Overview of Control Concepts
Internal controls are
the mechanisms,
rules, and
procedures implemented by a company to ensure the
- integrity of financial and accounting information,
- promote accountability and prevent fraud. To’annoon keessoo
mala, dambiiwwan, fi hojimaata dhaabbati tokko qulqullina
odeeffannoo faayinaansii fi herregaa mirkaneessuu, itti
gaafatamummaa guddisuu fi hanna ittisuuf hojiirra
oolchudha.
Internal control is the plan of organization and the methods a business
uses to safeguard assets, provide accurate and reliable information,
promote and improve operational efficiency, and encourage
adherence hordooffi to prescribed managerial policies.
The primary purpose of internal controls is to help safeguard an
organization and further its objectives. Kaayyoon to’annoo
keessoo inni jalqabaa dhaabbata tokko eeguu fi kaayyoo
isaa fuulduratti tarkaanfachiisuuf gargaaruudha.
Internal controls functions are to:
Minimize risks and protect assets,
Ensure accuracy of records,
Promote operational efficiency, and
Encourage adherence to policies, rules, regulations, and laws.
Internal Control Classifications
The specific control procedures used in the internal control and
management control systems may be classified using the following
four internal control classifications:
1. Preventive, detective, and corrective controls
(To’annoo ittisaa, qorannoo fi sirreeffama
• Preventive controls - Prevent problems from occurring
• Detective controls - discover problems that are not prevented
• Corrective controls - identify and correct problems; correct and
recover from the problems.
2. General and application controls
3. Administrative and accounting controls
4. Input, processing, and output controls
Control Activities
A. Proper Authorization of Transactions and Activities
• Authorization is the empowerment management gives employees
to perform activities and make decisions.
• Digital signature or fingerprint is a means of signing a document
with a piece of data that cannot be forged.
• Specific authorizationis the granting of authorization by
management for certain activities or transactions.
B. Segregation of Duties
• It refers to dividing responsibility for different portions of a
transaction among several people.
• Good internal control demands that no single employee be given
too much responsibility.
What functions should be performed by different people?
• Authorizing functions
– Authorization of transactions
• Recording functions
– Preparing source documents
– Maintaining journals
– Preparing reconciliations
– Preparing performance reports
• Custodial functions
– Handling cash
– Handling assets
– Writing checks
– Receiving checks in mail
• It helps to safeguard assets and improve accuracy because each
person can look at and thereby limit the others’ actions.
• If two of these three functions are the responsibility of a single
person, problems can arise.
• Segregation of duties prevents employees from falsifying records
in order to conceal theft of assets entrusted to them.
• Prevent authorization of a fictitious or inaccurate transaction as a
means of concealing asset thefts.
C. Design and Use of Adequate Documents and Records
• The proper design and use of documents and records helps ensure
the accurate and complete recording of all relevant transaction
data.
• Documents that initiate a transaction should contain a space for
authorization.
Control frame works
A. Internal Environment
• Management’s philosophy, and risk appetite
• Commitment to integrity, ethical values, and competence
• Organizing structure
• Methods of assigning authority and responsibility
• Human resource standard
B. Objective Setting
• Strategic objectives ▫ High-level goals
• Operations objectives ▫ Effectiveness and efficiency of operations
• Reporting objectives ▫ Improve decision making and monitor performance
• Compliance objectives ▫ Compliance with applicable laws and regulations
C. Event Identification
Identifying incidents both external and internal to the organization that could affect the
achievement of the organizations objectives.
Key Management Questions:
• What could go wrong?
• How can it go wrong?
• What is the potential harm?
• What can be done about it?
D. Risk Assessment
Risk is assessed from two perspectives:
• Likelihood ▫ Probability that the event will occur
• Impact ▫ Estimate potential loss if event occurs
Types of risk
• Inherent ▫ Risk that exists before plans are made to control it
• Residual ▫ Risk that is left over after you control it
E. Risk Response
• Reduce ▫ Implement effective internal control
• Accept ▫ Do nothing, accept likelihood and impact of risk
• Share ▫ Buy insurance, outsource, or hedge
• Avoid ▫ Do not engage in the activity
F. Control Activities
• Proper authorization of transactions and activities
• Segregation of duties
• Project development and acquisition controls
• Change management controls
• Design and use of documents and records
• Safeguarding assets, records, and data
G. Monitoring
• Perform internal control evaluations (e.g., internal audit)
• Implement effective supervision
• Use responsibility accounting systems (e.g., budgets)
• Monitor system activities
• Track purchased software and mobile devices
• Conduct periodic audits (e.g., external, internal, network security)
• Employ computer security officer
• Install fraud detection software
• Implement fraud hotline
