Limitations of internal control and recording control systems

The owner of a small printing press in Ibadan approves every payment, signs every cheque, hires every worker and keeps the only set of books with one part-time clerk. There is no written procedure and no second pair of eyes. His honesty may be beyond doubt, yet the auditor cannot rely on his controls as she would on those of a bank with a hundred staff.

Every control system has limits, and small businesses have more of them. Auditors must know the limits, and must record what controls do exist in a form that can be reviewed and updated.

This topic covers why internal controls can fail, the special problems of small entities, why the auditor must record the system, and the three main methods of recording: narrative notes, flowcharts and questionnaires, including the internal control questionnaire and the internal control evaluation questionnaire. The next topic covers how the recorded controls are evaluated.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• the limitations of internal control
• how accounting systems and related controls are identified, recorded and analysed
• the evaluation of internal controls

CAMA 2020 and recording controls

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Why internal controls may be ineffective

No internal control system is foolproof, however good it looks. The inherent limitations are:

• Human error. People make mistakes, and a mistake in processing may not be caught by the control system.
• Cost. It may not be cost-effective to set up some controls. A control that costs more than the loss it prevents is not worth having.
• Override. Controls may exist, but employees or management may ignore or override them.
• Collusion. Two or more people may work together to avoid a control, perhaps to commit fraud. Segregation of duties then fails, because the people who should check each other are acting together.

Modern auditing is built on testing systems and controls, but because of these limits the auditor never relies on control testing alone. The auditor always adds some testing of transactions and balances, called substantive testing, and the amount depends on how effective the controls are judged to be.

Other limits include controls aimed at usual transactions that do not catch unusual ones, changes in conditions that make controls out of date, and the judgement used in applying controls.

Problems for small entities

Many control activities found in a large company are too costly or impractical for a small one. Segregation of duties is the obvious case, because a company with a few staff cannot separate every task. The same person must do many things. Control often rests on the owner-manager, who personally authorises many transactions and reviews performance.

That involvement can reduce the risk caused by lack of segregation, so the attitude and actions of the owner become central to the auditor's risk assessment. There is usually no written code of conduct, so a culture of integrity shown by the owner's example is important. The auditor usually sees owner involvement as only a partial substitute for ordinary controls.

Problems arise when control depends too much on senior management:

• there may be no evidence of how systems are supposed to work, so the auditor relies more on enquiry than on documents;
• there may be no evidence that controls exist and operate;
• management may override the controls that exist;
• management may lack the expertise to control the entity; and
• there is unlikely to be an independent person in management, as there would be among those charged with governance in a large entity.

The auditor must still understand and evaluate whatever controls exist, and plan the work accordingly. A lower level of reliance on controls is likely, and so a large amount of substantive testing.

Why the auditor records the system

The auditor must understand each of the five components of the control system. The understanding is needed to evaluate the system and assess audit risk, and the result decides whether the audit is systems-based or transactions-based. Work on controls is therefore an important part of gathering evidence, and, like other significant evidence, it must be documented in the working papers, probably on the permanent file.

Recording also lets the next year's team see what was found before, and lets a reviewer check that the evaluation was sound.

Recording methods

The internal control questionnaire (ICQ)

An ICQ is designed to establish whether appropriate controls exist to meet specific control objectives. Each question has a yes or no answer and deals with a particular control. Usually a yes shows a control strength and a no shows a weakness. For credit control, the questions might be: Are credit references taken on all new customers? Are credit limits set for customers?

To establish that the correct prices are charged on invoices, the question is: Is a check made to match the price on a sales invoice to the official price list? To establish that raw materials delivered are as ordered: Are raw materials counted and checked against the purchase order when delivered?

An ICQ records the system and helps the evaluation, since the yes and no answers give an overall picture of reliability. It is simple to complete, so a junior can do it. But it can be long and time-consuming.

Updating ICQs. Instead of drawing up new questionnaires each year, the auditor usually takes those from last year's file, checks them and updates them.

The steps are:

• obtain last year's ICQs
• look at the weaknesses they showed and find out whether the client has acted on them
• check the accuracy of each ICQ by reviewing system documentation, interviewing staff and doing walk-through tests, and amend as needed
• then, with an up-to-date set, assess whether weaknesses exist

The internal control evaluation questionnaire (ICEQ)

The ICEQ was developed in answer to the length of ICQs. It has a small number of key control questions designed to show whether major weaknesses may exist. With an ICQ the auditor looks for "good news", expecting to find particular controls. With an ICEQ the auditor looks for "bad news", the chance that controls are weak. A yes should again mean good control.

In the credit example, one ICEQ question might be: Is there reasonable assurance that goods can be dispatched only to authorised customers whose balance is within their credit limit? An ICEQ is shorter, but its questions are less precise and need more knowledge and experience to answer. The choice between them is the auditor's or the firm's. Both record and evaluate.

Choosing a method

Many firms combine methods: a flowchart for the main transaction flow, narrative notes for special features and a questionnaire to check that the usual controls exist. Whichever method is used, a walk-through test confirms that the record is accurate. For a small entity with simple processes, narrative notes may be enough. For a large, document-heavy system, a flowchart with a questionnaire is more efficient.

For computerised systems, firms use electronic questionnaires and may also use process-mapping software.

Worked examples

1. That is collusion, which defeats segregation of duties.
2. It is an inherent limit, so the auditor still performs substantive tests.

1. The owner's involvement is a partial substitute for segregation.
2. The auditor assesses the owner's integrity and the evidence that the review happens, and plans more substantive testing.

1. "Is every supplier paid from a list of approved suppliers? Yes/No."
2. A yes is a strength; a no is a weakness.

1. A flowchart is suitable: it shows the flow of documents between departments.
2. Narrative notes would be long, and a questionnaire alone would not show the flow.

How to score full marks

• List the four limitations and explain collusion.
• For small entities give the lack of segregation and the role of the owner.
• Compare the three methods with a strength and weakness each.
• Contrast the ICQ and the ICEQ: good news and bad news.

Common mistakes in the exam

• Saying controls give absolute assurance.
• Saying owner involvement removes the need for substantive testing.
• Confusing the ICQ with the ICEQ.
• Forgetting to document the system in the working papers.

Quick revision

• Limits: error, cost, override, collusion.
• Small entities: weak segregation, owner involvement, more substantive tests.
• Record by narrative, flowchart, questionnaire.
• ICQ: many questions; ICEQ: few key questions.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.