1. S5: Internal controls

2. What is Internal Control Internal control is a process Internal control is a process Internal control is effected by people Internal control is effected by people Internal control is geared to the achievement of objectives Internal control is geared to the achievement of objectives Internal control cannot be expected to provide absolute assurance of the achievement of objectives Internal control cannot be expected to provide absolute assurance of the achievement of objectives

3. As defined by Committee of Sponsoring Organisations (COSO), USA Process effected by entities management and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the following three broad categories Process effected by entities management and other personnel designed to provide reasonable assurance regarding the achievement of objectives in the following three broad categories Effectiveness and efficiency of operations Effectiveness and efficiency of operations Reliability of financial reporting Reliability of financial reporting Compliance with applicable laws and regulations Compliance with applicable laws and regulations

4. As defined by the Internal controls standards committee of INTOSAI Integral process to provide reasonable assurance that the following general objectives are being achieved Integral process to provide reasonable assurance that the following general objectives are being achieved Fulfilling accountability obligations Fulfilling accountability obligations Complying with applicable laws and regulations Complying with applicable laws and regulations Executing orderly, ethical, economical, efficient and effective operations Executing orderly, ethical, economical, efficient and effective operations Safeguarding resources against loss Safeguarding resources against loss Internal control is a dynamic integral process and management at all levels have to be involved to provide reasonable assurance of the achievement of its objectives Internal control is a dynamic integral process and management at all levels have to be involved to provide reasonable assurance of the achievement of its objectives

5. Components of internal controls Control environment - Assignment of Authority and Responsibility Control environment - Assignment of Authority and Responsibility Risk assessment Risk assessment Information and communication Information and communication Monitoring Monitoring Control procedures and activities Control procedures and activities

6. Control environment Depends on Management’s overall attitude, awareness and actions regarding internal control Depends on Management’s overall attitude, awareness and actions regarding internal control The factors influencing control environment are The factors influencing control environment are Integrity and ethical values Integrity and ethical values Commitment to competence Commitment to competence Management philosophy and operating style Management philosophy and operating style Organisational structure Organisational structure Internal audit and Audit Committee Internal audit and Audit Committee Use of IT Use of IT HR policies and practices HR policies and practices

7. Internal control structure Controls should be Controls should be Appropriate Appropriate Consistent Consistent Cost-effective Cost-effective Management should periodically review and update controls so that these remain effective Management should periodically review and update controls so that these remain effective

8. Types of internal controls Management, Administrative or Accounting Management, Administrative or Accounting Preventive, Detective or Directive Preventive, Detective or Directive Preventive Preventive Which deter undesirable events from occurring Which deter undesirable events from occurring Detective Detective To detect and correct undesirable events that have occurred To detect and correct undesirable events that have occurred Directive Directive To cause or encourage a desirable event to occur To cause or encourage a desirable event to occur

9. Limitations of Internal Controls Can provide only reasonable and not absolute assurance about the achievement of the entities objectives Can provide only reasonable and not absolute assurance about the achievement of the entities objectives As it depends on human factor, is subject to flaws in design, errors of judgment or interpretation, misunderstanding, collusion, fatigue etc. As it depends on human factor, is subject to flaws in design, errors of judgment or interpretation, misunderstanding, collusion, fatigue etc. Design of an internal control system faces resource constraints Design of an internal control system faces resource constraints

10. Review of Internal Controls Ascertaining the system Ascertaining the system Discussion with auditing entity Discussion with auditing entity Drawing a detailed flow chart highlighting all activities and process flow Drawing a detailed flow chart highlighting all activities and process flow Identifying the controls Identifying the controls Testing compliance Testing compliance Conforming the controls with management Conforming the controls with management Testing compliance for each identified control Testing compliance for each identified control

11. Review of Internal Controls Evaluating the system Evaluating the system Analyzing the results Analyzing the results Forming opinion regarding adequacy and functioning of controls Forming opinion regarding adequacy and functioning of controls All this should be documented and reported All this should be documented and reported

12. Objectives of assessment of Internal Controls To check whether To check whether Internal control systems have been prescribed and documented Internal control systems have been prescribed and documented Systems are adequate Systems are adequate Management implements these in the manner prescribed Management implements these in the manner prescribed Management periodically reviews them through internal audit and takes corrective measures Management periodically reviews them through internal audit and takes corrective measures

13. Case Study