Internal Control

Introduction

As a result of the recent scandals of companies such as Enron and WorldCom, the Sarbanes-Oxley Act (SOX) was enacted to preemptively curb fraudulent financial reporting. SOX has strengthened requirements of both internal controls and procedures for financial reporting. For example, one major change requires the CEO and CFO of publicly traded companies to personally validate an auditor’s report for reliability and transparency.1 Internal control is a process where a common goal is achieved by management and personnel to ensure safe guarding assets, as well as attainment of realistic objectives such as operation, reporting and compliance.2 The following presents an overview of internal controls, a real-world example of internal controls in action, and a synopsis of monitoring, perhaps the most critical part of a strong internal control system.

The Committee of Sponsoring Organizations (COSO) provides a framework in which to analyze a firm’s internal controls. Below are the five interrelated components of this framework:

1. Control environment- The top management is responsible for setting standards, processes, structure and accountability of the organization, resulting in the establishment of the control environment. Constituents of control environment are value and integrity, philosophy of management.

2. Risk assessment- The management’s ability to minimize risk by identifying, evaluating, managing and handling risk by establishing objectives, and linking all levels of organization.

3. Control activities- Activities that are either manual or automated and applied to help minimize or prevent specific risks faced by the organization. These activities are carried out at all levels with varying degrees. Examples of control activities include segregation of responsibilities, human resources control, physical control, documentation procedures, establishment of responsibilities and independent internal verification.

4. Information and communications- The management’s responsibility to gather relevant and quality information from external and internal resources in order to communicate necessary information to the organization and to the external parties. The effective communication requires timeliness, and relaying appropriate information to the effective personnel.

5. Monitoring- The management reviews organization activities periodically to evaluate whether all five internal controls are effective and functioning according to organization mission and objectives resulting in efficient internal control.

Internal control is most effective when all five components are woven together and work simultaneously. The use of internal controls is not limited to publicly held companies. Below is an application of the COSO internal control framework to a government program.

Naval Reactors Example

Naval