Go beyond the basics of many issues the construction industry brings to the accounting profession. Get hands-on advice on the accounting, audit and tax issues that make the construction industry a high-risk client. Address difficult issues such as look-back calculations, measuring progress of construction contracts and overhead allocations. Enhance your skills today to reduce the risk of your next construction engagement.
Objectives:
Prerequisite: Completion of the AICPA course Construction Contractors: Accounting, Auditing and Tax, or experience in providing services for construction contractors.
VALUE AID!: Audit Risk Alert - Construction Contractors Industry Developments
731995
What Are Internal Controls
At times, we accountants get too caught up in defining internal controls as procedures that are put in place to protect the theft of cash or the prevention of fraud. It is true that internal controls assist in accomplishing these issues, but for a business the internal controls are much broader than those defined by most auditors. Every company has processes and procedures that must be performed in order for any company to succeed and grow. If a $5 million organization has policies and procedures in place that are appropriate for a $50 million organization, then that $5 million organization has a strong foundation to grow and to expand much more rapidly than most of its counterparts. On the other hand, if a $50 million organization has the same policies and procedures in place as that of a $5 million organization, then expect many troubles and the organization's inability to handle a risk of failure.
Internal controls are designed to carry out an entity's processes. Such processes should provide the owner, management, and employees reasonable assurance that certain defined objectives are being achieved. A company will have a difficult time achieving its objectives if the primary means of handling the details are not being achieved. These details should include
1. The reliability of data,
2. The efficiency and effectiveness of operations,
3. The protection and safeguarding of the entity's assets, and
4. The compliance of applicable laws and regulations.
Therefore, the term "control" is not necessarily a theft deterrent, but more of a process or procedure whereby defined objectives set by management can be achieved. Such controls may or may not be documented. The reason why most small entities do not have such controls documented is mostly due to time and priorities set by the company. However, the problem with lack of documented policies, procedures, and internal controls is guidance. Such policies and procedures will allow employees of organizations to understand their job, their purpose for being an integral part of the company, and direction to where the company is heading.
Components of Internal Control
Internal control is made up of the following five interrelated components:
• Control environment
• Risk assessment
• Control activities
• Information and communication
• Monitoring
Control Environment
The design and implementation of any internal control system is subject to the control environment the system operates within. In simple form, the control environment can be defined as the organization's culture or the "tone at the top" set by management as it relates to the internal control function. Multiple internal control policies and procedures can be written and dictated to staff, but if the attitude and behavior of the company's top management toward these policies and procedures is abusive, the purpose and objective of the internal control structure is lost.
Appendix B, Internal Control Components, of SAS No. 109, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, identifies the following elements of an entity's control environment
a. Communication and enforcement of integrity and ethical values. The effectiveness of controls cannot rise above the integrity and ethical values of the people who create, administer, and monitor them. Integrity and ethical values are essential elements of the control environment that influence the effectiveness of the design, administration, and monitoring of other components of internal control. Integrity and ethical behavior are the product of the entity's ethical and behavioral standards, how they are communicated, and how they are reinforced in practice. They include management's actions to remove or reduce incentives and temptations that might prompt personnel to engage in dishonest, illegal, or unethical acts. They also include the communication of entity values and behavioral standards to personnel through policy statements and codes of conduct and by example.
b. Commitment to competence. Competence is the knowledge and skills necessary to accomplish tasks that define the individual's job. Commitment to competence includes management's consideration of the competence levels for particular jobs and how those levels translate into requisite skills and knowledge.
c. Participation of those charged with governance. An entity's control consciousness is significantly influenced by those charged with governance. Attributes include those charged with governance's independence from management, the experience and stature of its members, the extent of its involvement and scrutiny of activities, the appropriateness of its actions, the information it receives, the degree to which difficult questions are raised and pursued with management, and its interaction with internal and external auditors. The importance of responsibilities of those charged with governance is recognized in codes of practice and other regulations or guidance produced for the benefit of those charged with governance. Other responsibilities of those charged with governance include oversight of the design and effective operation of whistle-blower procedures and of the process for reviewing the effectiveness of the entity's internal control.
d. Management's philosophy and operating style. Management's philosophy and operating style encompass a broad range of characteristics. Such characteristics may include the following: management's approach to taking and monitoring business risks; management's attitudes and actions toward financial reporting (conservative or aggressive selection from available alternative accounting principles, and conscientiousness and conservatism with which accounting estimates are developed); and management's attitudes toward information processing and accounting functions and personnel.
e. Organizational structure. An entity's organizational structure provides the framework within which its activities for achieving entity-wide objectives are planned, executed, controlled, and reviewed. Establishing a relevant organizational structure includes considering key areas of authority and responsibility and appropriate lines of reporting. An entity develops an organizational structure suited to its needs. The appropriateness of an entity's organizational structure depends in part on its size and the nature of its activities.
f. Assignment of authority and responsibility. This factor includes how authority and responsibility for operating activities are assigned and how reporting relationships and authorization hierarchies are established. It also includes policies relating to appropriate business practices, knowledge and experience of key personnel, and resources provided for carrying out duties. In addition, it includes policies and communications directed at ensuring that all personnel understand the entity's objectives, know how their individual actions interrelate and contribute to those objectives, and recognize how and for what they will be held accountable.
g. Human resource policies and practices. Human resource policies and practices relate to recruitment, orientation, training, evaluating, counseling, promoting, compensating, and remedial actions. For example, standards for recruiting the most qualified individuals - with emphasis on educational background, prior work experience, past accomplishments, and evidence of integrity and ethical behavior - demonstrate an entity's commitment to competent and trustworthy people.
731995
