Evaluation of Internal Controls
Evaluation of internal controls refers to the process of assessing the effectiveness of an organization’s internal control system. Internal controls are policies and procedures established by a company to ensure the integrity of financial and accounting information, promote accountability, and prevent fraud.
The evaluation process can be conducted by an organization’s internal audit department, external auditors, or regulatory bodies. It typically involves the following steps:
- Identify Key Controls: The first step is identifying the key controls that mitigate the company’s most significant risks. These could include controls over financial reporting, operational processes, or compliance with laws and regulations.
- Assess Design Effectiveness: The auditors review the design of the identified controls to determine if they are appropriately designed to prevent or detect errors, fraud, or noncompliance. This might involve reviewing process documentation, organizational structures, and system configurations.
- Test Operating Effectiveness: If the controls are considered to be appropriately designed, the auditors will then test their operating effectiveness. This involves observing the controls in operation, re-performing the control activities, or examining supporting documentation to verify that the controls are functioning as intended.
- Report on Control Deficiencies: If any control deficiencies are identified during the assessment, these will be reported to management or the board of directors. The severity of the deficiency determines the level of reporting. Material weaknesses (the most severe type of control deficiency) need to be reported in the company’s annual report.
Internal control evaluations are an important part of risk management and corporate governance. They can provide assurance to management and stakeholders that the company’s operations are effective and efficient, its financial reporting is reliable, and it’s in compliance with applicable laws and regulations.
Example of Evaluation of Internal Controls
Let’s consider a manufacturing company, “ManufactCo”, that wants to evaluate its internal controls over the procurement process to prevent fraud and ensure efficient use of resources. Here’s how it might go:
- Identify Key Controls: ManufactCo’s auditors identify the controls in place to prevent unauthorized purchases. These include requiring purchase orders for all purchases, approval from a department head for any purchase order above a certain amount, and verification of goods received against the purchase order and the supplier’s invoice.
- Assess Design Effectiveness: The auditors review these controls and determine that they are logically designed to prevent unauthorized purchases. The requirement for purchase orders means that purchases must be documented, the approval requirement adds a level of oversight, and the verification of goods received adds a check to ensure that what was ordered was received and invoiced correctly.
- Test Operating Effectiveness: To test whether these controls are working in practice, the auditors select a sample of purchases and check that a purchase order was issued, approval was received if necessary, and goods received were verified against the purchase order and invoice. They find that in a few cases, the verification of goods received was not documented properly.
- Report on Control Deficiencies: The auditors report this deficiency to ManufactCo’s management. They recommend that management enforce the requirement for documenting the verification of goods received and provide training to ensure that all staff understand this control.
This example illustrates how the evaluation of internal controls can help a company identify weaknesses in its processes and take steps to mitigate risks. This is an integral part of an organization’s risk management efforts and corporate governance.
