22107 Lecture Notes - Lecture 5: Cash Cash, Internal Control, Password
UTS 2014 – Accounting for Business Decisions A
Page 18
LECTURE 5 – CASH AND INTERNAL CONTROLS
Some features of cash include being transportable, exchangeable and almost untraceable.
LEARNING OBJECTIVES
Describe the role of internal control in a business.
In its broadest sense, internal control is the process that a company’s management uses to
help the company meet its operational and financial reporting objectives.
Among other things, internal control helps a company protect its assets.
Internal control is the system of policies and procedures used in a company to promote
efficient and effective operations, reliable financial reporting and compliance with laws and
regulations.
All companies have systems of internal control. The only question is the strength of them.
Recognising IC affects a company’s success or failure, the Sarbanes-Oxley Act in the United
States contained several new requirements for publicly traded companies regarding IC.
One was that firms include in annual reports to shareholders an internal control report.
Describe the five components of internal control.
Internal Control – Integrated Framework states that good IC consists of the following:
o Control environment is the atmosphere in which the members of an organisation conduct
their activities and carry out their responsibilities.
It is the foundation for all other components of internal control.
Often called ‘tone at the top’ as it reflects the overall control consciousness of organisation.
One of the most important factors affecting a firm’s control environment is the overall
integrity and ethical values of personnel.
These attributes translate into behavioural standards that permeate throughout operations.
Other factors include management’s philosophy and operating style, the assignment of
authority and responsibility, and the general structure of an organisation.
Each of these factors contributes to the overall corporate culture within which IC operates.
o Risk assessment refers to the identification and analysis of the risks that threaten the
achievement of organisational objectives.
Because business conditions change over time, risk assessment = ongoing business activity.
Organisational risks can arise from both external and internal sources.
External sources might include new competitors, changing customer expectations or even
natural disasters. Internal sources include inadequate workforce training, errors in financial
reporting of activities or theft of assets by employees.
Once an organisation identifies its risk, the risks can be analysed with the following process:
Estimate the significance of a risk then assess the likelihood of the risk occurring then
consider what actions should be taken to manage the risk.
Risks of minor significance or those with a lower likelihood of occurrence generally do not
warrant serious concern. E.g. risk of meteorite destroying firm’s warehouse can be ignored.
Significant risks with higher likelihood demand considerable attention. E.g. theft of cash.
o Control activities are the policies and procedures established to address the risks that
threaten the achievement of organisational objectives.
Although specific control activities vary widely across organisations, they generally fall into
one of several categories (as outlined below):
UTS 2014 – Accounting for Business Decisions A
Page 19
Establishing responsibility – a critical factor in good IC is establishing responsibility for the
performance of a given task. When responsibility is clear, two benefits arise. First, the
employee knows that he/she will be held accountable for completion of the task. Second,
management knows who to consult if the task is not completed satisfactorily.
Maintaining adequate documentation – accounting information is useful only when it is
reliable (free from error) so control activities are necessary in all organisations to promote
error-free accounting records.
Segregation of duties – this is a technique that limits one person’s control over a particular
task or area of a company. It is accomplished by spreading responsibility among multiple
employees so that one employee’s work can serve as a check against another’s work.
Physical security – good IC includes effort to safeguard company assets + records. Most of
these controls are meant to prevent the loss of assets. Examples include secured facilities,
alarm systems, computer passwords, video monitors and door sensors. Other controls are
meant to detect the loss of assets – e.g. periodic counting of inventory for comparison to
accounting records. Significant discrepancies can then be investigated.
Independent verification – is the process of reviewing + reconciling information within a
business. This is particularly useful when reconciling an asset balance with the accounting
records for that asset. E.g. bank reconciliation. Often, the most effective verifications are
conducted on a surprise basis and are conducted by individuals who have no connection to
the process or the employee being verified. E.g. internal audit divisions of organisations.
o Information and communication refers to the requirement for the open flow of relevant
information throughout an organisation.
Information must be captured and communicated in a form and a timeframe that enables
employees to complete their responsibilities.
This requires information systems that produce relevant and reliable reports.
It also requires both upward and downward lines of communication.
So management must communicate with employees and vice versa.
o Monitoring refers to the assessment of the quality of an organisation’s internal control.
It can be accomplished in two ways.
First is through ongoing activities. E.g. in their recurring daily responsibilities, supervisors can
check for evidence that a control activity is functioning properly. They can also ask
employees if they understand controls in place and if those controls are being completed.
The second is through a separate evaluation.
In both ways, the purpose of monitoring is to continuously improve internal control.
Limitations of Internal Control
Regardless of how well IC control is designed, it can provide only reasonable assurances that
a company is meeting its objectives. IC systems are limited in their effective because of:
The human element refers to the fact that internal controls are often based on human
judgement and action. IC cannot eliminate them all of our mistakes. Also, employees can
purposefully circumvent controls for personal gain. Sometimes this will be a manager who
overrides the control activities in place. Other times, it will be collusion among employees to
circumvent existing controls – can be very effective at defeating a firm’s internal controls.
Cost-benefit analysis refers to the cost of implementing a control activity versus the benefit
that the control provides.
