Auditing and Internal Control
What this domain tests
Auditing and Internal Control tests audit risk, evidence, materiality, assertions and the design of controls. For a finance assistant, expect practical questions on segregation of duties, reconciliation, authorization, physical verification and the difference between internal audit and statutory audit.
Core rules
- Audit risk = inherent risk x control risk x detection risk. The auditor reduces detection risk through substantive procedures and tests of controls.
- Materiality is a matter of professional judgment; it guides what is tested and what is reported.
- Audit evidence must be sufficient and appropriate. External confirmations and physical inspection are generally stronger than internal oral explanations.
- Internal control has five components: control environment, risk assessment, control activities, information and communication, and monitoring.
- Key control activities include authorization, segregation of duties, reconciliation, access restriction and physical safeguards.
- Internal audit evaluates controls and adds value; statutory audit expresses an opinion on financial statements. Neither provides an absolute guarantee.
Worked example
A cash clerk receives cash, records the receipt in the ledger and also prepares the bank reconciliation. This combines custody, recording and reconciliation. The control weakness is incompatible duties: one person could misappropriate cash and conceal it in the reconciliation. The fix is to separate cash custody, ledger recording and bank reconciliation among different employees, with independent review.
Traps that cost marks
Do not say an audit guarantees that fraud does not exist. Do not confuse internal control with internal audit. Do not treat a small sample as conclusive. Do not ignore management override, a key limitation of any control system. Documentation must support the conclusion.