Internal control system

Internal Control

System A High Level Perspective

1

Internal controls

• There are several types of internal control, and each

organisation will use some or all of these, to a greater or lesser

extent. Some organisations have more extensive and more

effective controls than others.

• Internal controls are applied to prevent adverse events from

happening or to detect failures in control when they occur. A

useful and common method of categorising internal controls is

to analyse them into three categories:

1. Financial controls.

2. Operational controls.

3. Compliance controls 2

Standard Internal control system

• An internal control system consists of a ‘control environment’ and control procedures.

• A useful definition of internal control was given by the US Committee Of Sponsoring Organizations (COSO).

• The COSO Framework defines internal control as the achievement of objectives’ in the following three categories

1. Reliability of financial reporting (through financial controls).

2. Effectiveness and efficiency of operations (through operational controls).

3. Compliance with relevant laws and regulations (through compliance controls).

3

The COSO Framework elements -1

A control environment:

• The control environment sets the tone of an organization, influencing the control consciousness of its people.

• It is the foundation for all other components of internal control, providing discipline and structure.

• Control environment factors include the integrity, ethical values and competence of the entity's people, management's philosophy and operating style, the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.

4


Risk identification and assessment:

• Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent.

• Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed.

• As economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change 5


Control Activities:

• Policies and procedures that help ensure management

directives are carried out.

• These policies & procedures help ensure that necessary

actions are taken to address risks towards achievement of

the entity's objectives.

• Control activities occur throughout the organization, at all

levels and in all functions. They include a range of

activities as diverse as approvals, authorizations,

verifications, reconciliations, reviews of operating

performance, security of assets and segregation of duties.

.

6

The COSO Framework elements -4 Information and communication:

• Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities.

• Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the business. They deal not only with internally generated data, but also information about external events, activities and conditions necessary to informed business decision-making and external reporting.

• Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others.

• Effective communication with external parties, such as customers, suppliers, regulators and shareholders is required

7

The COSO Framework elements - 5

Monitoring:

• Internal control systems need to be monitored--a process that

assesses the quality of the system's performance over time.

• Monitoring is accomplished through on-going monitoring

activities, separate evaluations or a combination of the two.

• On-going monitoring occurs in the course of operations. It

includes regular management and supervisory activities, and

other actions personnel take in performing their duties.

• The scope and frequency of separate evaluations will depend

primarily on an assessment of risks and the effectiveness of on-

going monitoring procedures.

• Internal control deficiencies should be reported upstream, with

serious matters reported to top management and the board.

8

Fundamental Concepts

1. Internal Control is a process. It is a mean to an end not an

end itself.

2. Internal control is not merely a policy manual and forms but

it is the assurance of effective and efficient implementation

of those manuals.

3. Internal control can be expected to provide only reasonable

assurance not an absolute assurance of the implemented

control.

4. Internal control is geared to the achievement of the

objectives in one or more overlapping categories.

9

Financial controls

• Financial controls relates to the preparation of reliable published financial statements, including interim and condensed financial statements and selected financial data derived from such statements, such as earnings releases, reported publicly

• Financial controls are designed to ensure that:

− There are no errors in the preparation of accounting records and financial statements.

− No fraud is committed (there may be controls for detecting fraud when it occurs , as well as controls that try to prevent fraud from being able to occur).

− Assets of the company are not stolen, lost or damaged. 10

Operational controls

• Operational controls addresses the company 's basic business

objectives, including performance and profitability goals and

safeguarding of resources.

• Operational controls are designed to prevent failures in

operational procedures, or to detect and correct operational

failures if they do occur. Operational failures may be caused

by:

− Program breakdowns (total breakdown or in certain

function)

− Failures in the performance of systems.

− Weaknesses in procedures / process execution.

− Poor management such as no planning, monitoring,… 11

Compliance controls

• Compliance controls ensure that the company complies with

the most significant laws, rules and regulations.

• The most significant regulations for a company vary according

to the nature of its business, (i.e. compliance with health and

safety regulations, in the case of banks money laundering

prevention regulations,….)

12

13

Compliance controls

Regulations Who Needs to

Comply

Security Areas

Covered

Compliance

Requirements

HIPAA US healthcare

organisations and

partners all over the

globe

Creating, storing and

transmitting

electronic protected

health information

All major "Best

Practice Safety "

areas

Sarbanes Oxley

(SOX) & Accounting

Standards

US public companies

and partners over the

globe

Defined to secure the

public against

corporate fraud and

misrepresentation

All major "Best

Practice Financial "

areas

PCI DSS

(Also Covered by

Breach Laws)

Merchants who take

credit cards

Privacy of Customer

Financial Data

Varies by size of

merchant, requires

Best Practices plus

3rd Party Quality

Risk Assessments

Establishing internal control system – (1)

• The board of directors is responsible for maintaining a sound system of internal control.

• They should set appropriate policies on internal control & seek regular assurance to satisfy that the system is operating effectively.

• In deciding the policies for internal control and assessing what constitutes an effective system of internal control, the board should consider the following factors:

1. The nature and extent of the risks facing the company;

2. The extent and categories of risks that the board regards as acceptable for the company to bear.

3. The likelihood that the risks will materialise.

4. The company’s ability to reduce the incidence and impact on the business of the risks that do materialise.

5. The costs of operating particular controls relative to the benefits to be obtained from managing the risks they control. 14

The internal control system should:

1. Be embedded in the operations of the company and form

part of its culture.

2. Be capable of responding quickly to risks which the

business may face as they emerge and develop.

3. Include procedures for reporting immediately to the

management responsible of control failings and any

corrective action that should be undertaken.

15

Establishing internal control system – (2)

Internal audit overview

• Internal audit is defined as an independent appraisal activity established within an organisation as a service to it. It is a control which functions by examining and evaluating the adequacy and effectiveness of other controls.

• If the board of directors and the audit committee do not have the time to carry out a detailed review themselves, and they can rely on information provided to them by internal auditors

• Internal auditors may be full-time employees of the company or external professionals appointed by the company to carry out specific investigations.

• There must be a system for monitoring and review by higher level management

16

The possible tasks of internal audit –(1)

1. Reviewing the internal control system. Traditionally, an

internal audit department would carry out checks on the

financial controls in an organisation. The checks would be to

establish whether suitable financial controls exist and if so,

whether they are applied properly and are effective. It is not

the function of internal auditors to manage risks, only to

monitor and report them, and to check that risk controls are

efficient and cost-effective.

2. Special investigations. Internal auditors might conduct

special investigations into particular aspects of the

organisation’s operations (systems and procedures), to check

the effectiveness of operational controls.

17


3. Examination of financial and operating information.

Internal auditors might be asked to investigate the timeliness

of reporting and the accuracy of the information in reports.

4. Value for money (VFM) audits. This is an investigation

into an operation or activity to establish whether it is

economical, efficient and effective.

5. Reviewing compliance by the organisation with particular

laws or regulations. This is an investigation into the

effectiveness of compliance controls..

18

6. Risk assessment. Internal auditors might be asked to

investigate aspects of risk management, and in particular the

adequacy of the mechanisms for identifying, assessing and

controlling significant risks to the organisation, from both

internal and external sources.

7. Internal auditors might be involved in providing continuous

support to the risk management process. If a company has

established a risk oversight committee with responsibility for

the oversight and reporting of risks, a senior internal auditor

might be one of the committee members. The internal audit

department might even have responsibility for coordinating

risk management within the company, and reporting to the

board or audit committee about risks on a company-wide

basis. 19


Investigation of internal controls Internal auditors are commonly required to check the soundness of internal financial controls. In assessing the effectiveness of individual controls, and of an internal control system generally.

• Factors to be considered:

1. Automated controls are by no means error- or fraud-proof, but may be more reliable than similar manual controls.

2. Non-discretionary controls are checks and procedures that must be carried out. Discretionary controls are those that do not have to be applied, either because they are voluntary or because an individual can choose to dis-apply them.

3. Finding if the controls extensive enough or carried out frequently enough ? Are the controls applied rigorously? For example, is a supervisor doing his job properly? (to check whether the controls are effective in achieving their purpose)

20

Business

Internal control system