ACCA P1 | Governance, Risk and Ethics

Exam focused answer pointers

Role of internal audit in ensuring effective internal controls REFCC

1. Reviews and reports upon controls put in place for key risks.
2. Examination of financial and operating information for accuracy, timeliness and adequacy.
3. Follow-up visits to ensure that the weaknesses reported in prior reports have been addressed.
4. Compliance against standards (allowed variance or tolerance).
5. Compliance against relevant regulations and externally imposed targets.

Sound system of corporate governance makes it harder for companies to

fail
1. Agency problem
2. Risks
3. External reporting
4. Investor confidence
5. Internal controls
6. New investments

Effectiveness of internal controls cannot be guaranteed

1. Control can be under or over-specified.
2. Human factors can undermine or circumvent the effectiveness of many internal controls.
3. Controls can be ineffective if employees collude.
4. Occurrence of non-routine unpredicted events.
5. Management or employees may exercise poor judgement or miscalculation.

Effectiveness of internal controls cannot be judged on the basis of cost

1. It is the design of the control rather than cost which is the primary driver of effectiveness.
2. Control can be over-specified, meaning that control is more robust and expensive than needed.
3. Any control can be corrupted, circumvented or ignored.

ALARP (as low as reasonably practicable)

1. In most businesses, the focus will be on reducing risks rather than eliminating them.
2. However, many risks cannot be avoided. Many companies undertake hazardous activities.
3. The fact that risk cannot be avoided doesnt mean that companies become complacent.
4. Judgement will be involved in deciding on what level of risk is as low as reasonably practicable.
5. It would be financially and operationally impracticable to eliminate certain risks.

Importance of accurate risk assessment

1. Underestimated risks may mean inadequate risk management processes are employed to address
them.
2. Exaggerated risks may mean unnecessary costs have been put in to address them.
3. Governments and legislator require risk assessment in number of areas (EU requires companies to
carry out risk assessment in health and safety, product reliability and finance).
4. Number of stakeholders may be concerned with the adequacy of risk assessment process. If they are
dissatisfied, this may have an impact on the company.
5. Inaccurate risk assessments may bread fear and mistrust among shareholders and stakeholders.

Page 1 of 2
ACCA P1 | Governance, Risk and Ethics
Exam focused answer pointers

Page 2 of 2