Internal Controls and Financial Transaction Cycles
The control framework
COSO's five components - control environment, risk assessment, control activities, information and communication, monitoring - underpin questions here. Controls are preventive (authorisation, segregation of duties, access restriction) or detective (reconciliations, exception reports, audits), and manual or automated. Segregation of duties separates custody of assets, authorisation, record-keeping and reconciliation; collusion or management override can defeat it, and any compensating control (such as independent review of a combined role) must be evidenced.
Cycle-specific red flags
Procure-to-pay: shell or duplicate vendors, three-way match bypass, invoices just below approval limits, purchase-order splitting. Payroll: ghost employees, changed bank details, payments to leavers. Revenue: premature recognition, credit notes after period end, side agreements. Cash and bank: lapping of receivables, cheque kiting, stale reconciling items. Journals: top-side entries, round sums, unusual users, period-end clustering.
Design versus operating effectiveness
A control can be well designed and never performed. Testing requires inquiry, observation, inspection and re-performance - inquiry alone is never sufficient evidence.
Traps. Confusing the existence of a policy with the operation of a control; accepting "management reviewed it" without proof of the review; overlooking master-data change controls, a favourite hiding place; testing one transaction and declaring the control effective.
Rule of thumb. For every fraud scheme you can name, ask: which single control would stop it, and who independently proves that control ran every time it should have?