A lecture delivered by Ms. janirose Z. Fernandez- LBP Vigan during the 2017 RCMC held at NSCC, Caoayan, Ilocos Sur on October 30, 2017

1. INTERNALINTERNAL
CONTROLCONTROL
for Cooperativesfor Cooperatives
A lecture delivered by Ms. Janirose Z. Fernandez LBP Ilocos
Sur during the 2017 Cooperative Month Celebration
NSCC Plaza, Caoayan Ilocos Sur.

2. 22
Comprises the plan of organization and all
coordinated methods and measures
adopted within a business to safeguard its
assets, check the accuracy and reliability of
its accounting data, promote operational
efficiency and encourage adherence to
prescribed managerial policies.
Internal ControlInternal Control

3. 33
Internal ControlInternal Control
Internal ControlInternal Control – is the systems, policies, procedures
and processes effected by the BOD, management and
other personnel to safeguard the assets, limit or control
risk and achieve the objectives of the entity.
while
Internal Audit – provides an objective, independent
review of the entity’s activities, internal control, and
management information system to help the board and
management monitor and evaluate the adequacy and
effectiveness of internal control.

4. 44
PURPOSE OF INTERNALPURPOSE OF INTERNAL
CONTROLCONTROL
1.1. Ensure that the business ofEnsure that the business of
the Coop is conducted in athe Coop is conducted in a
prudent manner in accordanceprudent manner in accordance
with policies and strategieswith policies and strategies
established by the board ofestablished by the board of
directors;directors;
2.2. That transactions are onlyThat transactions are only
entered into with appropriateentered into with appropriate
authorityauthority
3.3. That assets are safeguardedThat assets are safeguarded
and liabilities controlled;and liabilities controlled;

5. 55
PURPOSE OF INTERNALPURPOSE OF INTERNAL
CONTROLCONTROL
4.4. That accounting andThat accounting and
other records provideother records provide
complete accurate andcomplete accurate and
timely informationtimely information
5.5. That management isThat management is
able to identify, assess,able to identify, assess,
manage and control themanage and control the
risks of therisks of the
business.business.

6. 66
PRIMARY AREAS OFPRIMARY AREAS OF
INTERNAL CONTROLSINTERNAL CONTROLS
1.1. Organizational structuresOrganizational structures
(definitions of duties and(definitions of duties and
responsibilities,responsibilities,
discretionary limits fordiscretionary limits for
loan approval, andloan approval, and
decision-makingdecision-making
procedures).procedures).
2.2. Accounting proceduresAccounting procedures
(reconciliation of account,(reconciliation of account,
control lists, periodic trialcontrol lists, periodic trial
balances, etc.)balances, etc.)

7. 77
PRIMARY AREAS OF INTERNALPRIMARY AREAS OF INTERNAL
CONTROLSCONTROLS
3.3. The “four eyes”The “four eyes”
principles (segregationprinciples (segregation
of various functions,of various functions,
cross-checking, dualcross-checking, dual
control of assets, doublecontrol of assets, double
signatures, etc).signatures, etc).
4.4. Physical control overPhysical control over
assets and investmentsassets and investments

8. 88
Internal Audit – What is it?Internal Audit – What is it?
 AA systematicsystematic andand independentindependent reviewreview
of the operations and controls of theof the operations and controls of the
organizationorganization
- SystematicSystematic: the work is done: the work is done
according to pre-designed plans andaccording to pre-designed plans and
programsprograms
- IndependentIndependent: the work is done: the work is done
independent of managementindependent of management

9. 99
Internal Audit –Internal Audit –
Why do it?Why do it?
 To fulfill a key link in the riskTo fulfill a key link in the risk
management processmanagement process
 Primary Goals are:Primary Goals are:
- to ensure that internal policies and- to ensure that internal policies and
procedures are being followedprocedures are being followed
- to ensure that financial and operating- to ensure that financial and operating
information is accurateinformation is accurate
-- To identify previously unrecognized risksTo identify previously unrecognized risks

10. 1010
Internal Audit –
should do it?should do it?
 Chief Internal AuditorChief Internal Auditor
- Banking and Accounting Professional usually CPA- Banking and Accounting Professional usually CPA
with credit background of financial institutionwith credit background of financial institution
- Maintains membership and/or ties with- Maintains membership and/or ties with
professional associationsprofessional associations
 StaffStaff
-- Qualified candidates from within the Coop orQualified candidates from within the Coop or
through recruitmentthrough recruitment

11. 1111
Personal QualitiesPersonal Qualities
 Focused, well organizedFocused, well organized
 Attentive to detailsAttentive to details
 Exercises good judgment – knows what’sExercises good judgment – knows what’s
importantimportant
 Excellent written and verbal communicationExcellent written and verbal communication
skillsskills
 Trustworthy – will do the right thingTrustworthy – will do the right thing
 Pleasant personality – can manage and trainPleasant personality – can manage and train
staffstaff
 Creative and independent thinker – can drawCreative and independent thinker – can draw
sound conclusions and form relevantsound conclusions and form relevant
recommendationsrecommendations

12. 1212
AuditorAuditor
IndependenceIndependence
 Reports directly to the boardReports directly to the board
of directorsof directors
 Maintains appropriate communicationMaintains appropriate communication
with the general manager/CEOwith the general manager/CEO
 Manages the budget and schedule forManages the budget and schedule for
the departmentthe department
 Works in a separate and secure spaceWorks in a separate and secure space
 Direct access to informationDirect access to information

13. 1313
Components of InternalComponents of Internal
ControlControl
 Control environmentControl environment
 Risk AssessmentRisk Assessment
 Control ActivitiesControl Activities
 Accounting, informationAccounting, information
and communicationand communication
systemsystem
 Self-assessment orSelf-assessment or
monitoringmonitoring

14. 1414
Assessing the Control EnvironmentAssessing the Control Environment
 Control EnvironmentControl Environment – sets the tone of the– sets the tone of the
Coop, influencing control consciousness of itsCoop, influencing control consciousness of its
people. It is the foundation for all otherpeople. It is the foundation for all other
component of internal controlscomponent of internal controls
 Points of FocusPoints of Focus
•Organizational structure assignment of authority andOrganizational structure assignment of authority and
responsibilityresponsibility
•Human resource policies and proceduresHuman resource policies and procedures
•Integrity and ethical valuesIntegrity and ethical values
•Commitment to competenceCommitment to competence
•Management philosophy and operating styleManagement philosophy and operating style
 An effective Control Environment is one thatAn effective Control Environment is one that
establishes and promotes collective positiveestablishes and promotes collective positive
attitude toward achieving effective internalattitude toward achieving effective internal
control over the unit’s businesscontrol over the unit’s business

15. 1515
Evaluating Risk AssessmentEvaluating Risk Assessment
ProcessProcess
 Risk AssessmentRisk Assessment – is the process of identifying– is the process of identifying
and analyzing relevant risks to the achievementand analyzing relevant risks to the achievement
of the Coop’s objectives and determining theof the Coop’s objectives and determining the
appropriate responseappropriate response
 Point of FocusPoint of Focus
• Risk identificationRisk identification
• Risk analysis and prioritizationRisk analysis and prioritization
• Risk managementRisk management
 An effective Risk Assessment establishes andAn effective Risk Assessment establishes and
maintains process to identify, analyze, andmaintains process to identify, analyze, and
manage risk relevant to achieving a unit’s goalsmanage risk relevant to achieving a unit’s goals
and objectives.and objectives.

16. 1616
6. Revise
policies
4. Implement policies
and assign responsibility
5. Test effectiveness
and monitor results
1. Identify
risks
2. Develop strategies and
procedures to prioritize risks
3. Design policies
to mitigate risks

17. 1717
RISKRISK
 Is the potentialIs the potential
for realizationfor realization
of theof the
unwantedunwanted
negativenegative
consequencesconsequences
of an eventof an event
 The possibility of loss,The possibility of loss,
injury, disadvantage orinjury, disadvantage or
destructiondestruction

18. 1818
Types of Major RisksTypes of Major Risks
for Coopsfor Coops
 Liquidity RisksLiquidity Risks
 Operations RiskOperations Risk
 Credit RiskCredit Risk

19. 1919
Assessing ControlAssessing Control
ActivitiesActivities
 Control ActivitiesControl Activities – are the policies and– are the policies and
procedures established and implemented toprocedures established and implemented to
address the risks and to achieve the Coop’saddress the risks and to achieve the Coop’s
objectives.objectives.
 Point of FocusPoint of Focus
• Severity and frequency of audit findings, specificallySeverity and frequency of audit findings, specifically
on the :on the :
 Design of the controlDesign of the control
 Operating effectiveness of the controlOperating effectiveness of the control
 An effective Control Activity is one that isAn effective Control Activity is one that is
properly designed and implemented toproperly designed and implemented to
mitigate the risksmitigate the risks

20. 2020
Assessing Control ActivitiesAssessing Control Activities
(Attributes)(Attributes)
 Design of the controlsDesign of the controls
• Existence of Appropriate policies andExistence of Appropriate policies and
procedures necessary with respect to eachprocedures necessary with respect to each
of the entity’s activitiesof the entity’s activities
 Operating effectiveness of the controlsOperating effectiveness of the controls
• Identified control activities in place are beingIdentified control activities in place are being
applied properlyapplied properly
 Examples of Control ActivitiesExamples of Control Activities
• DocumentationDocumentation
• Approval and authorizationApproval and authorization
• VerificationVerification
• SupervisionSupervision
• Segregation of DutiesSegregation of Duties
• Safeguarding of AssetSafeguarding of Asset
• ReportingReporting
• IT ControlsIT Controls

21. 2121
Assessing the InformationAssessing the Information
and Communication Systemand Communication System
 Information and CommunicationInformation and Communication – encompasses the– encompasses the
methods for identifying, capturing, andmethods for identifying, capturing, and
communicating pertinent information in a time framecommunicating pertinent information in a time frame
that enables people to carry out their responsibilitiesthat enables people to carry out their responsibilities
 Points of FocusPoints of Focus
• InformationInformation
• CommunicationCommunication
 An effective Information and Communication SystemAn effective Information and Communication System
ensures that information relevant to operating theensures that information relevant to operating the
business and the maintenance of internal control andbusiness and the maintenance of internal control and
records are identifies, captured, and communicatedrecords are identifies, captured, and communicated
to appropriate individual on a timely basisto appropriate individual on a timely basis

22. 2222
Assessing theAssessing the
MonitoringMonitoring
SystemSystem
 MonitoringMonitoring – Assessing the– Assessing the
quality of internal controlquality of internal control
system performance oversystem performance over
timetime
 Points of FocusPoints of Focus
• Ongoing Monitoring ActivitiesOngoing Monitoring Activities
• Separate Evaluation*Separate Evaluation*
• Reporting DeficienciesReporting Deficiencies
 An effective MonitoringAn effective Monitoring
System detects andSystem detects and
remedies control deficienciesremedies control deficiencies
throughout the entirethroughout the entire
internal control systeminternal control system

23. MinimumMinimum
Internal ControlInternal Control
StandardsStandards
2323

24. 2424
Proper AccountingProper Accounting
RecordsRecords
 Accounting records should satisfy theAccounting records should satisfy the
needs of a particular financialneeds of a particular financial
intermediaryintermediary
 These should contain sufficientThese should contain sufficient
details to meet management anddetails to meet management and
supervisory needs and should besupervisory needs and should be
properly and currently posted.properly and currently posted.

25. 2525
Division of Duties andDivision of Duties and
ResponsibilitiesResponsibilities
Division of Duties andDivision of Duties and
ResponsibilitiesResponsibilities
 Duties must be segregated to allowDuties must be segregated to allow
the proper functioning of automaticthe proper functioning of automatic
checks.checks.
 No one person should be in completeNo one person should be in complete
charge of business transactionscharge of business transactions
 Operating instructions for eachOperating instructions for each
position should be reduced in writingposition should be reduced in writing

26. 2626
Signing AuthoritiesSigning Authorities
 Different levels of officers to sign forDifferent levels of officers to sign for
and in behalf of the institution shouldand in behalf of the institution should
be approved by the Board ofbe approved by the Board of
DirectorsDirectors
 Extent of authority shouldExtent of authority should
be clearly definedbe clearly defined

27. 2727
DualDual
ControlControl
 Routine of eachRoutine of each
transaction shouldtransaction should
be so designedbe so designed
that at least twothat at least two
or moreor more
individuals areindividuals are
involved in theinvolved in the
completion ofcompletion of
every transactionevery transaction

28. 2828
Independent BalancingIndependent Balancing
 This means that someone runs andThis means that someone runs and
balances records that are normallybalances records that are normally
posted by another person, or thatposted by another person, or that
someone countssomeone counts
held by anotherheld by another
personperson

29. 2929
Joint CustodyJoint Custody
 Two or more persons are involved inTwo or more persons are involved in
the safekeeping of physicalthe safekeeping of physical
properties including documentsproperties including documents

30. 3030
PhysicalPhysical ControlControl
 Safeguarding and housingSafeguarding and housing
of assets demand adequateof assets demand adequate
physical protection. Physicalphysical protection. Physical
control includes the vault gate keyscontrol includes the vault gate keys
of equipment, alarms and otherof equipment, alarms and other
physical devices to protect thephysical devices to protect the
premises.premises.

31. 3131
NumberNumber
CoNtrolCoNtrol
Sequence number controlsSequence number controls
incorporated in the accountingincorporated in the accounting
system serves two purposed: (a) tosystem serves two purposed: (a) to
control processing and (b) to identifycontrol processing and (b) to identify
individual transactionsindividual transactions

32. 3232
Knowledge ofKnowledge of
Outside ActivitiesOutside Activities
of Employeesof Employees
 Periodic submission of statement of assetsPeriodic submission of statement of assets
and liabilities ascertains the financialand liabilities ascertains the financial
status of officers and employeesstatus of officers and employees
 Any immediate or sudden change inAny immediate or sudden change in
appearance or habits of officers andappearance or habits of officers and
employees may be indicative ofemployees may be indicative of
misconduct, particularly when the changemisconduct, particularly when the change
reflect spending habits that go beyond thereflect spending habits that go beyond the
limit of their incomelimit of their income

33. 3333
Rotation of DutiesRotation of Duties
 Rotation reduces the opportunity forRotation reduces the opportunity for
fraud points to the adaptability of anfraud points to the adaptability of an
employee and often results in newemployee and often results in new
ideas for the organizationideas for the organization

34. 3434
 This policy is closely related toThis policy is closely related to
rotation of duty as both result to arotation of duty as both result to a
forced absence from regular duties.forced absence from regular duties.
Vacation for those in position of trustVacation for those in position of trust
must be enforcedmust be enforced

35. 3535
Direct VerificationDirect Verification
 This pertains toThis pertains to
confirmation ofconfirmation of
accounts oraccounts or
records by meansrecords by means
of directof direct
correspondencecorrespondence
with the coop’swith the coop’s
customerscustomers

36. 3636
Sound PersonnelSound Personnel
PoliciesPolicies
 RecruitmentRecruitment – A formal– A formal
procedure must be followed whenprocedure must be followed when
employing new people. A check ofemploying new people. A check of
their previous employment andtheir previous employment and
credit references in mandatory incredit references in mandatory in
order to hire individuals oforder to hire individuals of
competence and integritycompetence and integrity
 Fair Salary ScaleFair Salary Scale – To attract and– To attract and
keep honest staffkeep honest staff
 Incentive and other Benefits – toIncentive and other Benefits – to
keep employees morale highkeep employees morale high

37. 3737
Sound PersonnelSound Personnel
PoliciesPolicies
 Code of Discipline.Code of Discipline. This should be aThis should be a
code of discipline that serves as a guidecode of discipline that serves as a guide
for the conduct expected of the officersfor the conduct expected of the officers
and employees in their day-to-dayand employees in their day-to-day
pursuit of company objectives. Code ofpursuit of company objectives. Code of
discipline must also spell out whatdiscipline must also spell out what
constitutes violations and theirconstitutes violations and their
corresponding penalities.corresponding penalities.

38. 3838
Internal Audit-Internal Audit-
How is it done?How is it done?
 Develop a comprehensive annualDevelop a comprehensive annual work planwork plan forfor
board approval, including time schedule, budgetsboard approval, including time schedule, budgets
and scopeand scope
 Design a generic auditDesign a generic audit work programswork programs for eachfor each
area of Coop operationarea of Coop operation
 DesignDesign work paperswork papers that clearly document thethat clearly document the
evidence of work performed, conclusions drawn,evidence of work performed, conclusions drawn,
and meets requirementsand meets requirements
 PreparePrepare audit reportaudit report for the board andfor the board and
management on a timely basis, and providemanagement on a timely basis, and provide
status updates at least on a quarterly basesstatus updates at least on a quarterly bases
 Follow up on status of implementingFollow up on status of implementing
recommendationsrecommendations

39. 3939
SAMPLE AUDIT PROGRAMSAMPLE AUDIT PROGRAM
TASKTASK YY
EE
SS
NN
OO
NN
FF
AA
SOURCESSOURCES COMMENTSCOMMENTS
Verify Petty CashVerify Petty Cash
Count cash and agree to petty cashCount cash and agree to petty cash
balancebalance
Confirm the cash is counted periodicallyConfirm the cash is counted periodically
by a supervisorby a supervisor
Review paid transactions for appropriateReview paid transactions for appropriate
receipts and approvalreceipts and approval
Review replenishment vouchers for theReview replenishment vouchers for the
periodperiod
Confirm that cashbox is reasonablyConfirm that cashbox is reasonably
safeguardedsafeguarded
Ensure segregation of duties in cashEnsure segregation of duties in cash
handling (approval, disbursement, andhandling (approval, disbursement, and
accounting)accounting)
Office _________________ Audit Date:__________________
Audit Period ____________ Reviewer: ___________________
Source Code: 1 Document, 2 – Interview, 3 - Observation

40. 4040
Audit ReportAudit Report
 Keep it short and to the pointKeep it short and to the point
 Report on a timely basisReport on a timely basis
 Include four parts, at a minimum:Include four parts, at a minimum:
1.1. Executive summary: bullet list items ofExecutive summary: bullet list items of
concern that require immediate attentionconcern that require immediate attention
2.2. Describe the scope of work (periodDescribe the scope of work (period
covered, business process or fundingcovered, business process or funding
source, etc.)source, etc.)
3.3. List key findings of exception to policy,List key findings of exception to policy,
risks and recommendationsrisks and recommendations
4.4. Note any prior recommendations thatNote any prior recommendations that
have not been implementedhave not been implemented

41. 4141
FRAUD TRIANGLEFRAUD TRIANGLE
Incentives/Incentives/
PressuresPressures
OpportunityOpportunity
Attitude/IntegrityAttitude/Integrity

42. 4242
SITUATIONS THATSITUATIONS THAT
OFFER OPPORTUNITYOFFER OPPORTUNITY
FOR FRAUDFOR FRAUD
 Ineffective internal controlsIneffective internal controls
 Too much trust placed on employeesToo much trust placed on employees
 Employees have detailed knowledge ofEmployees have detailed knowledge of
the accounting system and itsthe accounting system and its
weaknessweakness
 Management domination can subvertManagement domination can subvert
normal internal controlsnormal internal controls
 Expected moral behavior is notExpected moral behavior is not
communicated to employees (no codecommunicated to employees (no code
of ethics)of ethics)

43. 4343
SITUATIONS THAT OFFERSITUATIONS THAT OFFER
OPPORTUNITY FOR FRAUDOPPORTUNITY FOR FRAUD
 Unreasonable budgets and expectationsUnreasonable budgets and expectations
 Related party transactionsRelated party transactions
 Incomplete or out of date proceduralIncomplete or out of date procedural
documentationdocumentation
 Management sets a bad exampleManagement sets a bad example
 Conflicts of interestConflicts of interest

44. 4444
PROFILE OF A FRAUDSTERPROFILE OF A FRAUDSTER
 Big spenderBig spender (expensive hobbies, living beyond(expensive hobbies, living beyond
means, high personal debt)means, high personal debt)
 Under stressUnder stress (suffering from personal crisis(suffering from personal crisis
such as financial problems or bad marriage)such as financial problems or bad marriage)
 Has evident financial needsHas evident financial needs (illness, drugs,(illness, drugs,
gambling)gambling)
 IntelligentIntelligent (challenged by a secured system,(challenged by a secured system,
bored by routines)bored by routines)

45. 4545
PROFILE OFPROFILE OF
A FRAUDSTERA FRAUDSTER
 InquisitiveInquisitive (tempted by the discovery(tempted by the discovery
of a computer vulnerability)of a computer vulnerability)
 Risk takerRisk taker (willing to bend the rules(willing to bend the rules
and take chances)and take chances)
 Rule breakerRule breaker (takes short cuts, self-(takes short cuts, self-
justifies, infractions of law)justifies, infractions of law)
 Hard workerHard worker (first to arrive in the(first to arrive in the
morning and last to leave at night,morning and last to leave at night,
never absent)never absent)

46. 4646
REMINDERSREMINDERS
ON FRAUDON FRAUD
 Internal auditors are not expectedInternal auditors are not expected
to be fraud specialiststo be fraud specialists
 Audit procedures, even if doneAudit procedures, even if done
with due professional care, do notwith due professional care, do not
guarantee fraud detectionguarantee fraud detection
 Detection of Fraud is only a by-Detection of Fraud is only a by-
product of the audit function, notproduct of the audit function, not
its main goalits main goal

47. Thank You!