Systems of internal control: formula sheet

Key formulas

Objectives of internal control

Reliable reporting + efficient operations + legal compliance + asset safeguarding

Use these four as a checklist when a question asks what controls are for.

Components of internal control

Control environment + Risk assessment + Information and communication + Control activities + Monitoring

Learn the five in this order. Control environment is the foundation.

Level of assurance

Internal control gives reasonable assurance, not absolute assurance

Always link this to inherent limitations such as collusion and management override.

Control risk link

Strong controls → lower control risk → less substantive testing; weak controls → higher control risk → more substantive testing

Only rely on controls after tests of controls show they operate effectively.

Elements of the control environment

Management attitude + structure + authority and responsibility + HR policies + competence + oversight by those charged with governance

Use as a checklist. Link each element in the scenario to it by name.

Audit committee main roles

Financial reporting + internal control and risk review + internal audit oversight + external auditor relationship

Membership is normally independent NEDs, with at least one having recent relevant financial experience under many codes.

Impact on audit

Weak control environment → higher risk of material misstatement at overall level → more substantive procedures and less reliance on controls

State this link to earn the application mark.

Limitations of controls

Human error, collusion, management override, cost versus benefit

Even a strong environment gives reasonable, not absolute, assurance.

Preventive vs detective

Preventive = stops error before it happens; Detective = finds error after it has happened

Always say which one applies and why. Reconciliations and reviews of exception reports are usually detective.

Segregation of duties

Separate: authorisation, custody of assets, recording, and reconciliation/review

Where segregation is not possible, such as in a small entity, suggest compensating management review or oversight.

Control answer structure

Control + what it does + risk it addresses

Marks are awarded for the link to the risk, not for naming the control alone.

Manual vs automated

Automated = consistent but depends on IT general controls; Manual = flexible but prone to human error and override

Use this when asked to compare the two.

General controls (categories)

Access + Change management + Operations/backup + Recovery

Apply across all applications. Use these as headings in a written answer.

Application controls (categories)

Input + Processing + Output (+ master files)

Specific to one application. Link each control to an assertion such as completeness or accuracy.

Answer pattern

Risk → Control → Purpose

State what could go wrong, the control that prevents or detects it, and why it works.

Reliance rule

Effective general controls → application controls can be relied on

If general controls are ineffective, application controls may not operate consistently.

Internal vs external audit: purpose

Internal: evaluate and improve risk management, control, governance. External: give an opinion on whether the financial statements are true and fair (or fairly presented).

Use this as the first line of any comparison answer.

Internal vs external audit: appointment and reporting

Internal: appointed by management or the board, reports to management or the audit committee. External: appointed by shareholders (members), reports to shareholders.

Reporting line is the key independence point.

Internal vs external audit: scope and focus

Internal: scope set by the entity, any area, mainly operations and controls. External: scope set by law and auditing standards, financial statements.

External auditor needs reasonable assurance only on material misstatement.

Internal vs external audit: relationship to the entity

Internal: employee or outsourced provider, not independent of the entity. External: independent of the entity.

Internal auditors aim for objectivity, not full independence.

Factors in need for internal audit

Scale, diversity and complexity of operations; number of employees and locations; risk; cost versus benefit; regulation; management attitude; quality of other controls.

Always link each factor to the scenario facts.

Independence safeguards

Reporting to audit committee or board; unrestricted access; no operational duties; audit committee controls appointment, removal and budget; rotation of staff.

Name the threat first, then the safeguard.

Three-part point

Deficiency + Consequence + Recommendation

Each point in a management letter or exam answer should contain all three parts. Missing one loses marks.

Deficiency test

Control missing, badly designed, or not operating effectively

Use this to check that what you have identified is truly a deficiency and not just a feature of the business.

Reporting rule (ISA 265)

Significant deficiencies: communicate in writing, on a timely basis, to those charged with governance and to management at an appropriate level

Other deficiencies go to the appropriate level of management, orally or in writing, if not already communicated by others.

Content of a written communication

Description + potential effects + sufficient explanation + purpose and limits of the audit

Include a statement that the audit was not designed to identify all deficiencies.

Test of control structure

Control objective → Control → Test → Evidence expected

Write each test so it checks a named control, not a general area.

Tests of control methods

Inspection, observation, enquiry, re-performance, test data

Enquiry alone is weak evidence. Pair it with inspection or re-performance.

Result of tests

Controls effective → rely and reduce substantive work; controls ineffective → more substantive work

Always state the effect on the audit approach.

Walkthrough vs test of control

Walkthrough = understanding confirmed; Test of control = operating effectiveness over the period

Do not treat a walkthrough as proof the control worked all year.

Quick revision

• Internal control components: control environment, risk assessment process, information system, control activities, monitoring of controls.
• Controls provide reasonable assurance, not absolute assurance, because of inherent limits such as human error, collusion and management override.
• Preventive controls stop errors happening; detective controls find them afterwards; corrective controls fix them.
• Segregation of duties separates authorisation, custody of assets and recording of transactions.
• General IT controls cover access, program changes, development and operations; application controls work within a specific process.
• Examples of application controls include input validation, sequence checks, and exception reports.
• Internal audit is part of monitoring; the external auditor decides independently how much to rely on it.
• A significant deficiency should be communicated in writing to those charged with governance on a timely basis.
• Deficiency, consequence, recommendation: use this three-part structure in every written answer.
• Tests of control check that a control operated effectively; substantive procedures check amounts and disclosures.
• Methods of testing controls: inspection, observation, re-performance and enquiry combined with other evidence.
• Auditors record systems using narrative notes, flowcharts and questionnaires.

Common mistakes

• Confusing control environment with control activities. Fix: Control environment is attitude and culture (tone at the top, governance). Control activities are specific procedures such as authorisations and reconciliations.
• Claiming internal controls prevent all fraud and error. Fix: Say controls give reasonable assurance only, and cite limitations such as collusion, management override and human error.
• Listing textbook elements without linking them to the scenario. Fix: Quote or paraphrase the scenario fact in every point, then name the element.
• Confusing the control environment with control activities. Fix: Control environment is culture, tone and structure. Control activities are specific procedures such as authorisation, reconciliations and segregation of duties.
• Listing control names with no link to risk Fix: For every control write what it does and the risk it reduces. Use the scenario facts.
• Calling every review a preventive control Fix: If it happens after the transaction, such as a reconciliation or exception report review, it is detective.
• Confusing general and application controls, for example calling passwords an application control. Fix: Ask whether the control protects the whole system or checks one transaction type. Network passwords are general; a check that an employee number exists in payroll is application.
• Listing controls without explaining the risk or purpose. Fix: Write a full pair: for example, a backup stored offsite prevents permanent data loss after a fire or ransomware attack.
• Saying internal audit is compulsory for all companies. Fix: State that external audit is required by law for most companies but internal audit is generally a management or governance decision, unless a regulator or code requires it.
• Describing internal auditors as independent in the same way as external auditors. Fix: Say internal auditors are employees (or contractors), so they seek objectivity through safeguards such as reporting to the audit committee.

Exam tips

• In scenario questions, quote the fact first, then name the component or deficiency, then state the risk. Marks follow this chain.
• Objective tests often swap component names. Know exactly which component each example belongs to.
• When asked for limitations, give general ones. When asked for weaknesses, give ones specific to the scenario.
• Always end a written answer with the effect on the audit approach: control risk and the balance of tests of controls and substantive procedures.
• Use short, separate points with a clear heading for each, so the marker can award a mark for each one.
• In Section B OT cases, read the scenario for words about tone, structure and oversight. Questions often ask which element is weak, and only one option fits best.
• In Section C, every point needs a scenario fact. Generic lists score few marks.
• Always add the audit consequence when the requirement mentions the auditor. It is a frequent missed mark.