5 Components of internal controls

The 5 components of ICS

1. Control Environment (Tone at the top)

• Clear ethics and integrity expectations (code of conduct)
• Competent staff and defined organisational structure
• Board/management oversight and accountability
• Elements included:

1. Communication and enforcementof integrity and ethical values.

2. Commitment to competence

3. Participation by those chargedwith governance

4. Management’s philosophy and operating style

5. Organizational structure

6. Assignment of authority andresponsibility

7. Human resources policies andpractices.

 

 

2. Risk Assessment

• Identifying key risks (fraud, error, compliance, IT, operational risks)
• Assessing likelihood/impact and prioritising risks
• Updating risk assessment when changes happen (new system, new branch, new product)

3. Control Activities

• Segregation of duties (authorise–record–custody separated)
• Approvals and authorisation limits
• Reconciliations (bank, inventory, debtor/creditor)
• Physical controls (locks, access control, stock counts)
• IT controls (access rights, change controls, backups)
• Categories of Control activities will include policies and procedures that pertain to:

1. Performance review

2. Information processing

3. Physical controls

4. Segregation of duties

(3 functions need to be segregated: authorization, recording & custody of assets)

4. Information & Communication

• Reliable systems for capturing and processing transactions
• Proper documentation, audit trails, and timely reporting
• Clear internal communication of policies and procedures
• An effective IS should consider establishing records and methods that:

1. Identify & records all valid transactions

2. Resolve incorrect processing transactions

3. Process & account for system overrides

4. Present transactions and related disclosures properly in the FR

5. Monitoring Activities

• Ongoing supervisory reviews and exception reporting
• Periodic internal audits or control self-assessments
• Follow-up and corrective actions when weaknesses are found
• Is a process used to assess the effectiveness of the
• performance of internal control.
• It involves evaluating the design and operation of controls and taking corrective action where necessary.
• Mgt may monitor controls through ongoing activities such as supervisory activities and/or separate evaluations.(eg:customer complaint)
• Internal auditors also contribute to the monitoring rocess.

Practical implication for audit

• Auditors evaluate whether these components exist and operate effectively.
• Weakness in any component increases control risk, so auditors rely less on controls and do more substantive testing.