Internal Controls, Audit and Ethical Practice

Introduction and context

Accounting information is useful only when it is reliable, complete, authorized and available at the right time. A computerized accounting system such as Tally can record transactions rapidly, calculate balances and produce reports, but software does not automatically prevent error or dishonesty. The quality of accounting information depends on the controls surrounding the system: who may initiate a transaction, who approves it, who records it, who holds the related asset and who reviews the resulting report.

Internal control is therefore both a management responsibility and an accounting responsibility. It combines policies, procedures, people and technology designed to protect assets, maintain accurate records, support efficient operations and ensure compliance with laws and organizational rules. Audit provides an independent or objective examination of records and controls. Ethical practice gives direction to professional judgment when rules do not provide an immediate answer.

In a small business, one employee may perform several accounting tasks because staffing is limited. This increases the importance of compensating controls, such as owner review, bank reconciliation and regular audit-trail inspection. Tally can support these controls through user permissions, approval processes, voucher numbering, alteration histories, backup facilities and reporting tools.

Learning objectives

After completing this chapter, a learner should be able to:

1. Explain the purpose and components of internal control.
2. Apply authorization and segregation-of-duties principles in a Tally environment.
3. Verify accounting vouchers and supporting documents.
4. Use audit trails, reconciliations and exception reports to identify irregularities.
5. Explain access controls, backups and data-security practices.
6. Distinguish errors from fraud risks and recommend suitable responses.
7. Apply integrity, objectivity, confidentiality and professional competence in accounting work.

1. Internal control: meaning and purpose

Internal control is a continuous process carried out by the governing body, management and employees to provide reasonable assurance that organizational objectives will be achieved. The objectives usually fall into four groups:

• Operations: resources are used efficiently and business activities are properly managed.
• Reporting: financial and operational information is accurate, complete and timely.
• Compliance: the organization follows applicable laws, tax rules, contracts and internal policies.
• Safeguarding: cash, inventory, equipment, data and other assets are protected from loss or unauthorized use.

The phrase reasonable assurance is important. No control system can eliminate every risk. Controls may be bypassed through collusion, management override, human error, system failure or an unexpected event. The objective is to reduce risk to an acceptable level at a cost proportionate to the benefit.

A useful risk relationship is:

Probability expresses how likely the event is; impact expresses the resulting financial, operational, legal or reputational loss. This is a risk-assessment model rather than a precise measurement in every organization. It helps management prioritize controls. A low-probability event with catastrophic impact may still require strong controls.

Components of a control system

A commonly used framework identifies five connected components:

1. Control environment: leadership example, organizational structure, competence, accountability and ethical culture.
2. Risk assessment: identification and analysis of events that may prevent objectives from being achieved.
3. Control activities: approvals, reconciliations, segregation of duties, physical safeguards and system restrictions.
4. Information and communication: timely distribution of reliable information to responsible employees.
5. Monitoring: ongoing supervision and separate evaluations to determine whether controls operate effectively.

A weakness in one component can reduce the effectiveness of the others. For example, a well-designed approval screen is ineffective if managers routinely approve transactions without reviewing them.

2. Authorization and approval

Authorization means that a transaction has been approved by a person with appropriate authority before it is completed or recorded. Authorization limits should be documented. For example, a purchasing officer may approve purchases up to 50,000 currency units, while larger purchases require a finance manager or director.

Authorization may be:

• General: approval of recurring transactions within a defined policy, such as routine office supplies.
• Specific: approval of an unusual or high-value transaction, such as acquiring equipment or writing off a receivable.

An approval should identify the transaction, amount, purpose, date and approving person. A verbal instruction may be acceptable in an emergency, but it should be documented promptly. In Tally, an organization can use user roles, voucher approval settings and restricted access to ensure that preparation and authorization are not performed by the same unauthorized user.

A control is not demonstrated merely because a voucher contains a name or signature. The reviewer should consider whether the approver had authority, whether the approval occurred before the transaction, and whether supporting evidence was examined.

3. Segregation of duties

Segregation of duties divides incompatible responsibilities among different people. The key responsibilities are:

1. Custody: physical or electronic control over an asset.
2. Authorization: permission to commit the organization to a transaction.
3. Recording: entering the transaction in the accounting system.
4. Reconciliation or review: comparing records with independent evidence.

For example, the employee who receives cash should not also record the receipt and reconcile the bank account. The employee who creates a supplier should not be able to approve and pay that supplier without independent review.

Segregation reduces the possibility that one person can commit and conceal an irregularity. It does not mean that every task must be performed by a different person. In a small enterprise, compensating controls may include:

• owner review of bank statements and payment lists;
• dual approval of electronic payments;
• independent review of unusual journal entries;
• monthly inventory counts;
• automatic notifications for changes to master data;
• restricted access for the bookkeeper.

Transaction-cycle example

The three-way match compares the purchase order, goods-received note and supplier invoice. It helps establish that the organization ordered, received and was billed for the same goods or services.

4. Voucher verification and source documents

A voucher is an accounting record that supports an entry. Examples include payment vouchers, receipt vouchers, sales invoices, purchase invoices, contra vouchers and journal vouchers. Verification should occur before posting and should be risk-based: high-value, unusual, manual or related-party transactions deserve more scrutiny.

A practical voucher-verification procedure asks:

• Is the document genuine and issued by the stated party?
• Is the date within the correct accounting period?
• Is the amount mathematically accurate?
• Is the transaction related to the organization’s business?
• Has the appropriate person authorized it?
• Are tax, discount, quantity and account classifications correct?
• Is there evidence that goods or services were received?
• Has the transaction already been recorded?
• Is the voucher number controlled and accounted for?
• Does the entry agree with the bank, inventory or subsidiary ledger evidence?

A voucher should be marked or electronically linked to show review status. Missing documents should not be silently replaced by unsupported entries. The correct response is to obtain evidence, record the exception and escalate it where necessary.

Common voucher risks

5. Tally audit trails and accounting records

An audit trail is a chronological record showing how a transaction entered the system, who created or changed it, when the change occurred and, where available, what the earlier value was. An effective audit trail connects the source document to the voucher, ledger, trial balance and final report.

Important audit-trail features include:

• sequential voucher numbers and identification of gaps;
• user name and date/time of creation or alteration;
• record of deleted, cancelled or reversed vouchers;
• alteration history for amount, date, ledger and narration;
• evidence of approval;
• links to attachments or source documents;
• logs of changes to ledgers, stock items and user permissions.

In a Tally installation, the exact availability and configuration of audit-trail functions depend on the product edition, release and enabled features. Users must therefore verify the organization’s configuration rather than assume that every change is automatically recorded. Audit settings should be activated, protected from unauthorized modification and reviewed periodically.

An audit trail is not the same as an audit. A log tells an examiner what happened in the system; an audit evaluates whether the event was authorized, properly supported and fairly presented. A user may legitimately alter a voucher to correct an error, but the correction should retain evidence of the original entry, reason for change and approving authority.

Reviewing an audit trail

A reviewer can filter for:

• entries altered after approval;
• postings made outside normal working hours;
• backdated transactions;
• unusually large round amounts;
• deleted or cancelled vouchers;
• frequent changes by one user;
• changes to bank, cash, supplier or customer masters;
• manual journal entries affecting revenue, expenses or year-end balances.

These indicators do not prove fraud. They identify transactions for investigation. A legitimate year-end adjustment may be backdated within the permitted period; a suspicious pattern requires corroborating evidence.

6. Access controls and information security

Access controls limit system functions and data to authorized users. They should follow the principle of least privilege: a user receives only the access necessary for assigned duties.

Main access controls

• Identification: the system recognizes a user account.
• Authentication: the user proves identity, preferably with a strong password and, where available, multi-factor authentication.
• Authorization: the system determines permitted functions.
• Accountability: activity is attributable to an individual account.
• Review: management periodically confirms that access remains appropriate.

User accounts should be unique. Shared passwords destroy accountability and make audit-trail interpretation unreliable. Employees who leave or change roles should have access removed or revised promptly. Administrator rights should be limited because they may allow alteration of controls, users and audit settings.

Physical and technical safeguards include secure computers, screen locking, malware protection, encrypted backups, controlled server access and safe disposal of printed reports. Backups should be scheduled, tested by restoration and stored separately from the primary system. A backup that has never been tested may not be usable after a failure.

Cloud or network-based systems create additional concerns: service-provider reliability, data location, confidentiality, internet availability and contractual access to records. Management remains responsible for accounting information even when processing is outsourced.

7. Reconciliations and monitoring

A reconciliation compares two independent records and explains differences. Common reconciliations include bank, cash, receivables, payables, inventory and payroll-control accounts.

For a bank reconciliation, the accounting cash balance is compared with the bank statement balance. Differences may arise from deposits in transit, unpresented cheques, bank charges, direct deposits, errors or unauthorized transactions. Each difference should be supported and cleared within a reasonable time.

Monitoring should be planned rather than occasional. Useful management reports include:

• outstanding receivables by age;
• supplier balances and unusual changes;
• inventory adjustments and negative stock;
• cancelled invoices and credit notes;
• cash withdrawals and suspense-account movements;
• budget-to-actual variances;
• user activity and altered vouchers.

A control exception should be assigned to a responsible person, given a deadline and followed up. Repeated exceptions may indicate that the underlying process, training or system design requires change.

8. Errors, fraud and red flags

An error is an unintentional mistake, such as transposing digits, selecting the wrong ledger or omitting an invoice. Fraud is an intentional act involving deception or concealment to obtain an unauthorized benefit or cause a loss. The same incorrect entry may initially appear as either; intent must not be assumed without evidence.

The fraud triangle explains three conditions commonly associated with fraud:

• Pressure: financial difficulty, unrealistic targets or personal obligations.
• Opportunity: weak controls, excessive access or inadequate supervision.
• Rationalization: belief that the organization owes the person, or that the act is temporary or harmless.

A further factor often discussed in practice is capability—the person’s knowledge and position to exploit a weakness. Strong controls reduce opportunity and make detection more likely, but ethical culture and fair management also matter.

Red flags include unexplained lifestyle changes, reluctance to take leave, persistent override of procedures, missing documents, supplier relationships that are not disclosed, repeated round-number entries and unusual pressure to avoid review. Red flags justify careful investigation, not accusation.

When fraud is suspected, preserve records, restrict unauthorized changes, inform the designated supervisor or whistle-blowing channel and avoid destroying or altering evidence. Confidentiality should be maintained, and allegations should be handled fairly. Serious matters may require legal, regulatory or external-audit advice.

9. Audit: purpose, types and process

An audit is a systematic examination of evidence relating to financial information, controls or compliance. An external financial-statement audit provides an opinion based on sufficient appropriate evidence and applicable auditing standards. An internal audit is an independent evaluation designed to improve risk management, control and governance. A compliance audit examines adherence to laws, contracts or policies.

A basic audit process includes:

1. Planning: understand the entity, objectives, systems and risks.
2. Risk assessment: identify areas where material error or fraud may occur.
3. Control evaluation: determine whether controls are suitably designed and operating.
4. Testing: inspect documents, observe procedures, confirm balances, recalculate amounts and analyze data.
5. Evidence evaluation: assess reliability, relevance and sufficiency.
6. Reporting: communicate findings, implications and recommendations.
7. Follow-up: determine whether agreed corrective actions were implemented.

Auditors exercise professional skepticism. This means maintaining an alert mind and critically assessing evidence, especially when information is inconsistent or obtained from an interested party. It does not mean assuming that every employee is dishonest.

10. Ethical accounting practice

Ethics concerns the principles used to decide what ought to be done. Professional accounting conduct commonly rests on five principles:

• Integrity: be honest and straightforward.
• Objectivity: avoid bias, conflicts of interest and undue influence.
• Professional competence and due care: maintain knowledge and perform work carefully.
• Confidentiality: protect information and disclose it only with authority or legal justification.
• Professional behavior: comply with laws and avoid conduct that discredits the profession.

Ethical problems often involve pressure to manipulate profit, conceal liabilities, backdate entries, misuse customer data or approve a transaction involving a relative. A practical response is to identify the facts, relevant rule, affected parties and possible consequences; consult a supervisor or professional adviser; document the reasoning; and refuse participation in misleading reporting.

Confidentiality does not authorize concealment of unlawful conduct. Legal reporting duties, regulatory requirements or professional standards may require disclosure through appropriate channels. Personal devices, messaging applications and cloud storage should not be used for confidential records without authorization and adequate security.

11. Technology, automation and AI

Computerized systems reduce arithmetic and duplication errors but introduce technology risks. Automated posting may process an incorrect rule consistently; imported data may contain duplicates; and an unauthorized user may alter master data quickly. Controls must therefore address both input and automated processing.

Analytics can identify duplicate invoice numbers, unusual transaction times, high-value journals, dormant suppliers receiving payments and abnormal changes in margins. Artificial intelligence may assist classification or anomaly detection, but its output requires human review. AI-generated explanations or classifications can be incomplete, biased or based on incorrect data. Confidential accounting data should not be entered into an external AI service unless the organization has approved the service and assessed privacy and security risks.

Good practice includes maintaining an approval record for automated rules, testing system changes before implementation, restricting interfaces, retaining source data and reviewing exceptions rather than relying blindly on a system score.

12. Illustrative case: Sunrise Traders

Background

Sunrise Traders is a small wholesaler using Tally for sales, purchases, inventory and banking. One accounts clerk creates suppliers, records purchase invoices, prepares payments and performs the bank reconciliation. The owner approves payments by signing a printed list once a month.

Problem

The owner notices three payments to a new supplier. The invoices have consecutive numbers, identical descriptions and round amounts. Inventory records show no corresponding increase. The audit trail shows that the supplier master and invoices were created by the same user on a Sunday. Two vouchers were altered after the monthly payment list was approved.

Analysis

The arrangement has poor segregation of duties: one person controls supplier creation, recording and payment preparation. The warning signs are not conclusive proof of fraud, but they indicate high risk. There is a possible fictitious supplier, unsupported purchases and alteration after approval. The owner’s monthly signature is not an effective review because it occurs after processing and does not demonstrate examination of source evidence.

Approach and solution

Sunrise should preserve the Tally data and original documents, restrict further changes to the relevant supplier and notify the responsible manager or external adviser. The invoices should be matched to purchase orders, goods-received notes, delivery evidence, bank records and supplier confirmation obtained independently. The employee should not be asked to investigate alone.

The redesigned process should require independent approval of new suppliers, separate receipt of goods from invoice recording, dual payment authorization and monthly bank reconciliation by someone other than the payment preparer. User permissions should prevent the clerk from altering approved vouchers, and audit-trail reports should be reviewed for backdated or post-approval changes. If evidence confirms wrongdoing, management should follow applicable employment, legal and reporting procedures.

Outcome and learning points

The case illustrates that software cannot compensate for poorly designed responsibilities. Sequential vouchers, user logs and exception reports help detect risk, but source-document verification and independent review remain necessary. Controls should be preventive, detective and corrective: prevent unauthorized activity, detect exceptions promptly and correct weaknesses so that they do not recur.

Challenges and limitations

Internal control can be expensive for a small organization. Excessive approvals may delay operations, while poorly designed controls encourage employees to bypass them. Segregation may be impossible when only one or two people handle finance. Controls may also become outdated after new software, payment channels or business models are introduced.

Audit provides reasonable, not absolute, assurance. Sampling means that some errors may remain undiscovered. Collusion and management override can defeat apparently strong procedures. Audit trails can also be incomplete if logging is disabled, data are imported incorrectly or users share accounts. These limitations make ethical culture, competent supervision, independent review and continuous improvement essential.

Best-practice implementation checklist

1. Document approval limits and transaction procedures.
2. Map each process from source document to final report.
3. Separate authorization, custody, recording and reconciliation wherever possible.
4. Use individual Tally accounts with least-privilege permissions.
5. Protect administrator access and review user lists regularly.
6. Number vouchers systematically and investigate missing sequences.
7. Attach or retain reliable supporting documents.
8. Reconcile bank, cash, inventory, receivables and payables regularly.
9. Review altered, cancelled, deleted and unusual entries.
10. Test backups by restoring sample data.
11. Train staff in ethics, security and escalation procedures.
12. Record control exceptions and follow corrective actions to completion.

Chapter Summary

Internal control is a continuous system of policies, people and technology that provides reasonable assurance over operations, reporting, compliance and asset protection. Authorization confirms that transactions are approved by appropriate persons, while segregation of duties reduces the ability of one person to commit and conceal an irregularity. Voucher verification connects accounting entries to reliable source evidence, and reconciliations compare independent records.

Tally supports control through user permissions, voucher numbering, audit trails, approval restrictions and reporting, but its effectiveness depends on correct configuration and responsible use. Audit trails help identify altered, deleted, backdated or unusual transactions; they do not replace an audit or prove fraud. Access controls should use unique accounts, least privilege, strong authentication, timely removal of access and tested backups.

Errors are unintentional, whereas fraud involves intentional deception. Fraud risks can be assessed through pressure, opportunity, rationalization and capability, but warning signs require investigation rather than premature accusation. Ethical accounting requires integrity, objectivity, competence, confidentiality and professional behavior. Effective control is therefore not merely a software function: it is a governance practice supported by technology, evidence, independent review and ethical judgment.

Key Terms

Audit: Systematic examination of evidence relating to financial information, controls or compliance.

Audit trail: Chronological record of transactions and changes made in an accounting system.

Authorization: Approval by a person with appropriate authority.

Compensating control: An alternative control used when a preferred control, such as full segregation, is impractical.

Confidentiality: Protection of information from unauthorized disclosure.

Control environment: Leadership, structure, competence and ethical culture supporting control.

Error: An unintentional mistake in processing or reporting.

Exception report: A report identifying transactions or events outside expected conditions.

Fraud: Intentional deception to obtain unauthorized benefit or cause loss.

Integrity: Honesty and straightforwardness in professional conduct.

Least privilege: Providing only the access required for a user’s duties.

Monitoring: Ongoing or periodic evaluation of whether controls operate effectively.

Objectivity: Freedom from bias, conflicts of interest and undue influence.

Reconciliation: Comparison of independent records and explanation of differences.

Reasonable assurance: A high but not absolute level of confidence.

Segregation of duties: Division of authorization, custody, recording and review responsibilities.

Source document: Original evidence supporting an accounting transaction.

Three-way match: Comparison of purchase order, goods-received note and supplier invoice.

Voucher: A record used to support and authorize an accounting entry.

Whistle-blowing: Reporting suspected wrongdoing through an appropriate protected channel.

Review Questions

Short Answer Questions

1. What are the four main objectives of internal control?
2. Define segregation of duties and name four responsibilities commonly separated.
3. What is an audit trail, and why is it useful?
4. State three principles of ethical accounting practice.
5. Why should backups be tested by restoration?

Long Answer Questions

1. Explain the five components of an effective internal-control framework and show how they operate together.
2. Describe a complete procedure for verifying a purchase voucher in a computerized accounting system.
3. Explain how user access controls, audit trails and reconciliations work together to reduce fraud risk.
4. Distinguish internal audit from external financial-statement audit and compliance audit.
5. Discuss the limitations of internal control and explain how a small business can use compensating controls.

Analytical / Application Questions

1. A clerk can create suppliers, enter invoices and prepare electronic payments, while the owner reviews only the monthly bank balance. Identify the control weaknesses and design a practical revised process.
2. An audit-trail report shows several large journals entered late at night and altered after approval. Explain the investigation steps that should be taken without assuming that fraud has occurred.
3. A manager asks an accountant to backdate an expense so that the current year’s profit is lower. Apply the principles of integrity, objectivity, competence, confidentiality and professional behavior to recommend an appropriate response.

Multiple Choice Questions with Answers

Question 1

Which responsibility should normally be separated from recording cash receipts?

A. Preparing a sales quotation

B. Reconciling the bank account

C. Designing a product label

D. Ordering stationery

Correct Answer: B. Reconciling the bank account

Question 2

What is the main purpose of authorization control?

A. To ensure transactions are approved by an appropriate person

B. To guarantee that no transaction will contain an error

C. To eliminate the need for source documents

D. To allow every employee to approve payments

Correct Answer: A. To ensure transactions are approved by an appropriate person

Question 3

Which documents are compared in a three-way match?

A. Bank statement, cashbook and trial balance

B. Payroll register, tax return and payslip

C. Purchase order, goods-received note and supplier invoice

D. Budget, ledger and bank reconciliation

Correct Answer: C. Purchase order, goods-received note and supplier invoice

Question 4

Which statement best describes an audit trail?

A. A list of accounting policies only

B. A chronological record of transactions and system changes

C. A forecast of next year’s revenue

D. A document that replaces independent audit evidence

Correct Answer: B. A chronological record of transactions and system changes

Question 5

What does the principle of least privilege require?

A. All users receive administrator access

B. Users receive only the access needed for their duties

C. Users share one password for convenience

D. Former employees retain access for reference

Correct Answer: B. Users receive only the access needed for their duties

Question 6

Which situation is an example of an error rather than established fraud?

A. A deliberate fictitious supplier created to divert payment

B. Intentional concealment of a personal expense

C. An accidental transposition of two digits in an invoice amount

D. A planned alteration of records to mislead an auditor

Correct Answer: C. An accidental transposition of two digits in an invoice amount

Question 7

Which action is most appropriate when a suspicious voucher is identified?

A. Delete it immediately

B. Ignore it until year-end

C. Preserve evidence and investigate through an appropriate channel

D. Accuse the preparer publicly

Correct Answer: C. Preserve evidence and investigate through an appropriate channel

Question 8

Which ethical principle requires freedom from bias and conflicts of interest?

A. Objectivity

B. Confidentiality

C. Custody

D. Authorization

Correct Answer: A. Objectivity

Question 9

Why is a bank reconciliation an important control?

A. It guarantees that all sales are genuine

B. It compares independent records and explains differences

C. It gives every employee payment authority

D. It removes the need for bank statements

Correct Answer: B. It compares independent records and explains differences

Question 10

Which is a limitation of internal control?

A. Controls can never be documented

B. Controls provide absolute assurance against all fraud

C. Collusion or management override may defeat controls

D. Controls are useful only in manual systems

Correct Answer: C. Collusion or management override may defeat controls