Internal Controls Systems

🟢 Lite — Quick Review (1h–1d)

Internal Controls — Key Facts for ACCA/CA Pakistan

• ISA 315 — Components of internal control (COSO-based framework)
• ISA 265 — Communicating deficiencies in internal controls to those charged with governance
• Five Components of Internal Control:
  1. Control Environment
  2. Risk Assessment
  3. Information & Communication
  4. Control Activities
  5. Monitoring
• IT Controls: General controls (access, change management, backup) + Application controls (input, processing, output)
• Limitations: Cost-benefit, human error, management override, collusion
• Walk-through Test: Trace one transaction through entire process
• Tests of Controls: Verify controls operate as designed

⚡ Exam Tip: Management override is the GREATEST limitation of internal controls — it allows senior management to bypass controls. ISA 315 specifically requires auditors to address this risk.

---

🟡 Standard — Regular Study (2d–2mo)

Internal Controls — Detailed Content

ISA 315 — Components of Internal Control:

1. Control Environment: The foundation for all other components — tone at the top.

Elements:

• Communication and enforcement of integrity and ethical values
• Commitment to competence
• Board/audit committee oversight
• Organizational structure, reporting lines, authority, responsibility
• Human resource policies (recruitment, training, performance evaluation)

Red flags in control environment:

• Dominant CEO with no oversight
• High staff turnover
• Weak recruitment procedures
• No whistleblower mechanism

2. Risk Assessment: Entity’s process for identifying, analyzing, and responding to risks to achievement of objectives.

Auditor must understand:

• Entity’s risk identification process
• How management assesses likelihood and impact
• How responses are determined and implemented

3. Information & Communication: Relevant information must be identified, captured, and communicated in a timely manner.

• Accounting system: Processes transactions, maintains records
• Communication: Information flows up, down, and across organization
• IT: Systems capture and process data

4. Control Activities: Policies and procedures that ensure management directives are carried out.

Key categories:

• Authorization — General (policy-level) or Specific (transaction-level)
• Segregation of Duties — No single person controls all phases of a transaction
• Reconciliations — Account reconciliations, bank reconciliations
• Physical Controls — Asset security (locks, access logs, inventory counts)
• IT Controls — Access rights, change management, backup procedures

5. Monitoring: Process to assess quality of internal control performance over time.

• Ongoing evaluations (routine supervision, management review)
• Separate evaluations (internal audit, inspection)
• Reporting deficiencies

ISA 265 — Communicating Deficiencies:

The auditor must communicate:

• Orally (for significant deficiencies) — promptly to management
• In writing (for significant deficiencies) — to TCWG
• In writing (for material weaknesses) — to TCWG

Timeline: Before auditor’s report is issued

---

🔴 Extended — Deep Study (3mo+)

Comprehensive Internal Controls Notes

IT Controls — Detailed Framework:

General Controls (ITGC): Apply to all IT systems and infrastructure:

• Access Controls: Logical (passwords, biometrics) + Physical (server room access)
• Change Management: Procedures for requesting, testing, approving, implementing changes
• Computer Operations: Backup procedures, disaster recovery, business continuity
• Development Controls: Systems development life cycle, testing, implementation

Application Controls: Apply to specific business processes:

• Input Controls: Completeness checks, validity checks, batch totals, edit validation
• Processing Controls: Run-to-run totals, sequence checks, file totals
• Output Controls: Output review, distribution controls, reconciliation to source

Auditing IT Systems:

When IT is significant to financial reporting:

• Understand role of IT in business processes
• Identify controls over IT infrastructure
• Test IT general controls
• Where IT general controls fail → more manual substantive testing required

Segregation of Duties Matrix:

Function	Authorization	Custody	Recording	Verification
Cash Receipts	✓	✓
Cash Disbursements	✓		✓
Recording Transactions			✓	✓
Asset Custody		✓		✓

Best Practice: No single person should handle more than ONE of these functions for any transaction.

Walk-Through Test vs Tests of Controls:

Feature	Walk-Through Test	Tests of Controls
Scope	One transaction through entire process	Multiple items, specific control
Timing	During interim planning	During substantive phase
Purpose	Confirm understanding of process	Verify control operates effectively
Evidence	Inquiry + observation + inspection	Inquiry + inspection + reperformance

Management Override — Specific Audit Procedures (ISA 240):

Since management can override controls:

• Examine journal entries (particularly year-end, unusual accounts)
• Review accounting estimates for bias
• Evaluate business rationale for significant transactions
• Test controls over approval of unusual transactions
• Investigate fraud allegations

Limitations of Internal Controls:

┌─────────────────────────────────────────────────────┐
│ INTERNAL CONTROLS — LIMITATIONS                      │
├─────────────────────────────────────────────────────┤
│ 1. Human error and judgment failures                │
│ 2. Management override (bypass controls)           │
│ 3. Cost-benefit trade-off (controls not costlier   │
│    than benefit)                                    │
│ 4. Collusion (two people work together to defeat)  │
│ 5. External events (natural disasters, fraud)      │
│ 6. Systems failure or IT disruptions               │
│ 7. Override by those with authority                 │
└─────────────────────────────────────────────────────┘

Internal Audit vs External Audit:

Aspect	Internal Audit	External Audit
Appointed by	Management/Board	Shareholders
Objective	Evaluate internal controls, risk management	Opinion on FS
Scope	Broad (operational + compliance)	Financial statements
Standards	IPPF (Institute of Internal Auditors)	ISAs
Reporting	Management	Shareholders/public

Common Exam Mistakes:

Mistake	Correction
”IT controls = more reliable”	IT creates NEW risks (cyber, system failure); controls must address these
”No control failures found = controls work”	Must consider WALK-THROUGH + tests of controls; one item doesn’t prove reliability
Ignoring segregation of duties	Single person handling authorization + recording = high fraud risk
Not linking controls to assertions	Each control addresses specific assertion (existence, completeness, accuracy)

⚡ High-Yield Control-Assertion Link:

Control	Assertion Addressed
Bank reconciliation	Existence, completeness, accuracy
Purchase authorization	Occurrence, accuracy
Segregation of duties	Prevention of fraud/error
Physical inventory count	Existence, completeness
Aged receivables review	Valuation
Impairment review	Valuation

⚡ Exam Answer Framework for Controls Questions:

1. Identify which component of internal control is relevant
2. Describe the control activity
3. Evaluate whether control is likely effective (design) and operating effectively (tests)
4. Assess impact on risk assessment
5. Recommend follow-up procedures if control deficiency identified

---

Content adapted based on your selected roadmap duration. Switch tiers using the selector above.