Advantages of An Internal Control System - ZenGRC

Internal controls are designed to protect an organization from fraud, loss of assets, compliance failures, and other obstacles to overall business objectives. After investing time, money, and effort into implementing a system of internal controls, it is important to ensure that the system is effective. The best way to assess the effectiveness of internal controls is through internal audit control testing.

What Is Internal Audit Control Testing?

Internal audit control testing aims to improve operations, financial reporting, and compliance by evaluating the effectiveness of the internal control system. An auditor uses a series of assessment techniques to gather a complete understanding of control procedures. Using a risk-based approach, auditors can focus on areas where risk is more likely to occur, identify areas of concern or weakness, and make recommendations to improve internal controls. This ensures the organization can fully benefit from its internal controls.

Advantages of an Internal Control System

Some advantages of internal controls include:

• ​Only a few, trusted senior-level workers can modify internal controls, making it easier to track and guard against abnormalities.
• ​Well-designed and executed internal controls increase efficiency by making transactions transparent.
• ​Internal controls protect employees from accusations of irregularities or misappropriation of funds by balancing transparency and efficiency.
• ​They make the organization process-driven rather than people-driven, reducing dependence on specific key employees.
• ​Internal controls can identify redundancies in operating and compliance procedures, providing opportunities to simplify operations.
• ​They can serve as an early warning system, enabling early identification and correction of deficiencies before external, regulatory, or compliance audits.

The Five Steps to an Audit

While auditors may vary their approach, the fundamental structure of the audit process remains the same. The five stages necessary for a successful internal audit are:

1. Selection

The overall objective and scope of the audit are determined. After conducting a risk assessment, specific audit activities are outlined and approved by an audit committee.

2. Planning

The auditor meets with management, department heads, or supervisors to discuss the scope of audit procedures, relay audit timelines, and gather necessary background information, including findings from prior audits.

3. Fieldwork

Also called the execution phase, fieldwork is the on-site audit work. The auditor may:

• ​Investigate the overall control environment
• ​Interview random employees and managers
• ​Review financial information
• ​Inspect legal documents
• ​Review policies and procedures manuals
• ​Examine information technology systems
• ​Perform walkthroughs of certain business processes
• ​Distribute surveys regarding control activity requirements for specific job duties
• ​Perform tests of controls

Throughout this phase, the auditor communicates with management to relay preliminary findings.

4. Reporting

The auditor compiles all observations and findings, including recommendations to improve the operating effectiveness of controls. Management reviews the conclusions and is asked to respond in an action plan. These responses are included in the final audit report.

5. Follow-Up

Within a year of issuing the final audit report, the auditor conducts a follow-up audit to determine progress made on the action plan. If necessary, additional internal audit control testing is completed.

How Is Internal Audit Control Testing Done?

Following generally accepted auditing standards (GAAS), an auditor evaluates an organization’s control procedures. Due to the Sarbanes-Oxley Act (SOX) in the United States, internal controls over financial reporting receive significant attention during internal audit control testing.

The auditor collects sufficient audit evidence to conclude whether an organization’s financial statements are free of material misstatements. To substantiate this, the auditor conducts a test of controls.

The Four Categories for Test of Controls

To verify operational efficiency and effectiveness of internal control processes, an auditor uses various testing methods:

1. 1.Inquiry: Ask staff to describe verbally how a control activity is performed.
2. 2.Observation: Observe a control procedure as it is physically performed.
3. 3.Inspection: Examine documents as physical evidence that a control procedure was performed.
4. 4.Re-performance: The auditor initiates a transaction and re-performs the specific steps of the control activity to judge its effectiveness.

If audit evidence suggests possible risks of material misstatement in the organization’s financial statements, the auditor may increase the sample size and employ tests of details to verify the reliability of financial reporting. When errors are discovered, the auditor will issue findings that require corrective action.

The Six Principles of Internal Control

These principles are the basis for management to create and implement internal controls. They are the critical components of an effective internal control system.

Establishment of Responsibility

Assigning authority and responsibility is essential for accountability. A clearly defined organizational structure helps stakeholders understand leadership and escalation paths.

Segregation of Duties

Clearly defined responsibilities and limits of authority provide checks and balances to catch errors. Segregation of duties ensures that no single person has too much power to perpetrate fraud. For example, responsibility for maintaining an asset’s records should be separate from the physical custody of the asset.

Physical Control

Physical control refers to safeguarding assets and improving the accuracy of records. It is a preventive control to deter or prevent undesirable events such as theft or damage.

Documentation Procedures

Control systems should require employees to promptly submit source documents for accounting entries. This ensures timely recording of transactions.

Independent Internal Verification

Companies should verify records regularly or on an ad hoc basis. An employee not part of the team in charge of the data should double-check, providing objectivity and reducing bias. Exceptions and discrepancies should be reported to management for corrective action.

Human Resource Control

Human resources policies and procedures inform employees about expected integrity, ethical behavior, and competence. HR policies also drive other internal controls such as rotating employee duties, requiring vacation time, and conducting background checks.

Integrating Internal Audit Control Testing into Your Organization

Internal audit control testing is a form of risk management. When internal auditors help find and correct weaknesses in an internal control system, the organization benefits. Even a solid auditing process is subject to human error, so using software tools can help streamline the process, manage and automate controls, and facilitate reporting, making audits less burdensome.