Thesis submitted in fulfilment of the requirements for the degree Master of Technology: Internal Auditing in the Faculty of Business and Management Sciences at the Cape Peninsula University of Technology / South African Small, Medium and Micro Enterprises (SMMEs) play an important role in the stimulation of the national economy. However, according to previous research studies, these business entities have one of the worst sustainability rates in the world as approximately 80% of South African SMMEs tend to fail after being in operation for only three years. Taking the weak sustainability rate of these business entities into account, further studies suggest that South African SMMEs operate in a harsh economic environment, which, in turn, creates a breeding ground for risks to realise in, including that of occupational fraud risk. According to scholarly literature, the occurrence of occupational fraud risk is believed to stem from the utilisation of inadequate and/or ineffective internal control activities – South African SMMEs, in general, are believed to make use of inadequate and/or ineffective internal control activities. For this research study, focus was placed on investigating the effectiveness of internal control activities used within South African fast-moving consumer goods (FMCG) SMMEs to combat occupational fraud risk. This was achieved by conducting a literature review (see Chapter 2) to assist in the development of a survey to, in turn, conduct empirical research by collecting quantitative data from respondents (see Chapter 3). All relevant quantitative data gleaned were analysed using both descriptive statistics and inferential statistics (see Chapter 4). Based on the analysed data, it was found that although implemented internal control activities in sampled South African FMCG SMMEs were customised, a few internal control activities assisted in the combating of occupational fraud risk while the bulk of internal control activities did not assist in combating occupational fraud risk. Stemming from the study conducted, the inference was made that the occurrence (realisation) of occupational fraud risk may be exacerbated by the implemented internal control activities in South African FMCG SMMEs due to their ineffectiveness.

The Sarbanes-Oxley Act mandates public companies to establish internal control systems and assess their effectiveness. Quarterly reports by all companies and annual reports by companies with less than $75 million public float (non-accelerated filers) do not require auditor’s attestation while annual reports by companies with $75 million or more public float (accelerated filers) do require such auditor attestations. Quarterly reports should provide early warning of any impending material weakness (MW) to be disclosed in subsequent annual filings. This dissertation explores three types of “surprise” MW disclosures—positive, negative and no surprise—and consequences of such surprise disclosures. In part one, I document the frequency of surprise MW disclosures and internal control factors that are associated with each surprise type by filer status. Results show that 78 (77) percent of accelerated (non-accelerated) MW disclosures are negative surprise MW disclosures during 2004-2016. Entity level MWs are more associated with no-surprise rather than negative or positive surprise MW disclosures. In part two, I examine some consequences of surprise MW disclosures. The results show that companies with MW disclosures are more likely to dismiss their auditors and CFOs, and experience more shareholder voting against auditor ratification, compared to companies that issue clean reports. Auditor dismissal and CFO turnover are equally likely at negative and no-surprise MW disclosure companies. However, negative surprise accelerated filer companies’ shareholders are more likely to vote against auditor ratification than no-surprise accelerated filer companies. The third essay investigates the association between MW disclosures and audit fees. The results indicate that there is a significant positive association between audit fees and MW disclosures. Further, the results show that audit fees are higher at no-surprise companies than at negative surprise companies. The fourth essay focuses on audit report lag. The results indicate that MWs are associated with increased audit report lags, for both accelerated and non-accelerated filers. Further, surprise MW firms are more likely to experience increased audit report lag than no-surprise MW firms. Overall the results suggest that adverse internal control reports have consequences, and that the consequences vary between surprise and no-surprise MW firms. The results provide relevant empirical evidence to the ongoing debate on the necessity and efficacy of SOX Section 404 requirements.

Det oundvikliga beroendet av digitalisering och IT-system i dagens verksamheter och organisationer ställer krav på dagens arbetskraft att öka sina IT-kunskaper för att kunna integrera och kommunicera med nya datasystem för en mer effektiv verksamhet. Inte minst lika viktigt blir det för redovisningsekonomer som sköter verksamhetens finansiella redovisning då de måste kunna säkerställa att den redovisningsdata som framställs och levereras med hjälp av IT är felfri och uppnår kvalitet. Bristen på kunskap inom IT kan riskera att fel i redovisningsdata inte upptäcks och därmed påverkar redovisningsdatakvalitet. Detta i sin tur riskerar påverka redovisningskvalitet i den slutliga finansiella rapporteringen. Kommunikationen mellan avdelningarna riskerar också bli lidande då de med olika kunskaper har svårt att förstå varandra.Studiens syfte är att försöka bidra med kunskap om hur kunskapsskillnader i digital gundkunskap kan påverka säkerställandet av redovisningsdatakvalitet samt ge insyn i hur arbetet med detta kan gå till i praktiken. Med hjälp av tidigare forskning togs en analysmodell fram som illustrerar identifierade faktorers påverkansordning av redovisningsdatakvalitet; kunskapsskillnader → intern kontroll → redovisningsdatakvalitet.Studien tillämpar en instrumentell fallstudiedesign med en kvalitativ forskningsansats för att besvara frågeställningen. Två fokusgruppsintervjuer utfördes vid två olika tillfällen med respondenter från redovisningsavdelningen och IT-avdelningen från samma företag. Data transkriberades och kodades med hjälp av färgkodning för att tydliggöra de faktorer som utgör utgångspunkten i analysmodellen. En enkätundersökning genomfördes på resterande anställda på respektive avdelning för att komplettera resultaten från intervjuerna.Resultatet av studien visade att kunskapsskillnaderna har liten eller ingen alls direkt påverkan på redovisningsdatakvalitet utan snarare påverkar den interna kontrollen desto mer utifrån externa faktorer som tillkom. / The inevitable dependence on digitization and IT systems in today's operations and organizations demands the current workforce to increase their IT skills in order to be able to integrate and communicate with new computer systems for a more efficient business. It is equally important for financial accountants who’s responsible for the business’s financial reporting, since they must be able to ensure that the accounting data produced and delivered using IT is correct and of high quality. The lack of IT skills can increase the risk of errors in accounting data not detected and thus further affect the accounting data quality. This in turn risks affecting the accounting quality in the final financial reporting. The communication between the departments could also suffer due to the knowledge gaps between them that could make it difficult to understand each other.The aim of the study is to contribute with knowledge about how the differences in knowledge can affect the work in ensuring accounting data quality and give insight into how this work can be realized in practice. With the help of previous research, an analysis model was developed that illustrates identified factors and their influence on accounting data quality; knowledge gaps → internal control → accounting data quality.The study applies an instrumental case study with a qualitative research approach. Two focus group interviews were conducted on two different occasions with respondents from the accounting department and the IT department, both from the same company. Data was transcribed and coded using color coding to clarify the factors that form the basis of the analysis model. A survey was conducted with the other employees to complement and confirm the results found from the interviews.The result of the study showed that the differences in knowledge have little or no direct impact on accounting data quality, but rather affect the internal control, based on external factors that came into light during the analysis of the result. A revised analysis model was developed based on the result and replaced the initial hypothetical model.

每月公告營收額實施由來已久，過去文獻之研究，其實證結果大多具有資訊內涵，惟該資訊之允當性如何及其與會計師簽證數之差異如何均未曾加以探討。本研究之目的乃在探討公告營收額與會計師簽證數間之差異狀況，並試圖尋求解釋該差異之因素與解釋模型。 　　本研究主要分為二部份：一為目前差異情形之分析，一為假說之檢定。文中以代理理論為基礎，導出董監事持股比例、經理人持股比例、長期負債權益比、總資產金額、已上市年度數、以及簽證方式等六個代理變數，並加入產業變數進行分析，以尋求最佳之解釋模型。 　　研究結果顯示：（一）敘述性統計顯示實施查核程序之調整金額常高於執行核閱程序之調整金額，在調整金額之方向則調低營收額之次數高於調高營收額之次數，而調整門檻粗略估計約為10萬元左右，調整金額之百分比大多在簽證數之20%以下。（二）迴歸分析實證結果得知：(1)董監事持股比例與差異數有顯著關係，但董監事持股比例愈高，差異數愈小。(2)經理人持股比例與差異數幾乎無關，其原因可能為經理人持股普遍太低，操縱營收額可能對其持有或出售公司股票獲利之誘因不大，也可能是因為營收額之允當與否，代表經理人是否盡了代理人之職責，若有太大差異可能會影響其報酬。(3)長期負債權益比與差異數幾乎無關，其原因可能為債務合約關注之重點為淨利、流動比率、利息保障倍數、抵押品等因素，而對營收額之允當性可能沒有規定或監督。(4)公司總資產額愈大，差異數愈大，此與假說相反，其原因可能為公司愈大，其業務較為複雜，以致產生差異之機率增高，再者公司設置監控系統之成本在目前國內證管會之要求下已固定，且其成本於上市公司並非重大，以致考慮成本效益之情形大為降低。(5)公司上市愈久，差異數愈小，此與假說相符，換言之，公司之內部控制愈好，差異愈小。(6)簽證方式不同，差異數不同，查核之差異高於核閱之差異，此與假說相符。

本研究以力霸集團為個案研究對象，從決策及資源分配掌控者觀點定義該集團企業之最終控制者，首先分析力霸集團企業之董監結構及股權結構，並針對該集團之公司治理機制說明對內部控制議題及財務舞弊之影響。 研究結果顯示，力霸集團企業之最終控制者王又曾家族係透過交叉持股及掌握董事會席次控制權等控制途徑掌控集團企業，其集團內七家公開發行以上公司的平均直接持股率、股份控制權、盈餘分配權分別為7.72%、28.92%、6.81%，但平均席次控制權則高達95.33%，股份控制權（席次控制權）與盈餘分配權偏離差之平均值則達22.11%（88.52%）。力霸集團企業席次控制權與盈餘分配權嚴重偏離之個案研究發現，符合經營者之經營誘因不足，而財富侵佔動機較強之學術假設。此外，該集團企業亦嚴重違反內部控制制度中控制環境、風險評估、控制作業、資訊與溝通，以及監督機制等主要原則，造成投資人權益的重大損失。最後，本研究針對內部控制制度之有效性、公司治理機制、會計師責任，以及金融監理功能四層面，提出討論及建議。 / Using the Rebar Business Group as the case of this study, the present research first analyzes the ownership structures of the member firms from an ultimate controller perspective. Internal control related issues are then identified, followed by a discussion on the effect of corporate governance on internal control weakness and fraudulent reporting. The analysis indicates that cross-holding, pyramid structure and seat control over the board members are venues utilized by the Wang Family to actively control Rebar Business Group. An analysis on the measurement of voting right, cash flow right and board seat-control shows that direct shareholding, voting rights, cash flow rights are on average 7.72%, 28.92%, 6.81%, while the board seat-control ratio is 95.33%. The deviation between voting right (board seat-control) and cash flow rights is 22.11% (88.52%). To the extent that ownership and control is highly deviated, a weaker disciplinary effect and a stronger entrenchment effect can be expected. In addition, this research also finds that all principles buttressed in building a sound internal control system are violated. Finally, suggestions for improvements on internal control system and policies are provided.

本研究旨在探討沙氏法302條款（Sarbanes-Oxley Act Section 302，以下簡稱SOX302）、沙氏法404條款（Sarbanes-Oxley Act Section 404，以下簡稱SOX404）與管理當局盈餘預測之關聯性，係美國S&P500之公司為研究對象，研究期間為2002年至2009年，主要檢測：(1)相對於SOX 404而言，在SOX 302規範下揭露無內部控制缺失之公司，其管理當局盈餘預測準確度是否會較低。(2)在SOX 404之規範下揭露有內部控制缺失之公司，公司層級的內部控制缺失相較於會計層級的內部控制缺失，是否會導致管理當局盈餘預測準確度較低。 本研究之實證結果顯示：(1)在無內部控制缺失情況下，相對於SOX 404而言，在SOX 302規範下，管理當局盈餘預測準確度會較低。(2)在SOX 404之規範下揭露有內部控制缺失之公司，公司層級的內部控制缺失相較於會計層級的內部控制缺失，會導致管理當局盈餘預測準確度較低。 / The main purpose of this thesis is to investigate the relation among SOX302, SOX404 and the accuracy of management earnings forecasts. Using a sample of S&P listed companies during the period 2002-2009, I address the following issues: (1) whether companies with effective internal controls under SOX302 have lower earnings forecast accuracy, compared with those under SOX404; (2) in the SOX404 context, whether companies with firm-level material weaknesses have lower earnings forecasts accuracy, compared with those with account-specific material weaknesses. As predicted, my empirical results show that: (1) compared with those under SOX404, companies with effective internal controls under SOX302 have lower earnings forecasts accuracy; (2) compared with those that disclosed account-specific material weaknesses under SOX404, the companies with firm-level material weaknesses have lower earnings forecasts accuracy.

本研究以2004至2010年國內之上市公司為研究樣本，探討內部控制缺失對公司經營績效之影響。對於內部控制缺失之判斷，不同於以往，僅限以公司自行揭露或遭主管機關裁罰之資訊為對象，本研究廣泛蒐集公司負面新聞，將內部控制缺失依事件發生原因分類，並依照COSO報告架構將內部控制缺失依五大要素及五大目標予以分類。 實證研究結果顯示，內部控制缺失與企業經營績效間呈顯著負相關，重大之內部控制缺失對經營績效影響之程度較大。依發生原因分類內部控制缺失之分析結果顯示，違反金管會規定、管理階層操守與價值觀有偏差及發生會計錯誤而重編財報之公司，其經營績效較差。至於內部控制缺失涉及內部控制要素及控制目標者，分析顯示，各項缺失要素及目標皆與經營績效呈顯著負向關係，且缺失要素及缺失目標較多之公司，其經營績效較差。其中，控制環境、風險評估與監督三項控制要素缺失，以及財務報導目標缺失對經營績效有較顯著之負向影響。 / Based on a sample of 724 Taiwanese companies listed in Taiwan Securities Exchange over the period of 2004-2010, this research investigates the impact of internal control weaknesses on firm performance. Different from prior studies that identified internal control weaknesses only from voluntary disclosures made by the firm and releases regarding firm’s violation of regulations issued by the Finanical Supervisory Commission, Executive Yuan, ROC (FSC). This study extensively collects news related to events resulting from internal control weaknesses as an additional data source. A further classification of internal control weaknesses is performed based on the nature of the events and the internal control framework proposed in the COSO report. The empirical results indicate that firms with internal control weaknesses are significantly underperformed. It is also found that material weaknesses have greater impact on firm performance. The results show that firms associated with FSC regulation violation releases, the integrity and ethical values of management is biased, and had restated financial statements accounting errors have significantly lower performance. The internal control weaknesses classified by the elements and objectives of internal control based on the COSO framework, are found to be significantly and negatively related to the firm performance respectively and collectively. In specific, the weaknesses associated with control environment, risk assessment, monitoring, and financial reporting objective have greater impact on firm performance.

首先針對目前國內產物保險公司有關作業險管理尚未有完整之監理規範或管理實務，但是，因作業風險所導致之損失金額卻與日俱增，實為不可忽視之風險，故藉由探討產物保險公司建構作業風險管理機制，同時分析其中理論與實務之運作，盼能有助於國內產物保險公司在未來不論是主管機關的監理制度，或是與全世界風險管理趨勢的結合上，提供具有參考性之建議及方向作為研究的目的設定。 本研究透過文獻回顧及探討，對於國內外金融機構作業風險管理執行情況，可知作業風險管理與內部控制之關係應是互補的概念，不能單以內部控制取代作業風險控管，而唯有作業風險與內部控制相互充實，才能更能提昇作業風險管理之功能及能力。另對於產物保險相關之作業風險損失事件之收集彙整，瞭解作業風險損失可能產生重大的財務損失，或是影響公司之正常業務營運，由於作業風險與產險公司日常營運活動息息相關，且作業風險管理並非一全新之風險管理觀念，面對產險市場瞬息萬變，主管機關監理強度趨於嚴格，包括頒布保險業之風險管理實務守則，內容規範即可看出作業風險以結構化之管理，已成為潮流。如何透過管理流程，及輔以各項管理工具，與現行之內控、法令遵循等機制加以整合，將過去的被動轉換為主動的管理，不論是發生頻率低、損失幅度高的事件，或是發生頻率高、損失幅度低的事件，皆應平等重視。 個案研究則以作業風險管理之理論為基礎，逐一探討研究之標竿保險公司作業風險管理執行情形，可以得到下列四個結論：(一)落實風險管理之企業文化是關鍵成功因素、（二）作業風險管理專責單位或人員的建立應是有必要性、（三）建立完整之作業風險管理架構、（四）作業風險管理與內部控制制度是互補的、（五）無缺失不代表無風險。本研究最後提出以下建議：（一）師法目前Basel II銀行之作業風險管理經驗、（二）積極專業人才培訓是作業風險管理之成功要件、 (三)保險業者應儘速建立內、外部損失資料庫、(四)應設置隸屬董事會之風險管理委員會、(五)法令遵循自行評估之調整。以作為未來台灣產險業如何建制作業風險管理機制及有效控管作業風險之參考。 / Despite of the increasing exposure and loss due to operational risk to Taiwanese Non-Life insurance companies, an intergrated coorporate self-regulation or practical guidelines for operational risk management within financial institutions have not yet been developed. Therefore, through seriously study, discuss, and analyze the mechnisms on how to implement a thorough corporate operational risk management guidelines and a balanced operational point between theory and practice, I hope that this paper could give our local non-life financial institutes, regulators, and compliances some aspects on the regulatory governence development. Numerous articles and literature reviews on foreign and domestic businsses and financial institutions regarding operational risk management operations stated that interal control and operational risk management have substitutional effect. Therefore, only if both interal control and operational risk management simutaneously develop, will operational risk management’s functionality and ability be most effective. Massive information on opertaional risk loss event have been collected and compiled to study its impact to Non-life insurance companies, including the loss it may bring to the financial institution or the effect on daily business operation. Driven by legal changes and forever-changing business market, the local goverment have becoming tougher on regulatory governance, including promulgate the code of practice for operational risk management guildance, which we would see that structured operation risk management is the newfound trend. The intergration of current compliance, internal control and other mechanisms through management process in order for operational risk management corresponds to a much wider trend of “responsive” or “active”, not “passive” management is what we ought to act on. Also, we should treat low-frequency, high-magnitude events and high-frequency, how-magnitude events equally. This paper came up with five conclusions 1. implementing the enterprise culture of operational risk management is the key to success. 2. developing operational risk management response team is an ought to do 3. implementing thorough operational risk management structure 4. substitutional effect among operational risk management and internal control system 5. no merit does not mean no risk. At last, this conceptual paper gives some recommendations for future operational risk management development 1. take operational risk management experiences by Basel II as a model 2. cultivate ORM professionals actively is the key to success 3. develop internal and external risk loss database 4. The risk management committee should be subordinate to the board of director 5. adjustment of compliance’s interal accessment.

<p><strong>Problem: </strong>Vilka åtgärder använder sig små företag inom kontantbranschen av för att förhindra och upptäcka bedrägerier? Hur ser företagen och revisorerna på ansvaret för att upptäcka bedrägerier utförda av anställda och skiljer sig företagens förväntningar från revisorns skyldigheter?</p><p><strong>Syfte: </strong>Syftet med uppsatsen är att undersöka hur små företag arbetar för att förhindra och upptäcka bedrägerier. Syftet är även att studera om det finns ett förväntningsgap mellan företagsledningen och revisorerna gällande ansvaret att upptäcka interna bedrägerier utförda av personal.                                                                                            </p><p><strong>Metod: </strong>Denna rapport grundar sig på av en litteratur- och en empiristudie.  Empiristudien genomfördes med hjälp av totalt sju intervjuer, fyra med företag inom kontantbranschen samt tre revisorer. Även kompletteringsfrågor skickades till tre av respondenterna. Litteraturstudien består av böcker och artiklar som erhölls från databaser och biblioteket på Mälardalens högskola samt Västerås stadsbibliotek. <strong> </strong></p><p><strong>Slutsats: </strong>Intern kontrollsystemen är en av de viktigaste förebyggande åtgärderna mot bedrägeri. Samtliga företag i studien använder sig av någon form av kontroll för att upptäcka och förebygga bedrägerier utförda av anställda. Ofta används avstämningar av inköp, lager och försäljning samt rutiner för rättelser och returer, men den vanligaste kontrollen bland företagen utgjordes av företagsledarens aktiva roll i verksamheten. Företagsrespondenterna var överens om att det inte är revisorns skyldighet att upptäcka bedrägerier utförda av anställda, utan de ansåg att ansvaret att upptäcka dessa brott ligger på företaget. Denna studie visar att det inte finns ett förväntningsgap mellan företags- och revisorsrespondenterna angående ansvaret att upptäcka interna bedrägerier.</p> / <p><strong>Research </strong><strong>issue: </strong>What measures against fraud does small businesses in the cash  industry use to discover and prevent frauds?<strong> </strong>How<strong> </strong>do the businesses and the auditors look at the responsibility to discover frauds performed by employees and are there any differences between the businesses expectations and the auditors’ obligations?</p><p><strong>Purpose: </strong>The purpose with this thesis is to examine how small businesses are working to prevent and detect frauds. The purpose is also to examine if there is an expectation gap between managers and auditors regarding the responsibility to detect internal frauds preformed by employees.</p><p><strong>Method: </strong>One literature and one empirical study were made. The empirical data collection was carried out by means of seven interviews, four of them with companies within the cash industry and three of them with auditors. Complementary questions were sent to three of the respondents. The literature consists of books and articles. They were found in databases, the library at Mälardalen University and Västerås Municipal library. <strong> </strong></p><p><strong>Conclusion: </strong>Internal control systems are one of the most important preventive measures against fraud. The businesses in this study are using some kinds of controls to detect and prevent frauds performed by employees. Often tuning of purchase, storage and sales and routines for corrections and returns are used but the most common control among the businesses consisted of the managers’ active role in the operation. All the business respondents believe that it is not the auditors’ responsibility to detect fraud performed by employees but rather believed that the responsibility to detect these kinds of crimes lies with the company. This study shows that there is no existing expectation gap between the business respondents and the auditor respondents regarding the responsibility of detecting internal fraud.</p>

<p>The accounting scandals that have attracted attention in recent years have led to internal control becoming a more central part of business activity. Doubts about what firms actually do have increased, all caused by the attention of accounting scandals. To counter this, frameworks and laws evolved and gained a significant role in the organization and its surroundings. The aim of the present study is to find out how four companies in the Kristianstad region are working to ensure its internal control and how they work to minimize risk and reduce uncertainty. We have used a qualitative method and interviewed a person in a senior position in each company. In the theoretical frame of reference, we have used two models; the COSO-method and the components of it and the Swedish Code of Corporate Governance. Together, these two give us a good overall picture of internal control and corporate governance. The critical voices raised against the internal control and corporate governance are also represented, mainly by Michael Power. The results of this study are that companies ensure their internal control by maintaining good communication. Competence is a key word, and cooperation between a company's auditors is essential. Risks are minimized primarily by constantly monitoring and updating systems and processes.<strong></strong></p> / <p>De redovisningsskandaler som uppmärksammats senare år har lett till att intern kontroll blivit en alltmer central del av företagens verksamhet. Osäkerheten kring vad företag egentligen gör har ökat i takt med att skandalerna uppmärksammats. För att motverka detta har ramverk och lagar utvecklats och fått en alltmer betydande roll i organisationerna och för dess omgivningar.</p><p>Vi har valt att studera hur fyra företag i Kristianstad kommun arbetar med att säkerställa sin interna kontroll samt hur de arbetar med att minimera risker och därmed minska osäkerheten. Vi har använt oss av en kvalitativ metod och intervjuat en person i ledande ställning på vart och ett av företagen.</p><p>I den teoretiska referensramen har vi använt oss av två modeller, dessa är COSO-modellen och de komponenter som ingår i den samt svensk kod för bolagsstyrning. Tillsammans ger dessa två en bra helhetsbild över intern kontroll och bolagsstyrning. De kritiska rösterna som höjts mot intern kontroll och bolagsstyrning finns också representerade och då främst av Michael Power.</p><p>Resultatet av vår undersökning är att företag säkerställer sin interna kontroll genom att upprätthålla en god kommunikation. Att rätt kompetens finns på rätt plats, samt att det finns ett samarbete med företagets revisorer. Risker minimeras främst genom att ständigt kontrollera och uppdatera system och processer.</p>