts exist:
My experience has been that if any potential theft area exists, the board wants to know about it. But this is a decision you will make as the auditor. Errors: Another Cause of MisstatementsWhile auditors should consider control weaknesses that allow fraud, we should also consider whether errors can lead to potential misstatements. So, ask questions such as:
B. Fieldwork StageWhile it is more likely you will discover process control weaknesses in the planning stage of an audit, the results of control deficiencies sometimes surface during fieldwork. How? Audit journal entries. What are audit entries but corrections? And corrections imply a weakness in the accounting system. When an auditor makes a material journal entry, it’s difficult to argue that a material weakness does not exist. We know the error is “reasonably possible” (it happened). We also know that prevention did not occur on a timely basis. C. Conclusion StageWhen concluding the audit, review all of the audit entries to see if any are indicators of control weaknesses. Also, review your internal control deficiency work papers (more on this in a moment). If you have not already done so, discuss the noted control weaknesses with management. Your firm may desire to have a policy that only managers or partners make these communications. Why? Management can see the auditor’s comments as a criticism of their own work. After all, they designed the accounting system (or at least they oversee it). So, these discussions can be a little challenging. Now let’s discuss how to capture control weaknesses. 2. Capture Internal Control WeaknessesSo, how do you capture the control deficiencies? First, and most importantly, document internal control deficiencies as you see them. Why should you document control weaknesses when you initially see them?
Second, create a standard form (if you don’t already have one) to capture control weaknesses. Internal Control Capture FormWhat should be in the internal control form? At a minimum include the following:
After capturing the weaknesses, it’s time to communicate them. 3. Communicate Control WeaknessesMaterial weaknesses and significant deficiencies must be communicated in writing to management and those charged with governance. Other deficiencies can be given verbally to management, but you must document those discussions in your work papers. Provide a draft of any written communications to management before issuing your final letter. That way if something is incorrect (your client will let you know), you can make it right–before it’s too late. Additionally, discuss the control weakness with relevant personnel when you initially discover it. You don’t want to surprise the client with adverse communications in the written internal control letter. Internal Control Video SummaryHere’s a video that summarizes the information above. SummaryThe main points in capturing and communicating internal control deficiencies are:
These communications can be somewhat challenging since you’re telling management they need to make improvements. So make sure all information is correct and let your senior personnel do the communicating. How Do You Capture and Report Control Deficiencies?Whew! We’ve covered a lot of ground today. How do you capture and report control deficiencies? I’m always looking for new ideas: Please share.
Get my free accounting and auditing digest with the latest content.
Thanks for joining me here at CPA Scribo. Charles Hall |