Internal Control and Risk
Internal Control and Risk tests the design and evaluation of controls, risk assessment, and the governance processes that keep an entity within its risk appetite.
COSO and control types
- The five COSO components are control environment, risk assessment, control activities, information and communication, and monitoring. The control environment sets the tone at the top.
- Controls are preventive or detective, and manual or automated. Application controls operate on transactions; IT general controls cover access, change management, and operations.
- Segregation of duties separates authorization, custody of assets, recording, and reconciliation. No single person should control all four.
Risk management
- Identify risks, assess likelihood and impact, then treat by avoiding, reducing, sharing, or accepting. Acceptance must be informed and within the approved risk appetite.
- A risk register records owners, ratings, and responses. Key risk indicators provide early warning.
- The fraud triangle explains fraud as pressure, opportunity, and rationalization. Controls mainly reduce opportunity.
Worked example
In a purchase cycle, one clerk can create a supplier, raise a purchase order, and reconcile the supplier statement. This creates a risk of fictitious suppliers and unauthorized purchases, because the same person can conceal the transaction. Redesign the control: separate supplier master data maintenance from purchasing, require a second approval above a threshold, perform a three-way match of purchase order, goods receipt, and invoice, and have an independent reconciliation. On a five-point scale, likelihood 4 × impact 5 = 20, a high-priority risk. Reasoning: segregation reduces opportunity, while the three-way match provides a detective check that a purchase was authorized and received.
Traps that cost marks
- Treating all controls as equally important; entity-level controls affect the reliability of lower-level controls.
- Ignoring IT general controls such as user access and change management.
- Assuming a detective control prevents an error rather than detecting it after the fact.
- Calling risk acceptance the same as ignoring risk; acceptance requires authority and documentation.
Professional Ethics and Business Law
Professional Ethics and Business Law tests the ethical principles expected of a finance professional and the legal concepts that frame commercial and corporate conduct.
Ethical framework
- The fundamental principles are integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.
- Threats to compliance include self-interest, self-review, advocacy, familiarity, and intimidation. Safeguards include independent review, rotation, education, and oversight. If safeguards cannot reduce a threat to an acceptable level, decline or withdraw.
- Independence requires both fact and appearance. Close family in a key management position at an audit client creates a familiarity and self-interest threat.
Business law essentials
- A contract generally requires offer, acceptance, consideration, capacity, and intention to create legal relations. Remedies for breach include damages, specific performance, and injunction.
- Agency can be actual or apparent. A principal may be bound by an agent acting within apparent authority.
- Directors owe duties of good faith, avoidance of conflicts, and care and skill. Wrongful trading can arise when directors continue to trade while insolvent.
Worked example
An audit partner's spouse is the finance director of an audit client. The spouse is in a key management position and can influence the financial statements, creating a familiarity and self-interest threat. Even if the partner does not work on the engagement, the relationship is close family and compromises independence in appearance. Removing the partner from the engagement may not be sufficient; the firm should decline or resign the audit. Reasoning: independence is judged objectively, and a reasonable third party would question the audit if a close family member prepares the financial statements.
Traps that cost marks
- Believing confidentiality is absolute; disclosure may be required by law, regulation, or money-laundering reporting.
- Confusing an advocacy threat, such as promoting a client's shares, with a self-review threat, such as auditing your own work.
- Assuming a signed contract is enforceable without consideration or capacity.
- Treating professional scepticism as a reason to ignore reliable evidence rather than to challenge it.