Internal control

In accounting and organizational theory, Internal control is defined as a process effected by an organization's structure, work and authority flows, people and management information systems, designed to help the organization accomplish specific goals or objectives. [ [http://www.coso.org/publications/executive_summary_integrated_framework.htm COSO Definition of Internal Control] ] It is a means by which an organization's resources are directed, monitored, and measured. It plays an important role in preventing and detecting fraud and protecting the organization's resources, both physical (e.g., machinery and property) and intangible (e.g., reputation or intellectual property such as trademarks). At the organizational level, internal control objectives relate to the reliability of financial reporting, timely feedback on the achievement of operational or strategic goals, and compliance with laws and regulations. At the specific transaction level, internal control refers to the actions taken to achieve a specific objective (e.g., how to ensure the organization's payments to third parties are for valid services rendered.) Internal control procedures reduce process variation, leading to more predictable outcomes. Internal control is a key element of the Foreign Corrupt Practices Act (FCPA) of 1977 and the Sarbanes-Oxley Act of 2002, which required improvements in internal control in United States public corporations. Internal controls within business entities are called also business controls.

Internal controls have existed from ancient times. In Hellenistic Egypt there was a dual administration, with one set of bureaucrats charged with collecting taxes and another with supervising them. [cite book|title=The Rise and Decline of the State|author=van Creveld, Martin|pages=49|isbn=0-521-65629-X|publisher=Cambridge University Press]

Definitions

There are a variety of definitions of internal control, as it affects the various constituencies (stakeholders) of an organization in various ways and at different levels of aggregation.

Under the COSO Internal Control-Integrated Framework, a widely-used framework in the United States, internal control is broadly defined as a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: a) Effectiveness and efficiency of operations; b) Reliability of financial reporting; and c) Compliance with laws and regulations.

COSO defines internal control as having five components:

# Control Environment-sets the tone for the organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control.
# Risk Assessment-the identification and analysis of relevant risks to the achievement of objectives, forming a basis for how the risks should be managed
# Information and Communication-systems or processes that support the identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities
# Control Activities-the policies and procedures that help ensure management directives are carried out.
# Monitoring-processes used to assess the quality of internal control performance over time.

The COSO definition relates to the aggregate control system of the organization, which is composed of many individual control procedures.

Discrete control procedures, or "controls" are defined by the SEC as: "...a specific set of policies, procedures, and activities designed to meet an objective. A control may exist within a designated function or activity in a process. A control’s impact...may be entity-wide or specific to an account balance, class of transactions or application. Controls have unique characteristics – for example, they can be: automated or manual; reconciliations; segregation of duties; review and approval authorizations; safeguarding and accountability of assets; preventing or detecting error or fraud. Controls within a process may consist of financial reporting controls and operational controls (that is, those designed to achieve operational objectives)." [ [http://www.sec.gov/rules/interp/2007/33-8810.pdf SEC Interpretive Guidance] ]

Context

Under the COSO Framework, objective setting is considered a precondition to internal control. By setting objectives, management can then identify risks to the achievement of those objectives. To address these risks, management of organizations may implement specific internal controls. The effectiveness of internal control can then be measured by how well the objectives are achieved and how effectively the risks are addressed.

More generally, setting objectives, budgets, plans and other expectations establish criteria for control. Control itself exists to keep performance or a state of affairs within what is expected, allowed or accepted. Control built within a process is internal in nature. It takes place with a combination of interrelated components - such as social environment effecting behavior of employees, information necessary in control, and policies and procedures. Internal control structure is a plan determining how internal control consists of these elements [ [http://www.saunalahti.fi/mmla/e01.html Matti Mattila: The ECAR Model] ] .

The concepts of corporate governance also heavily rely on the necessity of internal controls. Internal controls help ensure that processes operate as designed and that risk responses (risk treatments) in risk management are carried out. In addition, there needs to be in place circumstances ensuring that the aforementioned procedures will be performed as intended: right attitudes, integrity and competence, and monitoring by managers.

Roles and responsibilities in internal control

According to the COSO Framework, everyone in an organization has responsibility for internal control to some extent. Virtually all employees produce information used in the internal control system or take other actions needed to effect control. Also, all personnel should be responsible for communicating upward problems in operations, noncompliance with the code of conduct, or other policy violations or illegal actions. Each major entity in corporate governance has a particular role to play:

Management: The Chief Executive Officer (the top manager) of the organization has overall responsibility for designing and implementing effective internal control. More than any other individual, the chief executive sets the "tone at the top" that affects integrity and ethics and other factors of a positive control environment. In a large company, the chief executive fulfills this duty by providing leadership and direction to senior managers and reviewing the way they're controlling the business. Senior managers, in turn, assign responsibility for establishment of more specific internal control policies and procedures to personnel responsible for the unit's functions. In a smaller entity, the influence of the chief executive, often an owner-manager, is usually more direct. In any event, in a cascading responsibility, a manager is effectively a chief executive of his or her sphere of responsibility. Of particular significance are financial officers and their staffs, whose control activities cut across, as well as up and down, the operating and other units of an enterprise.

Board of Directors: Management is accountable to the board of directors, which provides governance, guidance and oversight. Effective board members are objective, capable and inquisitive. They also have a knowledge of the entity's activities and environment, and commit the time necessary to fulfill their board responsibilities. Management may be in a position to override controls and ignore or stifle communications from subordinates, enabling a dishonest management which intentionally misrepresents results to cover its tracks. A strong, active board, particularly when coupled with effective upward communications channels and capable financial, legal and internal audit functions, is often best able to identify and correct such a problem.

Auditors: The internal auditors and external auditors of the organization also measure the effectiveness of internal control through their efforts. They assess whether the controls are properly designed, implemented and working effectively, and make recommendations on how to improve internal control. They may also review Information technology controls, which relate to the IT systems of the organization. There are laws and regulations on internal control related to financial reporting in a number of jurisdictions. In the U.S. these regulations are specifically established by Sections 404 and 302 of the Sarbanes-Oxley Act. Guidance on auditing these controls is specified in PCAOB "Auditing Standard No. 5" and SEC guidance, further discussed in SOX 404 top-down risk assessment. To provide reasonable assurance that internal controls involved in the financial reporting process are effective, they are tested by the external auditor (the organization's public accountants), who are required to opine on the internal controls of the company and the reliability of its financial reporting.

Limitations

Internal control can provide reasonable, not absolute, assurance that the objectives of an organisation will be met. The concept of reasonable assurance implies a high degree of assurance, constrained by the costs and benefits of establishing incremental control procedures.

Effective internal control implies the organization generates reliable financial reporting and substantially complies with the laws and regulations that apply to it. However, whether an organization achieves operational and strategic objectives may depend on factors outside the enterprise, such as competition or technological innovation. These factors are outside the scope of internal control; therefore, effective internal control provides only timely information or feedback on progress towards the achievement of operational and strategic objectives, but cannot guarantee their achievement.

Internal control involves human action, which introduces the possibility of errors in processing or judgment. Internal control can also be overridden by collusion among employees (see separation of duties) or coercion by top management.

Describing Internal Controls

Internal controls may be described in terms of: a) the objective they pertain to; and b) the nature of the control activity itself.

Objective categorization

Internal control activities are designed to provide reasonable assurance that particular objectives are achieved, or related progress understood. The specific target used to determine whether a control is operating effectively is called the "control objective". Control objectives fall under several detailed categories; in financial auditing, they relate to particular "financial statement assertions," [ [http://www.aicpa.org/download/members/div/auditstd/SAS106.PDF Statement on Auditing Standards #106] ] but broader frameworks are helpful to also capture operational and compliance aspects:

# Existence (Validity): Only valid or authorized transactions are processed (i.e., no invalid transactions)
# Occurrence (Cutoff): Transactions occurred during the correct period or were processed timely.
# Completeness: All transactions are processed that should be (i.e., no omissions)
# Valuation: Transactions are calculated using an appropriate methodology or are computationally accurate.
# Rights & Obligations: Assets represent the rights of the company, and liabilities its obligations, as of a given date.
# Presentation & Disclosure (Classification): Components of financial statements (or other reporting) are properly classified (by type or account) and described.
# Reasonableness-transactions or results appears reasonable relative to other data or trends.

For example, a control objective for an accounts payable function might be: "Payments are only made to authorized vendors for goods or services received." This is a validity objective. A typical control procedure designed to achieve this objective is: "The accounts payable system compares the purchase order, receiving record, and vendor invoice prior to authorizing payment."

Management is responsible for implementing appropriate controls that apply to transactions in their areas of responsibility. Internal auditors perform their audits to evaluate whether the controls are designed and implemented effectively to address the relevant objectives.

Activity categorization

Control activities may also be described by the type or nature of activity. These include (but are not limited to):

*Segregation of duties - separating authorization, custody, and record keeping roles to limit risk of fraud or error by one person.
*Authorization of transactions - review of particular transactions by an appropriate person.
*Retention of records - maintaining documentation to substantiate transactions.
*Supervision or monitoring of operations - observation or review of ongoing operational activity.
*Physical safeguards - usage of cameras, locks, physical barriers, etc. to protect property.
*Analysis of results, periodic and regular operational reviews, metrics, and other key performance indicators (KPIs).
*IT Security - usage of passwords, access logs, etc. to ensure access restricted to authorized personnel.

Control precision

Control precision describes the alignment or correlation between a particular control procedure and a given control objective or risk. A control with direct impact on the achievement of an objective (or mitigation of a risk) is said to be more precise than one with indirect impact on the objective or risk. Precision is distinct from sufficiency; that is, multiple controls with varying degrees of precision may be involved in achieving a control objective or mitigating a risk. Precision is an important factor in performing a SOX 404 top-down risk assessment. After identifying specific financial reporting material misstatement risks, management and the external auditors are required to identify and test controls that mitigate the risks. This involves making judgments regarding both precision and sufficiency of controls required to mitigate the risks. Risks and controls may be entity-level or assertion-level under the PCAOB guidance. Entity-level controls are identified to address entity-level risks. However, a combination of entity-level and assertion-level controls are typically identified to address assertion-level risks. The PCAOB set forth a three-level hierarchy for considering the precision of entity-level controls. [ [http://www.pcaobus.org/Rules/Rules_of_the_Board/Auditing_Standard_5.pdf PCAOB AS5] ] Later guidance by the PCAOB regarding small public firms provided several factors to consider in assessing precision. [ [http://www.pcaobus.org/Standards/Standards_and_Related_Rules/AS5/Guidance.pdf PCAOB Small Co Guidance Draft] ]

Fraud and internal control

Internal control plays an important role in the prevention and detection of fraud. [Rezaee, Zabihollah. "Financial Statement Fraud: Prevention and Detection." New York: Wiley; 2002. ] Under the Sarbanes-Oxley Act, companies are required to perform a fraud risk assessment and assess related controls. [ [http://www.deloitte.com/dtt/cda/doc/content/us_assur_Antifraud%20whitepaper.pdf D&T Anti-fraud Programs & Controls] ] This typically involves identifying scenarios in which theft or loss could occur and determining if existing control procedures effectively manage the risk to an acceptable level. [ [http://www.aicpa.org/download/antifraud/SAS-99-Exhibit.pdf AICPA Management Antifraud Programs and Controls] ] The risk that senior management might override important financial controls to manipulate financial reporting is also a key area of focus in fraud risk assessment. [ [http://www.aicpa.org/audcommctr/download/achilles_heel.pdf AICPA Management Override] ]

The AICPA, IIA, and ACFE also sponsored a guide published during 2008 that includes a framework for helping organizations manage their fraud risk. [ [http://www.aicpa.org/download/news/2008/Managing_the_Business_Risk_of_Fraud.pdf Managing the Business Risk of Fraud] ]

Internal Controls and Improvement

If the internal control system is implemented only to prevent fraud and comply with laws and regulations, then an important opportunity is missed. The same internal controls can also be used to systematically improve businesses, particularly in regard to effectiveness and efficiency. [ [http://www.bizmanualz.com/information/2008/03/17/using-coso-principles-to-improve-performance.html Using COSO Principles to Improve Performance, Bizmanualz] ]

ee also

*Center for Audit Quality (CAQ)

References

* International Organization of Supreme Audit Institutions (INTOSAI): Guidelines for internal control standards (1992)
* Committee of Sponsoring Organizations of the Treadway Commission: Internal control - integrated framework (1994)
* [http://www.nysica.com New York State Internal Control Association (NYSICA)]