What are the weaknesses of internal control system?

Internal controls that are designed and implemented properly will improve a financial report. The auditor as an independent professional is required to be able to identify whether there are any internal control weaknesses.

Internal control weakness can occur due to two causes. Firstly, it can occur because there is an absence of control. Secondly, the internal control weaknesses are caused by poorly designed controls. 

Baca juga.

The internal control weakness will increase the risk of material misstatement in the financial report, whether caused by error or fraud. If auditors succeed to identify internal control weaknesses on certain items or accounts then they can focus the substantive test on those items or accounts, so it will improve the efficiency of audit work.  

There are three approaches to identify internal control weakness. The first approach is to conduct the mapping process. This mapping process starts by gathering all the information regarding activities of internal control. Then the auditor makes the flowchart and identifies the area where there are any possibilities of internal control weakness. This method required experience and sufficient knowledge regarding internal control, especially control activities. 

The second approach is conducting a brainstorming of several possibilities of errors and fraud that can cause material misstatement in the financial statement. For example, the possibility of defective or obsolete inventories are still listed on the inventory list. The auditor shall assess whether a client has control activities to prevent those defective or obsolete inventories that are still recorded in the inventory list. This brainstorming method relies on the experience of the engagement team. 

The third method is to agree on the control activities to the appropriate assertions. The auditor gathers all the information regarding control activities and then matches those control activities to the appropriate assertions. The auditor will identify the assertion where there is no control and conclude that the internal control weakness on that assertion. 

In the practice, the auditor will combine those three approach methods in order to gain better identification of internal control weaknesses.

The internal controls you put in place help ensure that employees carry out the work according to company policies and procedures. Control strengths include simplicity, wide acceptance and effectiveness in making sure the company achieves its objectives. Weaknesses may manifest themselves as inconsistent application, frequent discrepancies and a lack of acceptance by employees. Your assessment of internal company controls has to look for such weaknesses and make corresponding changes using the strong controls as a model.

Duties

An assessment of internal control effectiveness has to evaluate the required separation of duties. A controlled task having several elements must be executed by several different employees. For example, paying a bill involves approving the spending, issuing the check and keeping a record of the transaction. The task of paying the bill has a strong control if three employees are responsible for the three elements, but a weak control if one employee handles the work and reports on it. You can assess the strength of critical controls by checking for the separation of duties.

Reports

Internal controls are strong if management receives reports from different areas of activity and can compare key variables. For example, if you get regular reports from manufacturing that include quantity of items shipped, and from sales with total sales figures, total sales over a period of time have to equal total items shipped. If you receive employee expense reports with gas charged to company credit cards, and reports of company payments, the total amount paid for gas has to equal the total reported by employees. Weak controls are those where variables from reports can't be compared.

Authorization

A consistent structure of authorizations is an element of strong controls. When responsible employees sign off on each stage of a procedure, you can track problems to find out where the problem originated. For example, a new product may require an authorization to proceed with a design, several approvals during the design process, an authorization to send it to manufacturing and an authorization to ship it. If the product has frequent failures in one of the design elements, you can trace the responsibility back through the authorizations and fix the problem to prevent a repetition. A weak system of controls doesn't allow you to trace responsibility.

Security

Access controls, both physical and digital, form an important part of your internal company controls. An assessment has to identify which areas of your facilities, such as data centers and warehouses, must have restricted physical access. You can then evaluate how strong your controls are by looking at the physical barriers to access and the records of who accessed the controlled facilities. Your assessment can apply a similar procedure for digital access, identifying which networked computers and servers should have restricted access and the effectiveness of the controls. A strong control limits access to authorized personnel and records who gained access and the time and date. A weak control doesn't control access and doesn't record the information reliably.

References

Writer Bio

Bert Markgraf is a freelance writer with a strong science and engineering background. He started writing technical papers while working as an engineer in the 1980s. More recently, after starting his own business in IT, he helped organize an online community for which he wrote and edited articles as managing editor, business and economics. He holds a Bachelor of Science degree from McGill University.

Image Credit

Jupiterimages/Photos.com/Getty Images

What are some control weaknesses?

What are weakness of internal control over cash?

What are the challenges of internal controls?

What are the limitations of any system of internal controls?