Chapter 6: Fraud and Internal Control

Internal Control Overview and Key Concepts Internal Control System: An internal control system consists of policies and procedures established by a company to monitor and control its business activities. The system’s primary objectives are: • • • • Protect assets from theft and unauthorized use. Promote efficient operations. Ensure reliable accounting and accurate financial reporting. Uphold company policies and compliance with laws and regulations. Sarbanes-Oxley Act (SOX): The Sarbanes-Oxley Act (SOX) mandates that public companies maintain effective internal controls. Key SOX requirements include: • • • • Documenting and verifying internal controls. Evaluating internal controls by auditors. Harsh penalties for violators, including imprisonment and fines. Public Company Accounting Oversight Board (PCAOB) supervises auditors. Committee of Sponsoring Organizations (COSO) Framework: COSO outlines five key components of internal control: 1. Control environment: Ethical standards, integrity, and organizational structure. 2. Risk assessment: Identifying, analyzing, and managing risks. 3. Control activities: Policies and procedures to reduce risks. 4. Information and communication: Ensuring proper reporting to internal and external parties. 5. Monitoring: Regular evaluation of the effectiveness of internal controls. Principles of Internal Control: The principles of internal control apply to all companies and are designed to ensure the effectiveness of the system: 1. Establish Responsibilities: Clear assignment of tasks to one individual to ensure accountability. o Example: Each cashier should have their own cash drawer. 2. Maintain Adequate Records: Good recordkeeping prevents loss and fraud and ensures accurate monitoring. o Example: Use pre-numbered sales slips to track sales and reduce the risk of unrecorded sales. 3. Insure Assets and Bond Key Employees: Insuring assets and bonding employees handling cash or other valuables protects against theft. o Bonding: Purchasing insurance to protect against employee theft. 4. Separate Recordkeeping from Custody of Assets: The person responsible for recording transactions should not also handle the assets. o Example: The employee handling cash should not be the same person recording cash transactions. 5. Divide Responsibility for Related Transactions: Splitting responsibilities among different employees prevents fraud. o Example: One person authorizes a purchase, another processes payment, and a third records the transaction. 6. Apply Technological Controls: Use technology (e.g., cash registers, time clocks) to enhance control. o Example: A cash register automatically records sales, making fraud more difficult. 7. Perform Regular and Independent Reviews: Conduct periodic reviews of internal controls to ensure compliance. o Example: Independent audits to evaluate control effectiveness. Limitations of Internal Control: Internal controls have certain limitations: 1. Human Error or Fraud: Errors can arise from mistakes or intentional fraud. o The fraud triangle explains that fraud occurs due to opportunity, pressure, and rationalization. 2. Cost-Benefit Constraint: The cost of implementing an internal control should not exceed its benefits. Technology, Fraud, and Internal Control: Technology impacts internal control in several ways: • • Reduced Processing Errors: Technology reduces manual processing errors, but data entry and software errors can persist. More Extensive Testing: Technology enables auditors to check larger data sets for accuracy. • New Evidence: Technology provides more detailed transaction records, like timestamps and user actions. Blockchain as a Control: Blockchain provides a secure, continuously updated ledger that enhances transparency and reduces the risk of tampering with records. It is increasingly being adopted by companies for its security benefits, with major firms like Deloitte and PWC investing in blockchain auditing services. Internal Control Example Analysis: Strengths: • • • Recordkeeper for inventory does not have access to the inventory: Ensures segregation of duties. Employees handling cash are bonded: Protects the company from losses due to employee theft. Detailed records of suppliers and accounts payable: Good recordkeeping practice that supports efficient operations. Weaknesses: • • • Cash drawer accessible to any worker with an ID card: Lack of control increases the risk of theft. Same employee requests, approves, and pays for inventory: Lack of separation of duties increases the risk of fraud. Employees auditing their own records: Compromises independence in review, increasing the risk of undetected errors or fraud. Conclusion: The internal control system is essential for protecting assets, ensuring accurate accounting, and promoting operational efficiency. However, even the best controls have limitations due to human error or fraud, and companies must weigh the cost of implementing controls against the potential benefits.