Internal Control: Test Your Knowledge

Today many companies recognize the desirability as well as the requirement to have an effective system of internal control. Yet, designing and implementing a cost-effective system of internal control is a daunting, if not overwhelming, task.

One way to overcome resistance to internal control is to educate stakeholders at every level of the organization about its advantages.

Try the following quiz to test your knowledge of internal control and consider using it as a teaching tool for others in your organization.

1. Houston Helpers, a faith-based group that offers help to people in need, has hired Janet Wells, a local CPA, to train its professional staff in the basics of internal control. As Wells begins her presentation, a participant interrupts by saying, “We are not like other organizations. How can we talk about common elements of internal control when we are a faith-based service provider?”

a. The participant is correct; there are no generally accepted frameworks for internal control.

b. The participant is incorrect; there are generally accepted frameworks for internal control, regardless of industry.

2. Internal control is a process designed to provide reasonable assurance regarding the achievement of which objective?

a. Effectiveness and efficiency of operations

b. Reliability of financial reporting

c. Compliance with applicable laws and regulations

d. All of the above

3. CS Inc. has asked you to join its board of directors. Before agreeing to do so, you realize that it is important that you understand the company’s approach to Enterprise Risk Management (ERM). Which of the following is NOT true about ERM?

a. ERM is a bottom-up view of the key risks facing the organization.

b. ERM links growth, risk and return.

c. ERM aligns risk appetite and strategy.

d. ERM identifies and manages cross-enterprise risk.

4. The directors of Evans Corp. are reevaluating their “tone at the top.” They realize the phrase “tone at the top” is used to describe the example set by directors, officers and executives through their statements and daily actions. The board members also realize written policies need to reinforce the tone, but are unsure how to integrate written policies into the “tone at the top.” If you were advising the board, what would you tell them is the cornerstone of these policies?

a. A comprehensive code of conduct

b. A conflict-of-interest policy

c. Organization communications

d. Protection of the organization’s assets

5. Your employer has asked you to develop controls to help prevent duplicate payments. Which of the following steps would NOT be appropriate in developing such a policy?

a. Create a form for updates to the master vendor file, which should be completed by the person requesting the change and signed off by someone at a higher level.

b. Purge inactive vendors.

c. Periodically run reports showing the daily changes to the master vendor file.

d. Prohibit the sharing of passwords for the master vendor file.

6. As part of a training exercise for a corporate controller’s staff, Jeri Lee breaks the group into teams and asks each team to gain (and document) their understanding of a potential acquisition’s system of internal control. When she returns to check on their progress, she discovers that one team is working on integrating the use of narratives, flowcharts and internal control questionnaires. What should Lee tell this team about using all three approaches simultaneously?

a. The team is correct in using all three approaches simultaneously.

b. The team only needs to use one approach.

c. Combining the use of narratives and flowcharts together is inefficient.

d. Combining the use of flowcharts and internal control questions together is ineffective.

e. b and c

COSO FRAMEWORK

The COSO framework consists of five elements of control: the control environment, risk assessment, control activities, information and communication, and monitoring. The remaining questions refer to these elements.

7. The owner of Austin Marina has approached the managing partner of a CPA firm about conducting a first-time independent audit. While discussing the nature and scope of the audit, the owner of Austin Marina asks if it is really necessary for the auditor to gain an understanding of Austin Marina’s system of internal control. Which of the following responses would NOT be correct?

a. The auditor needs to gain an understanding of the client’s internal control in order to assess risk.

b. An understanding of internal control is necessary to support the audit opinion.

c. Audit standards do not require the auditor to gain an understanding of the client’s system of internal control since risk can be assessed by other means.

d. Independent auditors can no longer assess control risk at a maximum without having support for that assessment.

8. Risks relevant to financial reporting include which of the following?

a. External events

b. Internal events

c. Circumstances that might affect reliable financial reporting

d. All of the above

9. Control activities can be defined as:

a. A means to an end

b. Authorized procedures

c. The particular category in which a control is placed

d. The actions of people to help ensure that management directives necessary to address risks are carried out

10. Evans & Co. has been struggling to implement the monitoring component of the COSO Internal Control—Integrated Framework. Which of the following is NOT correct in how the company can implement the monitoring component?

a. Monitoring can be an ongoing process.

b. Monitoring can be conducted as a separate evaluation.

c. An adequate internal audit staff can reduce external audit costs.

d. The independent auditor can serve as part of the control environment.

ANSWERS

1. (b) While the staff at Houston Helpers may not be aware of it, there are frameworks available to evaluate the effectiveness of internal control in any type of organization. The industry standard used by most U.S. companies is Internal Control—Integrated Framework, which was issued in 1992 by the Committee of Sponsoring Organizations (COSO), and is a blueprint for organizations to assess and enhance internal control systems. COSO was formed in 1985. The sponsoring organizations are the American Accounting Association, the AICPA, Financial Executives International, the Institute of Management Accountants, and the Institute of Internal Auditors.

2. (d) Effectiveness relates to the ability of the entity to accomplish its goals. Efficiency is concerned with maximizing the best use of resources. Reliability of financial reporting includes the accuracy of financial statement balances and adequate and complete disclosure. Compliance with applicable laws and regulations refers to all laws and regulations that apply to the entity.

3. (a) ERM provides “a process that provides a robust and holistic top-down view of key risks facing the organization.” (Effective Enterprise Risk Oversight: The Role of the Board of Directors, COSO, 2009). Thus ERM is significantly different from the more traditional risk management approaches. Board members need to understand the entity’s strategy for managing risks to ensure that day-to-day operations are aligned with stakeholder expectations. The other answers are true.

4. (a) “The code of conduct should be a source of guidance on daily behavior and set the minimum standards for that behavior,” according to the AICPA On-Site Training course Financial Fraud, Forensics, and the CPA. The “tone at the top” applies to everyone as they carry out their business and personal responsibilities. The other answers (a conflict-of-interest policy, organization communications, and protection of the organization’s assets) are normally considered for inclusion in the code of conduct.

5. (b) Accounts payable expert Mary Schaeffer recommends that inactive vendors be deactivated, not purged. This allows vendor activity to be researched if needed. The other steps are appropriate. Using forms for updates to the master vendor file allows accountability for changes. Schaeffer also recommends executive review of reports, which show daily changes to the master vendor file. Passwords to the master vendor file should never be shared. For more information, see “Fight Fraud and Duplicate Payments” (Dec. 4, 2008), by Mary Schaeffer, available at tinyurl.com/yfc7jog.

6. (e) A narrative is a written description of a system of internal control. A flowchart is a diagram of the documents and their sequential flow within an organization. A narrative and a flowchart present the same information. While one well-executed approach can be sufficient to gaining an understanding of internal control, a flowchart and an internal control questionnaire can be used together effectively, as the internal control questionnaire offers checklists that include the many types of controls available.

7. (c) Current audit standards require the independent auditor to obtain an understanding of the entity and its environment, including internal control. Moreover, the auditor is required to evaluate the design of controls and whether or not they have been implemented. Also, the auditor must document significant processes and their basis for assessing control risk.

8. (d) Risk assessment is the process of identifying and analyzing relevant risks in order to manage and mitigate the risks. External and internal events, as well as any other circumstance that could affect reliable financial reporting should play a part in risk assessment.

9. (d) The COSO definition of control activities recognizes that internal control is affected by people at every level of the organization. Control activities are more than a means to an end, and are not limited to authorized procedures. Control activities are often in overlapping categories.

10. (d) Management is responsible for establishing and maintaining the entity’s internal control, and an independent auditor cannot perform management functions. Monitoring can be an ongoing process or be conducted as a separate evaluation. For many larger entities, internal audit departments are essential for effective monitoring. In fact, AU section 322 addresses the effect of internal auditors on the external auditor’s evidence accumulation, provided the internal audit function is performed by staff independent of both the operating and accounting departments and reports either to top management or the audit committee.

SCORING

An effective system of internal control is one of the best ways to prevent the fraudulent misstatement of financial statements. If you answered all 10 questions correctly, you are an internal control guru. If you answered eight or nine questions correctly, your knowledge of internal control is competent.

If you answered seven or fewer questions correctly, you may want to build on your internal control skills. Fortunately, no one needs to “reinvent the wheel” when implementing or upgrading a system of internal controls. The resources listed on the previous page will help you stay competent in internal control.

James Schaefer (js2@evansville.edu) is a professor of accounting at the University of Evansville, and Joy V. Peluchette (jpeluche@usi.edu) is a professor of management at the University of Southern Indiana.

To comment on this article or to suggest an idea for another article, contact Matthew G. Lamoreaux, senior editor, at mlamoreaux@aicpa.org or 919-402-4435.

AICPA RESOURCES

Article

“Fight Fraud and Duplicate Payments,” by Mary Schaeffer, Dec. 4, 2008

Publications

• Guidance on Monitoring Internal Control Systems (#990022HI)
• Internal Control—Integrated Framework (#990012)

For more information or to make a purchase, go to cpa2biz.com or call the Institute at 888-777-7077.

On-Site Training

• Uncovering Misappropriation Schemes (#FE-MS)
• Financial Fraud, Forensics, and the CPA (#CL4FFF)
• Internal Control Deficiencies: Assessment and Reporting Under SAS 115 (#ICDAR)
• Internal Control Essentials for Financial Managers, Accountants, and Auditors (#ICDAD)
• Internal Controls and IT: Reliable Reporting and Fraud Prevention (#CTRF)
• Purchasing, Inventory, and Cash Disbursements: Common Frauds and Internal Controls (#CL4PCD)
• Revenue and Cash Receipts: Common Frauds and Internal Controls (#CL4RCR)

To access On-Site Training courses, go to aicpalearning.org and click on “On-Site Training” then search by “Acronym Index.” If you need assistance, please contact a training representative at 800-634-6780 (option 1).

White paper

Understanding Internal Control and Internal Control Services, by Thomas A. Ratcliffe and Charles E. Landes

IT Section and CITP credential

The Information Technology (IT) Center provides a venue for CPAs, their clients, employers and customers to research, monitor, assess, educate and communicate the impact of technology developments on business solutions. Visit the IT Center at aicpa.org/INFOTECH. Members who want to maximize information technology to increase efficiency and boost profits may be interested in joining the IT Membership Section or pursuing the Certified Information Technology Professional (CITP) credential. For more information about the IT Membership Section or the CITPcredential, visit aicpa.org/IToffers.

OTHER RESOURCES

Publication

Effective Enterprise Risk Oversight: The Role of the Board of Directors (can be downloaded at www.coso.org)

Web sites

• The Committee of Sponsoring Organizations, www.coso.org
• The Institute of Internal Auditors, theiia.org
• ISACA (formerly the Information Systems Audit and Control Association), isaca.org