Internal Control
The control framework
Internal control is designed to provide reasonable assurance about reliable reporting, effective operations, and compliance. Know the five components and, critically, the control activities: segregation of duties, authorisation, physical controls, reconciliations, and IT general controls.
Candidates must distinguish preventive controls (stop errors) from detective controls (find them), and understand that segregation of duties separates authorisation, custody, and recording.
Testing controls
Test of control asks: did the control operate effectively? Substantive testing asks: is the balance correct? A control that is not tested (or fails) forces more substantive work. Remember walkthroughs confirm understanding, not operating effectiveness over the period.
Worked example
A cashier receives cash, records it, and reconciles the bank account. This breaches segregation. Remedy: separate custody from recording, and have an independent person reconcile.
Traps
- Confusing tests of control with substantive procedures.
- Assuming a well-designed control is operating effectively - design ≠ operation.
- Forgetting IT general controls (access, change management, backups) underpin application controls.
- Missing that a deficiency must be communicated to those charged with governance.