hello, my name's paul kirkwood and i'm atutor at kaplan teaching out of our london centre and one of my specialistsubject is acca paper f8. the purpose of this session is to runthrough a syllabus area, i want you to try and get to know your syllabus alittle bit better. the syllabus area that i have chosen today is internal control. so lets run through our session objectives. first of all, i want to understand the key internal control syllabus areas that youwill be faced with in your exam. sometimes i just worry that studentsdon't really fully understand all of the syllabus areas that they will be facedwith or could be faced with in their
examination. this is especially true withthe change in the examination question types. with the introduction of multiplechoice questions and longer time questions, it's important that you have abroad syllabus coverage to be able to answer questions on any syllabus area andsyllabus coverage in our most recent exams has certainly increased. but as well as looking through the syllabus, i also want to build your confidence, build your confidence in yourability to pass this paper paper f8. and finally to do that i'm going to look atsome practical questions. i'm going to look at some multiple choice questionsfrom the past three papers that includes the specimen paper, and i'll also look atsome longer time questions from june
2015. so why have i chosen this session? well for me as a tutor, a key frustration has been that many students don't actually passthis exam when they could and really should, certainly the first attempt. well there are many reasons for this andjust to highlight a few for you, with the recent introduction of multiple choicequestions i do get concerned that students don't take sufficient care withthem. i myself am guilty of that so when i see a multiple choice question thensometimes i just look at the first couple of possible answers see one which i think is right and then
don't spend enough time reading throughthe others, and i make a silly mistake. as well as that i think sometimes peopletake too long over the mcq's. if you've got 4 possible answers and you can'tdecide between two of them as to which is right and which is wrong i've heardback from students experiences that what they tend to do is sit there and almost become paralyzed in the exam trying to work out which is correct. ifyou've just got 2 answers to choose from just choose a or b, you've got a 50/50 chance and you would not be negatively marked. so don't take too long especially inpaper f8 where the absolute majority of questions will be narrative and istruggle to think of many if any that
will be computational in nature. when wethink about the longer time questions, students as well sometimes misinterpretthe question requirement and that can be because they simplymisread it and don't answer the specific question asked. for example, if aquestion said 'identify and explain', too often people simply identify issuesrather than going on and explaining why that is a problem. so we'll think abouthow to read and then answer requirements in a full way. internalcontrols i've often had my students tell me that they find this area quite niceand they're looking to score highly. well if that's the case you've gotta makesure that you do. in this paper the pass
mark is 50%. in some areas i want you toscore highly, score well, in other areas that you find difficult maybe you'll bestruggling around the pass mark or maybe even just below but on averageyou'll have enough to pass. internal controls is often an area where you canscore well but you've got to do it, you can't make silly mistakes and you've gotto give the examiner exactly what she wants. in terms of the how we can build thoseskills, well it's understanding the syllabus and understanding the study guide is asa first point. again with the change mcq's and longer questions i needyou to be able to have a broad coverage
of all syllabus areas because you can draw on any areas of the syllabus to ask your questions. and i do think sometimesstudents have never looked at, certainly my paper, paper f8 syllabus, and more importantly the study guide itself. so let's move on, let's have alook at the syllabus itself. this is the main syllabus framework; five areas, oneof which syllabus section c is internal control. drilling down a little bitfurther we can see that internal control has got four elements. now each ofthose elements doesn't really give us much of a clue as to what is in our detailed syllabus and how it would be examined. but if i drill down one more level, and this is typically known as the 'study
guide', we can start to see a breakdown ofexactly what the examiner has got in your syllabus. so the first point there, point 1a, "to explain why an auditor needs to obtain an understanding ofinternal control relevant to the audit". well with this point we can go back tothe basic planning cycle of an audit itself, to be able to plan to do an audit effectively and efficiently you need to understand the client's internalcontrol systems and its accounting systems. how will you be able to planwhich is the best approach? whether it be tests of controls and substantiveprocedures or substantive procedures on their own.
how could you decide the best approach if you don't fully understand the client's systems? secondly we've got the part b, which isto, "describe and explain the five components of internal control". well for this elementyou need the knowledge, you need to be able to identify and then explain eachof those elements. well first of all, how do you rememberthis knowledge? well as you go through your text books or go through your time with your tutor in class or online, sometimes tutors or sometimes youyourself can come up with innovative ways to remember key data.
for this one the five elements are usingpneumonic, my pneumonic is crime. it would be a crime not to have goodinternal controls. and then i can map each of the crime letters across to oneof the five elements. so the 'c' i can relate to control activities, the 'r' to risk assessment, the 'i' to the information systems, the 'm' to the need for monitoringand the 'e' to the environment. so now i've got them remembered how do i thentake this forward? well you need to be able to not just remember and recall butexplain. take the bottom one, 'environment'; in terms of internal controls they willbe affective if the environment is good. that means that there is a culture andan attitude and an awareness of
management which flows through theorganization that appreciates the importance of internal control in thatorganization. without a strong control environment i'm afraid the otherelements are unlikely to succeed. moving on, the second element of thethe syllabus in detail is, "the use and evaluation of internal control systemsby auditors", and the top one looks at how auditors record the systems usingnarrative notes, flow chart, questionniares and evaluations. now again i'd like you tobe able to explain what each of them does and how they are used, but also lookat the word, "explain how auditors record internal control systems", i think itgoes a little bit deeper, i think here you
would need to be able to explainthe pros and cons, the advantages and disadvantages of each. part b in thissection talks about, "evaluating internal controlcomponents including deficiencies and significant deficiencies". what theexaminer wants you to be able to do is to identify and evaluate. evaluate,looking at strengths and deficiencies of internal control systems. and also in a scenario be able to pullout which are the most important or significant deficiencies. finally ittalks about the limitations of internal control components.
well i'm sure you're aware that no internalcontrol system is 100% foolproof. but why is it? and there are many reasons. some ofthem will be down to the design of the system itself, others are just inherent, the fact thatpeople are involved and people have inherent frailties in their personalitiesis a reason why no internal control system is perfect, but you need to beable to explain why this is. the third area of the syllabus looks at testsof controls, but before it gets into the detail it wants you in part a to be able todescribe computer systems, computer system controls including general andapplication controls. and here you've got to
know the distinction. it's no good justhaving a simple awareness that there's things like passwords, protection thatcould be used, there could be virus checks or backups orbatch controls or check digit controls, you've got to be able to categorize theminto either general or application. general controls are those which managesystem integrity, whereas application controls are around the input of data toensure it's complete and accurate, input into a system. it then moves into part b where you are asked to describe control objectives, procedures, activities, and tests ofcontrol. well, if you are asked about controlobjectives these could be on any of
those areas 1-6, any system that theexaminer chooses. but at a high level if i was asked aboutcontrol objectives i would always start my answer with the words, "to ensure that".control objectives, they are there to ensure something good happens or toensure something bad does not happen. for example; with the sales system to ensurethat we only sell to creditworthy customers, for the purchases system toensure that goods that are orderd are actually needed in the business itself,the payroll to ensure that we only pay our employees for work that they haveactually performed, inventory to ensure that we store inventory in effectivemanners to maintain it's quality, the cash
system to ensure that there is a minimumrisk of cash been fraudulently misappropriated by employees, non-currentassets to ensure that the purchase of any non current assets is authorized byan appropriate person and there is a business need. so again i could gothrough all of those six areas and link it back to the control objectives. interms of control procedures, i've got another pneumonic here, you need to beable to come up with control procedures to manage objectives. 'apips' is a littlepneumonic here, the 'a' stands for authorization controls, the 'p'performance review. well, performance review taking that one specifically, when iworked in industry a lot of my managers
the first thing they did when they camein on the morning, because i worked in retail, was still look at current sales oryesterday's sales compared to budgets and targets. why didthey do that? well they were looking for anomalies that might suggest thatsomething's gone wrong, that there's been a breach in a particular control in aparticular store. so performance review was a really effective control procedureto identify potential anomalies in internal control. we've also gotinformation processing and physical controls as well as segregation ofduties. so 'apips' just gives you some broad categories and
types of internal control proceduresthat a business may implement. coming down to tests of control, well, tests of controls are there for theauditor, the auditor, to ensure that the system the client system is operatingeffectively. tests of control are done by the auditor. if you're asked tocome up with tests of control then i think of two words. there are others thatdescribe the procedures of testing controls but i think if you've gotinspection and observation in your mind in a question which asks you for testsof control you're pretty much half way there to pass on that question but i'llsee that later on when we look at a real
past exam question. so that's section 3,and the final section, section 4, is about communication on internal control. wellfirst of all you need to understand how, when, who, should report back deficienciesin internal control. i'm sure you've all heard of the management letter, i thinkyou need to understand the format and the contents of a typical managementletter as well as what goes into the appendix. but there are other methods tofeedback to management. who would you speak to? would it be directors, would it be the auditcommittee? when? if you found a significant deficiency at the start ofthe audit would you wait till the management letter to highlight that? so ithink you need to be aware of the
broader way we report back internal control deficiencies. part b ofsection 4 talks about your need to be able to explain in a format suitable forinclusion in a management letter significant deficiencies andrecommendations to overcome those deficiencies. now that suggests when iread that two parts to an answer, but remember your examiner may ask youfor three elements; to identify and explain a deficiency, to explain theconsequence as well as giving a recommendation. therefore, your answer may have two columns or three columnsdepending on the requirement itself. now
i hope that what we've seen there byrunning through the syllabus in the more detailed study guide is hopefullyhighlighting areas that you're confident with and areas where perhaps you need tobuild your knowledge. internal control is not the most difficult area of thesyllabus but it's one where you really need, you really need a sound understanding and a sound knowledge on which to base your answers to thequestions set by the examiner. let's move on, i want to move on now to try and buildconfidence even more thinking of what we've just covered in the study guide tolook at some practical aswering of internal control questions. i'm going tolook at two types; were going to look at
some mcq's and we're going to lookat some longer questions. we're going to look at six multiple choice questions,two from each of the specimen paper, the december '14 paper and june '15 paper. we will then look at too long questions from june 2015. so with that hopefully we will beable to look at some basic exam technique as well as applying our knowledge to thequestions. so let's start with the specimen paper, this was question 4in the specimen paper; "application controls are manual or automatedprocedures that operate over accounting applications to ensure that alltransactions are complete and accurate". well, "which two of the following areapplication controls?". well here it links
straight back into the syllabus and studyguide, as i'm sure you can see, but here you need to understand the differentcategories of control. well password protection is the perfectexample, the perfect example, of a general control. so that is definitely not right. batchcontrols are the perfect example of an application control. if you'restruggling to remember what batch controls are as you can see by thepicture there of a calculator with a till roll, i always wanted a calculator with a till roll, ithought only the best accountants would own one of those, but if i had oneand i was entering data into a computer,
what i could do to ensure that i enterthe data accurately, let's say there was sales invoices, well i could add up manually on my calculator all of the invoice totals, involves values, that iwas going to enter into my computer system. i could then sum it and print offthat batch of invoice values. i could then enter the data the individual salesinvoices into the computer, but before i process that data into the computer icould check that the totals of my manual are adding up and what i have entered into thecomputer system itself, agree. that's called a batch control. it can bemanually done or sometimes computer systems themselves do an automated batchcontrol. well, with that in mind i can actually
discount, can't i, answers a and b. well i canactually get to the right answer simply by considering points one and two, becausethe answers must be d. because for a, 1 and 4, well 1's wrong. answer b, 3 and 4, well i know's 2 right. c, 1 and 2, well no no no 1 isn'tright, so the answer must be d. but there is where the risk arises. too often, imyself have made mistakes, i've thought i've got the right answer and then just movedon, it's always worth just checking that your answer is right. let's move throughthe last two points; "one for one checking"? well i've got no idea what that is so let's move on to thenext one; "regular back up of programs". well backups are just general controls. that'sdisplaying my knowledge. i know that
number four is wrong, it gives meconfidence that number three must be right even though i'm not exactly surewhat it is. i'm presuming one for one checking is where you enter a piece of data into acomputer system and either yourself or a colleague checks that you've entered the right data. thatto me is about data input accuracy therefore an application control. let'smove on this number 12 from the specimen paper; "which of the following is not setout as a component of internal control within isa 315?". well here you've got a pneumonic. the pneumonic is crime. these questions are beautiful because you know you're going to get it right. as long as you understand
crime, as long as you can recall theelements then straight away you must know that its part c, answer c sorry, that isnot a component. the control environment is and the information system is. soknowledge is power, it really is, especially in some of these multiplechoice questions. moving on, let's move to december '14. this is question 6; "which of the following procedures are tests ofcontrol", remember the tests of control focus on evaluating the effectiveness ofthe controls implemented by the company at preventing or detecting materialmisstatements. so they focus on the order to evaluating whether the clientsystems are effective. well let's start at the
top and work down shall we? so firstof all number 1; "observe whether the client staff arefollowing the inventory count instructions". well yeah, i think that'smaking sure that the client's controls are operating effectively. if they've gotinstructions in place lets ensure that they are following thoseinstructions. i'd actually have liked to have read those instructions before hand first to makesure the instructions are good enough but i think on its own number 1 isdefinitely a test of control. with that in mind, i can rule in answers b and cand i can rule out answers a and d. so 3 is definitely out, but actually just readthrough c again
don't just rule it out and ignore it, make sure you're comfortable that you've got to the right answer. "obtain asample of the last goods received notes and goods despatched notes and follow through to ensure inclusion in the correct accounting period", is the perfect description of acut-off test, and a cut-off test is a substantive procedure testing theassertion of cut-off. well now i'm left with 2 and 4. let's start with 2maybe; "review inventory present in the warehouse for evidence of damage or obsolescence". well if i'm looking for evidence of damage or obsolescence that's going to impactpotentially the value of the goods,
valuation very much an assertion, so asubstantive procedure. compared to number 4 where, "inspect and reviewmanagement's inventory instructions", that's really what i wanted to dobefore i observed the client, actually following them to make sure the client'scontrols, their inventory count instructions were effective. so it's gotto be 1 and 4, it's got to be answer b. moving on this is again fromdecember '14. now i think this is a tough question. why do i think it's tough? wellbecause we have set, as a tutor i have set this question several times in class andgot the answers in to mark from my students and they get this wrong quitefrequently. remember with mcq's
don't expect to walk into this exam andbe getting 10 or 11 or 12 out of 12. the multiple choice questions are not easy. don't expect to be scoring 90 or a 100 percent. you score 60, 70, 80 percent inyour multiple choice question you're doing fabulously well. remember the passmark is 50%. don't get down hearted if you're scoring in the fifties andsixties that's a pass you then need to follow that up with a strong writtensection and you will pass. so lets look at this question now; "which of the following is adisadvantage of recording accounting and control systems usinginternal control questionnaires?". internal control questionnaires, listsof questions which the client can answer
very easily; have they got a control inplace? they would answer yes, have they not got that control in place, answer no. well if it's long lists of questions, sorry aslong as the questions relating to controls that the client may ormay not have been, then yeah, i think those questionnaires would have a large number of irrelevant controls. that is a disadvantage, there's lots of things thataren't present. what about b; "it can be difficult to identify missing controls". well frankly no. to identify controls all you've got to do as an auditor is look at the responses. "yes's" show a control is present, "no" shows a controlisn't present, so i would say it's easy
to identify missing controls, just lookfor the note. what about c; "they are time consuming to complete". well, you know what, i thought yes. originally my gut reaction was yes, they are time consuming to complete. why?well because there's long list of questions some of which are irrelevant. so i dothink they can be time consuming. so what do i do now ,i've got a and c. obviously, justguess. but no we don't have to guess maybe stand back for a second think for 30seconds see if you can rule out one of theanswers and then move on. well here, when i thought again aboutpart c, well if we didn't do internal control question a's
we may well have to observe processes, writenarrative notes, construct flowcharts. and actually i think that would be far moretime consuming than a questionnaire. so then i changed my mind. no. in comparison to othertechniques, icq's, 'internal control questionnaires', are not time consuming tocomplete. the answer must be s. that allows us to move on to june '15. again another tough question. why? again i give it to my students and theystruggled with this one. in fact i thought, this is my personalopinion, i thought the june '15 questions were the hardest mcq's that i have seenfrom the three papers so far; specimen, december '14, june '15. however, awell prepared candidate should have been
comfortable, comfortably capable ofscoring a solid pass mark. let's look at this first one. number 3; "which of thefollowing is not an inherent limitation of internal control systems?". and i think thewording just threw people; "inherent limitation". well inherent, it's there, it'sgot nothing to do with the controls themselves there's just an inherentlimitation to control systems in their own right. well part a, "insufficient segregation ofduties", well i think that is a problem but i think that is a problem related tothe controls themselves. the control procedures implemented by the clientshave not segregated duties enough.
remember the question asks for, "which ofthe following is not an inherent limitation?'. well i actually think part a isnot an inherent limitation, so a must be the answer. but looking down to b and c, makesure you get it right. well the idea that employees may 'collude'together to commit a fraud or the risk of possibility that errors, sorry, humans make errors in their work, youcan't really legislate against removing that in it's entirety. you can't removethe risk of human error, you can't remove the risk of collusionby humans. so which are just there, which are inherent; b and c. part a is notinherent because we can design the system to
remove the segregation of duty issue. finally number 12. when this came out,myself my other fa tutors in london, we had a right go at this one. we came upwith different ideas, we struggled. we eventually got to what we thought wasthe right answer and then when we saw the examiner's comments the examiner actually put this one inher examiners commentary so we knew we had the right answer, but i think this istough. "which two of the following controls of asales system ensure that all goods despatched are completely and accuratelyinvoiced?". let's start at the top;
"goods dispatched notes are matched tosales invoices", so we're looking for goods that have been completely and accuratelyinvoiced following dispatch. well, if goods despatched are matched to salesinvoices that seems right. by matching goods despatched notes to their corresponding invoices then you'll be proven that all goodshave been completely and accurately dispatched, so i think number 1 is right. soimmediately if i've got no other idea i can simply do a 50/50 guess between aand d. let's look down. well in that case i know that number 3 is wrongbut let's deal with them in order; "sales invoices are sequentially numbered".sales invoices are sequentially numbered. how does that
relate to goods being dispatched? i can'tsee anything at all, so i'm assuming that's wrong, it can't be right. number 3, well i know it's wrongbecause a or d must be the right answers. but "sales invoices matched to customerorders"? again where's the link to goods dispatched? so i'd rule out number 3. myproblem was number 4. even today i struggle a bit to answer this. why woulda regular review of unfulfilled orders ensure the goods despatched are completeand accurately invoiced? this still seems to be a bit of a disconnect. if i stand back and think, i can argue theright answer would be that if goods haven't been fulfilled then it maybecause the order is still outstanding
on the system. it may be the goods havebeen dispatched but they haven't yet been invoiced, so regularly reviewing unfulfilled orders could help ensure that we've got complete andaccurate invoicing at goods despatched. i don't particularly like that questionbut i could have got to the right answer. the right answer b and d. so that concludesmy review of the multiple choice questions. just a final comment, yes very much build on your knowledge and application skills but also there's examtechnique in there, ruling items in, ruling items out to make the best educatedguesses where you don't actually know
the exact answer.
0 komentar: