Implementing and auditing the internal control system dimitris n chorafas

Implementing and Auditing the Internal Control System Dimitris N Chorafas IMPLEMENTING AND AUDITING THE INTERNAL CONTROL SYSTEM Also by Dimitris N Chorafas MANAGING RISK IN THE NEW ECONOMY NEW REGULATION OF THE FINANCIAL INDUSTRY MANAGING CREDIT RISK: Analysing, Rating and Pricing the Profitability of Default MANAGING CREDIT RISK: The Lessons of VAR Failures and Imprudent Exposure RELIABLE FINANCIAL REPORTING AND INTERNAL CONTROL: A Global Implementation Guide CREDIT DERIVATIVES AND THE MANAGEMENT OF RISK SETTING LIMITS FOR MARKET RISK HANDBOOK OF COMMERCIAL BANKING: Strategic Planning for Growth and Survival in the New Decade UNDERSTANDING VOLATILITY AND LIQUIDITY IN FINANCIAL MARKETS THE MARKET RISK AMENDMENT: Understanding Marking-to-Model and Value-at-Risk COST EFFECTIVE IT SOLUTIONS FOR FINANCIAL SERVICES AGENT TECHNOLOGY HANDBOOK TRANSACTION MANAGEMENT INTERNET FINANCIAL SERVICES: Secure Electronic Banking and Electronic Commerce? NETWORK COMPUTERS VERSUS HIGH-PERFORMANCE COMPUTERS VISUAL PROGRAMMING TECHNOLOGY HIGH-PERFORMANCE NETWORKS, PERSONAL COMMUNICATIONS AND MOBILE COMPUTING PROTOCOLS, SERVERS AND PROJECTS FOR MULTIMEDIA REAL-TIME SYSTEMS THE MONEY MAGNET: Regulating International Finance, Analyzing Money Flows and Selecting a Strategy for Personal Hedging MANAGING DERIVATIVES RISK ROCKET SCIENTISTS IN BANKING HOW TO UNDERSTAND AND USE MATHEMATICS FOR DERIVATIVES: Foreign Exchange and the Behaviour of Markets HOW TO UNDERSTAND AND USE MATHEMATICS FOR DERIVATIVES: Advanced Modelling Methods AN INTRODUCTION TO COMMUNICATIONS NETWORKS AND THE INFORMATION SUPERHIGHWAY (with Heinrich Steinmann) DERIVATIVE FINANCIAL INSTRUMENTS: Managing Risk and Return FINANCIAL MODELS AND SIMULATION: Concepts, Processes and Technology Implementing and Auditing the Internal Control System Dimitris N Chorafas ( Dimitris N Chorafas 2001 All rights reserved No reproduction, copy or transmission of this publication may be made without written permission No paragraph of this publication may be reproduced, copied or transmitted save with written permission or in accordance with the provisions of the Copyright, Designs and Patents Act 1988, or under the terms of any licence permitting limited copying issued by the Copyright Licensing Agency, 90 Tottenham Court Road, London W1P OLP Any person who does any unauthorized act in relation to this publication may be liable to criminal prosecution and civil claims for damages The author has asserted his right to be identified as the author of this work in accordance with the Copyright, Designs and Patents Act 1988 First published 2001 by PALGRAVE Houndmills, Basingstoke, Hampshire RG21 6XS and 175 Fifth Avenue, New York, N.Y 10010 Companies and representatives throughout the world PALGRAVE is the new global academic imprint of St Martin's Press LLC Scholarly and Reference Division and Palgrave Publishers Ltd (formerly Macmillan Press Ltd) ISBN 0-333-92936-5 This book is printed on paper suitable for recycling and made from fully managed and sustained forest sources A catalogue record for this book is available from the British Library Library of Congress Cataloging-in-Publication Data Chorafas, Dimitris N Implementing and auditing the internal control system / Dimitris N Chorafas p cm Includes bibliographical references and index ISBN 0-333-92936-5 Auditing, Internal I Title HF5668.25 C523 2000 657' 458—dc21 00-049149 10 10 09 08 07 06 05 04 03 02 01 Printed in Great Britain by Antony Rowe Ltd, Chippenham, Wiltshire This publication is designed to provide accurate and authoritative information in regard to the subject matter covered It is sold with the understanding that the author and the publishers are not engaged in rendering legal, accounting or other professional services Contents List of Figures List of Tables Preface Acknowledgements List of Abbreviations and Acronyms PART I WHY INTERNAL CONTROL SYSTEMS MUST BE AUDITED The Role of Auditing in an Organization Introduction Auditing Defined Auditing as an Indispensable Element of a Management System Senior Management Responsibilities in Connection with Auditing and Internal Controls Value-Added Services to be Provided by Auditing The Role of an Independent Auditing Committee and the Contribution of the Treadway Commission Good Practice Guidelines Regarding Auditing Committee Functions and Responsibilities What is Meant by 'Internal Control'? Introduction 'Internal Control' Defined What Constitutes a Sound Internal Control Policy? Steps in Implementing an Internal Control System Improving the Status of Internal Control in Business and Industry What Is Meant by a 'Rigorous Internal Control Solution'? A Practical Example with Internal Control Approaches to Operational Risk Appendix: Definitions of Internal Control by AICPA, Basle Committee, EMI, IIA, and COSO v VI Contents Internal Control and the Globalization of Financial Markets 54 Introduction The Impact of Globalization on Internal Control Regulators Look at Internal Control as a Foundation of Sound Management Important Differences Between Accounting Systems Handicap Global Internal Control and Auditing Internal Control Deficiencies, Conflicts of Interest, and the Massaging of Accounting Data A Threat Curve Which Addresses Our Problems and Their Likelihood 54 55 New Standards for Auditing Internal Control and the Use of Risk-Based Audits 58 62 65 78 83 Introduction Auditing Responsibilities Prescribed by Securities Laws Agency Costs and the Impairment of Assets Using a Company's Cash Flow for Auditing Reasons The Concept Underpinning Risk-Based Auditing Authority and Responsibility for Risk-Based Auditing Solutions Paying Attention to Information Requirements for Risk-Based Auditing 101 A Methodology for Auditing the Internal Control System 105 Introduction Discovery is the First Major Step of a Valid Auditing Methodology Auditing Strengths and Weaknesses of an Internal Control System: An Example From a Money Centre Bank The Methods of Internal Control Resemble Those of Military Intelligence Internal Control Intelligence and the Calculation of Assumed Exposure Internal Control Intelligence and Dynamic Computing of Capital Requirements Synergy Necessary Between Business Units to Make Internal Control a Reality 83 85 87 91 95 98 105 106 110 114 118 123 127 Contents PART II MANAGEMENT APPRAISAL OF AND ACCOUNTABILITY FOR THE INTERNAL CONTROL SYSTEM Senior Management Responsibilities For Internal Control Introduction Legal Reasons Why Internal Control Must be Managed Effective Internal Control Requires Trustworthy People Internal Control, Product Review, and Risk Assumptions Senior Management Cannot Delegate its Accountability for Internal Control Restructuring is a Critical Element of Financial Innovation Beware of Creative Accounting: it is Poison to Internal Control 155 Internal Control Implementation Must Focus on Core Functions 159 Introduction Which are the Core Functions of a Financial Institution? A Polyvalent Approach to the Implementation of Internal Control: the Commission Bancaire Directives Why Both a priori and a posteriori Studies Improve Internal Control Do We Need a Separate Department to Look After Compliance? The Case of Two Swiss Banks Management Intent: Its Impact on Internal Discipline and Financial Reporting New Rules of Competition and the Need for Market Discipline 133 133 134 140 144 148 152 159 160 163 165 172 176 182 Establishing an Efficient Internal Control Structure 185 Introduction Organizational Solutions for Internal Control at Edward Jones The Process of Internal Control and the Prerequisites for Risk Management Commercial Risk, Financial Risk, and the Tuning of Internal Control 185 187 190 193 Vlll Contents Should We Analyze the Behavioural Pattern of Our Traders? Developing and Using a System of Internal Margin Calls Internal Controls Should Highlight Information Technology Failures 196 202 206 PART III CASE STUDIES ON THE IMPLEMENTATION OF INTERNAL CONTROL Applying Internal Control to Our Institution's Limits System Introduction Limits, Marking-to-Market, and the Contribution of Internal Control Internal Control and the Role of Benchmarks Answers by Leading Institutions to an Internal Controls and Limits Questionnaire Setting Limits is a Business Requiring Know-how and Imagination The Study of Internal Controls by the European Monetary Institute Advance Notice Can Help in Limiting Future Loss Through Repositioning 10 Auditing Counterparty Limits and Trading Limits Introduction Internal Controls and Dynamic Limits Management The Role of Auditing in Controlling the Calculation of Prices and Risk Premiums Internal Controls, Leveraging, and the Evaluation of Risk and Return Should Internal Controls Reflect a Portfolio's Diversification? Internal Controls and Limits for Equity Trading Examining and Implementing Limits in Currency Positions 11 An Internal Control System for Engineering Design, Product Development, and Quality Assurance Introduction Long-Termism and Short-Termism in R&D 213 213 214 219 221 225 228 231 235 235 236 241 245 250 254 258 262 262 263 Contents A Methodology for Internal Control Applied to Engineering Design Internal Control's Contribution to the Project Manager's Job Internal Control for Prototypes and for Measurements Connected with Different Projects Design Reviews are Essentially a Process of Rigorous Auditing An Infrastructure for Quality Assurance 12 Services Provided by Information Technology to the Auditing of Internal Controls Introduction Positioning Our Institution to Profit From the Fact that Banking is Information in Motion The Use of Advanced Technology is not a Fad but an Obligation Online Banking and the Auditing of Financial Operations The Effective Use of Information Technology for Internal Control The Regulators Emphasize the Need to Use Technology in an Able Manner Why Auditing Increasingly Depends on Computer Systems 13 The Contribution of External Auditors to the Internal Control System Introduction Value-Added Duties Beyond Those Classically Performed by External Auditors What Should be Expected from Auditing Internal Controls by External Auditors? Are Central Bank Examiners Better Positioned in Studying the Effectiveness of Internal Controls? The Concept Behind Outsourcing Internal Auditing and Other Duties A Closer Look at Outsourcing Internal Auditing, its 'Pluses' and 'Minuses' Liabilities Which Might Come the Way of External Auditors IX 268 271 276 280 284 289 289 292 294 299 304 308 310 314 314 315 319 323 327 330 334 ... in self-assessment through internal control and auditing Focal areas of internal control and the impact of internal and external key factors The functions of internal control, auditing, accounting,... ON THE IMPLEMENTATION OF INTERNAL CONTROL Applying Internal Control to Our Institution's Limits System Introduction Limits, Marking-to-Market, and the Contribution of Internal Control Internal. .. INSTRUMENTS: Managing Risk and Return FINANCIAL MODELS AND SIMULATION: Concepts, Processes and Technology Implementing and Auditing the Internal Control System Dimitris N Chorafas ( Dimitris N Chorafas