The-Accountant-Jan-Feb-2018

Information Financial Reporting Technology and Assurance
Internal Control Systems
Assessment in Audit
By CPA Samuel K. Maritim
ISA 500 Audit Evidence paragraph
10 on selecting Items for Testing
to Obtain Audit Evidence states,
‘’when designing tests of controls
and tests of details, the auditor shall
determine means of selecting items for
testing that are effective in meeting the
purpose of the audit procedure.’’
An audit assignment should not just
aim at producing Financial Statements
for publication but should ensure
that the systems upon which such
financial statements are produced are
reliable and adequate in every respect.
In order to obtain such assurance,
tests and procedures should be carried
out to confirm the assertions held by
management emanating from their
systems. An Internal Control System is
one such system.
Internal Control System (ICS) is the
whole system of controls put in place by
management in order to safeguard, secure
and protect the assets of the company.
Internal control may be the equivalent
of steps and procedures put in place to
mitigate against all business risks by an
entity. The best evaluators of risks are
auditors because they are external to the
business and may have independent and
objective third party approach. An ICS is
business wide. It is present in every area
of operation e.g. in payments, income/
revenue recording and recognition, in
bank and cash management etc.
An audit cannot be complete in my
view without having to undertake an
Internal Control System Assessment
in order to measure and evaluate the
degree of risk the Auditor may be facing.
Assessing the Internal Control System is
in other words undertaking a risk based
audit which is more value adding than a
normal audit.
Structured Interviews
Arrange to carry out a series of structured
interviews with senior management
and other personnel at various
organizational levels. Management and
senior employees of the company hold
important information that will help map
out control procedures in the company.
Remember some controls may exist in
theory rather than in practice in a number
of companies and they could be working
very well. By holding such interviews, you
may capture some undocumented control
systems practiced by management.
Literature Review
The Assessor should review documented
accounting procedures, policies and
controls. He should further study the
financial regulations and procedures and
other organizational policies such as
human resource policies and practices.
The Assessor should check compliance of
internal controls and accounting systems
by inspecting documents and records
prepared and produced by these systems.
The output results should be consistent
with management expectations and
intended outputs.
System Features and Action
Points
In the process of executing a transaction,
from commencement to conclusion,
several actions are taken by different
people to produce the final outcome.
The Assessor should deliberately check
for system points where specific action
is required as an input in the process of
producing a transaction. Such actions
include but are not limited to checking
and supervising, examining, validating and
analysing content, quality and quantities
and appropriate approvals or rejections. It
is critical to note that all actions in the
control points should be evidenced by use
of initials, signatures, passwords and other
security codes. Further all action points
are segregated and distinct in nature.
Management Override
An Assessor should take necessary steps
and procedures to check and examine
for evidence of management override
4 JANUARY - FEBRUARY 2018