Components of internal control - Information, communication,...

Learning Outcomes

After reading this article, you will be able to explain how information systems, communication processes, and monitoring of controls contribute to an effective internal control system. You will identify key elements and purposes of information flows and monitoring, distinguish their roles in the control environment, and describe how auditors assess and evaluate these areas when planning and performing audits. You will also practice applying these concepts to exam-style scenarios and recognize common weaknesses or deficiencies.

ACCA Audit and Assurance (AA) Syllabus

For ACCA Audit and Assurance (AA), you are required to understand the components of internal control, including detailed knowledge of the role of information, communication, and monitoring. You should be able to:

• Describe and explain the components of internal control, focusing on information systems and communication, as well as monitoring of controls.
• Explain why the auditor obtains an understanding of information systems and communication relevant to the audit.
• Identify examples of information system and monitoring controls in common business processes (sales, purchases, payroll, etc.).
• Discuss methods for evaluating the adequacy of information, communication, and monitoring activities, including assessing deficiencies.
• Recommend improvements and explain communication requirements relating to internal control weaknesses.

Test Your Knowledge

Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, remember to look more closely at that area during your revision.

1. What is meant by "information system and communication" in the context of internal control? List two examples relevant to a sales process.
2. Explain why monitoring of controls is necessary, and give two examples of monitoring activities commonly found in organizations.
3. True or false? A business does not need formal communication channels as long as key information is available in its information system.
4. Describe one risk an auditor may encounter if a company does not monitor its internal controls regularly. Suggest an appropriate recommendation.

Introduction

Most entities depend on a combination of information systems, communication practices, and ongoing monitoring to ensure that business processes operate as intended and risks are managed. In the context of internal control, information, communication, and monitoring are three of the five components identified by ISA 315, and they are critical for supporting reliable financial reporting and safeguarding assets.

Key Term: information system
The set of manual and electronic procedures and records established to initiate, process, record, and report transactions and maintain accountability for assets, liabilities, and equity.

Information, Communication, and Monitoring in Internal Control

Information System and Communication

An effective information system collects, processes, and maintains necessary records to prepare financial statements and track assets and liabilities. It enables the entity to initiate, process, and document all business activities, making management accountable and providing reliable data for users.

The communication component refers to the means by which information is made known to those who need it, both internally and externally. This includes formal policies, reporting lines, manuals, and informal feedback channels.

Key Term: communication (internal control)
The process and methods used by an entity to transmit relevant information to individuals—internally between departments and externally to stakeholders—so responsibilities are understood and tasks are carried out properly.

The Role of the Information System

A comprehensive information system should:

• Identify and capture all relevant data for financial reporting.
• Process transactions accurately, completely, and in the correct period.
• Maintain and update records needed to account for assets, liabilities, equity, revenue, and expenses.
• Enable correction of errors or resolution of exceptions.
• Track changes, overrides, or corrections to records.

For example, a computerized inventory system should log all receipts, issues, and adjustments, while also flagging discrepancies for review.

Internal and External Communication

Effective communication ensures that:

• Staff understand their roles, procedures, and authorities.
• Policy changes are distributed to relevant employees.
• Management receives timely and appropriate information about operational and control matters.
• Information relevant to external compliance (e.g., taxation, regulatory) is properly communicated.

Communication failures can result in unrecorded transactions, duplicated work, delays, or non-compliance.

Worked Example 1.1

Scenario:
Pacific Ltd uses a manual process for sales order entry between sales staff and dispatch. Management notices that some customer orders are not being processed, and others are duplicated in the ledger.

Answer:
Poor communication channels (missing order confirmations, inconsistent record exchange) and an inadequate information system for tracking orders lead to unfulfilled and double-counted sales. The control deficiency is lack of timely, reliable information flow. Recommendation: Implement sequential order logs and require written order confirmations to support clear communication.

Monitoring of Controls

Monitoring is the ongoing or periodic assessment of internal controls to ensure they are present and function as intended. Effective monitoring enables management to detect deficiencies quickly and address them before they result in misstatements.

Key Term: monitoring (internal control)
The process by which management evaluates the effectiveness of internal control systems, including ongoing activities and separate evaluations, and takes corrective action as needed.

Examples of monitoring activities include:

• Regular reconciliation of bank and key general ledger accounts.
• Management review of variances or exception reports.
• Supervision and periodic performance reviews.
• Internal audit assessments.
• Feedback channels for staff to report control lapses (“whistleblowing” mechanisms).

Key Term: deficiency in internal control
A flaw in the design, implementation, or operation of a control that could prevent timely prevention or detection of misstatements.

Why Monitoring is Necessary

Without structured monitoring, internal controls may deteriorate over time or fail to respond to changing risks. This increases the likelihood that errors or fraud go unnoticed.

ISA 315 requires auditors to understand not only the controls that exist, but also the entity’s process for reviewing their continued effectiveness.

Worked Example 1.2

Scenario:
FastCar Co. established segregation of duties in its payment process two years ago, but staff turnover has been high in the finance team. In the last six months, payment errors have increased.

Answer:
Absence of monitoring allowed controls to become ineffective as new staff were not adequately trained and responsibilities blurred. Monitoring through periodic review of segregation compliance and exception reports would have highlighted this issue earlier.

Monitoring: Ongoing vs. Separate Evaluations

• Ongoing activities: Built into regular operations, such as supervisor reviews or automated alerts.
• Separate evaluations: More formal assessments, e.g., internal audit reviews or special investigations.

Both methods help to ensure continued compliance and provide assurance to those charged with governance.

The Auditor’s Viewpoint

The auditor assesses not just whether these systems and processes exist, but also their effectiveness in supporting reliable financial and management reporting.

Auditors often document:

• How information relevant to financial reporting is collected and processed.
• Whether lines of communication are clearly established and policies reach intended users.
• If management or others regularly monitor the effectiveness of controls and address identified issues.

Exam Warning

Weak documentation of information flows or unclear reporting hierarchies are frequent causes of control failures. In Section B constructed response questions, clearly state the practical impact of inadequate information, communication, or monitoring when evaluating or recommending controls.

Summary

Information systems, communication, and monitoring are central to an entity’s ability to produce reliable financial statements and comply with regulations. Robust systems capture all relevant transactions, communication ensures duties and issues are understood, and monitoring detects and corrects weaknesses. Auditors must assess not only the design but also the ongoing operation of these areas when planning and conducting audits.

Key Point Checklist

This article has covered the following key knowledge points:

• Explain how information systems and communication form part of effective internal control.
• Identify examples of good information flows and communication channels within business processes.
• Describe the need for ongoing and separate monitoring of controls and list common monitoring activities.
• Recognize the risk of failure when information, communication, or monitoring processes are weak or absent.
• Recommend improvements and evaluate deficiencies in the information, communication, or monitoring components of control systems.

Key Terms and Concepts

• information system
• communication (internal control)
• monitoring (internal control)
• deficiency in internal control