Skip to main content
Loading Explore guides…
Internal Controls Overview · Acedra
Home
Explore
Business
Internal Controls Overview
Sign in to save
Chat
If YouTube asks you to sign in, open the video on YouTube.
Watch on YouTube
Reload player
Transcript
42 segments
Copy
Hide video
0:00
Welcome, I'm Henan Murdoch. In this episode, we're going to talk about internal controls. We're going spend some time looking at the definitions. We're going to also take a look at some examples and also take a look at some of the control factors.
0:19
To help us better understand these dynamics around internal controls and to better get a better understanding of how this works as it relates to an engagement and internal orders may be working on, we have Kathleen Crawford who will help us better understand all these things related to internal controls. - Welcome, Kathleen. - Hi, Henan, good to see you. Nice to see you, too. So, we have some questions around internal controls. We know that internal auditors spend a lot of time
0:45
looking at internal controls, but we really need to first understand them, identify them, then test them. But right now we're trying to understand what they're about so we can go about identifying them. So, can you help us better understand what controls are about and all those things related to this, that internal auditors need to know about? Sure. Well, let's start with some flavors, types of internal controls. So, there are four types that are commonly labeled.
1:14
First is what's called preventive controls. So preventive controls are those procedures, processes, decision points that occur, that stop undesirable outcomes before they occur. So this is, as the generic definition, to prevent something from happening, that's what this type of control accomplishes for us. Detective controls by are controls that are put in place, not necessarily to keep something from happening, but instead to acknowledge and report if something did happen that was unexpected.
1:54
So there's a cost benefit decision often when it comes to whether to use a preventive or detective control. Corrective or directive are often recommendations, they happen after the fact, after an event, and maybe some undesirable outcomes occurred that were not anticipated. And so to prevent such an undesirable outcome from occurring again, there would be a recommendation to put another type of control in place, which is typically called corrective. Finally, the suite of controls may include
2:37
some additional things called mitigating or compensating controls. So, maybe the budget isn't available for some of the preventive or detective controls, but we can do something else instead that will be almost as good. That's what mitigating or compensating controls are typically about. So we have these four different categories. Awesome okay. So that's great as far as definitions go, but can you give us some examples so we can more specifically learn about
3:12
what are different examples for each one of those categories? Sure. The chart that we're looking at now is demonstrating those four areas or four different types of controls. We have preventive, detective, directive, and mitigating. Let me talk about segregation of duties, which many audit professionals see as the gold standard of internal control, segregation of duties means that we have two parts, we have say a key in a combination or two people who affect half of the control.
3:47
These controls are expensive, and so that gold standard moniker is no joke and it's no coincidence. We want to make sure that whatever is protected with segregation of duties is significant enough to warrant that because it is costly. Access passwords, we're very, very accustomed to access passwords, and they are intended to be preventive controls, but there will only be as good as people's ability to maintain the expected rotation of passwords and that the passwords are strong enough.
4:27
Now I will say in some instances, we don't have to worry about that because our systems will generate some passwords in some cases or prompt us to change them as necessary. In the area of detective control, supervisory review is a very important one. So someone with significant management responsibility will oversee the work of others and make sure that they are doing what they are tasked with doing. In a previous episode, you might remember that I spoke about something called span of control.
5:03
So, in order to assess whether or not detective control in the form of supervisory review is really beneficial, we need to consider how many people does this person oversee and how likely is it that he or she will be able to do what is expected in the form of a control function?
5:25
Training programs, policies and procedures, documentation, it's very common for these types of things to be recommended by internal auditors after something has been found lacking in terms of people's abilities to do what they need do or having sufficient direction about how to do what they're supposed to do. So these three, I kind of keep in one comment because they're very much of a piece. These are very common recommendations that auditors might make.
6:01
I would also say that supervisory review is helpful when there's a lack. If we don't have the opportunity to have segregation of duties, then supervisory review can be an after the fact kind of situation. It's not going to prevent the way the segregation of duties does, but it can mitigate for lack of segregation of duties. Yes, that is very true because if you don't have the ability to separate the incompatible duties, then you probably want to have maybe a report
6:34
that is generated the end of a period, maybe at the end of the week, end of the month, depending on the risk, and how someone review those transactions to make sure that they're appropriate and that nothing happen that they need to be alarmed about. One of the things about internal controls too, that I find very helpful to do is in addition to making sure the control is there, but look at the qualitative elements around it. So, with security cameras and many of my reviews,
6:58
I found that sometimes the cameras, the angle of it was not appropriate, the granularity, there was not crisp images, they were not keeping them long enough. So in many cases, we have to look at some of these qualitative elements as well. And of course, when you think about passwords, yes, you can have very complex passwords with alphanumeric characters, the length, all of these elements can be built into the requirement, but then if someone writes it down on a post note
7:27
and post it on their wall or under the mouse pad or something like that, you take it all away. And one last thing, you mentioned banking, because you have so much experience with that; when you think about two individuals, one has a key one has the password, you have someone who has a combination in their head, but then they have the key hanging on a little nail on the wall, that is not exactly what you want. That's not exactly what they had in mind at all. Absolutely not.
7:58
So, as we look at frameworks, so COSO comes to mind because COSO definitely has one of the components, but as we're thinking about all of these things, as they come together, can we reflect back on COSO and see how these controls fit into that framework to make sure we see the alignment and the parallels that both of them have with each other? Sure. I have the graphic up here for us to look at. So reminding people that the five tiers of interest are the control environment,
8:33
risk assurance rather risk assessment, control activities, information and communication, and monitoring activities. So, in terms of the types of controls that we've spoken about, the preventive or detective, these all fit in what we would expect to have as far as risk assessment will predict where our risks are and where we need to have appropriate controls. If you're looking at the color version of this, that's the sort of green tier that we see in the model
9:19
on the left hand side of the graphic. And then the control activities, the three key principles here, selecting and developing control activities, selecting and developing ITGCCs, and mobilizing through policies and procedures, what types of controls should be in place, what are warranted given the level of risk that they are meant to offset or contain. So the COSO internal control integrated framework gives us really terrific signals as to the purpose of these things,
10:04
and hopefully, it isn't just seen as an exercise that we must go through, it is important to protecting the information and other assets of the organization and not for nothing. It's also important to protect our human capital, our employees around the organization. So as them to be able to make sound decisions and appropriate actions for the benefit of the business. And these control activities are applicable or are applied rather different levels within organization.
10:39
So there are certain things like the organization having a certain algorithm or complexity requirement for passwords, that'll be like an entry level control that applies to the entire organization or a training program, like ethics training that apply to the entire organization, that's an entry level control. And as you look at the third dimension, the depth dimension of the COSO cube, the framework, as you start to see what goes into division and function and program process,
11:06
and if you keep going further back, further back, you're thinking, okay, even at the transaction level, you're going to have some control activities. So you start to think, okay, in this area, maybe the manufacturing area, they have security cameras, but they don't have it in other areas. They have reconciliations. Maybe some of those are going to be in this area, but not in that area. The inventory counts, so we have some preventive controls about authorization
11:29
that apply to some areas, we have some detective controls, like inventory counts that only apply to the warehousing area and so on. So, then we start to see how these controls are applicable in different areas within the organization. So, definitely fits into the framework. So as far as factors, we spoke about factors as relates to risk assessment, but are there also factors that influence internal controls? Most definitely.
11:58
We want to think about the less obvious control factors. And as you were speaking, I was actually thinking about training of personnel, but maybe not the way that I had originally intended it on this graphic. When you were talking about the COSO cube and making sure to differentiate between some of the things that are appropriate and that happen at the divisional level or the departmental level, I was thinking about how important it is to train our internal auditors to recognize
12:32
that that differentiation is there for a reason, that there's not just one-size-fits-all or a cookie-cutter approach to these suites of controls that they're going to come in touch with. So factors that might be less obvious, we have to look at, now I'm speaking in the context of auditors reviewing control, we need to look at ability of personnel. What is the technical expertise as processes and systems become more sophisticated? Do we have people who are keeping pace
13:08
with their technical expertise? And so do they get training as new requirements or new features of their process or their responsibilities comes into effect? How much training are they getting? And perhaps even more important, are the managers in those areas making resources of available for training? And you can look at this two ways too, the resources are the personnel, and are they allowed to go to training, but also, is there enough financing, is there enough of a budget for said training?
13:51
There's also a principle within COSO that focuses on competence. And if you think about individuals who perform control activities, let's just say bank reconciliations, for example they may seem simple or people who have reviewed them and done for a while, they understand the process that you need to go through, but for people who are not familiar with it, they need to be trained. So, reconciliations are a very important control, but if the individual who needs to perform it
14:22
has not been fully trained on what to do under normal circumstances, and also how to correct anomalies that may be identified during the process of performing the reconciliation, then that control activity could be compromised. I can remember a very vivid example of just that, and I won't name the organization nor the person's particular role, but someone had ascended to a role where reconciliations were part of the job description, and this person followed as much of the process
14:56
as she was able to, but because she hadn't been trained and because she herself, I guess, did most of her banking online, did not necessarily have an appreciation for the fact that you have to resolve reconciling differences. So this was a situation where eventually there was no recourse to the financial institution where that account was being held, and we had to charge off some losses because the person had not been appropriately trained. Through no fault of her own,
15:27
it was just wasn't within the scope of her training, don't know why, but that's the way it went. We learned from those unfortunately events. We did. So what are some of the other factors? Well, some other things for us to think about control awareness of management, certainly, we would expect that management leadership would be very aware of controls and their benefits to the organization, and I'm sure that they are. What I look at is level of involvement.
16:04
So how involved is management in making sure that their staff are aware of the need for controls? What is management's level of understanding of the different risks and controls? So a certain management style might be rather hands-off, and if that's the case, then their understanding may not be robust enough to have an appreciation for the value of the well placed control. They might actually see it as more of an inconvenience. And if that is an attitude that they communicate
16:36
to their direct reports, then that's a problem. I also look at resolution of errors. When there are errors, so that example that I gave you in terms of reconciliations that was caught fairly quickly because there was another process of periodic review on a least a quarterly basis of the reconciliations. And that happened as a matter of routine, so the errors were resolved relatively quickly, and the training went into place for that individual I mentioned.
17:09
So we would be looking for that kind of thing as part of the suite of controls, identification and reporting of exceptions. So you mentioned situations where there might be some automated reporting of certain exception conditions. So hitting a particular threshold will trigger some kind of report that goes to another level or another department that gets reviewed, that gets evaluated, and eventually, that gets resolved. Span of control, the supervision of the controlled environment,
17:44
and what's the level of supervision and how many people are reporting up to that person who has to serve a control function. - Yes, managers need to manage. - Indeed. So the amount of supervision and the quality of the supervision is very important. So how about assets? Is there anything in terms of their record keeping of documents and safeguarding of assets that's also a potential factor here? Most definitely. So with regard to safeguarding of assets, how does management attempt
18:16
to reduce those risk factors that may result in losses? So let's talk computing. We know that computers are getting smaller and smaller, laptops are getting smaller and smaller, and if somebody was sufficiently motivated, it wouldn't be that difficult a matter to slip an iPad under one's winter coat and go out the front door. - That's a simple example. - Or a back door for that matter. Or the back door for that matter.
18:48
And so we have to look around and say, what are the important assets that this organization needs? What about records? Records of a proprietary nature. So maybe we have, I don't know, some new product or service that is in development, how is that information kept from prying eyes, and how are we making sure that it is safeguarded until it runs its course to hopefully come to market, whatever that might be. So, I would definitely argue for having safeguarding
19:27
especially of information that is not only proprietary, but also potentially really, I'm trying to think of the word here. Well, the crown jewels of the organization. Yes exactly. In many cases, those are the items that create value and that differentiates one organization from another. Yes absolutely. And of course, that also brings up matters around ethics as well. You don't want someone who sells off this secret recipe or the secret formula.
19:58
So the ethical elements also need to be safeguarded as well. Yes indeed. So we have one more category and those are the moral and ethical factors. So, that actually links very nice to what you were saying about people's not just people's behavior, but also their intent.
20:19
What is our code of conduct or code of ethics or conflicts of interest statement? It's great to have one but it's the basement, as far as I'm concerned. What we really want to be certain is that not only does the code of conduct or code of ethics or conflict of interest statement exist, but how is it disseminated and how is compliance and perhaps even more importantly, how is understanding actuated? How do we know that all employees at all levels understand
20:54
what's inbounds in terms of conduct in the organization, what is out of bounds? You'll learn a lot about whether or not there's true commitment when we look at how management handles fraud. For example, when you think of how management handles fraud, or one of the things that I think about is the treatment of infractions handled exactly the same way, regardless of the position of the person who involved. - So if we're talking about… - Consistency. Yes, consistency through and through.
21:31
So rank should not have its privileges in a situation like this, and if it does, then that tells you something about the imbalance when it comes to handling fraud. And it sets a signal as well to employees and it doesn't have to be a high ranking individual, it could be a lower ranking individual who happens to have friendships or some kind of protection or they're seen as being extremely valuable. And certainly, the organization wants to be careful, but if you compromise your ethics,
22:04
that does send a signal to other employees that some of these behaviors will be accepted or tolerated. So that's dangerous in terms of setting up precedent. So Kathleen, thank you very much for all of this and helping us better understand all of these things about internal controls because we definitely spend a lot of time there. So in terms of their definition, some of examples which are great to better illustrate what those definitions mean in practical terms, the presence of the control
22:31
and the qualitative aspect about them, and then those controlled factors. Thank you very much. It's my pleasure, Henan. If you like this series, subscribe to the ACI learning YouTube channel to enjoy more audit related content.
Here to help you learn
Sign in to keep a private conversation with your course tutor.
Ask me anything about the material…
Sign in to chat