Internal Accounting Systems and Controls
The control environment and the accounting system
Internal control is the whole system of checks that gives management reasonable assurance that records are reliable, assets are safeguarded and laws are followed. The control environment (tone from the top, ethical culture, organisational structure) sits above the accounting system (how transactions are captured, recorded and reported) and the control activities themselves. Learn the classic control categories and be able to classify an example: segregation of duties, authorisation limits, physical controls, reconciliations, information processing controls and performance reviews.
Fraud, error and the three lines
Distinguish error (unintentional) from fraud (intentional, involving deception). Fraud risk factors include pressure, opportunity and rationalisation. Questions often ask where responsibility lies: management owns the control system, the internal audit function gives independent assurance, and the audit committee oversees. Know the difference between preventive controls (stopping it happening, e.g. credit checks) and detective controls (finding it afterwards, e.g. bank reconciliations).
Traps to watch
- A control described as segregation of duties is often really an authorisation control - read what the person is actually doing.
- Detective controls do not prevent loss; do not overstate their effect.
- Internal audit is not part of the control system's operation - it provides assurance over it.
- Reconciliations detect; they do not authorise.
Worked rule of thumb
If one person both raises a purchase order and approves the invoice, the opportunity element of the fraud triangle is present. The fix is not more checking afterwards - it is segregation of duties so no single person controls a transaction from start to finish.