Internal control and management reporting: formula sheet

Key formulas

COSO internal control components

Control environment + Risk assessment + Control activities + Information and communication + Monitoring

Five components. Learn the order, with the control environment as the foundation.

COSO objectives categories

Operations + Reporting + Compliance

The three categories of objectives that the controls support.

Cost-benefit rule for controls

Benefit of control ≥ Cost of control

A rule of thumb for design. Benefits include losses avoided and better assurance.

Board responsibility under UK Code guidance

Board = determine risk appetite + maintain sound systems + review effectiveness + report

Review should cover all material controls, including financial, operational and compliance controls.

Control type grouping

Preventive, detective, corrective, directive

Use these labels when you classify controls in a scenario.

Control environment (definition)

Control environment = tone at the top + structure + authority + integrity and ethics + competence + board oversight

This is a checklist, not a calculation. Use it to structure comments on culture and governance.

Four control types by purpose

Directive (guide) → Preventive (stop) → Detective (find) → Corrective (fix)

Useful as a sequence. A good control system uses a mix, not just one type.

Cost-benefit test for a control

Implement a control if expected benefit (risk reduced) > cost of operating it

Benefits are often judgement-based. State the logic in words and avoid inventing figures.

Recommendation structure

Weakness → Risk it creates → Recommended control → Control type → Cost or limitation

Using this chain in every answer earns application and analysis marks.

Core purpose of internal audit

Assurance + advice on governance, risk management and internal control

Use this to define the role in one line before applying it to the case.

Key reporting line

Head of internal audit → audit committee (functional); finance director or CEO (administrative)

Functional reporting to independent NEDs protects objectivity.

Internal vs external audit: user

Internal = management and board; External = shareholders

Main contrast point. Also compare scope, appointment and legal requirement.

Need for internal audit: test

Need = scale + complexity + risk + regulation + weak control, against cost

A judgement, not a rule. Always weigh against cost and alternatives.

Internal audit report structure

Finding → Risk/Impact → Cause → Recommendation → Management response

Use this order for every control weakness you report. It shows you understand why the weakness matters, not just what it is.

Control review sequence

Objective → Risk → Control → Test → Conclusion

A sound approach to evaluating any control. Design effectiveness asks if the control would work. Operating effectiveness asks if it did work.

Outsourcing decision test

Benefit (skills, flexibility, independence) vs Cost (knowledge loss, confidentiality, reduced control)

Weigh both sides against the facts in the scenario and reach a reasoned conclusion.

Reporting line

Internal audit reports to the audit committee, not to the finance director alone

This protects independence and ensures findings reach those charged with governance.

Characteristics of good information (ACCURATE)

Accurate, Complete, Cost-beneficial, User-targeted, Relevant, Authoritative, Timely, Easy to use

A memory aid, not a fixed ACCA list. Use it to structure your answer and always apply each point to the scenario.

Cost-benefit test for information

Value of the information to decision-making ≥ Cost of producing it

Value is often hard to measure in money. Argue it in terms of better decisions or reduced risk.

Levels of information

Strategic (board, external, long term) → Tactical (middle managers, medium term) → Operational (day-to-day, detailed)

Match the report's content, detail and frequency to the level of the user.

Reporting and control loop

Plan/target → Measure actual → Compare (variance) → Report → Corrective action

Reporting is the link that closes the control loop. If it fails, control fails.

Audit committee composition (typical code position)

Independent NEDs only; at least one with recent and relevant financial experience

Exact numbers vary by code. Use the scenario's code if one is given, and do not quote a number you cannot support.

Oversight chain

Management designs and operates controls → internal audit tests them → audit committee reviews and challenges → board is responsible

Use this to show who does what. The board is always ultimately responsible.

Core responsibilities (memory aid)

Reporting, Controls and risk, Internal audit, External audit, Whistleblowing

Five headings to structure any answer on the committee's role.

Audit committee vs risk committee

Audit committee = assurance over controls and reporting; Risk committee = risk strategy, appetite and exposure

Overlap is common. Say so in the answer, and judge it against the company's situation.

Quick revision

• Internal control supports objectives, reliable reporting, compliance and protection of assets; it gives reasonable, not absolute, assurance.
• The control environment is the tone and culture set by the board and management.
• Controls can be preventive, detective or corrective; know an example of each.
• Segregation of duties, authorisation, physical safeguards and reconciliations are core procedures.
• Controls have limits: collusion, management override, human error and cost.
• Internal audit evaluates and reports on controls and risk management; it does not own them.
• Independence of internal audit depends on its reporting line, usually to the audit committee.
• Outsourcing internal audit may give expertise and flexibility but can reduce organisational knowledge and control.
• Good management information is accurate, relevant, timely, complete, understandable and cost-effective.
• The audit committee, made up of independent non-executives, oversees reporting, controls, risk and the audit functions.
• Always tie advice to the scenario: size, sector, risks and resources.
• Structure answers as weakness, consequence, recommendation.

Common mistakes

• Treating internal control and internal audit as the same thing. Fix: Say that internal control is the system owned by management. Internal audit is an independent function that reviews it as part of monitoring.
• Listing the five COSO components without applying them. Fix: Use the list only as a checklist. Each point must name a scenario fact, the risk and a fix.
• Giving a generic list of controls with no link to the scenario. Fix: Quote a case fact in every point and explain why the control suits this business.
• Ignoring the control environment and jumping straight to procedures. Fix: Ask whether the scenario shows poor tone at the top, weak oversight or pressure. If so, address it first.
• Treating internal audit as the same as external audit. Fix: State the differences: users, scope, appointment, legal requirement and opinion. Internal audit advises management; external audit reports on financial statements.
• Saying internal audit is independent without explaining how. Fix: Name the audit committee reporting line, approval of plan and head's removal, no operational duties and adequate resources.
• Listing generic advantages and disadvantages with no link to the scenario. Fix: Choose points that match the company's facts and refer to them by name, for example its overseas sites or its fraud history.
• Recommending outsourcing or in-house without a conclusion. Fix: Take a position and justify it. A reasoned view earns marks even if another view is possible.
• Listing characteristics of good information with no link to the scenario. Fix: Use each characteristic only with a scenario fact. Write: 'Reports are issued six weeks after month end, so they are not timely and variances cannot be corrected.'
• Treating all users as the same and ignoring the level of information. Fix: State who uses the report and whether they need strategic, tactical or operational information. Suggest different formats for the board and for line managers.

Exam tips

• Apply, do not recite. Marks come from linking each COSO component or limitation to a named fact in the scenario.
• Use clear sub-headings that match the requirement, such as one per component, so the marker can see your structure quickly.
• Always cover cost versus benefit and the idea of reasonable assurance when you evaluate a system.
• When asked about internal audit, separate it from internal control: internal audit reviews and reports, management owns the controls.
• Finish with a prioritised recommendation and a conclusion in the requested format to pick up professional skills marks.
• Treat the control environment as a separate point whenever the scenario mentions culture, pressure, management attitude or weak oversight.
• Label each recommended control by type. It shows technical knowledge and helps structure the answer.
• Tie every recommendation to a named fact in the case, and always say what risk it addresses.