CIMA'S Official Learning System

cima CIMA'S Official Learning System Strategic Level Paul M. Collier Sam Agyei-Ampomah ELSEVIER AMSTERDAM BOSTON HEIDELBERG LONDON NEW YORK OXFORD PARIS SAN DIEGO SAN FRANCISCO SINGAPORE SYDNEY TOKYO

Contents The CIMA Learning System Acknowledgements How to use the CIMA Learning System Guide to the Icons used within this Text Study technique Management Accounting - Risk and Control Strategy Syllabus xv xv xv xvi xvii xx 1 Introduction to Risk and Control 1 Learning Outcomes 3 1.1 Introduction 3 1.2 The emergence of risk, governance and control 3 1.3 What is corporate governance?, 4 1.4 What is risk management? 5 1.5 What is internal control? 6 1.6 What is audit?.6 1.7 A model of governance, risk and control 7 1.8 Fraud, information systems and financial risk 7 1.9 Summary 7 2 Management Control Theory 9 Learning Outcomes 11 2.1 Introduction 11 2.2 Organisation theory 11 2.3 Systems theory 11 2.4 Environmental change 12 2.5 Open and closed systems 12 2.6 Organisational control 13 2.6.1 Target-setting 13 2.6.2 Operations 13 2.6.3 Control 14 2.7 Corrective action 14 2.7.1 Feedback 14 2.7.2 Feedforward 15 2.7.3 Standards for control 15 2.8 Management control 15 2.8.1 Anthony's theory of control 16 2.8.2 Otley and Berry's model of control 17 2.8.3 Simon's strategy, control and learning 18 2.9 The example of low cost airlines 19 in

iv MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY h2 2.10 Organisational structure 19 ^ 2.10.1 Functional structure 20 Q 2.10.2 Divisionalised structure 20 u 2.10.3 Matrix structures 21 2.10.4 Network structures 21 2.11 Responsibility centres 21 2.11.1 Divisional performance management 22 2.11.2 Controllability 22 2.12 Shareholder value and value-based management 22 2.13 Alternative perspectives on management control 23 2.13.1 The economic-rational perspective 24 2.13.2 Natural and non-rational perspectives 24 2.13.3 The interpretive perspective and socially constructed reality 25 2.13.4 Radical or critical perspective 25 2.13.5 Pluralist approaches to alternative perspectives 26 2.14 Alternative perspectives applied to CIMA students 26 2.15 Summary 27 Revision Questions 31 Solutions to Revision Questions 35 3 Accounting Control and Behavioural Consequences 3.1 3.2 3.3 3.4 3.5 3.6 Learning Outcomes Introduction Accounting controls 3.2.1 Standard costing 3.2.2 Capital investment appraisal 3.2.3 Overhead allocation 3.2.4 Transfer pricing 3.2.5 Budgeting 3.2.6 Beyond Budgeting 3.2.7 Budgetary control and variance analysis New manufacturing methods and the management accounting response 3.3.1 Just in Time 3.3.2 Total Quality Management 3.3.3 Cost of quality Emerging management accounting techniques 3.4.1 Strategic management accounting 3.4.2 Life cycle costing 3.4.3 Target costing 3.4.4 Kaizen Lean management accounting 3.5.1 The impact of changes in business practices on accounting controls Non-financial performance measurement 39 41 41 42 42 42 43 44 45 46 47 48 48 49 49 50 50 51 51 52 52 53 54

MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY 3.7 Consequences of accounting control and dysfunctional behaviour 55 3.7.1 Dysfunctional consequences of budgeting 56 3.7.2 Dysfunctional consequences of non-financial performance measures 57 3.8 The example of TNA 57 3.9 Summary 59 Revision Questions 63 Solutions to Revision Questions 67 n O z Corporate Governance and the Audit Committee 71 Learning Outcomes 73 4.1 Introduction 73 4.2 Models of corporate governance 73 4.3 Governance, risk management and internal control 7'4 4.4 Historical perspective 74 4.5 Corporate governance developments in the UK 75 4.5.1 Review of the Combined Code 76 4.6 International developments 77 4.6.1 The United States 77 4.6.2 South Africa 78 4.6.3 Other international developments 78 4.6.4 Basel Committee 79 4.7 Corporate governance 79 4.8 Principles of corporate governance 80 4.8.1 Directors 80 4.8.2 Remuneration 81 4.8.3 Accountability and audit 81 4.8.4 Relations with shareholders 81 4.8.5 Institutional shareholders 81 4.8.6 Disclosure 81 4.9 Board effectiveness 82 4.9.1 Roles of Chairman and Chief Executive 83 4.9.2 Non-executive directors 83 4.9.3 Remuneration committee 84 4.9.4 Nomination committee 84 4.10 Audit committees and the Combined Code 85 4.11 Smith Guidance 86 4.12 Review of Turnbull Guidance 87 4.13 Role of audit committee 87 4.13.1 Audit committees and internal control 88 4.13.2 Audit committees and the external auditor 89 4.14 Reviewing the effectiveness of internal control 90 4.14.1 Board responsibility 90 4.14.2 Board annual assessment 91 4.14.3 Checklist for Audit Committee's Assessment of Internal Control 92

vi MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY h2 4.15 Benefits of good corporate governance 93 j±! 4.16 Enterprise governance 93 O 4.17 Summary 94 Revision Questions 99 Solutions to Revision Questions 101 5 Risk and Risk Management 105 Learning Outcomes 107 5.1 Introduction 107 5.2 Risk 107 5.3 Types of risk 108 5.3.1 Business or operational risk 109 5.3.2 Financial risk. 109 5.3.3 Environmental risk 109 5.3.4 Reputation risk 109 5.4 International risk 110 5.4.1 Economic risk 110 5.4.2 Political risk, 110 5.5 Threat, uncertainty and opportunity 111 5.5.1 Risk as hazard or threat 111 5.5.2 Risk as uncertainty 111 5.5.3 Risk as opportunity 111 5.5.4 Risk:.from threat to opportunity 111 5.6 Drivers of value and risk 112 5.7 A wider view of risk 113 5.7.1 Managers and risk 114 5.7.2 Risk and organisational culture 114 5.7.3 Risk and national culture 115 5.7.4 Risk and society 115 5.8 Implications for risk management 116 5.8.1 Risk appetite 117 5.8.2 Risk culture 117 5.8.3 Risk thermostat 117 5.9 Risk management 118 5.9.1 Enterprise risk management 119 5.9.2 Risk management and shareholder value 120 5.9.3 Risk management in the public sector 121 5.10 Benefits of risk management 121 5.11 Risk management strategy 122 5.11.1 Risk management roles and responsibilities 122 5.11.2 Risk management cycle 122 5.12 Risk management process 123 5.13 An approach to managing risk 124 5.14 Risk assessment 124 5.14.1 Risk identification 125 5.14.2 Methods of identifying risk 125 5.14.3 Risk description 125

MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY vii 5.14.4 Risk estimation 5.14.5 Methods of estimating risk 5.14.6 Critique of methods 5.14.7 Risk mapping: the likelihood/consequences matrix 5.14.8 The Risk Register 5.14.9 Risk evaluation 5.15 Risk reporting 5.16 Risk treatment (or risk response) 5.16.1 Risk mapping and risk response 5.16.2 Portfolio 5.16.3 Insurance 5.16.4 Derivatives and hedging 5.16.5 Disclosure 5.17 Residual risk reporting 5.18 Summary Appendix A: The case of Northen Rock a failure of risk management Appendix B: How risks are reported in annual reports: Three international examples Revision Questions Solutions to Revision Questions Internal Control Learning Outcomes 6.1 Introduction 6.2 Internal control 6.3 Internal control system 6.4 COSO model of internal control 6.5 Internal control and the Combined Code 6.5.1 Internal control and Sarbanes-Oxley 6.6 Role of the board in relation to internal control 6.7 Classification of controls 6.7.1 Financial controls 6.7.2 Non-financial quantitative controls 6.7.3 Non-financial qualitative controls 6.8 The changing role of management accountants 6.9 Accounting controls 6.9.1 Cash 6.9.2 Debtors 6.9.3 Inventory 6.9.4 Investments and intangibles 6.9.5 Fixed assets 6.9.6 Creditors 6.9.7 Loans 6.9.8 Income and expenses 6.9.9 Payroll controls 6.9.10 Personnel-related expenses 125 125 128 128 130 131 131 131 132 134 134 134 135 135 136 139 141 145 151 161 163 163 163 164 165 166 167 167 169 170 170 171 173 175 175 175 176 176 176 177 177 177 177 178 n O m z

viii MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY 6.10 H 6.11 6.12 u Limitations of internal control Cost-benefit of internal control Summary Revision Questions Solutions to Revision Questions 178 178 179 181 183 7 Internal Audit and the Auditing Process 7.1 7.2 7.3 7.4 7.5 7.6 7.7 7.8 7.9 7.10 7.11 7.12 7.13 7.14 7.15 7.16 7.17 7.18 7.19 7.20 7.21 7.22 7.23 7.24 7.25 7.26 Learning Outcomes Introduction Audit Types of audit Internal auditing Need for internal audit Scope of internal audit Head of internal audit Systems-based auditing Risk-based internal auditing Internal audit and enterprise-wide risk management Different types of risk in auditing Risk assessment in auditing 7.12.1 Intuitive or judgemental risk assessment 7.12.2 Risk assessment matrix 7.12.3 Risk ranking Risk management in auditing Audit planning Audit testing and statistical sampling Analytic review 7.16.1 Ratio analysis 7.16.2 Benchmarking Other methods of internal audit Internal control questionnaires Evaluation of audit findings Audit working papers Internal audit reporting Professional ethics 7.22.1 Fundamental principles 7.22.2 Conceptual framework Resolution of ethical conflicts Case study: Ethics and CIMA The effectiveness of internal audit Summary Appendix: Risk, control and internal audit: A case study of ABC Revision Questions 187 189 189 189 190 192 194 195 195 196 196 198 199 199 199 200 201 201 201, 202 204 204 205 205 206 206 207 207 208 208 209 209 210 211 213 217 Solutions to Revision Questions 223 221

MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY ix 8 Information Systems and Systems Development 227 8 Learning Outcomes 229 p^j 8.1 Introduction 229 5 8.2 Information and information systems 229 8.3 Information strategies 230 8.3.1 Information systems strategy 230 8.3.2 Information technology strategy 230 8.3.3 Information management strategy 230 8.3.4 Linking information strategies 230 8.4 Cost-benefit of information 231 8.5 Methods of data collection 231 8.6 Methods of presenting management information 232 8.6.1 Periodic reports 232 8.6.2 Briefing book 233 8.7 Types of IS 233 8.7.1 Transaction processing systems 233 8.7.2 Management information systems 233 8.7.3 Enterprise resource planning system 234 8.7.4 Strategic enterprise management 234 8.7.5 Decision support systems 234 8.7.6 Executive information systems 234 8.7.7 Expert systems 235 8.8 Information and the web 235 8.8.1 Internet, 235 8.8.2 Intranets and extranets 235 8.8.3 E-commerce 236 8.9 IS outsourcing and facilities management 236 8.9.1 IT and shared services centres 237 8.10 IS development 237 8.11 Systems design and approval 238 8.12 Systems development controls 238 8.13 Systems development auditing 240 8.14 Systems implementation 241 8.15 Post-implementation review 241 8.16 IT structure and support services 241 8.17 Information Technology Infrastructure Library 242 8.18 Summary 243 Revision Questions 245 Solutions to Revision Questions 247 9 Information Systems Control and Auditing 253 Learning Outcomes 255 9.1 Introduction 255 9.2 Information security 255 9.3 Internal controls in an IT environment 256 9.3.1 CobiT 256 9.3.2 SAC and esac 258

x MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY 9.3.3 Comparing the models 258 \±d 9.3.4 IT control objectives 259 O 9.4 Control strategies and classifications 260 u 9.5 General controls 260 9.5.1 Personnel controls 260 9.5.2 Logical access controls 261 9.5.3 Facility controls 261 9.5.4 Business continuity 261 9.6 Application controls 262 9.6.1 Input controls 262 9.6.2 Processing controls 263 9.6.3 Output controls 263 9.7 Software control and software piracy 263 9.8 Network controls 264 9.8.1 Firewalls 265 9.8.2 Data encryption 265 9.8.3 Authorisation 265 9.8.4 Virus protection 265 9.8.5 Prevention and detection of hacking 266 9.9 Auditing in an information systems environment 267 9.10 Auditing computer systems 267 9.11 Computer assisted audit techniques 268 9.12 Techniques used to review system controls 268 9.12.1 Test data 268 9.12.2 Embedded audit facilities 268 9.13 Techniques used to review actual data 269 9.13.1 Audit interrogation software 269 9.13.2 Resident audit software 269 9.13.3 Integrated audit monitors 269 9.13.4 Simulation 269 9.14 Control self-assessment 269 9.15 Auditing system's maintenance 270 9.16 Summary 270 Revision Questions 273 Solutions to Revision Questions 275 10 Fraud 277 Learning Outcomes 279 10.1 Introduction 279 10.2 Fraud 279 10.3 The opportunity for fraud 280 10.4 Indicators of fraud risk 281 10.5 Fraud risk management strategy 282 10.6 Fraud prevention 283 10.6.1 Anti-fraud culture 283 10.6.2 Risk awareness 284

MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY x i 10.6.3 Whistle blowing 284 Q 10.6.4 Sound internal control systems 284 10.7 Identifying fraud 284 10.8 Responding to fraud 285 10.9 Fraud using computer systems 285 10.10 Management fraud 286 10.11 Other types of fraud 287 10.12 Summary 287 Revision Questions 289 Solutions to Revision Questions 291 11 Introduction to Risk Management and Derivatives 293 Learning Outcomes 295 11.1 Introduction 295. 11.2 Recent developments infinancialmarkets 295 11.3 The treasury function 296 11.3.1 Cost centre or profit centre 297 11.4 Overview offinancialriskmanagement 300 11.4.1 Why do companies manage financial risk? 300 11.4.2 Thefinancialrisk management process 301 11.5 Introduction to derivatives 307 11.5.1 Forward contracts 307 11.5.2 Futures contracts 309 11.5.3 Swaps 309 11.5.4 Options 310 11.5.5 Uses of derivatives 313 11.5.6 Derivatives and financial reporting 314 11.6 Summary 314 Revision Questions 315 12 Interest Rate Management 317 Learning Outcomes 319 12.1 Introduction 319 12.2 Sources of interest-rate risk 319 12.3 Fixed versus floating interest rates 321 12.4 Internal hedging techniques 321 12.5 Derivatives (external) hedging techniques 322 12.5.1 Interest-rate swaps 322 12.5.2 Forward-rate agreements 325 12.5.3 Interest-rate futures 326 12.5.4 Interest-rate options 329 12.5.5 Swaptions 331 12.5.6 Selecting a hedging method 331

xii z LU h- o u MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY 12.6 Summary 334 Revision Questions 335 Solutions to Revision Questions 339 13 Foreign Exchange: Relationships and Risks 13.1 13.2 13.3 13.4 13.5 13.6 Learning Outcomes Introduction The foreign exchange market 13.2.1 Exchange rates 13.2.2 The meaning of spot and forward rates Theoretical foreign exchange relationships 13.3.1 Interest-rate parity 13.3.2 Purchasing power parity 13.3.3 The Fisher effect 13.3.4 The international Fisher effect 13.3.5 Expectations theory 13.3.6 Implications of these theories Foreign exchange risk exposure 13.4.1 Transaction risk 13.4.2 Economic risk 13.4.3 Translation risk 13.4.4 Attitudes to risk Political risk 13.5.1 Managing political risk Summary Revision Questions Solutions to Revision Questions 345 347 347 347 348 350 353 354 358 359 360 360 361 361 362 362 363 364 365 366 366 367 371 14 Foreign Exchange Risk Management 14.1 14.2 14.3 14.4 14.5 14.6 14.7 Learning Outcomes Introduction Hedging exchange-rate risk Internal hedging techniques 14.3.1 Invoicing in the home currency 14.3.2 Bilateral and multilateral netting 14.3.3 Leading and lagging 14.3.4 Matching 14.3.5 Restructuring External hedging techniques 14.4.1 Forward markets 14.4.2 Money market hedge 14.4.3 Futures 14.4.4 Options Selecting a hedging method Currency swaps Cross-currency hedging 377 379 379 379 380 380 380 382 382 383 383 383 385 388 390 391 395 396

MANAGEMENT ACCOUNTING - RISK AND CONTROL STRATEGY xiii 14.8 Summary 396 g Revision Questions 397? Solutions to Revision Questions 405 Zn Guidance on Examination Preparation 421 Revision Questions 429 Solutions to Revision Questions 447 November 2007 Examinations 485 Index 519