Management and Internal Control Systems for ACCA SBL

What this chapter covers

Management and internal control systems: topics in the order to study them

1. 1Management Control Systems and Control FrameworksStart here because it sets the big picture and the vocabulary that every later topic uses.
2. 2Internal Control Systems and Their ComponentsOnce you know the frameworks, learn the building blocks of control so you can test a case against them.
3. 3Internal Control Weaknesses and RecommendationsThis is the main exam skill, so practise it as soon as you know the components.
4. 4Internal Audit Function and Its RoleInternal audit is a key part of the control environment and the usual body that monitors controls.
5. 5Outsourcing and In-house Internal AuditThis builds on the role of internal audit by asking how the function should be resourced.
6. 6External Audit and Audit CommitteesLearn the external and board-level oversight after internal audit, so you can compare the roles and see how they interact.
7. 7Systems of Control: Fraud, Compliance and WhistleblowingFinish with specific control areas, which bring together everything you have learned and rely on culture and ethics.

How to prepare Management and internal control systems

1. Read each topic once and write a one-page summary in your own words: what the concept is, why it exists, and what problem it solves.
2. Build a simple checklist for diagnosing a case: control environment, risk assessment, control activities, information and communication, and monitoring. Use it on every practice scenario.
3. For each weakness you find, write three parts: the weakness, the risk or consequence for this business, and a specific recommendation. Avoid generic advice that could fit any company.
4. Practise comparing options, such as outsourced versus in-house internal audit, and state a clear recommendation with reasons that use the facts in the case.
5. Link controls to governance, risk and ethics. Ask who is accountable, what the culture is, and whether the board is overseeing the issue properly.
6. Answer past-style tasks under time pressure and write in a professional format, such as a short report or briefing note. Check that you answered the exact requirement.
7. Review your answers against the marking approach: did you apply the scenario, give balanced points, and show scepticism about management claims?

Common mistakes in Management and internal control systems

• Listing textbook controls without linking them to the scenario.

  Fix: Quote or refer to a fact in the case, explain the risk it creates for this business, and tailor the recommendation to it.

• Identifying weaknesses but giving no recommendation, or a vague one.

  Fix: Use a fixed pattern of weakness, consequence and recommendation, and make each recommendation specific and practical.

• Confusing the roles of internal audit, external audit and the audit committee.

  Fix: Remember who each serves: internal audit serves management and the board, external audit serves shareholders, and the audit committee oversees both on the board's behalf.

• Recommending more controls without considering cost, culture or strategy.

  Fix: Weigh the cost and burden of a control against the risk it reduces, and consider how it affects staff behaviour and the business's aims.

• Treating governance and ethics as separate from control questions.

  Fix: Ask whether a weakness comes from poor board oversight, a dominant individual or a weak culture, and say so in your answer.

• Ignoring the requirement and format, and so losing professional skills marks.

  Fix: Spend a few minutes planning, answer the exact task in the requested format, and show analysis, scepticism and clear communication.

Last-day revision: Management and internal control systems

• ✓A control system helps achieve objectives, protect assets, support reliable reporting and ensure compliance.
• ✓Internal control gives reasonable assurance, not absolute assurance, because of human error, collusion and management override.
• ✓Diagnose a case by control environment, risk assessment, control activities, information and communication, and monitoring.
• ✓Every weakness answer needs three parts: the weakness, its consequence, and a specific recommendation.
• ✓Controls must be cost-effective and should support strategy, not block it.
• ✓Internal audit provides assurance and advice on risk, control and governance, and reports to the audit committee, not just to management.
• ✓Outsourcing internal audit can give expertise and flexibility, but may reduce organisational knowledge and raise confidentiality and independence concerns.
• ✓External auditors give an independent opinion on the financial statements; internal audit serves the organisation's own needs.
• ✓An audit committee is made up of independent non-executive directors and oversees reporting, controls, internal audit and the external auditor relationship.
• ✓Fraud risk rises with pressure, opportunity and rationalisation, so look for all three in a case.
• ✓Whistleblowing works only if staff trust the channel and are protected from retaliation.
• ✓Tone at the top and culture often matter more than the written procedures.

Management and internal control systems practice questions

• Aldous Retail has strict rules requiring three-way matching of orders, receipts and invoices, and managers must approve all purchases above …
• Mirabel Foods Inc.'s internal auditors have just completed a review that found weak authorisation controls over supplier master data. The ch…
• Which of the following is a core responsibility of an audit committee in relation to the external auditor?
• Kestrel Bank outsources internal audit to Harlow & Co, which is also the bank's external auditor. The audit committee chair is concerned. Wh…
• Orion Retail's audit committee wants to ensure that its internal audit function can report weaknesses in controls without fear of reprisal f…
• Dalmore Retail's board is reviewing its approach to controls. Management proposes a compliance-based approach to preventing fraud, with deta…
• Halvorsen Logistics has a finance clerk who also approves supplier invoices, raises payments and reconciles the bank account. The audit comm…
• Marlow Group is a listed company whose audit committee has only two members, both of whom are executive directors. A new investor asks what …

Management and internal control systems in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

• ACCA Applied KnowledgeInternal controls
• ACCA Applied SkillsThe scope of the internal audit function, outsourcing and internal audit assignments
• CMA IntermediateAudit Risk, Internal Control, Internal Check and Internal Audit
• CMA FinalInternal Control and Internal Audit