Control & AIS Overview

Control & AIS - Overview

• A threat is any potential adverse occurrence or unwanted event that could be injurious to either the accounting information system or the organization.
• Exposure, or impact, refers to the potential dollar loss should a particular threat become a reality.
• Likelihood is the probability that a specific threat will occur.

Primary Objective of an AIS

• The primary objective of an AIS is to control the organization so that it can achieve its intended objectives.
• Management expects accountants to take a proactive approach to eliminating system threats and to detect, correct, and recover from threats when they occur.

Internal Control

• Internal control processes are implemented to achieve the following:
  • Safeguard assets
  • Maintain sufficient records
  • Provide accurate and reliable information
  • Prepare financial reports according to established criteria
  • Promote and improve operational efficiency
  • Encourage adherence to management policies
  • Comply with laws and regulations

Functions of Internal Control

• Preventive Controls: Deter problems from occurring.
• Detective Controls: Discover problems that are not prevented.
• Corrective Controls: Identify and correct problems; correct and recover from the problems.

Legislations

• Foreign Corrupt Practices Act (FCPA) (1977): Passed to prevent companies from bribing foreign officials to obtain business and requires all publicly owned corporations to maintain a system of internal accounting controls.
• Sarbanes–Oxley Act (SOX) (2002): Applies to publicly held companies and their auditors to prevent financial statement fraud, make financial reports transparent, protect investors, strengthen internal controls, and punish executives who perpetrate fraud.

Control Frameworks

• COBIT: Framework for IT control.
• COSO: Framework for enterprise internal controls (control-based approach).
• COSO-ERM: Expands the COSO framework taking a risk-based approach.

COBIT Framework

• The current framework version is COBIT 2019.
• COBIT 2019 is based on the following principles:
  • Meeting stakeholder needs
  • Covering the enterprise end-to-end
  • Applying a single, integrated framework
  • Enabling a holistic approach
  • Separating governance from management

Components of COSO Internal Control Integrated Framework

• The COSO Internal Control–Integrated Framework outlines five components:
  • Control environment
  • Risk assessment
  • Control activities
  • Information and communication
  • Monitoring

Control Environment

• The control environment encompasses:
  • Management’s philosophy, operating style, and risk appetite
  • Commitment to integrity, ethical values, and competence
  • Internal control oversight by the Board of Directors
  • Organizing structure
  • Methods of assigning authority and responsibility
  • Human resource standards

Risk Assessment

• Two Perspectives:
  • Likelihood: Probability that the event will occur.
  • Impact: Estimated potential loss if the event occurs.
• Types of risk:
  • Inherent risk: Risk that exists before plans are made to control it.
  • Residual risk: Risk that is left over after you control it.

Risk Response

• Reduce/Mitigate: Implement effective internal control.
• Accept: Do nothing; accept the likelihood and impact of the risk.
• Share/Transfer: Buy insurance, outsource, or hedge.
• Avoid: Do not engage in the activity.

Control Activities

• Control activities include:
  • Proper authorization of transactions and activities
  • Segregation of duties
  • Project development and acquisition controls
  • Change management controls
  • Design and use of documents and records
  • Safeguarding assets, records, and data
  • Independent checks on performance

Information & Communication

• Three principles apply to the information and communication process:
  • Obtain or generate relevant, high-quality information to support internal control.
  • Internally communicate information, including objectives and responsibilities, necessary to support the other components of internal control.
  • Communicate relevant internal control matters to external parties.

Monitoring

• Monitoring encompasses:
  • Performing internal control evaluations (e.g., internal audit)
  • Implementing effective supervision
  • Using responsibility accounting systems (e.g., budgets)
  • Monitoring system activities
  • Tracking purchased software and mobile devices
  • Conducting periodic audits (e.g., external, internal, network security)
  • Employing a computer security officer
  • Engaging forensic specialists
  • Installing fraud detection software
  • Implementing a fraud hotline

This quiz covers the fundamental concepts of Control and Accounting Information Systems (AIS). It explores threats, exposure, likelihood, and the primary objectives of AIS, emphasizing the importance of internal control processes in safeguarding assets and ensuring operational efficiency.