Auditing and Internal Control Basics
Auditing and Internal Control Basics tests the language of assurance: what an auditor actually opines, how control systems prevent and detect error, and how vouching differs from verification.
Core concepts
- Internal control components: control environment, risk assessment, control activities, information and communication, and monitoring.
- Segregation of duties: the person who authorises, the person who records and the person who holds the asset should never be the same individual.
- Internal check is woven into the daily flow of work; internal audit is a separate, post-event review. They are not synonyms.
- Vouching tests the genuineness of a recorded transaction against supporting documents; verification confirms an asset's existence, ownership and valuation.
- Audit opinions: unmodified (clean), qualified, adverse and disclaimer. The auditor gives reasonable assurance, not a guarantee.
Worked example
In a small office one clerk receives cash, writes the receipt, enters the cash book and prepares the bank reconciliation. The weakness is obvious: the same person can misappropriate cash and conceal it in the records. The remedy is to separate receipting from recording and have the reconciliation done by someone independent - the reconciliation itself is a detective control that would surface the shortage.
Traps that cost marks
- Claiming an auditor 'detects all fraud'; the duty is reasonable assurance plus reporting under the applicable provision (section 143(12) of the Companies Act).
- Confusing sampling risk with materiality.
- Treating a weakness in internal control and an audit qualification as the same thing.