Ais Chapter 4

Front 1

Internal Control

Back 1

a process effected by an entity's board of directors, management and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations.

Front 2

Internal control is a process

Back 2

Because internal control is a process, it is subject to process improvement; and single correct answers to control problems seldom exist. Accountants must use judgement and experience in designing and implementing internal controls; the controls must be periodically reviewed to ensure their continued effectiveness.

Front 3

Internal control necessarily involves people in the organization

Back 3

COSO and Lander definitions lay the responsibility for internal control squarely at the feet of management and the BOD. Internal controls require discussion during design, implementation, and evaluation. They impact human behavior and control systems designers and as far as possible must anticipate their behavioral impact.

Front 4

Internal controls are designed to provide reasonable assurance.

Back 4

Internal controls should not, and probably cannot, be designed to provide absolute assurance of anything. Internal controls are subject to a cost benefit constraint. Their cost must be outweighed by the benefit.

Front 5

Accounting controls are subject to a cost benefit analysis. What section covers this idea?

Back 5

Internal controls provide reasonable assurance.

Front 6

Reasonable is defined as

Back 6

governed by or being in accordance with reason or sound thinking; being within the bouds of common sense; not excessive or extreme.

Front 7

Internal controls provide reasonable assurance in a few common areas, such as operations, financial reporting, and humab behavior.

Back 7

There are 4 purposes of internal controls: safeguarding assets, ensuring financial statement reliability, promoting operational efficiency, and encouraging compliance with management's directives. In short, they are there to help insure that no one steals from the company and everyone follows the rules.

Front 8

4 purposes of internal controls

Back 8

safeguarding assets, ensuring financial statement reliability, promoting operational efficiency, encouraging compliance with managers directives.

Front 9

Foreign corrupt practices act

Back 9

Passed in 1977 by US congress
In some countries bribery was an acceptable way of doing business. the FCPA was enacted to stop those practices by US businesses and to restore some confidence in US business practices aroud the world. REQUIRES companies to maintain an adequate system of internal controls. MEntions the concept of reasonable assurance. Companies failing to comply can be subject to fines and imprisonment.

Front 10

Sarbanes Oxley

Back 10

Enacted in 2002 as a response to corporate scandals. SOX is the most sweeping accounting related legislation business professionals have seen since the FCPA. Under SOX management and external auditors must assess the company;s internal controls an on annual basis. Management has certain required disclosures when reporting to the SEC. These include acknowledgment that management is personally and organizationally responsible for the deisng and implementation of internal controls. Especiall as they replte to reasonable assurance of reliable financial statements. Management must disvlose any internal control chnages if they have a noticeable effect on internal controls over financial reporting. Management must certify that they have informed the auditors and the BOD audit committee of any significant problems or weakness in internal control. Management must also PERSONALLY sign the required certificiations and cannot be delegated.

Front 11

What is the role of accountants in the internal controls process?

Back 11

Accountants can be involved in the design, implementation, or evaluation of internal controls as an external auditor, internal auditor, controller, or consultant.

Front 12

Risk is part of everyday life.

Back 12

The question is are businesses taking unnecesary risks?

Front 13

Brown's Taxonomy of Risk catgories

Back 13

1. Financial risks are related to monetary activities.
2. Operational risks concern the people, assets, and techbologies used to create value for the organization's customers.
3. Strategic risks relate to the entity's decision making processes at the senior management and BOD level.
4. Hazard risk deals with directors' and officers' liability.

Front 14

Financial risk according to BROWN

Back 14

Financial risks are related to monetary activities.
Includes 3 types:
market risk which refers to changes in a company's stock prices, investment values, and interest rates.
2. Credit risk is associated with customer's unwillingness or inability to pay amounts owed to the organization.
3. Liquidity risk - involves the possibility that a company will not have sufficient cash and near cash assets to meet its short term obligations.

Front 15

Market risk

Back 15

Refers to changes in a company's stock prices, investment values, and interest rates. For exmaple, if a company fails to diversify it's investments, it runs the risk of a significant decrease in value that will impact financial statements.

Front 16

credit risk

Back 16

associated with customer's unwillingness or inability to pay amounts owed to the organization. For example if you go to a retail store they will likely approve you for a small amount whithout a solid investigation which will probably boost sales however the company has a higher risk of nonrepayment.

Front 17

liquidity risk

Back 17

involves the possibility that a company will not have sufficient cash and near cash assets avail to meet it's short term obligations. If a company has no budget or spending plan for cash it is exposed to this risk.

Front 18

Operational risks and subcategories BROWN

Back 18

Operational risks concern the people, assets, and technologies used to create value for the organization's customers.
1. System risk relates directly to IT.
2. Human error - recognizes the possibility that people in the organization may make mistakes.

Front 19

Systems risk

Back 19

relats tdirectly to information technology. AS ogranizations become increasingly dependent on computers there's the risk that IT resources will fail at a critical moment.

Front 20

Human error

Back 20

Recognizes the possibility that people in the organization may make mistakes. These mistakes may include asset misappropriation and/or theft, divulgence of trade secerets, legal action from breaking the law and or other consequences.

Front 21

Strategic risk under BROWN

Back 21

Strategic risk related to the entity's decision making process at the senior management and BOD level.
1. legal and regulatory risk is concerned with the change that those parties may break laws that result in finanicla, legal, or operational sanctions. For example, if the CEO or CFO were to knowingly falsify the reports required by SOX they may be subject to government penalties.
2. Business strategy risk comprises poor decision making related to a company's basis for competing in its market. You may remember web grocer is now out of business because they did not adequately consider the risk associated with trying to develop a new market for a previously nonexistent service.

Front 22

Legal and regulatory risk

Back 22

legal and regulatory risk is concerned with the change that those parties may break laws that result in finanicla, legal, or operational sanctions. For example, if the CEO or CFO were to knowingly falsify the reports required by SOX they may be subject to government penalties

Front 23

Business strategy risk

Back 23

Business strategy risk comprises poor decision making related to a company's basis for competing in its market. You may remember web grocer is now out of business because they did not adequately consider the risk associated with trying to develop a new market for a previously nonexistent service.

Front 24

Hazard risk BROWN

Back 24

Has a single category. directors' and officers' liability. Organizations in which directors and officers are accused of mismanagement by shareholders, government agencies, employees, or other stakeholders bear this risk in a very direct way.

Front 25

COSO

Back 25

Committee of Sponsoring organizations of the Treadway Commission

Front 26

COSO is composed of?

Back 26

Institute of Management Accountants, American Institute of Certified Public Accountants, American Accounting Association, Institute of Internal Auditors, and the Financial Executive Institute.

Front 27

5 components of COSO for effective internal control

Back 27

1. Control environment
2. Risk Assessment,
3. Control Activities
4. Information and communication
5. Monitoring

Front 28

Control environment according to COSO

Back 28

Control environment refers to the tone at the top of the organization. IT reminds accountants and managers that without the clear demonstrated commitment of upper management and opinion leaders in the organization, internal control will not be taken seriously.

Front 29

Risk Assessment under COSO

Back 29

Involves using a taxonomy, business experience, research, and dialogue to identify the risks associated with operations. By identifying risks, we can design appropriate, cost effective internal controls to provide reasonable assurance of safeguarding assets, ensuring financial statement reliability, promoting operational efficiency, and encouraging compliance with management's directives.

Front 30

Control activities under COSO

Back 30

refer to the actual controls implemented on the basis of risk assessment. Preventive controls help prevent errors and irregulatiries from happening. Detective controls such as airport metal detectors help stakeholders determine when an error has occurred. Finally, corrective controls which cincludes punishment for subverting internal controls focus on fixing a problem, error, or irregularity after it hasoccurred.

Front 31

IT controls according to COSO

Back 31

general controls apply to an entire IS system examples would be backing up files regularly and installing virus detectiona nd removal software.
Application controls are associated with specific IT applications such as quickbooks and peachtree do not allow users to make journal entries where debits and credits are not equal.

Front 32

Information and communication under COSO

Back 32

For an internal contol system to be effective, its purpose, methods, and results must be communicated throughout the organization. Employees at all levels should understand risk and how to minimize them.

Front 33

Monitoring COSO

Back 33

Managers must determine the quality of internal contros. Monitoring systems can eb automated but many involve human interacton. The results of monitoring should be used to guide employee behavior.

Front 34

Enterprise Risk Management : Integrated Framework

Back 34

Enterprise Risk Management is a process, effected by an entity's BOD, management and others, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regaring the achievenment of company objectives.

Front 35

ERM framework has 8 elements of control

Back 35

internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, monitoring

Front 36

Internal environment ERM

Back 36

Encompasses the tone of an organization and sets the basis for how risk is viewed and adddressed by an entity's people including risk appetite, integrity and ethical values, and the environment in which they operate.

Front 37

Objective setting ERM

Back 37

Objectives must be set before management can identify potential events affecting their achievement. ERM ensures that management has in place a process to set objectives and that the chosen objectives suport and align with the entity's mission and are consistent with risk appetite.

Front 38

Event Identification ERM

Back 38

Internal and external events affecting achievement of an entity's objectives must be identified, distinguished between risks and opportunities. Opportunities are channelled back to management's strategy or objective setting process.

Front 39

Risk Assessment ERM

Back 39

Risks are analyzed, considering likelihod and impact, as a basis for determinging how they should be managed. Risks are assessed on an inherent and a residual basis.

Front 40

Risk Response ERM

Back 40

Management selects risk responses -- Avoiding, reducing, accepting or sharing risk-developing a set of actions to align risks with a company's tolerance and risk appetite.

Front 41

Control Activities ERM

Back 41

Policies and procedures are established and implemented to help ensure the risk responses are effectively carried out.

Front 42

Information and communication ERM

Back 42

RElevant information is identified, captured, and communicated in a form and timeframe that enable people to carry out their responsibilities.

Front 43

Monitoring ERM

Back 43

The entirety of enterprise risk management is monitored and modifications are made as necessary. Monitoring is accomplished through ongoing management activities, separate evals, or both.

Front 44

Internal control examples

Back 44

1. Adequate documentation
2. background checks
3. backup of computer files
4. backup of power suplies
5. bank reconciliation
6. batch control totals
7. data encryption
8. document matching
9. edit checks
10. firewalls
11. insurance and bonding
12. internal audits
13. limit checks
14. lockbox systems
15. physical security
16. preformatted data entry screens
17. prenumbered documents
18, restrictive endorsement of checks and daily deposits
19. segregation of duties
20. user training.

Front 45

How is adequate documentation an internal control?

Back 45

Understanding how things are supposed to happen in an AIS system is an imp first step in designing and assessing internal controls. flowcharts and / or data flow diagrams help you critique internal controls and determine if they are functioning effectively.

Front 46

How is a background check an internal control?

Back 46

Background checks, especially for those handling large amounts of money are essnetial, if a background check reveals financial difficulties or criminal convictions that may create pressure to breach an internal control..

Front 47

How is a backup of computer files an internal control?

Back 47

IF done regularly backing up files takes only a few minutes, whereas recreating files from scratch takes FOREVER. Daily backups ensure that no more than one day's work is lost in the event of a systems failure.

Front 48

How is a backup of power supplies an internal control?

Back 48

While a computer does not run indefinitely on a backup power supply, it will run long enough to give a user time to save the file they are working on ensuring those are not lost.

Front 49

How is a bank reconciliation an internal control?

Back 49

The basic purpose is to account for timint differences between the account holder's records and the bank's records of a cash account. Reconciling at least monthly can be helpful in spotting out of sequence checks, fraudulent signatures, and errors in the IS.

Front 50

how are batch control totals internal controls?

Back 50

When an IS system is processing a batch of documents you can calculate various control totals to promote data integrity.

Front 51

How is data encryption an internal control?

Back 51

Without data encryption hackers and other computer criminals can easily access, change, and/or steal data. Compromising data integrity and privacy throughout the organization.

Front 52

How is document matching an internal control?

Back 52

Document matching helps ensure that vendor invoices are only paid when merchandise has been properly ordered and invoiced.

Front 53

How are edit checks internal controls?

Back 53

the information system "echoes" the data you're entered back yo you before you complete the final processing. That process allows you to edit the data for any errors or other changes.

Front 54

How are firewalls internal controls?

Back 54

Firewalls can prevent unauthorized intrusions into an accounting information systema dn warn users when such intrusions are detected.

Front 55

How is insurance and bonding an internal control?

Back 55

While insurance and bonidng cannot prevent internal control breaches, they can help organizations correct any financial losses they experiene as a result. IF you've ever hired contractors to work in your home they were probably bonded. Companies often bond key employees as a safeguard against error and/or fraud.

Front 56

How is an internal auditing an internal control?

Back 56

OInternal audits can reveal indivations of fraud, waste, and inefficiency, thus strengthening an internal control system.

Front 57

How are limit checks an internal control?

Back 57

Most general ledger packages limit transaction dates to the current year; they don't allow users to pre or post date transactions.

Front 58

How is lockbox system an internal control?

Back 58

Lockbox systems help promote strong internal control over cash. Rather than remigtting payment directly to an organization, customer's send payment to a lockbox and the independent company monitors the lockbox and deposits cash into the bank.

Front 59

how is physical security an internal control?

Back 59

Simple actions such as locking doors and securing computers helps.

Front 60

How does using preformatted data entry screens an effective internal control?

Back 60

Using preformatted data entry scrends for things like customer orders and cash disbursement processing greatly improves data entry efficiency.

Front 61

How doe using prenumbered documents help internal controls?

Back 61

A seriously out of sequence document could be a warning sign of an internal control breach or fraud.

Front 62

how does restrictively endorsing checks and depositing cash daily help internal controls?

Back 62

Restrictive endorsements give the bank more specific instructions which limit the uses of the endorsed check; the most common is "for deposit only" often with an account number. If cash is deposited it is secure.

Front 63

How does segregation of duties promote internal control?

Back 63

IS MOST IMPORTANT. 3 different people should each take on one responsibility with respect to a specific asset; authorization for use, physical custody, and recordkeeping.

Front 64

How is user training an internal control?

Back 64

All internal control processes in the world are virtually useless if peopld don't know how to apply them. Employees should receive periodic training reminders about important internal controls their rationals and why they exist.