INTERNAL CONTROL QUESTIONNAIRE
CONTROL ENVIRONMENT
QUESTION
Integrity and Ethical Values
1. Does the management set the “tone at the
top” by demonstrating a commitment to
integrity and ethics through both its words
and deeds?
2. Have appropriate entity policies regarding
acceptable business practices, conflicts of
interest, and codes of conduct been
established and adequately
communicated?
3. Have incentives and temptations that might
lead to unethical behaviour been reduced
or eliminated?
Board of directors and audit committee
1. Are there regular meetings of the board
and are minutes prepared on a timely
basis?
2. Do board members have sufficient
knowledge, experience and time to serve
effectively?
3. Is there an audit committee composed of
outside directors?
Management’s philosophy and operating style
1. Are business risks carefully considered and
adequately monitored?
2. Is management’s selection of accounting
principles and development of accounting
estimates consistent with objective and fair
reporting?
3. Has management demonstrated a
willingness to adjust the financial
statements for material misstatements?
Human resource policies and practices
1. Do existing personnel policies and
procedures result in the recruitment or
development of competent and
trustworthy people needed to support an
effective internal control structure?
2. Do personnel understand the duties and
procedures applicable to the job?
3. Is the turnover of personnel in key
positions at an acceptable level?
YES, NO, N/A Comments
No The management of Sheridan
Audio Visual Ltd does not focus on
honesty, integrity and ethical
values.
No There were no written policies with
regards to appropriate entity
policies
No Even though they have this bonus
scheme for employees, this still
can’t guarantee that unethical
behaviour will reduce.
Yes Meetings with the board are held
quarterly.
Yes Majority of the company’s board
members, with the exception of
one, have been in the company for
No a long period.
We found that the management
No has a negative opinion of the
controls after talking to employees
No and managers. Finance isn't
important to the Managing
Director because he/she doesn't
have any involvement, and he/she
No doesn't value it either. Due to this,
fraud opportunities and material
misstatement risks are increased in
all financial statement balances. A
higher risk of non-compliance with
standards, regulations and banking
covenants increases.
No Rosie and David have an informal
conversation regarding new
recruits but there is no written and
signed agreement.
No It’s unclear what the job entails.
Yes The turnover of personnel in key
positions at an acceptable level
 INTERNAL CONTROL QUESTIONNAIRE
ORGANISATIONAL CONTROLS

QUESTION YES, NO, N/A Comments

Organisational controls
1. Are the following duties segregated within No
the computer department:
 Systems design?
 Computer programming?
 Computer operations?
 Data entry?
 Custody of systems documentation, It’s all done manually, so there’s no
programs and files? organizational control or computer
 Data control? department.
2. Are the following duties performed only
outside the computer department: No
 Initiation and authorisation of
transactions?
 Authorisation of changes in systems,
programs and master files?
 Preparation of source documents?
 Correction of errors in source
documents?
 Custody of assets?
Systems development and maintenance controls
1. Is there adequate participation by users No
and internal auditors in new systems
development?
2. Is proper authorisation, testing and No
documentation required for system and
program changes? There is no IT Staff yet.
3. Is access to systems software restricted to No
authorised personnel?
4. Are there adequate controls over data files No
(both master and transaction files) during
conversion to prevent unauthorised
changes?
Access controls
1. Is access to computer facilities restricted to Yes All staffs have individual password.
authorised personnel?
2. Is access to data files and programs No
restricted to authorised personnel?
3. Are computer processing activities No
reviewed by management?
Other controls
1. Is there a disaster contingency plan to No No formal plan exists at Sheridan
ensure continuity of operations? AV but Rosie is aware and
2. Is there off-site storage of back-up files and Yes considered threats to the computer
programs? hardware/software and has
3. Are sufficient generations of programs, implemented controls. Some of the
master files and transaction files No areas that are covered by their
maintained to facilitate recovery and insurance include fire and floods.
reconstruction of computer processing?
4. Are there adequate safeguards against fire, Yes Sheridan holds data and programs
water damage, power failure, power in a secure place in the new
fluctuations, theft etc? warehouse building since it is away
from the main office building and
warehouse; they think that it
would be much safer.
As an example, when it comes to
fire safety, every office is equipped
with fire alarms and the staffs have
been trained on what to do in case
of a disaster.