SUMMARY OF STATEMENT OF AUDITING PRACTICE (SAP) 1006 -
AUDITS OF THE FINANCIAL STATEMENTS OF BANKS (PART 11 OF 23)
 

Internal Control

Introduction

The auditor obtains an understanding of the accounting and internal control systems sufficient to plan the audit and develop an effective audit approach. After which, he considers the assessment of inherent and control risks so as to determine the appropriate detection risk to accept for the financial statement assertions and to determine the nature, timing and extent of substantive procedures for such assertions. Where the auditor assesses control risk at less than high, substantive procedures are ordinarily less extensive than are otherwise required and may also differ in their nature and timing.

Identifying, documenting & testing control procedures

SSA 400, “Risk Assessments and Internal Control” indicates that internal controls relating to the accounting system are concerned with achieving objectives such as:

• Transactions are executed in accordance with management’s general or specific authorisation.

• All transactions and other events are promptly recorded at the correct amount, in the appropriate accounts and in the proper accounting period so as to permit preparation of financial statements in accordance with an identified financial reporting framework.

• Access to assets is permitted only in accordance with management’s authorisation.

• Recorded assets are compared with the existing assets at reasonable intervals and appropriate action is taken regarding any differences.
  The audit considerations in relation to each of these objectives are discussed in the subsequent paragraphs.

In the case of banks, a further objective of internal controls is to ensure that the bank adequately fulfills its regulatory and fiduciary responsibilities arising out of its trustee activities. The auditor is not directly concerned with these objectives except to the extent that any failure to comply with such responsibilities might have led to the financial statements being materially misstated. Transactions are executed in accordance with management’s general or specific authorisation.

The overall responsibility for the system of internal control in a bank rests with those charged with governance of the bank’s operations. However, since banks’ operations are generally large and dispersed, decision-making functions need to be decentralised and the authority to commit the bank to material transactions is ordinarily dispersed and delegated among the various levels of management and staff. Such dispersion and delegation will almost always be found in the lending, treasury and funds transfer functions, where, for example, payment instructions are sent via a secure message. This feature of banking operations creates the need for a structured system of delegation of authority, resulting in the formal identification and documentation of:

(a) those who may authorise specific transactions;

(b) procedures to be followed in granting that authorisation; and

(c) limits on the amounts that can be authorised, by individual employee or by staff level, as well as any requirements that may exist for concurring authorisation.

Those charged with governance also need to ensure that appropriate procedures exist for monitoring the level of exposures. This will ordinarily involve the aggregation of exposures, not only within, but also across, the different activities, departments and branches of the bank.

In designing an audit plan to assess the effectiveness of a bank’s reconciliation controls, the auditor considers factors such as:

• Because of the number of accounts requiring reconciliation and the frequency with which these reconciliations need to be performed:

(a) much of the audit effort is directed to the documentation, testing and evaluation of the reconciliation controls; and

 

(b) the work of the internal auditor will also be similarly directed. The auditor therefore can ordinarily use the work of internal auditing.

• Since reconciliations are cumulative in their effect, most can be satisfactorily audited at the year-end date, assuming they are prepared as of that date, soon enough for the auditor to use and that the auditor is satisfied that the reconciliation control procedures are effective.

• In examining a reconciliation, the auditor considers whether items have not been improperly transferred to other accounts that are not subject to reconciliation and investigation at the same time.