Chapter 4 Internal Controls McGraw-Hill/Irwin Copyright © 2010 by The McGraw-Hill Companies, Inc. All rights reserved.

Outline Objectives Definition of internal control Internal control purposes Risk exposures COSO frameworks Examples 4-2

Objectives When you finish this chapter, you should be able to: Define “internal control” and explain its importance in the accounting information system Explain the basic purposes of internal control Describe and give examples of various kinds of risk exposures Conduct a comprehensive risk assessment Summarize and explain the importance of the COSO documents on internal control Critique existing internal control systems and design effective internal controls 4-3

Definition of internal control Most definitions of internal control contain four common elements: Internal control is a process Internal controls are designed to provide reasonable assurance Internal control necessarily involves people in the organization Internal controls provide that reasonable assurance in a few common areas 4-4

Internal control purposes Broadly speaking, internal controls should help organizations: Safeguard their assets Ensure the reliability of financial statements Promote operating efficiency Encourage compliance with management’s directives 4-5

Risk exposures One good way to start designing internal controls is to think about an organization’s risks. Among the many good ways to think about risk is Brown’s taxonomy. 4-6

Risk exposures Operational risk Financial risk Systems risk: related to information technology Human error risk: people in the organization might make mistakes Financial risk Market risk: changes in stock prices, investment values, interest rates Credit risk: customers’ unwillingness or inability to pay their debts Liquidity risk: insufficient cash to pay debts 4-7

Risk exposures Hazard risk Strategic risks Officers’ and directors’ liability: people might break laws, resulting in personal penalties Strategic risks Legal and regulatory risk: people might break laws, resulting in penalties for the organization Business strategy risk: poor decision making related to market competition 4-8

COSO frameworks The Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed frameworks related to internal control (1985) and enterprise risk management (2004). 4-9

COSO frameworks Internal Control: Integrated Framework Control environment: the tone at the top Risk assessment: using a taxonomy to identify organizational risks Control activities: actual responses to risk. Preventive, detective, corrective General, application Information and communication: keeping people informed Monitoring: periodic reviews and updates In 2006, COSO published “Internal Control over Financial Reporting—Guidance for Smaller Public Companies” to provide suggestions for implementing Internal Control: Integrated Framework. 4-10

COSO frameworks Enterprise Risk Management: Integrated Framework Internal environment: tone at the top Objective setting: organizational goals Strategic Reporting Operations Compliance Event identification: what can happen that may impede goals Internal External Risk assessment: likelihood and impact Inherent Residual 4-11

COSO frameworks Enterprise Risk Management: Integrated Framework (continued) Risk response: generic ways to deal with risk Avoid Accept Reduce Share Control activities: specific procedures for responding to risk Information and communication: keep people informed about what’s happening with risk and the plan Monitoring: Ongoing activities and / or separate evaluations that ensure the plan is updated as needed 4-12

Examples Although every organization’s approach to internal control is slightly different, certain controls are common in many organizations. The following slides contain some examples. 4-13

Examples Adequate documentation Background checks Back-up computer files Back-up power supplies Bank reconciliation Batch control totals Data encryption Document matching Edit checks 4-14

Examples Firewalls Insurance and bonding Internal audits Limit checks Lockbox systems Physical security Preformatted data entry screens Prenumbered documents Restrictive endorsements of checks 4-15

Examples Daily deposit of cash receipts Segregation of duties User training All internal controls have associated costs—financial, operational and behavioral. The key is ensuring that the benefits outweigh the costs. 4-16

4-17