4 steps to design INTERNAL CONTROLS

what's up audit fans i'm back and today

we're looking at designing

internal controls a big thank you to

charlene who wrote to me

uh through facebook and said oh look i'd

really love something

about how to design internal controls

this isn't something that the auditor

would normally

do because when we design internal

controls for our client we

actually create a self-review

independence threat

but if you're an internal auditor or

you're providing some recommendations

or if you're studying and it's quite a

common question to be asked

what sort of internal controls should be

used

to minimize a particular risk today i'm

going to address it with a four-step

process

let's get into it

[Music]

hi and welcome to amanda loves to audit

my name is amanda i do love

audit and i'm really excited to be

here back again on my youtube channel

we're just starting out

university semester here in australia so

it's full steam ahead for me

really really busy but i wanted to give

a shout out to

all of my returning viewers from places

like

canada indonesia namibia nigeria south

africa usa

germany uganda did i say again it twice

no

ghana it's really amazing somebody in

the comments asked if i'm malaysian

and i'm not so my parents are both from

china

in the guangzhou region of china i

don't speak any chinese so my parents

came here my mom came here when she was

five years old

my dad came in his teenage years

and when my mum was growing up she

went to kindergarten not knowing any

english

so when she talked with an accent she

received a lot of bullying

even then you know a lot of racism

against asians so

when she had kids and we were the only

asian kids in our school

she said i want you to sound aussie i

want you to be able to blend in so that

if you can sound like everybody else

then hopefully you won't experience the

same

levels of racism and discrimination

that she experienced as a child growing

up

and so when i was i think three or four

years

old my mother said to my grandmother

uh who she looked after us a lot she

said look that's it we're not speaking

any chinese anymore

english only so i really only know

enough

cantonese to get by at yamcha i know

that i want to eat

haa gao cha sil baos um

paigwat dantats i know that i don't want

to eat the fung jao which is

the chicken foot but really that's the

extent of

my chinese language skills so that's

enough about me

i've been a tiny bit busy recently um

i've just won the national teaching

excellence award

for the business economics law and

related

category i'll have a video more on that

a little bit later because i'm doing a

big speech

a whole lot of other things so i was

really excited to

receive that and all of you out there in

youtube land were a really big part of

that as well so

i did a survey a little while ago asking

about whether you thought the resources

were high quality

and some feedback and a lot of those

quotes and a lot of those

pieces of information made it into my

application so thank you

so much to everybody that's out there

that filled in that survey

for everyone who's new welcome i love

audit

and you'll hear that you'll see that in

everything that we do so i'm just going

to switch camera positions a little bit

so that then i can have my writing

coming up here so just hang on

so today we're getting into how do i

design an internal control it's a really

common exam

question just to see that you can do the

other perspective

and if you're studying management

accounting how to design an internal

control can be really important because

management accounting is about

number one doing accounting from within

the firm but also

designing the management systems that

make sure that

everyone in the organization is working

together moving in the same direction

there are going to be four steps in our

process so step number one

is going to be about identifying

the potential misstatement

now the reason that we need to do this

is that remember a control is a response

to a risk so essentially we have to

identify the risk what is the potential

misstatement

the potential error that could occur so

that's

step number one then step number two

and i'm going to just move that up a

little bit is

we have to ask ourselves the question do

we want to

prevent the issue from happening or

are we trying to detect an error

afterwards so in a lot of circumstances

where it's a control around a process

i want to try and prevent right

prevention is always better than a cure

so you have to think am i going to

prevent

or do i want to detect now detecting is

about

picking up that there's a mistake

perhaps after a process has happened

so you have a manufacturing process

you're making a good and then

there is quality control so you know you

have everything in the process the

machines doing the right things checking

their parts

and the quality control at the end is to

make sure

that you detect any issues before they

go out you know the product goes out to

the customer so you have to think

do i want to try and prevent or do i

want to try and detect

now i'm going to do this with a live

example as well after so i'm just going

to go through the theory first

so part one identify the potential

misstatement so what is the risk

part two am i thinking about preventing

or detecting

then you actually need to design

and effective

and efficient

internal control now what do i mean by

effective

effective i mean that it has to work it

has to prevent

the error that you've got and when i say

efficient

i mean that efficient is it's not going

to cost us too much resources

because remember when it comes to

internal controls

you have to think about the cost versus

the benefit

so in a supermarket to make sure that

people don't

steal from a supermarket i could make

every single person have to go through

an airport

x-ray screening type of thing when they

leave the store

that would be very very beneficial

however it would cost a lot in terms of

time

for my customers effort

to get it done and also

it would be really expensive okay

so i need to balance the benefit

of preventing or detecting a

misstatement with the cost

so you're going to think about that in

your design now

also when you're thinking about the

design you have to consider whether you

want

a manual control so somebody physically

doing something versus some sort of

automated or

i t or systems

based solution okay because if you do

have

something that needs a manual control

remember humans can make mistakes

with an automated system you've got to

be really careful because

if you don't program the system

correctly it can still make a mistake so

if you don't program it correctly it

could still

go wrong so our

fourth thing that we want to think about

is monitoring

all right are we doing something to

check the control

essentially we need to make sure that we

are

checking the

operation

of the control

okay a really great example of that

monitoring aspect

is if we have a bank and you go with

your card

and uh i have one in my pocket actually

so here's my card um for my bank account

i go to the atm i put it in i get the

pin wrong

oh okay that's the wrong pin remember

the right pin i put it in

the bank at the end of the day we'll get

a report

that says what are all the cards where

an incorrect pin was entered

or perhaps an incorrect pin was entered

more than

three times or we actually chewed up the

card

so we want to check that the control is

operating effectively we want to check

that the operation of the control is

working because remember

we know that when the control

stops working

what happens my regular viewers will

know this when the control stops working

then we have an increased risk

of errors and misstatements

all right and we definitely don't want

that we don't want to have misstatements

going

into the financial um record records and

the

the accounting of the firm so to recap

i'm going to scroll quickly back up

number one identify the potential

misstatements

number two decide whether you want to

prevent or detect

number three design an effective

and efficient internal control thinking

about the cost versus the benefit

that cost could be the time it takes the

dollars

to actually implement it the effort it

might take

think about whether you want manual or

automated systems

and then consider the monitoring what

are we doing to monitor this control

to make sure that it's always working is

it if something goes wrong a system

flags with us

so now let's look at a practical example

so in my practical example i'm going to

think about

a retail operation and i'm using a

retail operation

because it's something that we can

imagine in our minds we've all been

shopping to a store now i need to find

something oh let's just i have a

notebook here

so a big thank you to uh microsoft for

uh

they sent me a notebook the other day

i'm an mie expert which is a microsoft

innovative

um educator expert and i got a little

goodie bag from them includes a notebook

so say we're

a retail operation and we're selling

fancy notebooks so let's say this is

like you know it's leather and it's

really fancy

so what is the risk so let's start with

step one

the risk is going to be

theft of inventory

all right if people steal the inventory

they're not buying it and we're not

making revenue so we've got our risk

of misstatement is a theft of inventory

and we might also have the so let's talk

about the theft of inventory risk

so then i have to think prevent

or detect so that's p or d in this one i

definitely want

to try and prevent theft okay i don't

want to detect the theft

after it's happened i want to try and

prevent people from stealing

my item from my storm so prevent or

detect

now number three comes the actual part

of

designing the internal control well i

want something

that will stop people from stealing my

product i got a couple of different

options

here and it might be that i might need

to have multiple things in place

i could have security cameras

all right but if i have security cameras

someone's going to need to be watching

them so if i have security cameras

that could be a deterrent potentially

i could also have rfid

stickers

on the inventory

all right so an rfid sticker or one of

those security tags so

often it could be like a little sticker

that's placed on an individual item or

it could be a big removable tag so if

you bought clothing

from a department store often those will

have like a big tag on it

that the sales checkout person will have

to remove so

an rfid sticker or some sort of security

tag

or security tag

now given that this is a book like

a hole i don't want to punch a hole in

my notebook for the tag

so a little rfid sticker might be a good

idea and that's why a lot of stuff comes

shrink wrapped in plastic that is um

just so

that they can then stick the rfid

sticker on there and it's come a long

way

the old days rfid stickers were really

expensive now i'm seeing supermarkets

even

use them on things like expensive meat

products so

i've got my security cameras i've got my

rfid stickers

um i'm going to have with the rfid

sticker

needed with that is going to be the rfid

detectors

at the store oops

can't spell store entry exit

that is also why a lot of stores will

only have one entry exit point

so that they can put those big gates up

and often you will see those gates will

be covered in advertising and things so

you don't notice that it's there so

you've got

your rfid your stickers etc

the last thing that we might do is also

a store bag check

all right so that when you leave the

store they say look

uh can you open your bag you know bags

of a bigger size

to make sure that that's happening so

that's an example here for the fact that

we've got our theft let's do another

example my next example is still going

to go back to my notebooks

but my risk is going to be

the risk of charging the customer

the wrong price right and that

is going to result for us in inaccurate

sales so that's affecting our accuracy

assertion

now of course in terms of prevention or

detection i want to try and

prevent okay then coming

into the control

one thing that i could do and i can

remember the days where when you went to

the supermarket

you didn't actually have barcodes there

was a little sticker that somebody

manually added to the product and then

you typed it in

into the cash register so we could use

barcode scanning

barcodes on goods

and scan

at the register

okay so that's going to be my control

now

in terms of the control it's very cheap

it's efficient you have to have

obviously a cash register system

but the one thing that we want to do

here in terms of the monitoring

all right is that we might want to do

something like

check price overrides

all right so if somebody tries to

override the price

there's a couple of different options

you could have you need

manager whoops that's meant to be an r

manager

to approve any price overrides

or at the end of the day you could have

a daily report

about those overrides and that's really

common in retail stores where they'll

say okay

give me the day end of day report oh

yeah this was overwritten because this

was damaged

this person had an extra discount this

was the manager's discretion

so you want to monitor how many prices

were incorrect

um often there's also a thing that says

oh look if the shelf says

five dollars but your thing says ten

dollars you get whatever the shelf

price is so that could be one of your

override codes

now i realized back here when i was

designing the controls for

the risk of theft then um

the mo the store bag check um

could be one of those monitoring

controls so i realized i forgot that i

forgot to talk about the monitoring

but the store bag check could also

be part of that monitoring process

i hope that that clarifies to everybody

how you can design an internal control

and remember to take it step by step

think about the risk

do i want to prevent or detect what are

the control activities that i could do

automated or manual or with our systems

or a combination of both

and then what am i going to put in place

to monitor to make sure that control

works properly so i want to thank you

for watching this video of course if you

haven't already consider subscribing

for all of those internal auditors out

there you might want to check out

autotopia it's a new

internal audit community that i'm

involved with

it has free resources that people are

sharing

internal con audit checklists and

documentation

and we've also got regular webinars to

help you become

a better internal auditor i'm really

excited to be part of the autotopia team

i'll be working with them to create some

content for some courses

that they're going to have big thank you

i want everybody to stay safe

stay well i've checked myself on the

vaccination schedule i'm hopefully

going to be vaccinated in september or

october of this year

so i'm really excited about that but

stay safe stay well wherever you are

and i'll see you next time

[Music]

you