Principles of Internal Control Components

Summary

This presentation delves into the principles of internal control, outlining five key components: control environment, risk assessment, control activities, information and communication, and monitoring activities. It emphasizes the importance of integrity, ethical values, board oversight, and management's role in setting structures and responsibilities. The script also addresses the significance of risk assessment, control activities, and effective communication within an organization. It concludes with a focus on monitoring and timely communication of internal control issues, tying everything back to the audit risk model.

Takeaways

• 🏢 The control environment is foundational for internal control, emphasizing the organization's commitment to integrity and ethical values.
• 👥 Independence of the board of directors from management is crucial for effective oversight of internal control development and performance.
• 📊 Management's role in establishing structures, reporting lines, and defining authorities and responsibilities is key to pursuing organizational objectives.
• 👩‍💼 Attracting, developing, and retaining competent employees aligns with the organization's objectives and affects the internal control environment.
• 🔗 Holding individuals accountable for their internal control responsibilities ensures the pursuit of objectives and identifies those who fail to meet expectations.
• 🎯 Clear specification of objectives is essential for identifying and assessing related risks, which is a fundamental part of risk assessment.
• 🔍 Identifying and analyzing risks across the entity helps in planning how to manage and mitigate those risks effectively.
• 🚫 Considering the potential for fraud when assessing risks is important to establish an environment that reduces the likelihood of fraudulent activities.
• 🔄 Entities must assess and adapt to changes that could significantly impact the system of internal controls to maintain their effectiveness.
• 🛠️ Control activities are selected and developed to mitigate risks to an acceptable level, including performance reviews, physical controls, and segregation of duties.
• 💻 General control activities over technology are essential to support the achievement of objectives and often involve IT professionals for implementation.
• 📜 Establishing control activities through policies and procedures ensures that what is expected is put into practice within the organization.
• 📢 Quality information is crucial for the functioning of internal controls, including the accurate identification, classification, measurement, recording, and presentation of transactions.
• 🗣️ Effective internal communication regarding objectives and responsibilities for internal controls is necessary for their proper functioning.
• 🌐 External communication about issues affecting internal controls is important for transparency and addressing concerns with external parties.
• 🔍 Ongoing and separate evaluations are conducted to determine if internal control components are installed and functioning as intended.
• ⏰ Timely evaluation and communication of internal control problems to responsible parties are essential for corrective actions and improvements.

Q & A

What are the five components of internal control?

The five components of internal control are the control environment, risk assessment, control activities, information and communication, and monitoring activities.

What is the first principle related to the control environment?

The first principle related to the control environment is that the business shows a commitment to integrity and ethical values.

How does the board of directors demonstrate independence from management?

The board of directors demonstrates independence from management by providing oversight over the development and performance of internal control.

What is the significance of management setting up structures, reporting lines, and authorities and responsibilities?

Management setting up structures, reporting lines, and authorities and responsibilities is significant because it ensures that roles and responsibilities are well-defined, which is crucial for accountability and the smooth functioning of the organization.

Why is it important for a business to attract, develop, and retain competent employees?

It is important for a business to attract, develop, and retain competent employees because it aligns with the organization's objectives and contributes to the overall performance and success of the business.

How does a business hold individuals accountable for their internal control responsibilities?

A business holds individuals accountable by first determining the responsibilities for different individuals and then assessing whether they have followed through with their responsibilities. Those who do not meet expectations are held accountable.

What is the purpose of risk assessment in internal control?

The purpose of risk assessment in internal control is to identify and assess risks related to objectives, which helps the business to manage those risks effectively.

Why is it necessary to consider the potential for fraud when assessing risks?

Considering the potential for fraud when assessing risks is necessary to set up an environment within the organization that lessens the likelihood of fraud, which is part of the internal control components.

What is the role of control activities in mitigating risks to the achievement of objectives?

Control activities play a role in mitigating risks by selecting and developing activities that contribute to reducing those risks to acceptable levels, ensuring the achievement of objectives.

How does a business ensure the quality of information used in internal controls?

A business ensures the quality of information used in internal controls by obtaining, making, and using relevant and accurate information that supports the functioning of internal controls.

What is the significance of monitoring activities in internal control?

Monitoring activities are significant in internal control because they involve ongoing evaluations to determine if the components of internal control are installed and functioning properly.

Outlines

00:00

📚 Principles of Internal Control

This section introduces the five components of internal control and their related principles. The components include the control environment, risk assessment, control activities, information and communication, and monitoring activities. The control environment is emphasized as the foundation, where business integrity and ethical values are crucial. The board of directors' independence and oversight, management's establishment of structures, and the accountability of individuals for internal control responsibilities are highlighted. The importance of attracting, developing, and retaining competent employees is also discussed.

05:01

🔍 Risk Assessment and Control Activities

The focus here is on risk assessment and control activities within the internal control framework. The script discusses the need for clear objectives to identify and assess risks, the identification of risks across the entity, and the consideration of fraud in risk assessment. It also addresses the importance of adapting to changes that could impact internal controls. For control activities, the selection and development of controls to mitigate risks, the use of technology to support control activities, and the establishment of policies and procedures are covered. The section emphasizes the practical implementation of controls to ensure they contribute to the mitigation of risks to acceptable levels.

10:02

📋 Information, Communication, and Monitoring

This part of the script delves into the principles of information and communication within internal control systems. It stresses the importance of obtaining and using relevant, quality information to support internal controls, including accurate transaction recording and presentation. The necessity of internal communication regarding objectives and responsibilities for internal controls is highlighted. The script also touches on the communication with external parties about issues affecting internal controls. The section on monitoring activities discusses the ongoing evaluation of internal control components and the timely communication of internal control problems to responsible parties for corrective action. The audit risk model is briefly mentioned, connecting inherent risk, control risk, and detection risk within the context of internal controls.

Keywords

💡Internal Control

Internal control refers to the policies and procedures implemented by a company to ensure the reliability of financial reporting, compliance with laws and regulations, and efficient operation. In the video, internal control is the central theme, with the script detailing its five components and how they contribute to the overall integrity and ethical values of a business.

💡Control Environment

The control environment is the first component of internal control and sets the tone for the organization's commitment to integrity and ethical values. It is crucial as it influences the effectiveness of all other controls. The video emphasizes that a strong control environment is demonstrated by the business's commitment to ethical values and the board of directors' independence from management.

💡Risk Assessment

Risk assessment is the process of identifying and evaluating risks that could impact the achievement of an organization's objectives. It is one of the key components of internal control discussed in the video, where the script outlines principles such as specifying objectives clearly and identifying risks across the entity.

💡Control Activities

Control activities are the actions taken by an organization to ensure that risks are managed and mitigated. The video explains that these activities include performance reviews, segregation of duties, and information processing controls, which are essential for the effective functioning of internal controls.

💡Information and Communication

Information and communication involve the systems and processes that ensure relevant and quality information is obtained, processed, and communicated both internally and externally. The video script highlights the importance of clear communication of objectives and responsibilities for internal controls to support their functioning.

💡Monitoring Activities

Monitoring activities are the ongoing processes and evaluations used to assess the effectiveness of internal controls. The video discusses how businesses should develop and perform ongoing evaluations to determine if the components of internal controls are functioning as intended.

💡Board of Directors

The board of directors is a group of individuals elected by the shareholders to represent their interests and provide oversight of the company's management. In the context of the video, the board's independence from management is emphasized as a key principle for effective internal control.

💡Segregation of Duties

Segregation of duties is a control activity that involves separating tasks within a process to prevent any single individual from having control over an entire transaction. The video mentions this as a primary consideration in establishing internal controls to reduce the risk of fraud and errors.

💡Audit Risk Model

The audit risk model is a framework that helps auditors assess the risk of material misstatement in financial statements. The video references this model, explaining that control risk is a component of the overall audit risk, which includes inherent risk and detection risk.

💡Fraud

Fraud refers to intentional acts of deception to obtain an unjust or illegal advantage. The video script discusses the importance of considering the potential for fraud when assessing risks to the achievement of objectives, emphasizing the need for policies and procedures to mitigate fraud risks.

💡Accountability

Accountability is the obligation of individuals to accept responsibility for their actions and the outcomes of those actions. In the video, it is mentioned as a principle where businesses hold individuals accountable for their internal control responsibilities, ensuring that objectives are met and that there are consequences for non-compliance.

Highlights

Introduction to the five components of internal controls: control environment, risk assessment, control activities, information and communication, and monitoring activities.

The first principle of the control environment is the business's commitment to integrity and ethical values.

The board of directors should show independence from management to provide effective oversight.

Management must establish structures, reporting lines, and authorities and responsibilities with board oversight.

Business must attract, develop, and retain competent employees in alignment with objectives.

Individuals must be held accountable for their internal control responsibilities.

Risk assessment principles include specifying objectives clearly to identify and assess related risks.

Business must identify risks across the entity and analyze them for management.

Fraud potential must be considered in risk assessment.

Changes that could impact the internal control system must be identified and assessed.

Control activities must be developed to mitigate risks to an acceptable level.

General control activities over technology are necessary to support the achievement of objectives.

Control activities are implemented through policies and procedures.

Quality information is essential for the functioning of internal controls.

Internal communication is vital for understanding objectives and responsibilities related to internal controls.

External communication regarding issues affecting internal controls is necessary.

Ongoing evaluations are conducted to determine if internal control components are functioning properly.

Internal control problems must be communicated timely to responsible parties for corrective actions.

The audit risk model is explained, connecting inherent risk, control risk, and detection risk.

Transcripts

in this presentation we will take a look

at principles of internal control

components we're going to list out our

five components of the internal controls

and then we'll list out principles

related to them those five components

being the control environment or risk

assessment control activities

information and communication and

monitoring activities we're going to

start off with the control environment

listing the principles related to

control environment first principle

business shows a commitment to integrity

and ethical value so we're looking at

this in terms of the controls of the

organization in terms of the

organization as a whole that the

business shows a commitment to integrity

and ethical values note these things

aren't always the easiest things for us

to write down and communicate but you

could think about how can we get a feel

for that we're going to be of course

talking to people inquiring about it and

writing down our impressions of the

control environment in terms of business

shows commitment to integrity and

ethical value principle number two board

of directors shows independence from

management and exercises oversight of

the development and performance of

internal control you'll recall that the

board of directors are represented and

voted on by the owners the shareholders

so therefore they should be able to

provide some oversight over management

which in essence are the people that

they hire in order to act as agents of

the shareholders so the board of

directors should show independence from

management the more independence from

management then the more you would think

the board of directors would have good

oversight over management whereas if

there's less independence from

management it would be a more difficult

situation you would think the oversight

wouldn't be as good over the performance

of the management third principle

management sets up with board oversight

structures reporting lines and

authorities and responsibilities in the

pursuit of objectives so we have the set

up and the board of directors being

involved in this with the structure the

reporting liance we have the business

hierarchy the reporting lines within it

and authorities and responsibilities in

the pursuit of the objectives what are

the authorities and responsibilities

this is going to be really important

because of course people need to

understand

there are specific roles and

responsibilities it seems like a basic

thing but oftentimes people don't have a

good idea of what their responsibilities

are things fall down you know in the

middle between the responsibilities of

two individuals possibly and we don't

know exactly who to hold accountable

because it was never well defined in the

first place

principle for business shows a

commitment to attract develop and retain

competent employees in alignment with

objectives so we're looking at the types

of employees that are being brought into

the organization and we might also

consider the overturn of employees are

they bringing up the employees that seem

to be performing well the best top

performance of the employ of the

organization are they basically

retaining employees that are well

performing employees is there a high

turnover of employees of employees and

what's going to be basically the feeling

of employees which can be indicated in

whether there's a high turnover or not

or whether they're basically able to

develop employees within the

organization number five business holds

individuals accountable for their

internal control responsibilities in the

pursuit of objectives this of course

lines out with first determining what

the responsibilities are for different

individuals and then determining whether

or not the individuals have follow

through with their responsibilities and

the people that aren't following through

we know who to hold accountable and we

want to be able to see that the people

responsible for for certain conditions

or first certain objectives are the ones

being held accountable if those

objectives are not met next we'll take a

look at risk risk assessment principles

or principles related to a risk

assessment principle number one business

specifies objectives with enough clarity

to enable the identification and

assessment of risks related to

objectives so when we're thinking about

the risks we need to know exactly what

the objectives are so that that's gonna

help us to identify what the risks are

we need to be clear about that at the

more clear we are about that the more

clearly we can basically assess what

those risks are and take action with

regards to them principle number two

business identifies risks to the

achievement of its objectives across the

entity and analyzes risks as a basis

for determining how the risks are to be

managed once we understand what the

risks are we want to see them across the

organization and then we can come up

with a plan of course to see how we want

to deal with those risks how can we

mitigate those risks principle three

business considers the potential for

fraud in assessing risks to the

achievement of objectives so we want to

consider fraud and we'll talk a little

bit more about the fraud factors that

can be put together on what's gonna

increase the likelihood of fraud we want

to basically set up an environment

within the organization to lessen the

likelihood of fraud as part of the

components of our internal control so

first we have to say what are the risks

of fraud some of those risks are going

to be things that we can apply to any

type of organization some might be

specific to the type of organization

that we are in we want to see where the

fraud risks are highest and put in

policies and principles in order to

mitigate them principle number four

business entities and assesses changes

that could significantly impact the

system of internal controls so we're

gonna identify and assess any changes

anytime we have a significant change we

should have in our mind what is the

internal control what are going to be

the risks related to any significant

changes and we should basically map out

what are gonna be the risks related to

the significant change make adjustments

as necessary based on those changes in

those adjusted risks next we'll take a

look at the principles related to

control activities principle number one

principle selects and develops control

activities that contribute to the

mitigation of risks to achievement of

objectives to acceptable levels so now

we're on basically the ground floor

we're talking about the control

activities the actual implementation and

development and implementation of those

control activities that are going to be

put in place in order to contribute to

the mitigation the lessening of the

risks to the achievement of objectives

to acceptable levels we're going to be

thinking about things then including

performance reviews as our control

activities physical controls as our

perform as our control activities the

segregation of duties this probably

being the one that you want to think

about first when you think about

internal controls in general one

the first thing that probably comes into

mind should be the segregation of duties

you probably think of things like

performance review or people when they

first think about internal controls are

probably thinking about some type of

performance reviews we've consider an

audit and setting up the audit

procedures and someone asks you about

internal controls the first thing that

should come in your mind is really the

separation of duties is one of the major

functions and factions or areas of

internal controls then we have the

information processing controls

principle number two business selects

and develops general control activities

over technology to support the

achievement of objectives so once we

have these set up once we have the

control activities we will set them up

and we're probably going to need

technology in order to do this we're

gonna have some type of database program

as part of our internal controls

oftentimes we're gonna that's gonna

allow us to do things like the

separation of duties that like having

the performance reviews through the

interaction and the setting up of that

database and of course we need IT

professionals to help us with that that

part of it so we set up the internal

controls work with IT then to help us to

implement those by restricting or

manipulating the database to give

certain restrictions and assignments to

different individuals principle number

three business sets up control

activities through policies that

establish what is expected and

procedures that put policies into play

so obviously once we implement this

information we're going to actually put

into play the policies and the

procedures as we as we set the set and

thing out so we're imagining of course

we set up the controls now we're gonna

end up ah in the part of the control

system where we have to actually

implement and put those controls into

place which involves of setting up the

policies and procedures and implementing

those policies and procedures next we

have information and communication

principle principle number one business

obtains makes and uses relevant quality

information to support the functioning

of internal controls

this could include identify and record

valid transactions classify transactions

correctly measure the value of

transactions correctly record

transactions in the correct period

correctly present transact

and disclosures principle number two

business communicates information

internally communication includes

objectives and responsibilities for

internal controls and needed to support

the functioning of the internal controls

obviously when we set up the internal

controls we then need to have the good

communication in order for people to

understand those internal controls in

terms of what is expected of them as

well as what the reason is to some

degree because that will give them some

incentive to follow through and make

sure that they are implementing the

internal controls and possibly the

feeling of well-being and self-worth as

they go through the internal controls

some processes which can seem like

they're going to be something that's not

contributing to the performance but

actually is when you think about it out

on the bigger picture level so principle

number three business communications

with external parties regarding issues

affecting the functioning of internal

controls next we're gonna take a look at

monitoring activities principles related

to a principle number one business

selects develops and performs ongoing

and or separate evaluations to determine

whether the components of internal

controls are installed and functioning

so you'll of course we're thinking about

the internal controls here in terms of

what are the risks we come up with a

plan for internal controls we then

implement that plan with their control

activities we communicate that

information and then of course we

monitor that information to see if this

the internal control processes are set

up well if they're implemented well if

they're doing what we would expect them

to do principle number two business

evaluates and communicates internal

control problems in a timely manner to

parties responsible for taking

corrective action there's problems

internal internal controls in terms of

either the way the internal control is

set up not well designed or in the way

it's being implemented not being

implemented or followed through with

then we go to the appropriate level of

management and discuss the the

implementation and/or design at that at

that point parties include senior

management and the board of directors as

appropriate obviously if it's if it's to

the point where we can discuss this with

senior management and and take care of

it then that would be it if it's

something that's going to be a serious

flaw in the internal controls and have

substantial risk then of course we would

want to include the

directors as well audit risk model

you'll recall that the audit risk model

represents in a formula type format

audit risk equals the inherent risk the

inherent risk within basically inherent

in the organization of a type of

business that were in line with the

control risk controlled risk what we are

talking about now and then we have the

detection risk this is the auditors

basically whether the audit will pick up

pick up any problems within the auditing

process these two of recall are kind of

on the business side of things what

industry they're in what's inherently

risky about the business ventures that

they are in that's their decision to be

in that business and take on those

inherent risks the control risk is what

they are designing in their bureaucratic

system as they set up their their

business model and that of course is

with the component that we're focusing

on here when we consider the overall

audit risk model