Internal Control

General Overview

Internal control is the process designed to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Safeguarding assets against theft and unauthorised use, acquisition, or disposal is also part of internal control.

Internal Controls

The term internal controls refers to the overall operating framework of Policies, Practices, Systems, Management Philosophy, Values and Actions which exist in an organization to ensure that

a.       Essential organization Objectives are met;

b.      Assets are protected and Risks are managed;

c.       Legal requirements are met;

d.      Information used to report is accurate

To devise and maintain an adequate system of internal control for the operations of entity is the responsibility of management. Internal controls are the overall means whereby management ensures that objectives are met , risks are assessed and managed, appropriate reviews of the operations performance are made, and that information sharing and communications occur in a timely, accurate and appropriate fashion with due regard for protection of valuable information .

However the internal controls can only provide reasonable assurance that entities objectives are met. As such the company must consider the relative costs and benefits of objective established. The entity satisfies an internal control requirement by providing an operating framework for the departments to follow with regards to policies and practice.

Elements of Internal Control

Internal control systems operate at different levels of effectiveness. Determining whether a particular internal control system is effective and judgement resulting from an assessment of whether the five components - Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring - are present and functioning. Effective controls provide reasonable assurance regarding the accomplishment of established objectives.

1.     Control Environment

The control environment, as established by the organization's administration, sets the tone of an institution and influences the control consciousness of its people. Leaders of each department, area or activity establish a local control environment. This is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include:

a)      Integrity and ethical values;

b)      The commitment to competence;

c)       Leadership philosophy and operating style;

d)      The way management assigns authority and responsibility, and organizes and develops its people;

e)      Policies and procedures.

The management style and the expectations of upper-level managers, particularly their control policies, determine the control environment. An effective control environment helps ensure that established policies and procedures are followed. The control environment includes independent oversight provided by a board of directors and, in publicly held companies, by an audit committee; management's integrity, ethical values, and philosophy; a defined organizational structure with competent and trustworthy employees; and the assignment of authority and responsibility.

2.     Risk Assessment

Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economics, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

Objectives must be established before administrators can identify and take necessary steps to manage risks. Operations objectives relate to effectiveness and efficiency of the operations, including performance and financial goals and safeguarding resources against loss. Financial reporting objectives pertain to the preparation of reliable published financial statements, including prevention of fraudulent financial reporting. Compliance objectives pertain to laws and regulations which establish minimum standards of behaviour.

The process of identifying and analyzing risk is an ongoing process and is a critical component of an effective internal control system. Attention must be focused on risks at all levels and necessary actions must be taken to manage. Risks can pertain to internal and external factors. After risks have been identified they must be evaluated.

Managing change requires a constant assessment of risk and the impact on internal controls. Economic, industry and regulatory environments change and entities' activities evolve. Mechanisms are needed to identify and react to changing conditions.

3.     Control Activities

Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels, and in all functions. They include a range of activities as diverse as approvals, authorizations, verification  reconciliations, reviews of operating performance, security of assets and segregation of duties. In other words Control activities are the specific policies and procedures management uses to achieve its objectives. The most important control activities involve segregation of duties, proper authorization of transactions and activities, adequate documents and records, physical control over assets and records, and independent checks on performance.

Control activities usually involve two elements: a policy establishing what should be done and procedures to affect the policy. All policies must be implemented thoughtfully, conscientiously and consistently.

In order to identify and establish effective controls, management must continually assess the risk, monitor control implementation, and modify controls as needed. Top managers of publicly held companies must sign a statement of responsibility for internal controls and include this statement in their annual report to stockholders.

4.     Information and Communication

Pertinent information must be identified, captured and communicated in a form and time frame that enables people to carry out their responsibilities. Effective communication must occur in a broad sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream.

5.     Monitoring

Internal control systems need to be monitored - a process that assesses the quality of the system's performance over time. Ongoing monitoring occurs in the ordinary course of operations, and includes regular management and supervisory activities, and other actions personnel take in performing their duties that assess the quality of internal control system performance.

The scope and frequency of separate evaluations depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported immediately to top administration and governing boards.

Internal control systems change over time. The way controls are applied may evolve. Once effective procedures can become less effective due to the arrival of new personnel, varying effectiveness of training and supervision, time and resources constraints, or additional pressures. Furthermore, circumstances for which the internal control system was originally designed also may change. Because of changing conditions, management needs to determine whether the internal control system continues to be relevant and able to address new risks.

6.     Components of the Control Activity

Internal controls rely on the principle of checks and balances in the workplace. A short description of each of these control activities appears below:

1.       Segregation of duties requires that different individuals be assigned responsibility for different elements of related activities, particularly those involving authorization, custody, or record keeping. For example, the same person who is responsible for an asset's record keeping should not be responsible for physical control of that asset having different individuals perform these functions creates a system of checks and balances. Segregation of Duties reduce the likelihood of errors and irregularities. An individual is not to have responsibility for more than one of the three transaction components: authorization, custody, and record keeping. When the work of one employee is checked by another, and when the responsibility for custody for assets is separate from the responsibility for maintaining the records relating to those assets, there is appropriate segregation of duties. This helps detect errors in a timely manner and deter improper activities; and at the same time, it should be devised to prompt operational efficiency and allow for effective communications.

2. Personnel need to be competent and trustworthy, with clearly established lines of authority and responsibility documented in written job descriptions and procedures manuals. Organizational charts provide a visual presentation of lines of authority and periodic updates of job descriptions ensures that employees are aware of the duties they are expected to perform.

3.       Independent checks on performance, which is carried out by employees who did not do the work being checked, help ensure the reliability of accounting information and the efficiency of operations. For example, a supervisor verifies the accuracy of a retail clerk's cash drawer at the end of the day. Internal auditors may also verity that the supervisor performed the check of the cash drawer.

4.       Proper authorization of transactions and activities helps ensure that all company activities adhere to established guide lines unless responsible managers authorize another course of action. For example, a fixed price list may serve as an official authorization of price for a large sales staff. In addition, there may be a control to allow a sales manager to authorize reason able deviations from the price list. Authorization Procedures need to include a thorough review of supporting information to verify the propriety and validity of transactions. Approval authority is to be commensurate with the nature and significance of the transactions and in compliance with Organizations policy.

5.       Physical control over assets and records helps protect the company's assets. These control activities may include electronic or mechanical controls (such as a safe, employee ID cards, fences, cash registers, fireproof files, and locks) or computer-related controls dealing with access privileges or established backup and recovery procedures. Physical Restrictions are the most important type of protective measures for safeguarding organizations assets, processes and data.

6.       Adequate documents and records provide evidence that financial statements are accurate. Controls designed to ensure adequate record keeping include the creation of invoices and other documents that are easy to use and sufficiently informative; the use of pre-numbered, consecutive documents; and the timely preparation of documents. Documentation and Record Retention is to provide reasonable assurance that all information and transactions of value are accurately recorded and retained. Records are to be maintained and controlled in accordance with the established retention period and properly disposed of in accordance with established procedures.

7. Monitoring Operations is essential to verify that controls are operating properly. Reconciliations, confirmations, and exception reports can provide this type of information.

7.     Internal Control Limitations

There is no such thing as a perfect control system. Staff size limitations may obstruct efforts to properly segregate duties, which requires the implementation of compensating controls to ensure that objectives are achieved. A limited inherent in any system is the element of human error, misunderstandings, fatigue and stress. Employees are to be encouraged to take earned vacation time in order to improve operations through cross training while enabling employees to overcome or avoid stress and fatigue.

The cost of implementing a specific control should not exceed the expected benefit of the control. Sometimes there is no out-of-pocket cost to establish an adequate control. A realignment of duty assignments may be all that is necessary to accomplish the objective. In analyzing the pertinent costs and benefits, managers also need to consider the possible ramifications for the organization at large and attempt to identify and weigh the intangible as well as the tangible consequences.

Internal controls should reduce the risks associated with undetected errors or irregularities, but designing and establishing effective internal controls is not always a simple task and cannot always be accomplished through a short set of quick fixes.

Audit Guidelines

The Audit is one of many effective controls that the entity should use to administer its operations.

                      However, to judge its effectiveness it is necessary to ask the following question:

1.       Does the organization have a functioning Audit Committee?

2.       Is the audit made on surprise basis rather than scheduled in advance?

3.       Is an audit also performed when there is change of officers?

4.       Are records of the audit documented and the results kept in the organizations files?

5.       Is the scope of Audit comprehensive rather than just a financial reconciliation?

If answers to the above questions are in YES then it can be assumed that audit committee will be functioning correctly.

Let’s Sum Up

Internal control is the process designed to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Safeguarding assets against theft and unauthorized use, acquisition, or disposal is also part of internal control. Internal control systems operate at different levels of effectiveness. Determining whether a particular internal control system is effective and judgement resulting from an assessment of whether the five components - Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring - are present and functioning. Effective controls provide reasonable assurance regarding the accomplishment of established objectives. In order to identify and establish effective controls, management must continually assess the risk, monitor control implementation, and modify controls as needed. Top managers of publicly held companies must sign a statement of responsibility for internal controls and include this statement in their annual report to stockholders. There is no such thing as a perfect control system and internal control system too have its limitations, so we can say that the internal controls can only provide reasonable assurance that entities objectives are met. As such the company must consider the relative costs and benefits of objective established. The entity satisfies an internal control requirement by providing an operating framework for the departments to follow with regards to policies and practice.