GROUP 3

INTERNAL CONTROLS

A Written Report
Presented to
The class of Professor Olivia C. Ayuyao
Polytechnic University of the Philippines
Sta. Mesa, Manila

In Partial Fulfillment
Of the Requirement for the Subject
ACCO 2083

Presented By:
Dancel, Jeniffer
Daria, Via Sacarine
Delos Angeles, Cedric
Dionisio, Meldred
Esquejo, Venus
INTERNAL CONTROL
 “A process, effected by entity’s board of directors, management and other personnel,
designed to provide reasonable assurance regarding the achievement of objectives relating
to operations, reporting, and compliance.” – Committee of Sponsoring Organizations of
the Treadway Commission (COSO)
 “It is the plan of organization and all the coordinate methods and measures adopted within
an organization or agency to safeguard the assets, check the accuracy any reliability of its
accounting data, and encourage adherence to prescribe managerial policies.” – Section
123, P.D. 1445
IMPORTANT ELEMENTS of the COSO DEFINITION:
 Internal control is a process. – It is subject to process improvement; single correct
answers to control problem seldom exist. Accountants must use judgement and experience
in designing and implementing internal controls; the controls must be periodically
reviewed to ensure the continued effectiveness.
 Internal control necessarily involves people throughout the organization. – The COSO
definition positions internal control firmly and broadly within the organization. Internal
controls require discussion during design, implementation, and evaluation. They impact
human behavior, and control system designers, as far as possible, must anticipate their
behavioral effects.
 Internal controls are designed to provide reasonable assurance. – Internal control
should not, and probably cannot, be designed to provide absolute assurance of anything.
Almost internal control can be circumvented through collaboration or collusion. For
example, if a warehouse employee works with a receiving clerk, it may be possible to steal
inventory in spite of strong separation of duties.
IMPORTANCE OF INTERNAL CONTROL
The internal control system comprises policies, practices, and procedures employed by the
organization to achieve four broad objectives:
1. To safeguard assets of the firm.
2. To ensure the accuracy and reliability of accounting records and information.
3. To promote efficiency in the firm’s operations.
4. To measure compliance with management’s prescribed policies and procedures.

FOREIGN CORRUPT PRACTICES ACT (FCPA)

 It was passed by the U.S. Congress in 1977.
 Bribery is an acceptable way of business. Bribery involves giving, offering, soliciting, or
receiving things of value to influence an official in the performance of his or her lawful
duties.
  FCPA requires corporations covered by its provisions to maintain an adequate system of
internal accounting controls.
 “no person shall knowingly circumvent or knowingly fail to implement a system of internal
accounting controls or knowingly falsify any book, record or account.”
 The legislation also mentions the concept of reasonable assurance, defining it as “such level
of detail and degree of assurance as would satisfy prudent officials in the conduct of their
own affairs.”
 Companies failing to comply with the Foreign Corrupt Practices Act can be subject to both
fines and imprisonment.

SARBANES-OXLEY ACT OF 2002 (SOX)

 SOX is the most sweeping accounting related legislation business professionals have seen
since FCPA.
 It is a broad-reaching act that significantly changed the way U.S. companies do business,
as well as impacting the roles if top management, the board of directors, independent
auditors, and audit committees.
 SOX has many provisions designed to deal with specific problems relating to capital
markets, corporate governance, and the auditing profession.
Provisions od SOX related to internal controls include:
 Management and the external auditors must assess the company’s internal controls on an
annual basis.
 Management has certain required disclosures when reporting to the SEC. They include that
management is personally and organizationally responsible for the design and
implementation of internal controls, particularly as they relate to reasonable assurance of
reliable financial statements. Management also must disclose any internal control changes
since the last reporting cycle, if those changes is likely to have a noticeable effect on
internal controls over financial reporting. Finally, management must certify that they have
informed the auditors and the board of directors’ audit committee of any significant
problems or weaknesses in internal control.
 Management must personally sign the required certifications and reports related to the
preceding items. The signature cannot be delegated, even via a power of attorney.
RISK
Risk is a chance or possibility of danger, loss, injury, or other adverse consequences. It is the
possibility of suffering a loss or injury.
There are four categories of risk:
 Financial Risks
 Operational Risks
 Strategic Risks
 Hazard Risks

FINANCIAL RISK
Is a risk that is are related to monetary activities. It is the possibility that shareholders or
other financial stakeholders will lose money when they invest in a company that has debt if the
company's cash flow proves inadequate to meet its financial obligations. When a company uses
debt financing, its creditors are repaid before shareholders if the company becomes insolvent.
Financial risk also refers to the possibility of a corporation or government defaulting on its bonds,
which would cause those bondholders to lose money.

1. Market Risk - refers to changes in a company’s stock prices, investment values, and
interest rates. It is the possibility of an investor experiencing losses due to factors that affect
the overall performance of the financial markets in which he or she is involved. Market
risk, also called "systematic risk,” cannot be eliminated through diversification, though it
can be hedged against. Sources of market risk include recessions, political turmoil, change
in interest rates, natural disasters and terrorist attacks.
2. Credit Risk - is associated with customers’ unwillingness or inability to pay amounts owed
to the organizations. Credit risk is most simply defined as the potential that a bank borrower
or counterparty will fail to meet its obligations in accordance with agreed terms.
3. Liquidity Risk - involves the possibility that a company will not have sufficient cash assets
available to meet its short-term obligations. It generally arises when a business or
individual with immediate cash needs, holds a valuable asset that it cannot trade or sell at
market value due to lack of buyers, or due to an inefficient market where it is difficult to
bring buyers and sellers together.

OPERATIONAL RISK

concerns the people, assets, and technologies used to create value for the organization’s
customers. Operational risk is the prospect of loss resulting from inadequate or failed procedures,
systems or policies.

1. Systems Risk - relates directly to information technology.

 2. Human Error Risk - recognizes the possibility that people in the organization will make
mistakes.

STRATEGIC RISK

It relates to the entity’s decision-making process at the senior management and board of
the director’s level.

1. Legal and Regulatory Risk - is concerned with the chance that those parties might break
laws that result in financial, legal, or operational sanctions. Regulatory risk is the risk that
a change in laws and regulations will materially impact a security, business, sector or
market. A change in laws or regulations made by the government or a regulatory body can
increase the costs of operating a business, reduce the attractiveness of an investment, or
change the competitive landscape.
2. Business Strategy Risk - comprises poor decision-making related to a company’s basis
for competing in its markets. It is possible source of loss that might arise from the pursuit
of an unsuccessful business plan. For example, strategic risk might arise from making poor
business decisions, from the substandard execution of decisions, from inadequate resource
allocation, or from a failure to respond well to changes in the business environment.

HAZARD RISK

1. Directors’ and Officers’ Liability - refers to the risks bore by organizations which
directors and officers are accused of mismanagement by shareholders, government
agencies, employees, or other stockholders.

COSO'S INTERNAL CONTROL INTEGRATEDD FRAMEWORK

COSO (COMMITTEE OF SPONSORING ORGANIZATION OF THE TRADEWAY

COMMISSION)
 was organized in 1985 to sponsor the National Commission on Fraudulent Financial
Reporting, an independent private-sector initiative that studied the casual factors that can lead
to fraudulent financial reporting.
 It also develops recommendation for public companies and their independent auditors, for the
SEC and other regulators, and for educational institutions.
COSO compromises five professional accounting organization:
1. American Accounting Association ( AAA )
2. American Institute of Certified Public Accountants ( AICPA )
3. Financial Executives Institute ( FEI )
4. Institute of Internal Auditors ( IIA )
5. Institute of Management Accountants ( IMA )

COSO'S INTERNAL CONTROL INTEGRATED FRAMEWORK

 Originally published in 1992
 In 2010, COSO decided to update the 1992 framework and it took over a two and a half years
period to developed and authored by PricewaterhouseCoopers (PwC) under the direction of
the COSO board.
 COSO'S INTERNAL CONTROL INTEGRATED FRAMEWORK was updated in 2013.

COSO laid out the similarities and differences between the original and updated frameworks as
follows:

 Similarities:
1. Internal control definition
2. Objective categories: operation, reporting, and compliance
3. Components of a strong internal control plan
4. Necessity for all plan components to work together
5. Importance of judgement in establishing sound internal control

 Differences:
1. Environmental changes, such a economic conditions and legal considerations
2. Expanded objectives for operations and reporting
3. Creation of the fundamental concepts that support the components
4. Additional examples and approaches.
FIVE COMPONENTS OF COSO INTERNAL CONTROL INTEGRATED
FRAMEWORK
1. Control Environment
 often referred to as the “tone at the top”
 ensures that internal control is seen as a serious, important, worthy topic throughout the
organization
 Organizational Structure
 Integrity and Ethical Values
 Commitment to Competence
 Board of Directors and Audit Committee
 Management's Philosophy and Operating style
 Assignment of Authority and Responsibility
 Human Resources Policies and Procedure

2. RISK ASSESSMENT
 Clarifying an organization's risk exposure
 Company-wide Objectives
 Process-level Objectives
 Risk Identification and Analysis
 Managing Change

3. CONTROL ACTIVITIES
 Developing specific control to address the risk exposure
 Policies and Procedures
 Security (Application and Network)
 Application Change Management
 Business Continuity/Backups
 Outsourcing

4. INFORMATION AND COMMUNICATION

 Ensuring stakeholders know about the internal control plan
  Quality of information
 Effectiveness of Communication

5. MONITORING
 A process for keeping the plan update and relevant
 Ongoing Monitoring
 Separate Evaluations
 Reporting Deficiencies

17 PRINCIPLES TO PROVIDES MORE DETAILS ABOUT THE FIVE COMPONENTS

COMPONENT 1: CONTROL ENVIRONMENT

1. Demonstrates commitment to integrity and ethical values
2. Exercises oversight responsibility
3. Establishes structure, authority and responsibility
4. Demonstrates commitment to competence
5. Enforces accountability

COMPONENT 2. RISK ASSESSMENT

6. Specifies suitable objectives
7. Identifies and analyzes risk
8. Assess fraud risk
9. Identifies and analyzes significant change

COMPONENT 3. CONTROL ACTIVITIES

10. Selects and develops control activities
11. Selects and develops general controls over technology
12. Deploys through policies and procedures
COMPONENTS 4. INFORMATION AND COMMUNICATION
13. Uses relevant information
14. Communicates internally
15. Communicates externally

COMPONENTS 5. MONITORING ACTIVITIES

16. Conducts ongoing and/or separate evaluations
17. Evaluates and communicates deficiencies

Each of the five components and relevant principles is present and functioning.

PRESENT
 Refers to the determination that the components and relevant principles exist in the design
and implementation of the system of the internal control to achieve specified objectives.

FUNCTIONING
 Refers to the determination that the components and relevant principles continue to exist
in the operations and conduct of the system of internal control to achieve specified
objectives.
The five components operate together in an integrated manner.
 Components should not be considered discretely; instead they operate together as an integrated
system.
 Components are interdependent with a multitude of interrelationships and linkage among
them, particularly the manner in which principles interact within and across components.

OPERATING TOGETHER
 Refers to the determination that all five components collectively reduce, to an acceptable
level, the risk of not achieving the objective.
INTERNAL CONTROL EXAMPLES
Internal control systems are as unique and different as the organizations and managers that utilize them.

1. Adequate Documentation
 Understanding how things are supposed to happen in an accounting information system is an
important first step in designing and assessing internal controls.

2. Background checks
 Employees in sensitive positions, such as those who deal with large amounts of money, background
checks are essential.

3. Backup of computer files

 If done regularly, backing of computer files takes only a few minutes-a smaller inconvenience
compared to the alternative of recreating files from scratch.

4. Backup of power supplies

 A few years ago, California was subject to power blackouts when the state’s electrical grid was
overloaded. During that time, backup power supplies were commonly employed as an internal
control.

5. Bank Reconciliation
 Reconciling the bank statement at least monthly can be helpful in spotting out-of-sequence checks,
fraudulent signatures, and errors in the information system.

6. Batch control totals

 When an accounting information system is processing a group (batch) of documents, users can
calculate various control totals to promote data integrity.

7. Data encryption
 Without it, hackers and other computer criminals can easily access, change, and/or steal data,
compromising data integrity and privacy throughout the accounting information system.

8. Document Matching
 Whether electronic or paper-based, document matching helps ensure that vendor invoices are only
paid when merchandise has been properly ordered and invoiced.

9. Echo checks
 The information system “echoes” the data you’ve entered back to you before it completes final
processing.

10. Firewalls
  They can prevent unauthorized intrusions into an accounting information system and warn users
when such intrusions are detected.

11. Insurance and bonding

 While insurance and bonding cannot prevent internal control breaches, they can help organizations
correct any financial losses they experience as a result.

12. Internal Audits

 Internal Audits can reveal indications of fraud, waste, and inefficiency, thus strengthening internal
control.

13. Limit checks

 Most general ledger packages limit transaction dates to the current year; they don’t allow users to
pre- or post-date transactions.

14. Lockbox systems

 Lockbox systems help promote strong internal control over cash. Rather than remitting payment
directly to an organization, customers send their payment to a lockbox.

15. Physical security

 Simple actions such as locking doors and securing computers and related equipment can go a long
way in safeguarding assets.

16. Preformatted data entry screens

 Using preformatted data entry screens for things like customer orders and cash disbursement
processing greatly improves data entry efficiency.

17. Prenumbered documents

 Checks, purchase orders, sales invoices, and other documents should prenumbered to promote
strong internal control.

18. Restrictive endorsement and daily deposits of checks received

 Restrictive endorsements give the bank more specific instructions that limit the uses of the endorsed
check; the most common is for deposit only,”, often with an account number included. In addition,
all cash receipts (coin, currency, and checks) should be deposited daily in the bank to keep them
secure.

19. Segregation of duties

 Basically, segregation of duties means that, to the extent possible, three different people should
each take on one responsibility with respect to a specific asset: authorization for use, physical
custody, and recordkeeping.
20. User training
 Employees should receive periodic training/reminders about appropriate internal control
procedures, their rationales, and the reasons they exist.

INTERNAL CONTROL APPLICATIONS

This section of our group report presents four vignettes, meaning a short scene that captures a
single moment or a defining detail about a character, idea, or other element of the story. Through
provision of these simple yet elaborative scenarios, internal control strengths and weaknesses can
be identified.

Vignette No. 1
Internal Control over Cash

A company named Alphabet Soup Consulting employs 50 Consultants and managed by a

board of directors (consisting of three (3) persons):
1. Robbie (President)
2. Vickie (Vice President)
3. Richard (Treasurer).

According to the company’s bylaws: Checks over $500.00 require signatures of two directors to
be valid.

Scenario: An invoice of $500.00 is due. Robbie or Vickie cannot be reached; Richard frequently
writes two (2) or more smaller checks to cover the full amount due to pay the invoice and avoid
delay; and Richard’s action is justified because of increased efficiency.

Consequences of Richard’s actions: Breach of internal controls; safeguarding assets and

ensuring compliance with management’s derivatives were violated, these are two of the four basic
purposes of internal control.

Controls that Alphabet Soup Consulting could have taken:

What really happened after?

• Vickie and Robbie continued to allow Richard to circumvent the company’s controls.
• Richard had no external controls over his spending of the company’s money.
• Alphabet eventually went out of business due to poor liquidity.

Vignette No. 2
Embezzling

Gary and Dan – Psychologists in private practice, employed Christina as a receptionist

and they also employed a local CPA firm to handle many (but not all financial matters.)

Christina’s task:
1. Open the mail
2. Collect cash payments from clients
3. Write checks for Gary’s or Dan’s signature each month.

She is also tasked to:

1. Get a bank statement in the mail
2. Pass it to the CPA firm for reconciliation.

Unfortunately, Christina got into personal financial dilemma.

Embezzlement by Christina, the Receptionist:

Since Christina has:
– Access to company’s checks
– Known what Gary’s and Dan’s signatures looked like.
– To solve her personal problem:
She began forging checks written to her husband.
Those forged checks were stored in boxes in an unlocked filing cabinet.

One Saturday, Gary came into the office and noticed the bank statement sitting on Christina’s desk.
He decided to reconcile the bank statement on his own rather than sending it to the CPA firm, so
he can save himself and his partner some money.
He noticed out-of-sequence checks with signatures that resembled his and Dan’s but were not
exactly “right.”

Christina had embezzled a total of $250,000.00 before Gary and Dan caught into her scheme.

What happened later?

• Gary and Dan confronted Christina about her embezzlement.

• Christina was fired and prosecuted for embezzlement.
• Bank restored the embezzled funds into the owners’ account.
• They hired a new CPA firm.
 Vignette No. 3
Information Technology

A College of Business, Southern State University, with:

– 200 faculty members
– David, lead IT staff member
– 4 IT staff members

College’s e-mail is maintained on a central server:

 Administrator
 Staff member
 Professor

Scenario:
A new hire comes to work for the college, his/her e-mail password is the same as the e-
mail user name:

E-mail: jmortiz@ssu.edu; Password: jmortiz

A small group of students figured it out and hacked the faculty member’s e-mail accounts for
illicit purposes.

Actions: David, lead IT staff member introduced several new policies related to e-mail security:

 Random creation of initial passwords.

 Mandatory password changes every six (6) months.
 Daily file backup.
 Virus, spyware, and spam protection.

What happened after?

The college has experienced no significant internal control problems with information
technology since those policies were instituted.

Vignette No. 4
Inventory

The Village Bookstore, Claremont, California:

Employed: John, The Purchasing Manager:
• Prepares purchase orders to send to book publishers
• Receives the books when they arrive at the store.
Uses: Perpetual Inventory System - for every purchase and sale, inventory
records are updated.
John’s Assertion: There is no need for periodic counts of inventory. It will be a waste of time
since AIS is always updated.

Internal Control Problem: Separation of duties. Three important duties to be borne by different
people in most organizations:
1. Physical Custody.
2. Recordkeeping for the asset.
3. Authorization to use the assets.

In this case, John can steal books.

Rebuttal to John’s Assertion: Although the company uses perpetual inventory system, they still
need an annual inventory to promote financial statement reliability.

John, The Purchasing Manager, A trustworthy employee, never defraud The Village Bookstore
although he had multiple opportunities to do so.

What happened after?

• An external consultant from a local accounting firm pointed out the bookstore’s internal
control weaknesses.
• The company corrected them before they experienced significant financial losses.

Conclusion: The reference material provides different scenarios that happened in real situation in
the business world. Some resulted to success, some failure. The importance of those examples
relies upon the lessons we can acquire from them. We can learn from other’s mistakes and we can
apply them in real-business situations for success in internal control.