what's up audit fans i'm back and today
we're looking at designing
internal controls a big thank you to
charlene who wrote to me
uh through facebook and said oh look i'd
really love something
about how to design internal controls
this isn't something that the auditor
would normally
do because when we design internal
controls for our client we
actually create a self-review
independence threat
but if you're an internal auditor or
you're providing some recommendations
or if you're studying and it's quite a
common question to be asked
what sort of internal controls should be
used
to minimize a particular risk today i'm
going to address it with a four-step
process
let's get into it
[Music]
hi and welcome to amanda loves to audit
my name is amanda i do love
audit and i'm really excited to be
here back again on my youtube channel
we're just starting out
university semester here in australia so
it's full steam ahead for me
really really busy but i wanted to give
a shout out to
all of my returning viewers from places
like
canada indonesia namibia nigeria south
africa usa
germany uganda did i say again it twice
no
ghana it's really amazing somebody in
the comments asked if i'm malaysian
and i'm not so my parents are both from
china
in the guangzhou region of china i
don't speak any chinese so my parents
came here my mom came here when she was
five years old
my dad came in his teenage years
and when my mum was growing up she
went to kindergarten not knowing any
english
so when she talked with an accent she
received a lot of bullying
even then you know a lot of racism
against asians so
when she had kids and we were the only
asian kids in our school
she said i want you to sound aussie i
want you to be able to blend in so that
if you can sound like everybody else
then hopefully you won't experience the
same
levels of racism and discrimination
that she experienced as a child growing
up
and so when i was i think three or four
years
old my mother said to my grandmother
uh who she looked after us a lot she
said look that's it we're not speaking
any chinese anymore
english only so i really only know
enough
cantonese to get by at yamcha i know
that i want to eat
haa gao cha sil baos um
paigwat dantats i know that i don't want
to eat the fung jao which is
the chicken foot but really that's the
extent of
my chinese language skills so that's
enough about me
i've been a tiny bit busy recently um
i've just won the national teaching
excellence award
for the business economics law and
related
category i'll have a video more on that
a little bit later because i'm doing a
big speech
a whole lot of other things so i was
really excited to
receive that and all of you out there in
youtube land were a really big part of
that as well so
i did a survey a little while ago asking
about whether you thought the resources
were high quality
and some feedback and a lot of those
quotes and a lot of those
pieces of information made it into my
application so thank you
so much to everybody that's out there
that filled in that survey
for everyone who's new welcome i love
audit
and you'll hear that you'll see that in
everything that we do so i'm just going
to switch camera positions a little bit
so that then i can have my writing
coming up here so just hang on
so today we're getting into how do i
design an internal control it's a really
common exam
question just to see that you can do the
other perspective
and if you're studying management
accounting how to design an internal
control can be really important because
management accounting is about
number one doing accounting from within
the firm but also
designing the management systems that
make sure that
everyone in the organization is working
together moving in the same direction
there are going to be four steps in our
process so step number one
is going to be about identifying
the potential misstatement
now the reason that we need to do this
is that remember a control is a response
to a risk so essentially we have to
identify the risk what is the potential
misstatement
the potential error that could occur so
that's
step number one then step number two
and i'm going to just move that up a
little bit is
we have to ask ourselves the question do
we want to
prevent the issue from happening or
are we trying to detect an error
afterwards so in a lot of circumstances
where it's a control around a process
i want to try and prevent right
prevention is always better than a cure
so you have to think am i going to
prevent
or do i want to detect now detecting is
about
picking up that there's a mistake
perhaps after a process has happened
so you have a manufacturing process
you're making a good and then
there is quality control so you know you
have everything in the process the
machines doing the right things checking
their parts
and the quality control at the end is to
make sure
that you detect any issues before they
go out you know the product goes out to
the customer so you have to think
do i want to try and prevent or do i
want to try and detect
now i'm going to do this with a live
example as well after so i'm just going
to go through the theory first
so part one identify the potential
misstatement so what is the risk
part two am i thinking about preventing
or detecting
then you actually need to design
and effective
and efficient
internal control now what do i mean by
effective
effective i mean that it has to work it
has to prevent
the error that you've got and when i say
efficient
i mean that efficient is it's not going
to cost us too much resources
because remember when it comes to
internal controls
you have to think about the cost versus
the benefit
so in a supermarket to make sure that
people don't
steal from a supermarket i could make
every single person have to go through
an airport
x-ray screening type of thing when they
leave the store
that would be very very beneficial
however it would cost a lot in terms of
time
for my customers effort
to get it done and also
it would be really expensive okay
so i need to balance the benefit
of preventing or detecting a
misstatement with the cost
so you're going to think about that in
your design now
also when you're thinking about the
design you have to consider whether you
want
a manual control so somebody physically
doing something versus some sort of
automated or
i t or systems
based solution okay because if you do
have
something that needs a manual control
remember humans can make mistakes
with an automated system you've got to
be really careful because
if you don't program the system
correctly it can still make a mistake so
if you don't program it correctly it
could still
go wrong so our
fourth thing that we want to think about
is monitoring
all right are we doing something to
check the control
essentially we need to make sure that we
are
checking the
operation
of the control
okay a really great example of that
monitoring aspect
is if we have a bank and you go with
your card
and uh i have one in my pocket actually
so here's my card um for my bank account
i go to the atm i put it in i get the
pin wrong
oh okay that's the wrong pin remember
the right pin i put it in
the bank at the end of the day we'll get
a report
that says what are all the cards where
an incorrect pin was entered
or perhaps an incorrect pin was entered
more than
three times or we actually chewed up the
card
so we want to check that the control is
operating effectively we want to check
that the operation of the control is
working because remember
we know that when the control
stops working
what happens my regular viewers will
know this when the control stops working
then we have an increased risk
of errors and misstatements
all right and we definitely don't want
that we don't want to have misstatements
going
into the financial um record records and
the
the accounting of the firm so to recap
i'm going to scroll quickly back up
number one identify the potential
misstatements
number two decide whether you want to
prevent or detect
number three design an effective
and efficient internal control thinking
about the cost versus the benefit
that cost could be the time it takes the
dollars
to actually implement it the effort it
might take
think about whether you want manual or
automated systems
and then consider the monitoring what
are we doing to monitor this control
to make sure that it's always working is
it if something goes wrong a system
flags with us
so now let's look at a practical example
so in my practical example i'm going to
think about
a retail operation and i'm using a
retail operation
because it's something that we can
imagine in our minds we've all been
shopping to a store now i need to find
something oh let's just i have a
notebook here
so a big thank you to uh microsoft for
uh
they sent me a notebook the other day
i'm an mie expert which is a microsoft
innovative
um educator expert and i got a little
goodie bag from them includes a notebook
so say we're
a retail operation and we're selling
fancy notebooks so let's say this is
like you know it's leather and it's
really fancy
so what is the risk so let's start with
step one
the risk is going to be
theft of inventory
all right if people steal the inventory
they're not buying it and we're not
making revenue so we've got our risk
of misstatement is a theft of inventory
and we might also have the so let's talk
about the theft of inventory risk
so then i have to think prevent
or detect so that's p or d in this one i
definitely want
to try and prevent theft okay i don't
want to detect the theft
after it's happened i want to try and
prevent people from stealing
my item from my storm so prevent or
detect
now number three comes the actual part
of
designing the internal control well i
want something
that will stop people from stealing my
product i got a couple of different
options
here and it might be that i might need
to have multiple things in place
i could have security cameras
all right but if i have security cameras
someone's going to need to be watching
them so if i have security cameras
that could be a deterrent potentially
i could also have rfid
stickers
on the inventory
all right so an rfid sticker or one of
those security tags so
often it could be like a little sticker
that's placed on an individual item or
it could be a big removable tag so if
you bought clothing
from a department store often those will
have like a big tag on it
that the sales checkout person will have
to remove so
an rfid sticker or some sort of security
tag
or security tag
now given that this is a book like
a hole i don't want to punch a hole in
my notebook for the tag
so a little rfid sticker might be a good
idea and that's why a lot of stuff comes
shrink wrapped in plastic that is um
just so
that they can then stick the rfid
sticker on there and it's come a long
way
the old days rfid stickers were really
expensive now i'm seeing supermarkets
even
use them on things like expensive meat
products so
i've got my security cameras i've got my
rfid stickers
um i'm going to have with the rfid
sticker
needed with that is going to be the rfid
detectors
at the store oops
can't spell store entry exit
that is also why a lot of stores will
only have one entry exit point
so that they can put those big gates up
and often you will see those gates will
be covered in advertising and things so
you don't notice that it's there so
you've got
your rfid your stickers etc
the last thing that we might do is also
a store bag check
all right so that when you leave the
store they say look
uh can you open your bag you know bags
of a bigger size
to make sure that that's happening so
that's an example here for the fact that
we've got our theft let's do another
example my next example is still going
to go back to my notebooks
but my risk is going to be
the risk of charging the customer
the wrong price right and that
is going to result for us in inaccurate
sales so that's affecting our accuracy
assertion
now of course in terms of prevention or
detection i want to try and
prevent okay then coming
into the control
one thing that i could do and i can
remember the days where when you went to
the supermarket
you didn't actually have barcodes there
was a little sticker that somebody
manually added to the product and then
you typed it in
into the cash register so we could use
barcode scanning
barcodes on goods
and scan
at the register
okay so that's going to be my control
now
in terms of the control it's very cheap
it's efficient you have to have
obviously a cash register system
but the one thing that we want to do
here in terms of the monitoring
all right is that we might want to do
something like
check price overrides
all right so if somebody tries to
override the price
there's a couple of different options
you could have you need
manager whoops that's meant to be an r
manager
to approve any price overrides
or at the end of the day you could have
a daily report
about those overrides and that's really
common in retail stores where they'll
say okay
give me the day end of day report oh
yeah this was overwritten because this
was damaged
this person had an extra discount this
was the manager's discretion
so you want to monitor how many prices
were incorrect
um often there's also a thing that says
oh look if the shelf says
five dollars but your thing says ten
dollars you get whatever the shelf
price is so that could be one of your
override codes
now i realized back here when i was
designing the controls for
the risk of theft then um
the mo the store bag check um
could be one of those monitoring
controls so i realized i forgot that i
forgot to talk about the monitoring
but the store bag check could also
be part of that monitoring process
i hope that that clarifies to everybody
how you can design an internal control
and remember to take it step by step
think about the risk
do i want to prevent or detect what are
the control activities that i could do
automated or manual or with our systems
or a combination of both
and then what am i going to put in place
to monitor to make sure that control
works properly so i want to thank you
for watching this video of course if you
haven't already consider subscribing
for all of those internal auditors out
there you might want to check out
autotopia it's a new
internal audit community that i'm
involved with
it has free resources that people are
sharing
internal con audit checklists and
documentation
and we've also got regular webinars to
help you become
a better internal auditor i'm really
excited to be part of the autotopia team
i'll be working with them to create some
content for some courses
that they're going to have big thank you
i want everybody to stay safe
stay well i've checked myself on the
vaccination schedule i'm hopefully
going to be vaccinated in september or
october of this year
so i'm really excited about that but
stay safe stay well wherever you are
and i'll see you next time
[Music]
you