Internal Control
Internal Control
Internal Control
Internal Control
A comprehensive internal control system encompasses much more than accounting and related
records, however: physical safeguards, insurance protection, appropriate operating policies, and
good human resources management are also important elements of a system of internal control.
In other words, an internal control system consists of all the related methods and measures
adopted within an organization to:
According to the Canada Business Corporations Act, all federally incorporated companies are
required to maintain an adequate system of internal control, and the CICA stresses that this
internal control should address not only external financial reporting, but also the reliability of
internal reporting.
CS PERSPECTIVE
Another definition of internal control is provided in the CICA Handbook, as follows:
“Internal control comprises the plan of organization and all the co-ordinate systems
established by the management of an enterprise to assist in achieving management’s
objective of ensuring, as far as practical, the orderly and efficient conduct of its business,
including the safeguarding of assets, the reliability of accounting records and the timely
preparation of reliable financial information.”
As the foregoing excerpt from the CICA Handbook points out, the establishment and
maintenance of a good system of internal control is clearly an important management
responsibility. More will be said about this later.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
1
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Documents should be carefully designed, to ensure that they include all of the necessary
information. In addition, whenever possible, documents should be prenumbered, and all
documents should be accounted for. Prenumbering helps to prevent transactions from being
recorded more than once or, conversely, to prevent transactions from not being recorded at all. In
order for prenumbering to be effective, it is important to keep any voided documents so that all the
documents/numbers can be accounted for.
Finally, documents that are “source documents” for accounting entries should be forwarded to
the accounting department promptly, to help ensure timely recording of the transaction. This
control measure contributes directly to the accuracy and reliability of the accounting records.
Although accounting records are a very important component of this, an effective recordkeeping
and reporting system encompasses much more than accounting transactions. In order for a
system to be comprehensive, non-financial data related to the organization’s operations must also
be collected, recorded, analysed and reported.
Whenever possible (without creating pointless duplication of effort) data should be collected and
reported in such a way that the resulting records serve to cross-check one another.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
2
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Responsibility must also be assigned for the authorization and approval of transactions. For
example, the vice-president of sales is often assigned the authority to establish policies for
making credit sales. Typically, these policies require written approval of the credit department for
credit sales to specific customers.
Responsibility for recordkeeping for an asset and physical custody of that asset should
be assigned to different individuals.
Responsibility for recordkeeping for an asset and physical custody of that asset should be
assigned to different individuals.
An important aspect of safeguarding assets like cash, inventory and equipment is maintaining
records showing how much of each asset the organization is supposed to have at any point in
time. The records can then be checked against the quantities that are actually on hand, to
reveal any errors or misappropriations. However, if the person who keeps the records also
has access to the related assets, then theft or fraud could occur and the records could be
altered to hide it.
For example, personnel who receive, disburse, or otherwise handle cash should not maintain,
or even have access to, the cash records. In this way, if someone handling the cash makes a
mistake or engages in theft, there will be a difference between the amount of cash that is
actually on hand or in the bank and what the records show should be there. The difference
could then be investigated and corrective action taken.
To recap this very important element of internal control: If the accounting system is to
provide a valid basis of accountability for an asset, the record keeper should have neither
physical custody of the asset nor access to it. Similarly, the custodian of the asset should not
maintain or have access to the accounting records. The custodian of an asset is not likely to
convert the asset to personal use if another employee maintains the accounting records which
show that the asset should be on hand. The separation of accounting responsibility from the
custody of assets is especially important for cash and inventories, because these assets are
very vulnerable to misappropriation.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
3
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
When one individual is responsible for several related activities, the potential for errors and
irregularities is greatly increased. For example, in both the purchasing and selling areas
related activities should be assigned to different individuals, as described below.
Related purchasing activities include ordering merchandise, receiving goods, and paying (or
authorizing payment) for merchandise. Without proper separation of these purchasing
activities, orders could be placed with friends or with suppliers who give kickbacks. In
addition, payment might be authorized without a careful review of the invoice or, even
worse, fictitious invoices might be approved for payment. When the responsibilities for
ordering, receiving, and paying are assigned to different individuals, the risk of such abuses
is minimized.
Related sales activities also should be assigned to different individuals. Related sales
activities include making a sale, shipping (or delivering) the goods to the customer, and
billing the customer. When one person is responsible for these related sales activities,
salespersons could make sales at unauthorized prices to increase their sales commissions,
shipping clerks could ship goods to themselves, or billing clerks could understate the amount
billed for sales made to friends and relatives. These abuses are less likely to occur when
salespersons make the sale, shipping department employees ship the goods on the basis of the
sales order, and billing department employees prepare the sales invoice after comparing the
sales order with the report of goods shipped.
The principle of segregation of duties should also be applied within the recordkeeping
system itself. For example, different personnel should record cash receipts and cash
disbursements. Likewise, one person or group should maintain the general ledger (in which
the total amounts of major assets such as accounts receivable, inventory and equipment are
recorded), and another person or group should maintain the subsidiary ledgers (in which the
details of each customer’s account, each item of inventory, and each piece of equipment are
recorded).
In practice, it is usually quite difficult for small organizations with only few employees to
achieve the desirable level of segregation of duties. In such cases, the owner(s) may need to
become directly involved in monitoring sensitive areas, such as cash and inventories.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
4
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Some assets (such as cash, certain types of inventory and equipment, vehicles, etc.) are very
susceptible to theft and should be kept in locked or otherwise secured areas, in order to prevent
unauthorized access. Here’s an interesting twist on an internal control problem related to
inventory.
In business establishments such as bars and nightclubs, you might think that a major
control issue would be preventing theft of the inventory of liquor. However, you might
be surprised to know that there is also a major control issue related to preventing
employees from bringing inventory into the business. Why would employees want to
do this? The explanation is that they could sell drinks from the liquor they bring in,
not record these sales, and then keep the proceeds. They would thereby get the profit
margin on these sales, rather than the establishment.
To prevent unauthorized access, the computer system may require that passwords be entered and
random personal questions be correctly answered. Biometric controls, such as fingerprints or
retinal scans, can also be used before system access is allowed. Once access has been allowed,
other program controls can identify data having a value higher or lower than a predetermined
amount (referred to as limit or reasonableness checks), validate calculations (mathematical
checks), and detect improper processing orders (sequence checks).
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
5
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
A spin-off benefit of taking out insurance coverage is that (in order to reduce the likelihood and
magnitude of claims) insurance companies often provide helpful advice regarding how controls
can be improved and losses can be reduced or eliminated.
Bonding contributes to the safeguarding of assets in two ways: first, the insurance company will
carefully screen all individuals before adding them to the policy, and may identify and reject
risky applicants. Second, there will be a deterrence effect because bonded employees know that
the insurance company will prosecute any offenders.
For example, the control that is normally provided by segregation of duties can be circumvented
if employees engage in collusion (that is, if they agree to work together in order to cover up
errors or fraud). Although it may be impossible to prevent this entirely, collusion is much less
likely to occur in organizations whose employees are well motivated and feel that they are being
treated fairly.
It is certainly not our intention to suggest that all, most or even many employees, customers and
suppliers are dishonest, but rather to highlight management’s responsibilities. In particular, if
management expects others to behave in an ethical manner it must recognize that it has ethical
responsibilities in this regard as well, which include:
Ensuring that its employees are compensated fairly, so that they will not feel that they are
justified in helping themselves to more of the organization’s assets
Ensuring that its employees, customers or suppliers are not “led into temptation” (that is, not
put into situations in which they may be tempted to engage in dishonest activities, due to
management’s failure to maintain an effective system of internal controls).
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
6
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Establishment of Benchmarks
Budgets and other projections that set out the expected levels of cash receipts, inventories, etc.
should be part of a system of internal control. By comparing the actual amounts of the assets that
are on hand to the amounts that were expected to be on hand, management can spot any
significant differences and seek explanations for them. Any errors or other discrepancies can
thereby be quickly brought to light and investigated.
Independent Verification
Most systems of internal control provide for independent internal verification. This principle
involves the review, comparison, and reconciliation of data prepared by employees. Ideally, for
maximum efficiency combined with control, the work of one employee should, whenever
possible, provide a reliable basis for cross-checking the work of another employee, without
duplication of effort.
For other than routine cross-checks that are built into the accounting system, the following three
points are recommended in order to obtain maximum benefit from independent internal
verification:
Any discrepancies and exceptions should be reported directly to a management level that can
take appropriate corrective action.
In large companies, many of the tasks of independent internal verification are often assigned to
internal auditors. Internal auditors are employees of the company who monitor the
effectiveness of the company’s system of internal control. They periodically review the activities
of departments and individuals to determine whether prescribed internal controls are being
followed. The importance of this function is illustrated by the fact that most fraud is discovered
by companies through internal mechanisms, such as existing internal controls and internal audits.
For example, the alleged fraud at WorldCom, involving billions of dollars, was uncovered by an
internal auditor.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
7
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Two other internal control measures that are somewhat related to the concept of independent
verification are rotating employees’ duties and requiring employees to take vacations. These
measures are designed to deter employees from attempting fraud or theft, since they will not be
able to permanently conceal their improper actions. Many bank embezzlements, for example,
have been discovered when a new employee took over because the perpetrator was on vacation
or assigned to a new position.
As discussed in the text, most enterprises have independent external auditors who are engaged
by the Board of Directors, on behalf of the shareholders, to review the financial statements and
express an opinion regarding their fairness. The audit that they conduct includes examining, on a
test or sampling basis, the evidence supporting the amounts and disclosures in the financial
statements, to determine their validity and adequacy, and assessing the accounting principles
used and the significant estimates made by management.
In response to the corporate scandals that involved companies such as Enron, WorldCom, and
Global Crossing, legislators around the world introduced wide-ranging reforms to improve
accountability. One such example is the Sarbanes-Oxley Act in the United States, which,
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
8
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
amongst other provisions, requires accounting firms to attest to the adequacy of the internal
controls in the companies they audit.
In recent years there has been considerable debate regarding the extent to which the
independence of a firm of external auditors may be impaired when, for example, the firm also
provides accounting, consulting, tax or other services to its audit clients and derives large fees
from this work. Can the auditors be truly independent when doing an audit if a significant
amount of their revenues are dependent upon maintaining a positive relationship with the client
organization? Our intention is not to try to answer this question, as it involves complex
professional, legal and ethical considerations. However, you should be aware that “auditor
independence” is a very important and controversial issue.
Finally, most large organizations have a committee of the Board of Directors, usually called the
Audit Committee, which liaises with the internal audit staff (if any) and the external auditors in
order to ensure that any concerns they may have can be conveyed to the Board without
interference from management.
Note the following two paragraphs in particular, from this statement acknowledging
management’s responsibility (with bold added for emphasis).
“In meeting our responsibility for the reliability of financial information, management
maintains and relies on a comprehensive system of internal controls, including
organizational, procedural and internal accounting records.
To augment this internal control system, FHR maintains a program of internal audits
covering significant aspects of its operations. These controls and audits are designed to
provide reasonable assurance that assets are safeguarded, transactions are executed
and recorded in accordance with management’s authorization, and relevant and
reliable financial information is produced.
The Board of Directors is responsible for reviewing and approving the financial
information contained in the Annual Report, and overseeing management’s responsibilities
for the presentation and preparation of financial information, as well as the
maintenance of appropriate internal controls, management and control of major risk
areas, and assessment of significant and related party transactions. The Board carries out
this responsibility principally through the Audit Committee, which consists entirely of
non-management directors.”
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
9
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Cash sales and collections on account from customers are usually, by a wide margin, the largest
sources of cash receipts. Since the latter (collections on account from customers) are usually
received in the form of cheques, it is the former (cash sales) that are the most sensitive type of
transaction in terms of internal control considerations.
A very common measure for controlling cash sales is the use of locked cash registers or other
point-of-sale devices which print consecutive numbers on the receipts for each transaction. One
copy of the transaction receipt is usually given to the customer, while another copy is locked
inside the machine. Only the supervisor who empties the register and checks the amount of cash
on hand against the amount of sales recorded on the tape has access to this record. In order to
avoid disputes, and to prevent the supervisor from possibly “skimming” some cash, the
supervisor should count the cash in the presence of the cashier involved.
Generally, effective internal control over cash receipts requires that cash receipts should be
deposited intact into the bank account on a daily basis.
Some of the ways in which the internal control principles and elements explained earlier apply to
cash receipt transactions are shown in the following illustration. As might be expected, however,
organizations vary considerably in how they apply these principles to their particular operations.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
10
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
You should bear in mind that “cash” receipts can occur in many forms. In addition to currency
and cheques, cash includes credit card and debit card transactions, and other direct payments
such as EFT (electronic funds transfers) to the company. Each of these pose challenges for the
internal control system.
Generally, effective internal control over cash disbursements requires that payments or
disbursements should be made by cheque, rather than by cash. Such payments should be
made only after specified control procedures have been followed. In addition, the “paid” cheques
provide documentation and proof of payment.
Some of the ways in which the internal control principles and elements explained earlier apply to
cash disbursement transactions are shown in the illustration below. However, as you might
expect, organizations vary significantly in how they apply these principles to their particular
operations.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
11
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Finally, on the topic of cash control, it is important to bear in mind the central role of the
organization’s bank accounts. As mentioned earlier in the section on independent verification,
and as discussed and illustrated in the text, a bank reconciliation is an extremely important
control measure. Bank reconciliations must be prepared regularly (in small businesses, at least
monthly; in larger businesses, more frequently).
To illustrate, consider shoplifting losses in retail stores. Such losses might be completely
eliminated by having a security guard stop and search customers as they leave the store. Store
managers have concluded, however, that the negative effects of this procedure cannot be
justified. Instead, stores have attempted to “control” shoplifting losses by using less costly and
intrusive procedures such as:
Posting signs saying, “We reserve the right to inspect all packages” and “Shoplifters will be
prosecuted”
Using hidden TV cameras and store detectives to monitor customer activity
Using sensor equipment at exits.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
12
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
The human element is an important factor in every system of internal control. A good system
can become ineffective as a result of employee fatigue, carelessness, or indifference. For
example, an unmotivated receiving clerk may not bother to count goods received, or may falsify
or “fudge” the counts. Occasionally, two or more individuals may work together to get around
prescribed controls. As mentioned previously, such collusion can seriously impair the
effectiveness of the system, because it eliminates the protection expected from separation of
duties. For example, if a supervisor and a cashier collaborate to understate the amount of cash
receipts, the system of internal control may be subverted (at least in the short run).
As discussed earlier, the size of a business may impose limitations on its internal control
procedures. In a small company, for example, it may be difficult to apply the principles of
separation of duties and independent internal verification, because of the small number of
employees. In such instances, the owner usually assumes direct responsibility for, or oversees,
incompatible functions and internal verification.
Computer systems provide unique and very significant internal control challenges. In many
instances, computerization has shifted the responsibility for internal control to system designers,
programmers and end-users. For example, with point-of-sale systems, accountants are not
required to record daily transactions. The computer automatically records the transaction when
the cashier or clerk makes the sale. It is especially important to maintain effective control over
procedures related to authorization, access, and documentation in computerized systems.
Unfortunately, computer-related frauds are a major concern in business. The average computer
crime loss is nearly $1,000,000, compared with an average loss of only $30,000 resulting from
other types of white-collar crime. This is partially due to the fact that computer fraud can be
perpetrated almost invisibly and with electronic speed. Another important factor is that stealing
using an impersonal computer system seems, psychologically, far less criminal to some people.
Therefore, there is less of a moral barrier related to committing computer fraud than there is for
fraud involving person-to-person interaction.
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
13
Financial Accounting: A User Perspective, Fourth Canadian Edition Hoskin, Fizzell, Cherry
Supplementary Material to Accompany Financial Accounting: A User Perspective, Fourth Canadian Edition
14