Mid-2
Mid-2
Q(M). Explain the purpose of an internal control system and internal controls. How might an
audit committee review the effectiveness of the company’s system of internal control?
Answer:
Internal control systems are concerned with the management of business risks. These risks can
be controlled by measures taken internally by the organization.
↗Purpose:
An internal control system is for identifying operational, financial and compliance risks, applying
controls to reduce the risk of losses from these risks and taking corrective action when losses
occur.
i. Controls to ensure the systems and procedures of the organization are operated
without disruption or disturbance
ii. Controls to ensure that assets are safeguarded. For example, there should be controls to
ensure that money received is banked and is not stolen, and that operating assets such
as equipment and computers are not damaged or lost.
iii. Controls include measures to reduce the risk of fraud.
iv. Financial controls should ensure the completeness and accuracy of accounting records,
and the timely preparation of financial information.
v. Controls should be in place to ensure compliance with key regulations, such as health
and safety regulations or, in the case of banks, anti-money laundering regulations.
Q(F): (a) What are the main elements of a system of internal control? Explain the major
internal control risks.
Internal controls are an essential part of an internal control system. The COSO Framework for
an internal control system identifies five elements to a system of internal control.
The risks that are managed by an internal control system can be categorized into three broad
types.
1. Financial risks: These are risks of errors or fraud in accounting systems, and in accounting
and finance activities. Errors or fraud could lead to losses for the organization, or to incorrect
financial statements.
Examples of financial risks include the risk of:
failure to record financial transactions in the book-keeping system;
failure to collect money owed by customers;
failure to protect cash;
financial transactions (such as payments) occurring without proper authorization; and
mis-reporting (deliberate or unintentional) in the financial statements.
2. Operational risks: Operational risk is ‘the risk of losses resulting from inadequate or failed
internal processes, people and systems, or external events.
Operational risks include:
the risk of a breakdown in a system due to machine failures or software errors;
the risk of losing information from computer files or stolen of confidential information;
the risk of a terrorist attack;
losses arising from mistakes or omissions by staff; and
inefficient or ineffective use of resources.
3.Compliance risks: These are risks that important laws or regulations will not be complied with
properly. Failure to comply with the law could result in legal action against the company and/or
fines.
These risks can occur because:
they are badly designed, and thus not capable of achieving their purpose as a control; or
they are well-designed, but are not applied properly, due to human error or oversight,
or deliberately ignoring or circumvention of the control (a form of operational risk
event).
An internal control system needs to have procedures for identifying weak or ineffective internal
controls. This is one of the functions of monitoring the effectiveness of the internal control
system.
Q(F): a. What is the purpose of an internal audit function? What tasks might be carried out by
an internal audit department?
Internal audit is defined as ‘an independent appraisal activity established within an organisation
as a service to it. It is a control, which functions by examining and evaluating the adequacy and
effectiveness of other controls’.
↗Purpose:
An organisation might have an internal audit unit or section, which carries out investigative
work.
i. An internal audit function should act independently and will reported to a senior
executive manager such as the finance director.
ii. Internal auditors may report to the board itself or the audit committee. FRC Guidance
suggests that the internal auditor has direct access to the board chairman and the audit
committee, and is also responsible to the audit committee.
iii. This means that the internal auditors may be in an unusual position within the company.
iv. The senior internal auditor should have some control over deciding what aspects of the
company’s systems should be investigated or audited, and also has a responsibility for
reporting to the audit committee and the chairman of the board.
↗Tasks: The possible tasks of internal audit include the following.
1. Reviewing the internal control system. Traditionally, an internal audit department has
carried out independent checks on the financial controls in an organisation, or in a
particular process or system. The checks would be to establish whether suitable financial
controls exist, and whether they are applied properly and are effective.
2. Special investigations. Internal auditors might conduct special investigations into
particular aspects of the organisation’s operations (systems and procedures), to check
the effectiveness of operational controls.
3. Examination of financial and operating information. Internal auditors might be asked to
investigate the timeliness of reporting and the accuracy of the information in reports.
4. VFM (value for money) audits. This is an investigation into an operation or activity to
establish whether it is economical, efficient and effective.
5. Reviewing compliance by the organisation with particular laws or regulations. This is
an investigation into the effectiveness of compliance controls.
6. Risk assessment. Internal auditors might be asked to investigate aspects of risk
management, and in particular the adequacy of the mechanisms for identifying,
assessing and controlling significant risks to the organisation, from both internal and
external sources.
Q (F). b. What are the main problems with systems of whistleblowing in large companies?
Definition: Whistleblowing is the popular term used when someone who works in or for an
organisation… raises a concern about a possible fraud, crime, danger or other serious risk that
could threaten customers, colleagues, shareholders, the public or the organisation’s own
reputation
The audit committee should be responsible for review of the provisions and procedures for
whistleblowing within the company.
The objective of the audit committee should be to ensure that there are satisfactory
arrangements in place for the ‘proportionate and independent investigation’ of allegations by
whistleblowers.
A whistleblower is an employee who provides information about their company that they
reasonably believe provides evidence of:
fraud;
a serious violation of a law or regulation by the company or by directors, managers or
employees within the company;
a miscarriage of justice;
offering or taking bribes;
price-fixing;
a danger to public health or safety, such as dumping toxic waste in the environment or
supplying food that is unfit for consumption;
neglect of people in care; or
in the public sector, gross waste or misuse of public funds.
↗Problems with systems of whistleblowing:
Whistleblowing systems in large companies can face several challenges, which may impede their
effectiveness. Some of the main problems include:
1. Fear of Retaliation: Employees may be hesitant to report misconduct or unethical behavior due to fear
of retaliation from their managers or colleagues. They may worry about losing their job, facing demotion,
or being subjected to harassment or isolation if they report misconduct. This fear can prevent employees
from coming forward, even if they have valuable information.
2. Lack of secrecy and Confidentiality: Whistleblowers may be concerned about the confidentiality of
their reports and fear that their identity will be revealed, leading to negative consequences. Even if
confidentiality is promised, employees may still worry about the risk of being identified through indirect
means or leaks.
3. Lack of Trust in the System: Employees may lack confidence in the whistleblowing system due to past
experiences or perceptions of management's response to whistleblowers. If they believe that their
concerns will not be taken seriously or that the system is biased, they are less likely to report misconduct.
4. Inadequate Policies and Procedures: If the whistleblowing policies and procedures are unclear or
inconsistently applied, employees may be unsure about how to report misconduct or what protections
they are entitled to. This lack of clarity can lead to confusion and discourage employees from using the
system.
5. Inadequate Investigation and Follow-up: If reports of misconduct are not promptly and thoroughly
investigated, or if whistleblowers do not receive feedback on the outcome of their reports, it can
undermine confidence in the system. Employees may feel that their reports are ignored or that no action
is taken, leading to disillusionment and decreased reporting.
6. Cultural Barriers: In some corporate cultures, there may be a perception that reporting misconduct is
disloyal or detrimental to the company's reputation. This can create a culture of silence where employees
feel pressured to remain silent about wrongdoing rather than risk their careers or relationships with
colleagues.
7. Complex Reporting Channels: If the whistleblowing reporting channels are overly complicated or
difficult to access, employees may be deterred from reporting misconduct. It's essential for reporting
mechanisms to be user-friendly and accessible to all employees, regardless of their role or location within
the organization.
Lack of Support and Protection: Whistleblowers may not receive adequate support or protection from
retaliation, despite legal protections in place. This can leave employees feeling vulnerable and
discouraged from speaking up.
Perception of Futility: Employees may perceive whistleblowing as futile if they believe that reports will
not lead to meaningful action or change within the organization. This can result in underreporting of
issues or reliance on external whistleblowing channels.
Addressing these problems requires a holistic approach that involves creating a supportive environment
for whistleblowers, implementing clear and effective policies and procedures, ensuring confidentiality
and protection from retaliation, conducting thorough investigations, and fostering a culture of
accountability and integrity within the organization.
Whistleblowing procedures:
The Code of Practice states that an internal whistleblowing procedure will be effective only if it
has the confidence of the employees, who are its intended users. Confidence in the system will
be obtained only if the employer is genuinely committed to the procedure.
The Code of Practice suggests that features of an internal whistleblowing policy and procedure
should include the following provisions.
i. The internal whistleblowing procedures should be documented and a copy should
be given to every employee.
ii. It should set out the key aspects of the procedure, such as the person to whom
employees should report their suspicions or concerns. This might be the company
secretary or internal audit.
iii. It should contain a statement that the employer takes malpractice or misconduct
seriously, and is committed to a culture of openness in which employees can report
legitimate concerns without fear of penalty or punishment.
iv. It should give examples of the type of misconduct for which employees should use
the procedure and set out the level of proof that there should be in an allegation.
v. The document should set out the procedures by which an allegation will be
investigated.
vi. It should make clear that false or malicious allegations will result in disciplinary
action against the individual making them.
vii. It should make clear that no employee will be victimised for raising a genuine
concern. victimization for raising a qualified disclosure should be a disciplinary
offence.
viii. An external whistleblowing route should be offered, as well as an internal reporting
procedure.
ix. There should be an undertaking that, whistleblowers will be informed about the
outcome of their allegations and the action that has been taken.
x. Whistleblowers should be promised confidentiality, as far as this is possible.
Chapter-7:
There are two widely expressed concerns about the annual report and accounts of companies.
o Whether the accounts are reliable, and can be ‘trusted’ for making decisions about the
company;
o Whether the annual report is clear and helps the reader to understand the
performance, position and future prospects of the company.
The reliability of the annual report and accounts depends on several factors, including:
The honesty of the company in preparing them: if allowed to do so by accounting
regulations, companies might indulge in window dressing their financial performance or
financial position through the use of accounting policies (methods) that hide the true
position of the company.
The care of directors to prepare financial statements to give a ‘true and fair view’ and
that everything of relevance has been properly reported.
The opinion of the external auditors, which the shareholders should be able to rely on as
an objective and professional opinion.
The UK Code also requires that the directors should include in their annual report an
explanation of the:
i. basis on which the company generates or preserves value over the longer term (its
‘business model’); and
ii. strategy for delivering the objectives of the company.
The directors should also report, in both the half-yearly and the annual financial statements:
1. whether they consider it appropriate for the company to adopt the going concern basis
of accounting, when preparing the financial statements, and also
2. identify any material uncertainties about the company’s ability to do so over a period of
at least 12 months from the date of their approval of the financial statements.
Q. (M) What are the responsibilities of the external auditors with regard to the financial
statements of a company?
Investors, creditors and other stakeholders in a company rely on the information contained in
the annual report and accounts, which are audited each year by a firm of independent auditors.
The purpose of an independent audit is to make sure, that the financial statements are
objective and can be relied on.
After completing their annual audit, the auditors are required to prepare a report to the
shareholders of the company which has two main purposes:
i. to give an expert and independent opinion on the financial statements whether it
give a true and fair view of the financial position of the company as at the end of the
financial year covered by the report, and of its financial performance during the
year; and
ii. to give an expert and independent opinion on the financial statements whether
comply with the relevant laws.
The external audit might also act as a deterrent to fraud, because the auditors will check out of
control procedures, documents and transactions in the course of their audit work. They might
discover fraud during the course of their audit work, in which case it would be their
responsibility to report the matter to the directors.
The audit profession has identified potential threats to auditor independence. Auditors are
required to be aware of these threats, and to take measures to eliminate them or reduce them
to an insignificant level.
1. Self-interest threat: an auditor or audit firm is earning a large amount of fee income
from the audit. Auditors’ judgement might be affected by a desire to protect this income
stream.
For example, if the audit firm earns a large proportion of its revenue from a client
company, it may be unwilling to annoy that client by challenging the figures and
assumptions used by management to prepare the company’s financial statements.
2. Self-review Threat: This can arise when the audit firm does non-audit work for the
company, and the annual audit involves checking the work done by the firm’s own
employees. The auditors may not be as critical of the work, or prepared to challenge it,
because this would raise questions about the professional competence of the audit firm.
3. Advocacy threat: This can arise if the audit firm is asked to give its formal support to the
company by providing public statements on particular issues or supporting the company
in a legal case. Acting as advocate for a company means taking sides, and this implies a
loss of independence.
For example, a company CEO or finance director may act aggressively and in a bullying
manner towards audit staff, so that the auditors are browbeaten into accepting what
the ‘bully’ is telling them. Both real and imagined threats can affect the auditor’s
independence. A company may also threaten to take away the audit or stop giving the
firm non-audit work unless the auditor accepts the opinions of management.
Role and responsibilities of the audit committee:
The UK Code lists the role and responsibilities of an audit committee. they are as
follows:
i. To monitor the integrity of the company’s financial statements and any formal
announcements relating to the company’s financial performance. In doing so, it
should review ‘significant financial judgements’ that these statements and
announcements contain.
ii. To make recommendations to the board in relation to the appointment,
reappointment or removal of the company’s external auditors, to put to the
shareholders for approval in a general meeting of the company.
iii. To approve the remuneration and terms of engagement of the external auditors
(after they have been negotiated with the auditors by management).
iv. To review and monitor the independence of the external auditors, and also the
objectivity and effectiveness of the audit process, taking into account relevant
professional and regulatory requirements.
v. To develop and implement the company’s policy on using the external auditors to
provide non-audit services. This should take into account any relevant external
ethical guidance on the subject. The committee should report to the board,
identifying actions or improvements that are needed and recommending the steps
to be taken.
vi. To report to the board on how it has discharged its responsibilities.
Financial reporting and the role of the audit committee:
It is the responsibility of management to prepare complete and accurate financial statements. It
is the responsibility of the audit committee to review the significant financial reporting issues
and made judgements in connection with these statements.
o The audit committee should consider significant accounting policies to prepare the
statements, any changes to them, and any significant estimates or judgements on which
the statements have been based.
o Management should inform the committee about the methods they have used to
account
for significant or unusual transactions, where the accounting treatment is open to
different approaches.
o Taking the external auditors’ views into consideration, the committee should consider
whether the company has adopted appropriate accounting policies and made
appropriate estimates and judgements.
o The committee should also consider the clarity and completeness of the disclosures in
the financial statements.
Q. (M) What are the power and rights of shareholders? Explain the responsibilities of
institutional shareholders with a view to improving corporate governance.
Answer:
↗Power and rights of shareholders: Shareholders do not involve directly in the management
of the companies but may occasionally express their views about corporate strategy to the
chairman or board of the directors since the board of directors and management of the
company make the strategic and operational decisions.
Shareholders have certain rights in law and under the constitution (articles of association) of
their company.
they have a right to receive the annual report and accounts,
the right to vote at general meetings,
the right to a share of the profits of the company.
The powers of shareholders to exercise their rights are limited, and are mainly restricted to:
voting powers at general meetings; and
taking legal action in cases where the directors have acted illegally.
i. Pre-emption rights: shareholders have the first right of refusal and offered the right to
buy new shares in proportion to their existing shareholding while a company issues new
shares for cash.
ii. Right to approve long-term incentive schemes: shareholders may be given the right to
approve any new or amended long-term incentive scheme for the company.
iii. Election and re-election of directors and auditors: The articles of association of a public
company should provide for the directors to retire by rotation. A simple majority is
required for election of a new director or re-election of a director.
iv. Approval of remuneration policy: Shareholders have the right to a binding vote at least
every three years on the company’s remuneration policy.
v. Other voting rights: shareholders have a right to,
call a general meeting of the company, and call for a vote on a resolution
propose a resolution to be voted on at the AGM
call an extraordinary general meeting (EGM) if together they hold at least 5% of
the voting share capital.
include a matter in the business of the AGM of the company if together the hold
at least 5% of the voting share capital.
Investors expect a return on their investment. Most evidence suggests that well-
governed companies deliver reasonable returns over the long term.
Institutional investors also have legal responsibilities (fiduciary duties) to the individuals
on whose behalf they invest. For pension funds, these individuals are the beneficiaries
of the funds. In fulfilling their responsibilities, institutions should try to ensure that they
make a decent return on investment, and promoting good corporate governance is one
way of trying to do this.
the chairman should ensure that all the directors are made aware of the issues and
concerns of the company’s major shareholders; and
the board should keep in touch with shareholder opinion in the most practical and
efficient ways, whatever these may be.
The UK Corporate Governance Code states that: ‘The board should use general meetings to
communicate with investors and to encourage their participation.’ The provisions in this part
of the UK Code are concerned mainly with:
encouraging attendance by shareholders at the AGM and other general meetings;
giving shareholders an opportunity to ask questions and to hear about the company
during the meeting; and
giving shareholders the opportunity to use their vote and greater openness in voting
procedures at general meetings.