Management and internal control systems: formula sheet

Key formulas

COSO components

Control environment + Risk assessment + Control activities + Information and communication + Monitoring

Five components. Use them as a checklist to diagnose weaknesses in a case.

COSO objectives categories

Operations + Reporting + Compliance

Internal control supports all three, not just financial reporting.

Levels of control

Strategic (long term, whole organisation) → Tactical (resource use, budgets) → Operational (daily tasks)

Match each problem in the scenario to its level.

Control types by timing

Preventive, Detective, Corrective

Name the type when recommending a control.

Board duty under FRC guidance

Set risk appetite → Maintain systems → Review effectiveness at least annually

The board is responsible. Assurance is reasonable, not absolute.

Five components of internal control (COSO)

Control environment + Risk assessment + Control activities + Information and communication + Monitoring

Use these as headings to structure an answer on a control system. The control environment is the foundation for the rest.

Control types by timing

Preventive (before) | Detective (after) | Corrective (fix)

Preventive stops the event. Detective finds it. Corrective repairs the damage and stops recurrence.

Cost-benefit test for a control

Implement if expected risk reduction (benefit) > cost of the control

A rule of judgement, not a calculation. Always comment on cost and proportionality.

Weakness answer pattern

Weakness → Risk or consequence → Recommendation

Each point earns marks only if all three parts are present and linked to the scenario.

Answer structure for each point

Weakness + Consequence + Recommendation

Use this chain for every point. A weakness without a consequence or fix earns few marks.

Key control activities

Segregation of duties; authorisation; physical controls; reconciliations; supervision; documentation; IT access controls

Use as a checklist when choosing recommendations.

Control types

Preventive, detective, corrective

Say which type your recommendation is. Prefer preventive for high-risk areas.

Cost-benefit rule

Cost of control < Expected loss avoided

A recommendation should be proportionate. Small firms may use owner review instead of extra staff.

Limitations of control systems

Human error; collusion; management override; cost; unusual transactions; outdated controls

Use when asked why controls cannot give absolute assurance.

Internal audit core purpose

Internal audit = independent assurance + advice on risk management, control and governance

Use this as your opening definition. It is reported to the board or audit committee, not just to management.

Reporting line rule

Functional reporting → audit committee; administrative reporting → senior executive

Strong independence needs the audit committee to approve the plan, budget, and appointment or removal of the head of internal audit.

Internal vs external audit: who and why

Internal: appointed by management/board, scope set by the organisation, reports on controls and risk. External: appointed by shareholders, scope set by law and standards, reports on the financial statements

Both are needed. They differ in purpose, reporting, scope and independence, not in quality.

Need-for-internal-audit factors

Scale + diversity/complexity + risk + cost-benefit + staff issues + problems with controls

Use as a checklist when asked whether a company without internal audit should create one.

Purpose of external audit

Independent opinion on whether financial statements give a true and fair view under the reporting framework

It is an opinion, not a guarantee of accuracy or absence of fraud.

Audit committee composition

Independent non-executive directors, with at least one having recent and relevant financial experience

Check the code in the scenario. Codes vary by country, so state the principle.

Audit committee core duties

Reporting integrity + internal controls and risk + internal audit + external auditor relationship + whistleblowing

A useful checklist for any 'role of the audit committee' requirement.

Auditor independence threats

Self-interest, self-review, advocacy, familiarity, intimidation

Name the threat, then give the safeguard, such as rotation, separate teams, or restricting non-audit services.

Internal vs external audit

Internal: management-directed, wide scope, improves controls. External: shareholder-focused, statutory, opinion on financial statements

Compare on appointment, reporting line, scope, independence, objective and timing.

Fraud triangle

Fraud = Incentive/pressure + Opportunity + Rationalisation

Controls mainly reduce opportunity. Culture and ethics work on rationalisation.

Control types

Preventive → Detective → Corrective

Name the type for each control you suggest. A good answer has a mix of all three.

Core fraud controls

Segregation of duties + Authorisation + Reconciliation + Access restriction + Monitoring

Adapt each one to the specific process in the scenario.

Whistleblowing channel checklist

Confidential route + Senior independent recipient + Protection from retaliation + Investigation + Feedback

Use as a checklist when assessing or designing a policy.

Quick revision

• A control system helps achieve objectives, protect assets, support reliable reporting and ensure compliance.
• Internal control gives reasonable assurance, not absolute assurance, because of human error, collusion and management override.
• Diagnose a case by control environment, risk assessment, control activities, information and communication, and monitoring.
• Every weakness answer needs three parts: the weakness, its consequence, and a specific recommendation.
• Controls must be cost-effective and should support strategy, not block it.
• Internal audit provides assurance and advice on risk, control and governance, and reports to the audit committee, not just to management.
• Outsourcing internal audit can give expertise and flexibility, but may reduce organisational knowledge and raise confidentiality and independence concerns.
• External auditors give an independent opinion on the financial statements; internal audit serves the organisation's own needs.
• An audit committee is made up of independent non-executive directors and oversees reporting, controls, internal audit and the external auditor relationship.
• Fraud risk rises with pressure, opportunity and rationalisation, so look for all three in a case.
• Whistleblowing works only if staff trust the channel and are protected from retaliation.
• Tone at the top and culture often matter more than the written procedures.

Common mistakes

• Listing the COSO components from memory without applying them to the case. Fix: Attach a fact from the scenario to every component you mention. Marks go to application.
• Confusing strategic, tactical and operational control. Fix: Ask two questions: how long is the time horizon, and who acts? Board and long term means strategic. Budgets and managers means tactical. Daily tasks and staff means operational.
• Listing the five components with textbook definitions and no link to the scenario. Fix: Use the components only as a structure. Every point must quote or use a scenario fact.
• Naming a weakness but giving no consequence or recommendation. Fix: Always write weakness, risk, recommendation. Marks sit in the second and third parts.
• Listing textbook controls without using the scenario. Fix: Quote or refer to a specific fact in each point, such as the named role, system or location.
• Stating the weakness but not the consequence. Fix: Always add a sentence on what could go wrong for this company, such as fraud or misstated accounts.
• Treating internal audit as the same as external audit. Fix: Contrast purpose, appointment, scope, reporting and independence. External audit gives an opinion on the financial statements. Internal audit gives assurance on risk and control.
• Saying internal audit is responsible for internal controls. Fix: State that management designs and operates controls and the board is responsible for the system. Internal audit reviews and reports on them.
• Listing generic advantages and disadvantages with no link to the scenario. Fix: Attach every point to a fact in the case. Say why it matters for this company.
• Saying outsourcing is always cheaper or always more objective. Fix: Say it depends. Fees can exceed salaries for heavy use, and a provider may soften findings to keep the client.

Exam tips

• Do not recite frameworks. Use COSO or the FRC guidance as a lens and quote scenario facts as evidence.
• Name the level (strategic, tactical, operational) and the control type (preventive, detective, corrective) when you recommend something. It shows precision.
• Remember the professional skills marks: structure the answer in the format requested, be concise and show scepticism about management's claims of good control.
• Always mention limits of control, such as cost, override and collusion, in evaluation questions.
• Link control weaknesses to wider topics where relevant, such as governance, ethics, risk appetite or fraud.
• Use the five components as your answer structure, but never leave a heading without scenario facts under it.
• For every weakness, write the risk and a specific recommendation. Examiners reward the link between the three.
• Always comment on cost and practicality, especially in small or fast-growing businesses, and mention compensating controls.