Internal controls evaluation process and audit procedures

¶ … Internal Controls

The generalized lack of literary interest in the field of internal controls can be attributed to the perception that internal controls do not represent core organizational processes. Core organizational processes are product manufacturing or service delivery activities, those which directly serve the customers and retrieve income. But it is also true that the core operations could not be completed without the continuous completion of internal controls which ensure the correctness of the organizational processes and that of organizational budgeting, reporting and so on.

In order to ensure that a process of internal control is able to adequately answer the control need of the entity, it should be conducted onto three gradual stages. At the first stage, it is of the utmost importance for the audit party to ensure that they understand the control system and needs of the client; additionally, it is required that they conduct an analysis to document the understanding of the internal control. At the second stage, the audit team would conduct a preliminary assessment of the control risk. Finally, at the third stage, it would test and reassess; this virtually means that it would "perform tests of controls audit procedures [and] re-assess control risk" (Phases of a Control Evaluation PowerPoint).

At a more specific level, control audit elements at each of these three phases would include:

Phase 1: Understanding

In order to understand the control processes within an organization, it is necessary to conduct sustained interviews with several organizational players. Traditionally, it could be accepted that these interviews only target the control managers, but it is also true that organizational leaders might feel a necessity to present an improved version of the organization and its control functions and processes. In this order of ideas, it would also be necessary to conduct interviews with the staff members -- with those employees conducting the control, but also with those employees observant or otherwise integrated in the control processes.

As a parenthesis, it should be noted that employees are often reticent to participating in organizational evaluations by external auditors as they fear managerial repercussions for their answers. In order to reduce this threat, the auditor could promise to only communicate the result of the audit to the managerial team and keep employee information private. Such a measure would increase the chances of an objective and more realistic audit, which would also lead to more reliable results.

At the level of assessing the understanding of organizational employees' of the internal control process, the following questions should be answered:

Are all the organizational staff members -- in all divisions, including accounting, human resource management, and others -- aware of the current legislations and conducting all of their operations in accordance with the laws?

Do the organizational staff members implement prudential and preventive actions, even when these are not literally required by law?

Do the employees prepare reports and request the approval of their supervisors in the implementation of actions?

Are the communications among employees and between employees and managers adequate, in terms of efficiency and sufficiency? (IDAHO Management Control System)

Phase 3: Testing

Finally, in the third stage of the control process, it is necessary that tests be conducted on the efficiency of the control mechanisms. Specifically, the following questions should be answered:

Do all the tests conducted respect the pre-established organizational requirements and legislative stipulations?

In terms of organizational compliance with the above mentioned requirements and stipulations, is the degree of compliance adequate?

Do the control systems break into specific sub-task control operations which test particular operations, functions, risks and so on?

Upon termination of the control processes, do the internal auditors collect and adequately report information?

Are the control reports adequately integrated within the organizational context to offer lessons for the future?

Are the results of control processes used to improve the future audit operations (Phases of a Control Evaluation PowerPoint)?

As a final specification, it is important to note that the above checklist for internal control has been created based on the available literature and that it is as such a general theoretical suggestion for the elements to be integrated in a control process. Given however that each economic agent has diverse needs and is characterized by diverse features, it would be advisable for the checklist to be adjusted to the unique needs and characteristics of the respective entity.

References:

2003, Sarbanes-Oxley Compliance. A Checklist for Evaluating Internal Controls -- General Ledger and Financial Reporting Processes, AXS-One, http://www.axsone.com/pdf/GL_checklist_short%20version_121703.pdf last accessed on June 25, 2010

Internal Control Checklist, IDAHO Management Control Systems, http://www.sco.idaho.gov/web/DSADoc.nsf/6065F400C610BDB5872569BC0074D4EE/$FILE/Cklist60.rtf last accessed on June 25, 2010

Internal Control; Self-Assessment Checklist, the University of Utah, http://web.utah.edu/Internal_Audit/ppts/Internal%20Control%20Self%20Assessment%20Mar-06.doc last accessed on June 25, 2010

Phases of a Control Evaluation PowerPoint