Internal Control, Internal Check and Internal Audit
What this domain tests
This domain tests the meaning and components of internal control, its inherent limitations, the mechanics of internal check, and the distinction between internal audit and statutory audit.
Core rules
- Internal control is the plan of organisation and all methods adopted to safeguard assets, ensure the reliability of records, promote operational efficiency and encourage adherence to management policy.
- Components (COSO): control environment, risk assessment, control activities, information and communication, and monitoring.
- Limitations: collusion between employees, management override, cost-benefit constraints, human error and unusual transactions. Internal control gives reasonable, not absolute, assurance.
- Internal check is the arrangement of duties so that one person's work is automatically checked by another; no single person records, handles and authorises a transaction from start to finish.
- Internal audit is an independent appraisal function within the organisation, reporting to management or the audit committee, that evaluates the effectiveness of controls.
- The statutory auditor may rely on internal control and internal audit work but must still obtain his own evidence; responsibility for the opinion cannot be delegated.
Worked example
In a cash sales department, Clerk A receives cash and issues pre-numbered receipts, Clerk B records receipts in the cash book, and Clerk C reconciles daily bank deposits with the cash book and the receipt counterfoils. Internal check exists because receipt, recording and reconciliation are separated, so misappropriation requires collusion. The auditor tests the control by selecting a sample of receipt books and tracing them to the cash book and deposit slips; if the control operates effectively, substantive testing can be reduced but not eliminated.
Traps
Treating internal audit as equivalent to statutory audit; claiming internal control gives absolute assurance; relying on a control that has not been tested; confusing internal check (a procedural arrangement) with internal control (the whole system).