You are on page 1of 75

Understanding & Effectiveness of Internal Controls & RCSA Framework

What is Control? Traditional View of Controls What is Internal Control? COSO Framework (An Internal Control Framework) and Oversight Representative Components of Internal Control

Definition & Objective- Control Self-Assessment

Understanding & Effectiveness of Internal Controls

Understanding & Effectiveness of RCSA Framework

Objectives of RCSA How to Identify Risk Condition that Increase Risks

Characteristics- Control Self-Assessment


RCSA the Early days & Internal Audit Involvement

CSA compared with Traditional IA Approach


Core CSA Process

1- Control Environment 2- Control Activities 3- Risk Assessment

CSA Methodology and Practical Considerations


Advantages / Disadvantages of RCSA Utility of RCSA RCSA Reference Our Beliefs Limitations

4- Information and Communication


5- Monitoring

Why Controls Dont Always Work What you can do;

What is Control -Real life examples COSO Framework Its Oversight, Requirements and Application Internal Controls Who needs them 5 Internal Control Components In detail 5 Types of Risk 5 Types of Controls RCSA Framework Back ground and application RCSA Methodology Advantages and limitation of RCSA

What you can should do as an auditors

1. Power To Direct Or Determine 2. The Activity Of Managing Or Exerting Control Over Something "The Control Of The Mob By The Police Was Admirable" 3. Dominance, ascendance, the state that exists when one person or group has power over another 4. Discipline in personal and social activities 5. Command, control, mastery(noun) - A mechanism that controls the operation of a machine 6. Control (verb) - the economic policy of controlling or limiting or curbing prices or wages etc., "they wanted to repeal all the legislation that imposed economic controls" 7. Exercise authoritative control or power over - "control the budget"; "command the military forces" 8. Control, hold in, hold, contain, check, curb, moderate(verb) 9. Verify by using a duplicate register for comparison "control an account"

The combination of many factors which support people in their efforts to achieve their business objectives.
e.g. skills, culture, information, resources, measurements, policies, communication, teamwork, procedures.

A process is the method or task performed to achieve an objective.

A control is a mechanism to ensure the objective of process is achieved.

Controls seen as the responsibility of auditors and financial personnel. Controls perceived as limited to financial areas. Controls seen as bureaucratic & burdensome.

Committee of Sponsoring Organizations of the Treadway Commission (COSO)


1. AICPA (American Institute of Certified Public Accountants) 2. AAA (American Accounting Association) 3. IIA (The Institute of Internal Auditors) 4. IMA (Institute of Management Accountants 5. FEI (Financial Executives Institute)

Keeping an eye on entitys assets and resources Finding ways to make sure people dont do bad things Protecting the entity from being accused of doing bad things Good, sound business practice Common Sense!

Think about what you do;


Lock you home and vehicle Keep you ATM, CR/DR Pin number separate from your card Review bills and credit card statement before paying them Reconcile your bank statement Dont leave blank cheques or cash just lying around Expect your children to ask permission to do certain things Other examples

Vehicles are kept locked when not occupied. Hierarchies to build the structure and mechanism of accountability Computer Passwords are periodically changed and shouldnt be written down or kept by the PC Checking purchase card charges against source documents. Checking management reports against source documents Locked cash drawers and secure storage for checks Authorization required for certain activities Other Example

Internal control is broadly defined as a process, effected by an entity's board of directors, management/administration, council and individuals, designed to provide reasonable assurance regarding the achievement of three objectives: Which are; Effectiveness and Efficiency of Operations. Reliability of Financial Reporting. Compliance with applicable laws and regulations.

Intertwined with entitys operating activities.

Built into the entitys infrastructure.

"Built in' Controls support quality empowerment initiatives avoid unnecessary costs

enable quick response to changing conditions..

Fairly presented in conformity with (GAAP) Other relevant / appropriate accounting principles Regulatory requirements for external purposes

Existence or Occurrence Completeness Rights and Obligations Valuation or Allocation Presentation and Disclosure

Compliance to applicable laws is the most essential element of any business function.

Ensure compliance to
-

Entitys Operations / Admin Manual Entitys Personnel Policies Prudential Regulations F.E Manual AML & KYC Hand Book Operations Manual Accounting Manual Audit Manual Other relevant circulars/manuals i.e. Compliance Newsletters Regulatory Guidelines Audit Manual

Internal control consists of five main interrelated components, which derived from the way management runs a business, and are integrated with the management process.
The components are:
Control environment. 2. Risk assessment. 3. Control activities. 4. Information and communication. 5. Monitoring.
1.

1. Control Environment
The foundation on which everything rests.

Key factors: Managements attitude: Tone at the Top Individual attributes: integrity, ethical values, competence, culture, vision, leadership.
Control Environment

1. Control Environment

A control environment has: - Appropriate hiring policies - Assignment of authority and responsibility - Up to date job descriptions - Appropriate training - Meaningful review of performance - Punctuality and discipline - Hierarchical structure

What is Risk? Anything that could negatively impact the entitys ability to meet its operational objectives.
Risks are things that will stop an organization from meeting its objectives. What could keep your entity from reaching its goals?

What keeps you up at night?

Strategic risk that would prevent a department from accomplishing its objectives (meeting its goals).
Financial risk that could result in a negative financial impact to the Entitys (waste or loss of assets).

Regulatory (Compliance) risk that could expose the Entity to fines and penalties from a regulatory agency due to non-compliance with laws and regulations.
Reputational risk that could expose the Entity to negative publicity. Operational risk that could prevent the department from operating in the most effective and efficient manner or be disruptive to other Entity operations.

2. Risk Assessment Understanding objectives Identification of Risks Assessing Risks Significance Likelihood

Risk Assessment

2. Risk Assessment

For content, three factors will assist you in determining the significance of the risks you have identified:

Managements risk appetite and risk capacity The magnitude of the impact of the risks

The likelihood of occurrence

2. Risk Assessment

Variety of risks from external and internal sources Pre-condition to risk assessment - establishment of objectives
The broad categories of objectives used for risk assessment are: Operations objectives. Financial Reporting Objectives. Compliance Objectives.

Business Risk Framework


External Risks

Legal (regulation, legislation, etc) Economic (interest rates, currencies, inflation, GDP, unemployment, etc) Social (trends, values, population growth, consumer psychology, etc)

Technology New Entrants Suppliers Substitutes Competition

Capital Markets Political Disasters Rating Agencies Terrorism

Internal Risks Governance


Integrity

Compliance

Business Risk Framework

Authority Leadership Performance Incentives Limits

Management Fraud Employee Fraud Illegal Acts Unauthorized Use Reputation Operational Sourcing Product Development & Life Cycle Mgmt. Product Failure Business Interruption Strategic Alliances

Taxation Environmental Health & Safety Legal Regulatory

Technology Quality Customer Satisfaction Customer Accept./Credit

Obsolescence Shrinkage Efficiency Capacity Pricing Cycle Time

Contracting Performance Measures Health and Safety Trademarks/Branding Marketing

Repair & Maintenance Security Systems Acquisition Integration

Information Management

Financial Management

Human Resources

Management Info. System Dependence on IT Reliability External IT Access/Availability Completeness/Assurance Relevance Sufficiency

Budgeting & Planning Cash Flow Investment Evaluation Financial Reporting Financial Instruments Funding Accounting Information Cost control

HR Management Competencies Recruitment Recognition/Retention/ Compensation Performance Management Leadership Development Training

2. Risk Assessment - Magnitude of Impact

Insignificant
Minor

No impact on reputation
Consequences can be absorbed under

normal operating conditions Potential impact on reputation


There is some impact on reputation Reputation is impacted in the short term
Serious damage to reputation

Moderate Major
Catastrophic

2. Risk Assessment - Likelihood of Occurrence


Rare or Remote Unlikely Event may only occur in exceptional circumstances Event could occur in rare circumstances

Possible
Likely

Event could occur at some time


Event will probably occur in most circumstances

Almost Certain

Event is expected to occur in most circumstances

2. Risk Assessment
Quantitative Assessment gathers data in numerical form which can be put into categories, or in rank order, or measured in units of measurement. This type of data can be used to construct graphs and tables of raw data. Examples: Deposits Advances Actual Reported Frauds Financial Statements System Downtime Un-reconciled Transactions (Amount) Un-reconciled Transactions (days) Qualitative Assessment gathers information that is not in numerical form. For example, diary accounts, open-ended questionnaires, unstructured interviews and unstructured observations. Examples: Internal Audit External Audit SBP Audit (where applicable) Customer Service Complexity of Operations Core Banking Systems / ERP Applications Entitys operating software

2. Risk Assessment
Likelihood of Occurrence
Almost Certain

Likely

Possible

Unlikely

Rare Insignificant Minor Moderate Major Catastrophic

Magnitude of Impact

Actions supported by
Policies Procedures Safeguards Authorities assure management directives to address risks are carried out properly and timely.
Control Activities

Controls can be automated or manual; To be effective, control activities must be:


Directly related to the Control objective Appropriate Functioning consistently according to plan throughout the period Cost effective Comprehensive Reasonable

Information Technology Control Activities

-General Controls are the structure, policies and procedures that apply to the information systems and help to ensure proper operation.

-Application Controls are Programmed procedure in application software designed to ensure completeness and accuracy of information..

Authorization and approval procedures; Reviews of operating performances;


Supervision (assigning, reviewing/approving, guidance, training); Segregation of duties (authorizing, processing, recording, reviewing); Controls over access to resources and records;

Reviews of processes and activities; Numerical sequence of documents to ensure completeness; Exceptions reviews; reporting & top level

Performance indicators; Information system controls (general & application controls); System Access; System Configuration and Account Mapping; Exception/Edit Reports;

Reconciliations; Verifications;

General Controls:
- Access security - Data and program security - Physical security - Software development and program change controls - Data center operations -Service continuity (disaster recovery)

Application Controls :
- Designed to prevent, detect and correct errors and irregularities as information flows through information systems: Input controls (data entry) authorization; validation; error notification and correction Processing controls Output controls

Directive Controls
Entity Operation, Admin Manual; Personnel Policies; Policy on Sexual Harassment; Govt. Accounting Standards Board (GASB), UCP 600, Manuals, Instructions, Regulations, Circulars , public notices, CDD / AML Procedures Hand Book and Ops Manual, AML / CFT Regulations / AML Act 2010, FATF (40) , SECP Guidelines , FMU Regulations, Symbols user manuals, CTR user manuals

Preventive Controls
- Annual budget - Inventory of assets - Periodic performance evaluation - Segregation of incompatible duties ( a person is not in a position to both commit and conceal), Limits to authority (link to specific dollar levels) Original documents to support a transaction, Security Access (CCTV and Guards), point Custodianship, Physical controls over assets (Lock and Key), Authorized signers (Smart Cards)

Detective Controls
Review of computer/application user access log Periodic (annual) inventory count Account reconciliations (HO and Bank Statements) Physical inventories (Stock Reports ) Card logging, and approval (Layers, Review of reports, Card and Pin Checking) Internal auditors, RCSA

Corrective Controls
Adjusting Journal Entries; terminations; training, Documentation systems or processes (Gap Analysis) Improvement initiatives (Service weeks) Discipline actions (Demotions and Transfers), Error communication and reporting (Issue Resolution and P & V)

Recovery Controls
Disaster recovery and business continuation plans

4 - Information and Communication


Pertinent and reliable information should be identified, captured and communicated in form and timeframe that enables staff to carry out their responsibilities.

o Managements ability to make appropriate decisions is affected by the quality of information; that implies that the information should be appropriate, timely, current, accurate and accessible. o Information systems need to produce reports that contain operational, financial and nonfinancial, and compliance-related information.

4 - Information and Communication Right information Right place Right time Frankness Openness

Cost Effective controls are made possible by the right information


Communication of Plans, Performance Indicators, and Expectations.

Information
Transactions and events must be recorded promptly when they occur if information is to remain relevant and valuable to management in controlling operations and making decisions.

Documentation should be updated promptly, including policies and procedures.


Information is the basis for communication.

Communication
Effective communication should occur in all directions flowing down, across and up the organization, throughout all departments and divisions. Management should be kept up-to-date on performance, development, risks and other relevant events and issues. Management should communicate to its staff what information it needs to be effective; and provide feedback and direction.

5 - Monitoring
Monitoring ensures that the Internal controls operate as intended over time, and is accomplished through routine (on-going) activities, separate evaluations or a combination of both.

Ongoing monitoring activities cover each of the Internal control components, and involve action against irregular, unethical, uneconomical, inefficient and ineffective Internal controls.
Separate evaluations are conducted by Internal and/or external auditors; findings/recommendations are reported to the appropriate level of management for resolution.

Monitoring

5- Monitoring
5 - Monitoring

Benchmarking Exceptions Analysis of results Effective change Internal & External Audits

5 Monitoring - Examples
Supervision
Observations Raising queries

Exception Reports Inspections

Reviews of Reconciliations/ Variance Analysis


Performance Data Trend Analysis Audits

Self-assessments
Communication from Customers, Regulators, etc.

MONITORING

Ongoing Monitoring Separate Evaluations Reporting Deficiencies


CONTROL ACTIVITIES

Downwards Upwards Horizontal Departmental External

Policies Procedures Hard control activities

Management Information Systems Performance Information Instructions & Guidance

RISK ASSESSMENT

Organisation-wide Objectives Activity-level Objectives Risk Management Managing Change


CONTROL ENVIRONMENT

Integrity & Ethical Values Commitment to Competence Board of Directors & Audit Committee Management Philosophy & Operating Style

Organisational Structure Assignment of Authority & Responsibility Human Resource Policies & Practices

1. Inadequate knowledge of policies or governing regulations. I didnt know that! 2. Inadequate segregation of duties. We trust A who does all of those things. 3. Inappropriate access to assets. Passwords shared, cash not secured 4. Form over substance. You mean Im supposed to do something besides initial/sign it? 5. Control override. I know thats the policy, but we do it this way. Just get it done; I dont care how!

6. Inherent limitations. People are people and mistakes happen. You cannot foresee or eliminate all risk.

When thinking about Internal controls, consider the following: Compliance with policies and government regulationsare you following established procedures/instructions?

Propriety of transactionsis this legal and right? Does it feel or look wrong? Would someone else think so? Reliability and integrity of informationis the information/form/data/report accurate and complete?
Safeguarding assetscould anyone take or gain access to items under your control without being observed? Economy and efficiency of operationsis there a better way to do the job?

o o o o o o o o o

Make sure they have up-to-date policies and procedures; Ensure authorization limits are communicated within the departments; Ensure all assets (especially cash) are safeguarded at all times; Establish document control (especially for spreadsheets); Ensure approval signatures are visible (legible) on all required documentation; Make sure data is only accessible by authorized personnel; Understand the department/functions risks; Ensure adherence to Entity's policy and Entity's code; Establish objectives and measures for your department/function and for major programs; and Evaluate performance to gauge the efficiencies

Control Self Assessment Some Definitions

A CSA programme is a process which allows individual line managers and staff to participate in reviewing existing controls for adequacy, and recommending, agreeing and implementing improvements (IIA)
A formalised, documented and committed approach to the regular, fundamental and open review by managers and staff of the strength of control systems designed and operated to achieve business objectives and guard against risks within their sphere of influence (CIPFA)

..would one day completely replace the traditional audit as the primary assurance tool in the auditors toolkit (Gulf Canada)
A process through which any entitys Internal Control effectiveness is examined and assessed.

For each department/division objective, ask:


What could go wrong? How could we fail? What must go right to succeed? What decisions require the most judgment? What activities are most complex? What activities are regulated? On what do we spend the most money? How do you bill/collect related revenue? On what information do we most rely? What assets do we need to protect? How could someone or something disrupt our operations?

Lack of segregation of duties Too much trust - Approval of documents without review - Lack of verification of transactions after they have been entered in the system - Lack of reconciliations No follow-up when things appear questionable or not reasonable Lack of control over physical assets / inventories Lack of control over logical access, system/application access Lack of control over purchasing of materials/supplies Lack of knowledge of policies and procedures

RCSA- Objectives

The objective is to provide reasonable assurance that all business objectives will be met. (Institute of Internal Auditors)

Proactive management of risk Problems identification and its correction


Awareness of risk and control Upward timely communication to the senior management for: Significant risks and control issues Remedial action plans

RCSA Objectives

Assist employees in assuming responsibility for effective risk and control management

Teach staff to analyse, evaluate and report on the application and effectiveness of control mechanisms
Improve control awareness and the cost effectiveness of products/services

Complements performance reporting regimes Enables managers to certify corporate governance statements with more certainty

CHARACTERISTICS - Control Self-Assessment

An ongoing process to ensure controls are adequate and functioning correctly. A process to notify management timely, when things are going wrong. A mechanism to record and monitor issues and the status of corrective actions.

RCSA-The Early days

Perceived as a threat to Internal Audit

Sluggish start even in the US (only 17% of bodies were using it by 1995)
Seen as exporting systems based audit to staff

Less than 30% of processes/functions used RCSA and most of the applications were driven by Directors of Finance Supporters saw it as a useful control awareness initiative Audit critics believed it could be a new injection of life into flagging tick and turn auditing

Potential Internal Audit Involvement

Advice on design, implementation & maintenance of risk management system Advice on risk, control and governance
Undertake audits of business unit schedules using COSO model Review periodic reports of business units

Membership of Risk & Control Panel Reporting on its own plans, activities and outcomes
Contribute to overall assessment on Corporate Governance

Other Considerations

Few organisations cover more than 30% of risk functions


70% of sponsors are Internal audit After implementation, 60% of Internal audit functions remain involved

50% use COSO, 50% use proprietary software or Internal audit designed documentation (US experience)
Time involvement may have to be rationed 68% of audit functions claim RCSA is one of its products

CSA compared with Traditional Audit Approach


Traditional Approach
Assign duties, supervise staff Policy/rule-driven Limited employee participation Narrow stakeholder focus

RCSA Approach
Empowered, accountable employees Continuous improvement/learning curve Extensive employee participation and training Broad stakeholder focus

Auditors and other specialists

Staff at all levels, in all functions, as primary control analysts

Core RCSA Process

Identify and document all significant processes of the bank/entity,

Evaluate risks (inherent/ specific) in each process,

Assess controls used to manage / mitigate risks,

Pointed out gaps & make Actions plans to correct weaknesses,

RCSA Methodology

To begin a process assessment, appoint someone who is knowledgeable about the process but not the process owner to evaluate if adequate controls exist.
Do a walk through of the process and verify controls exist to verify: Existence or occurrence Completeness Valuation or allocation Rights and obligations Presentation and disclosure

RCSA Methodology

Evaluate if there are:


Enough controls to mitigate key risks there may be a gap Controls that essentially do the same thing it is possible to over-control a risk

RCSA Methodology

Evaluate the design of each control.

Does it mitigate a key risk? Can it do what it is supposed to do every time without fail?
Does it prevent or detect errors or fraud?

RCSA Methodology

Evaluate the effectiveness of each control. Does it operate as it was designed? Is it efficient? Ways to evaluate controls: Observation Re-performance Inspection Knowledge assessment Corroborative inquiry

Practical Considerations

Must set objectives

Decide on most appropriate approach


What topics, processes, systems should be covered Amount of time to be invested COSO model or your own model

Facilitation skills available Outputs from the workshop Reporting protocols


Ongoing application

RCSA Scope of Workshops A Model to Show!


Objectives of the Activity/Process: Strategy/Control Environment: Policies, Laws, Plans, Budgets, Procedures, Standards, Responsibilities, Structures, Accountabilities, HR Policies, market conditions, training, guidance, management information, IT systems, interfaces, monitoring arrangements, reporting, payment regimes, performance measurement, external factors, best practice etc Operations:

Profile of the System (key stages)

Objectives

Risks

Controls Expected

Controls Actual

Opinion

Testing

Evaluation/ Improvement

Report/ Action

1.

2.

3.

4. Etc.

Line management becomes fully involved in risk & control


Ownership creates greater awareness Corrective action can be taken more speedily

The concept fits with neatly with empowerment models Facilitates embedding and reporting requirements Cheaper than employing more auditors

Helps employees to understand and assume responsibility for control, Places front line responsibility with management for operational risk management,
More effective corrective actions because participants own the results,

Improve communication at all levels, Increase control consciousness of the entire institution, Cultural change embedding operational risk management at all levels.

Possible RCSA Disadvantages

Relies too much on honesty


May be too subjective (not related to business objectives)

In practice, applied to traditional financial areas Time consuming Does not lend itself easily to cross functional systems
Could become unreliable as an add on to normal duties Filling in documentation could become an end in itself

RCSA References

Still the best UK publication (in my opinion)

Control Self Assessment edited by Keith Wade and Andy Wynne in 1999 (published by Wiley)

In addition to explaining the reasons for RCSA and the various approaches, it examines about 20 different public and private sector

practices which are written by different experts and practitioners

Utility of RCSA

IC

BOD & Senior. Management

ITAM Process

Oversight Frequent & comprehensive reporting of control deviations to the BOD / Senior Management

RCSA Process

COSO Documentation

Effectiveness of existing controls


Adequacy of controls

(Operational, Financial Reporting & Compliance)

Our Beliefs
People are more important than systems as; They can make bad systems workable, They can make good systems fail, They make the difference in the midst of change, Understanding how controls work leads to better change management, Shared information leads to faster improvement and lower risks.

Limitations
Internal controls cannot ensure success when there are
Losses/ Frauds

Bad Governance

Poor managers

Collusion / Conflicts

Forgeries

Wrong Decisions

Unethical behavior

Override / Breach of controls

Name: Ms. Saima Riaz Email Address: ifl.pvt.pk@gmail.com

You might also like