COMM1140 Chap.8 Audit, Risk and Internal Control
Audit, Risk and Internal Control
Internal control provides reasonable assurance over effective operations, reliable reporting and compliance. The system includes control environment, risk assessment, control activities, information and communication, and monitoring. A case answer should identify what could go wrong, locate the weakness within those components, design a preventive or detective response and name evidence that would show whether it operated.
Audit is distinct from management's responsibility: management prepares information and runs controls, while auditors obtain evidence and form a conclusion within a defined scope. Policy existence alone does not prove operating effectiveness.
What this chapter covers
- 01
Control objectives
- 02
Five control components
- 03
Preventive and detective activities
- 04
Segregation of duties
- 05
Monitoring and escalation
- 06
Audit evidence and independence
Worked example · free
Diagnose unauthorised supplier payments
- +1Risk: a false supplier and invoice can be created and paid without independent challenge.
- +1Separate supplier setup from invoice entry and payment release, with approval of bank-detail changes.
- +1Add detective review of supplier changes, duplicate invoices and payment exceptions.
- +1Test access logs, approvals and a sample traced from supplier creation to bank payment.
Key terms
- Control environment
- The organisational culture, integrity, oversight and accountability that support the broader internal-control system.
- Risk assessment
- Identification and analysis of events that could prevent objectives from being achieved.
- Control activity
- A policy or procedure that prevents or detects a defined error, fraud or compliance failure.
- Monitoring
- Ongoing or separate evaluation of whether controls continue to operate and exceptions are resolved.
- Reasonable assurance
- A high but not absolute level of confidence, recognising cost, error, collusion and override limitations.
Audit, Risk and Internal Control FAQ
What is the difference between preventive and detective controls?
Preventive controls block an event before completion, while detective controls identify it after occurrence. Strong processes often combine restricted access with reconciliation or exception review so failure of one layer can still be identified.
Why is segregation of duties important?
Separating authorisation, custody, recording and review reduces the chance that one person can both create and conceal an unauthorised transaction, while independent monitoring tests whether the separation remained effective.
Does a signed policy prove a control worked?
No. It demonstrates design intent. Operating evidence includes dated approvals, system logs, reconciliations, exception follow-up and reperformance across the relevant period and transaction population, including documented resolution.
What remains management's responsibility after an audit?
Management remains responsible for preparing information and designing and operating controls. The auditor evaluates evidence and reports within the engagement scope without taking over the control owner's duties.
How do I turn a case weakness into a specific control?
Describe the risk event and objective before naming the control. Identify who can initiate, authorise, record, hold assets and review the process, then choose a preventive or detective activity that interrupts the actual route. For unauthorised supplier payments, separate supplier setup from payment release, require independent approval of bank-detail changes and review exceptions.
State the frequency, owner and escalation rule. A recommendation is specific when another person can understand how it reduces the scenario risk and what evidence its operation would leave.
What is the difference between control design and operating effectiveness?
Design asks whether the control could prevent or detect the stated error or unauthorised act if performed as specified. Operating effectiveness asks whether authorised people performed it consistently, at the right time, and resolved exceptions through the period. A policy may support the design assessment, while dated approvals, logs, reconciliations, reperformance and exception follow-up support operation.
Testing should address the relevant population and risk points; a sample of routine transactions may miss privileged-user changes or period-end overrides.
Why should residual risk appear in the conclusion?
Controls provide reasonable assurance rather than certainty because cost, human error, collusion and management override remain possible. After proposing a control, identify what could still bypass it and how monitoring, escalation or independent review would detect that exposure. This does not invalidate the recommendation.
It shows that the response distinguishes risk reduction from elimination and considers the system of connected components. The residual-risk statement also guides the audit evidence and frequency needed after the primary control is introduced.
Exam move
For each case, write the objective, risk event and possible misstatement or loss. Map the weakness to one or more control components, then propose a control that interrupts that route. State whether it is preventive or detective and identify evidence of operation. Practise distinguishing design from operation and management from auditor responsibility.
Close with residual risk and the monitoring needed because no control system offers certainty.
Working through Audit, Risk and Internal Control in COMM1140? Sia is AskSia’s AI Finance tutor — ask any COMM1140 Audit, Risk and Internal Control question and get a clear, step-by-step explanation grounded in how COMM1140 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
