This document discusses internal control systems and their importance for auditors. It defines internal control, describes its objectives and components. The five key components of internal control systems are the control environment, risk assessment, control activities, information and communication, and monitoring. The document outlines each of these components in detail. It also discusses the auditor's responsibilities in obtaining an understanding of a client's internal controls, documenting them through narratives, flowcharts or questionnaires, and testing the operating effectiveness of controls. The importance of communicating internal control matters through a management letter is also explained.

1. TOPIC 4: INTERNAL CONTROL SYSTEMS
References: Chapter 10
AUDITING AND ASSURANCE
SERVICES
IN MALAYSIA

2. LEARNING OUTCOMES
AUD390 2014
 DEFINITION OF INTERNAL CONTROL
 OBJECTIVES, COMPONENTS AND LIMITATIONS
 IMPORTANCE OF INTERNAL CONTROL TO
AUDITORS
 RELATIONSHIP OF INTERNAL CONTROL AND
AUDIT EVIDENCE
 REVIEW AND DOCUMENTATION OF INTERNAL
CONTROL
 TESTS OF CONTROLS FOR CLASSES OF
TRANSACTIONS
 STRENGTHS AND DEFICIENCIES OF INTERNAL
CONTROL
 MANAGEMENT LETTER

3. OVERVIEW
AUD390 2014
 A system of internal controls consists of policies &
procedures to provide management with reasonable
assurance that the company achieves its objectives &
goals.
 These policies & procedures are called controls, and
they normally considered as entity’s internal control

4. Cont…
AUD390 2014
 A set of policies are principles, rules, and guidelines
formulated or adopted by an organization to reach its
long-term goals and typically published in a booklet or
other form that is widely accessible.
 Procedures are the specific methods employed to
express policies in action in day-to-day operations of the
organization. Together, policies and procedures ensure
that a point of view held by the governing body of an
organization is translated into steps that result in an
outcome compatible with that view.

5. AUD390 2014
 Three objectives in designing internal control
systems:
 reliability of financial reporting
 effectiveness & efficiency of operations
 compliance with laws & regulations
Cont…

6. AUD390 2014
 Limitations of IC
 Human error
 Management override of IC
 Cost contraints
 Cost of entity’s ICS should note exceed that are
expected to derived
 Lack of personal quality among employee
 Collusion “an act of 2 or more employees to
steel assets or mistake records”
Cont…

7. COMPONENTS OF ICS
AUD390 2014
CONTROL ENVIRONMENT
RISK ASSESSMENT
CONTROL ACTIVITIES
INFORMATION &
COMMUNICATION
MONITORING

8. Control Environment
AUD390 2014
 Definition:
Includes governance and management’s overall
attitude, awareness and actions regarding IC and its
importance in the entity
 Auditors should consider:
 communication and enforcement of integrity and
ethical values
 commitment to competence
 participation by those charged with governance
 management’s philosophy and operating style
 organisational structure
 assignment of authority and responsibility
 human resource policies and practices.

9. Risk Assessment
AUD390 2014
 Definition:
Management’s identification & analysis of risks
relevant to the preparation of fin stat in accordance
with accounting standard i.e. FRS
 Risk assessment process
– Identify factors affecting risks
– Assess significance of risks & likelihood of
occurrence
– Determine actions necessary to manage risks

10. Control Activities
AUD390 2014
 Definition:
Policies & procedures established by management in
order to ensure that its directives are carried out
 Types of specific control activities:-
– Segregation (Separation) of duties
– Authorisation of transactions and procedures
– Adequate documented transactions and records
– Physical controls over assets and records
– Independent checks on performance

11. Information & Communication
AUD390 2014
 Definition:
Method used to initiate, records, process & report an
entity’s transactions & to maintain accountability for
related assets
 An effective information system establishes the
records and the methods that:
1. Identify and record all valid transactions.
2. Resolve incorrect processing of transactions.
3. Process and account for system overrides.
4. Transfer information from transaction processing
systems to the general ledger.
5. Capture information relevant to financial reporting for
events and conditions other than transactions.
6. Present the transactions and related disclosures
properly in the financial report.

12. Monitoring
AUD390 2014
 Definition:
Management’s ongoing & periodic assessment of the
quality of IC performance to determine whether
controls are operating as intended and are modified
when necessary
 Monitoring mechanism:
– Studies of existing IC
– Internal Audit Reports
– Reports from Regulatory such as BNM, SC, Bursa
Malaysia
– Feedback from operating personnel
– Complaints from customers

13. Obtain & Document Understanding
of Internal Control
AUD390 2014
 Purpose:
– To obtains an understanding of the entity’s IC
through
 Gathering evidence about the design of IC
 Observed whether the IC have been placed
in operations
 Methods in gathering evidence:
i. Narratives
ii. Flowcharts
iii. Internal Control Questionnaire

14. Narratives
AUD390 2014
 Definition ~ A written description of a client’s IC
 A proper narrative of any ICS include 4
characteristics
i. The origin of every documents & records in the
system
ii. All processing that takes place
iii. The disposition of every document and records
in the system
iv. An indication of the controls relevant to the
assessment of control risk

15. AUD390 2014

16. Flowcharts
AUD390 2014
 Definition ~ A diagram of the client’s documents
and their sequential flow in the organization
 Advantages:
– It provides a concise overview of the client’s
system
– It helps in identifying inadequacies in the system
– Easier to read
– Easier to update

17. AUD390 2014

18. Internal Control Questionnaire
AUD390 2014
 Definition ~ A series of questions about the controls in
each audit areas as a means of uncovering aspects of
internal control that may be inadequate
 It require a ‘yes’ or ‘no’ response, where NO indicating
potential internal control deficiencies

19. Tests of Controls
AUD390 2014
 Definition ~ Audit procedures to test the operating
effectiveness of controls in support of reduced
assessed control risk
 4 types of procedures involved:
i. Make inquiries of appropriate client personnel
ii. Examine documents, records & reports
iii. Observe control-related activities
iv. Re-perform client procedures

20. COMMUNICATION OF
INTERNAL CONTROL RELATED
MATTERS
AUD390 2014
 Auditing Standards (ISA315 & ISA260) require the
auditor to communicate to those charged with
governance, as soon as practicable, material
weaknesses in the design or operation of the
accounting & internal control systems, which have
come to the auditor’s attention
1. Management Letter (ML)
An optional letter written by the auditor to a client’s
management containing the auditor’s
recommendations for improving any aspects of the
client’s business

21. Cont…
AUD390 2014
• Items should be included in the ML:
 A statement that the purpose of the audit was
to report on the fin stats & not to provide
assurance on IC
 A statement that the letter only discusses
weaknesses in IC which have come to the
auditor’s attention as a result of the audit
 A statement of restriction on the distribution of
the report

22. Cont…
AUD390 2014
2. Director’s Statement on Internal Control
• Under the Listing Requirements of Bursa
Malaysia Securities Berhad (Listing
Requirements)
 Listed Companies to include a Statement
on Internal Control in the annual reports
 Company’s external auditors must review
the Statement on Internal Control & report
the result to the BOD

23. Cont…
AUD390 2014
• The Director’s Statement on Internal Control
should incorporate the following aspects
 The Board should maintain a sound system of
IC to safeguard shareholders’ investment &
the company’s assets
 The Board should (inter alia)
 Identify the principal risks & ensure the
implementation of appropriate systems to
manage the risks;
 Review the adequacy & integrity of the
company’s ICS & Management information
system, including systems for compliance
with applicable laws, regulations rules,
directives & guidelines

24. Tutorial Questions
AUD390 2014
1. Explain what is control environment and state 2 factors
affecting this component.
2. Identify a key internal control and possible substantive
test of transactions that could perform for each of the
following audit objectives
i. Sales made to existing customer (Existence)
ii. Existing sales transaction are recorded
(Completeness)
iii. Recorded sales are for amount of goods shipped and
are correctly billed and recorded (Accuracy)
3. State the audit objective (s) for the following tests
performed.
4. You decided to issue a Management Letter
i. Define Management Letter
ii. Briefly explain 2 purposes of Management Letter