【正文】
management needs information to effect control (page 31). ? Information about plans, risks, and performance. ? Information in a form and timeframe that is useful. ? Information from internal and external sources. ? When pleting a Risk/Control Worksheet for a significant activity (or process), evaluate the quality of related information and munication systems. 44 Internal Control Process Establish Control Environment Implement Control Activities Perform Risk Assessment Goals amp。 calls on delinquent accounts. ? Accountant reconciles monthly Statement of Accounts to internal records. ? Storeroom Manager pletes environmental health and safety checklist every six months. ? Department Chair reviews monthly reports. 41 Break 10 Minutes 42 Internal Control Process Establish Control Environment Implement Control Activities Perform Risk Assessment Goals amp。 Accountant investigates missing documents。 annual renewal notice. ? Storeroom is locked when employees are not present。 periodic physical counts should be performeddifferences should be checked. 36 What duties need to be segregated? ? It depends on the risk assessment (page 26). ? The approval, accounting/reconciling, and asset custody functions should be segregated. ? Generally, duties related to cash receipts and purchases are high risk and should be segregated. 37 How do we control our puters? ? It depends on the risk assessment (page 27). ? If a department has critical or confidential information which resides on a puter, then both the information and the puter need to be controlled. ? Basic controls are (pages 28 and 29): ? Monitoring pliance with software licenses. ? Password protecting information. ? Backingup information. ? Segregation of EDP functions. ? Program development controls. 38 Individual Exercise (page 30) Control Activities 39 What control activities are needed? ? Survey faculty members every semester to identify chemical needs。 Objectives Monitor Performance Information Communication and and 21 What is risk assessment? ? Risk assessment is (1) the identification of risks to the achievement of objectives and (2) the analysis of identified risks (page 15). ? A risk is anything that could jeopardize the achievement of an objective. 22 How do we identify risks? ? You know your risks. ? For each objective, ask yourself: ? What could go wrong? ? What assets do we need to protect? ? How could someone steal from us? ? What is our greatest legal exposure? ? Identify risks at the department level and at the activity (or process) level