Systems and Controls
What the exam tests
Systems and controls questions test internal control design, the COSO components, IFC-FR, IT controls and the limits of assurance. You must be able to spot a control gap in a process and propose a proportionate fix.
Core rules and concepts
- Internal control is a process designed to give reasonable assurance about reliable financial reporting, effective and efficient operations, and compliance. It is not the same as internal audit.
- COSO 2013 components: control environment; risk assessment; control activities; information and communication; monitoring activities. Entity-level controls sit above process-level controls.
- Control types: preventive, detective and corrective; manual and automated; authorization, segregation of duties, maker-checker, reconciliation, physical safeguards, access controls and audit trails.
- IFC-FR: s.134(5)(e) makes directors responsible for internal financial controls; s.143(3)(i) requires the auditor to report on their adequacy and operating effectiveness for companies covered by the rule. LODR Regulation 17(8) requires CEO and CFO certification.
- IT controls: IT general controls over access, change and operations; application controls; business continuity with RTO and RPO; cyber resilience. SEBI's Cybersecurity and Cyber Resilience Framework applies to regulated entities.
- Limitations: collusion, management override, human error and cost-benefit mean no system gives absolute assurance.
Worked example
In purchase-to-pay, one clerk creates the vendor, raises the purchase order, approves the invoice and releases payment. The fraud risk is high because there is no segregation of duties. A proportionate redesign separates vendor master creation, purchasing and payment approval; adds monthly vendor-master review; requires duplicate-invoice checks; and enables an audit trail. The control objective is authorization and accuracy of payments, and the residual risk is monitored by the accounts head and internal audit. Simply adding a second signature by the same clerk's supervisor is weaker if the supervisor does not independently verify the vendor.
Traps that cost marks
- Saying internal controls guarantee accurate financial statements.
- Treating IFC-FR as identical to all internal controls.
- Assuming automated controls need no testing.
- Ignoring management override and collusion.