Basics of Internal Control System

1. Internal Control
System
A High Level Perspective
1

2. Internal controls
• There are several types of internal control, and each
organisation will use some or all of these, to a greater or lesser
extent. Some organisations have more extensive and more
effective controls than others.
• Internal controls are applied to prevent adverse events from
happening or to detect failures in control when they occur. A
useful and common method of categorising internal controls is
to analyse them into three categories:
1. Financial controls.
2. Operational controls.
3. Compliance controls
2

3. Standard Internal control system
• An internal control system consists of a ‘control
environment’ and control procedures.
• A useful definition of internal control was given by the US
Committee Of Sponsoring Organizations (COSO).
• The COSO Framework defines internal control as the
achievement of objectives’ in the following three categories
1. Reliability of financial reporting (through financial
controls).
2. Effectiveness and efficiency of operations (through
operational controls).
3. Compliance with relevant laws and regulations (through
compliance controls).
3

4. The COSO Framework elements -1
A control environment:
• The control environment sets the tone of an organization,
influencing the control consciousness of its people.
• It is the foundation for all other components of internal
control, providing discipline and structure.
• Control environment factors include the integrity, ethical
values and competence of the entity's people,
management's philosophy and operating style, the way
management assigns authority and responsibility, and
organizes and develops its people; and the attention and
direction provided by the board of directors.
4

5. The COSO Framework elements -2
Risk identification and assessment:
• Every entity faces a variety of risks from external and
internal sources that must be assessed. A precondition to
risk assessment is establishment of objectives, linked at
different levels and internally consistent.
• Risk assessment is the identification and analysis of
relevant risks to achievement of the objectives, forming a
basis for determining how the risks should be managed.
• As economic, industry, regulatory and operating
conditions will continue to change, mechanisms are
needed to identify and deal with the special risks
associated with change 5

6. The COSO Framework elements -3
Control Activities:
• Policies and procedures that help ensure management
directives are carried out.
• These policies & procedures help ensure that necessary
actions are taken to address risks towards achievement of
the entity's objectives.
• Control activities occur throughout the organization, at all
levels and in all functions. They include a range of
activities as diverse as approvals, authorizations,
verifications, reconciliations, reviews of operating
performance, security of assets and segregation of duties.
.
6

7. The COSO Framework elements -4
Information and communication:
• Pertinent information must be identified, captured and
communicated in a form and timeframe that enable people to
carry out their responsibilities.
• Information systems produce reports, containing operational,
financial and compliance-related information, that make it
possible to run and control the business. They deal not only with
internally generated data, but also information about external
events, activities and conditions necessary to informed business
decision-making and external reporting.
• Effective communication also must occur in a broader sense,
flowing down, across and up the organization. All personnel must
receive a clear message from top management that control
responsibilities must be taken seriously. They must understand
their own role in the internal control system, as well as how
individual activities relate to the work of others.
• Effective communication with external parties, such as customers,
suppliers, regulators and shareholders is required
7

8. The COSO Framework elements - 5
Monitoring:
• Internal control systems need to be monitored--a process that
assesses the quality of the system's performance over time.
• Monitoring is accomplished through on-going monitoring
activities, separate evaluations or a combination of the two.
• On-going monitoring occurs in the course of operations. It
includes regular management and supervisory activities, and
other actions personnel take in performing their duties.
• The scope and frequency of separate evaluations will depend
primarily on an assessment of risks and the effectiveness of on-
going monitoring procedures.
• Internal control deficiencies should be reported upstream, with
serious matters reported to top management and the board.
8

9. Fundamental Concepts
1. Internal Control is a process. It is a mean to an end not an
end itself.
2. Internal control is not merely a policy manual and forms but
it is the assurance of effective and efficient implementation
of those manuals.
3. Internal control can be expected to provide only reasonable
assurance not an absolute assurance of the implemented
control.
4. Internal control is geared to the achievement of the
objectives in one or more overlapping categories.
9

10. Financial controls
• Financial controls relates to the preparation of reliable
published financial statements, including interim and
condensed financial statements and selected financial data
derived from such statements, such as earnings releases,
reported publicly
• Financial controls are designed to ensure that:
− There are no errors in the preparation of accounting records
and financial statements.
− No fraud is committed (there may be controls for detecting
fraud when it occurs , as well as controls that try to prevent
fraud from being able to occur).
− Assets of the company are not stolen, lost or damaged. 10

11. Operational controls
• Operational controls addresses the company 's basic business
objectives, including performance and profitability goals and
safeguarding of resources.
• Operational controls are designed to prevent failures in
operational procedures, or to detect and correct operational
failures if they do occur. Operational failures may be caused
by:
− Program breakdowns (total breakdown or in certain
function)
− Failures in the performance of systems.
− Weaknesses in procedures / process execution.
− Poor management such as no planning, monitoring,… 11

12. Compliance controls
• Compliance controls ensure that the company complies with
the most significant laws, rules and regulations.
• The most significant regulations for a company vary according
to the nature of its business, (i.e. compliance with health and
safety regulations, in the case of banks money laundering
prevention regulations,….)
12

13. 13
Compliance controls
Regulations Who Needs to
Comply
Security Areas
Covered
Compliance
Requirements
HIPAA US healthcare
organisations and
partners all over the
globe
Creating, storing and
transmitting
electronic protected
health information
All major "Best
Practice Safety "
areas
Sarbanes Oxley
(SOX) & Accounting
Standards
US public companies
and partners over the
globe
Defined to secure the
public against
corporate fraud and
misrepresentation
All major "Best
Practice Financial "
areas
PCI DSS
(Also Covered by
Breach Laws)
Merchants who take
credit cards
Privacy of Customer
Financial Data
Varies by size of
merchant, requires
Best Practices plus
3rd Party Quality
Risk Assessments

14. Establishing internal control system – (1)
• The board of directors is responsible for maintaining a sound system
of internal control.
• They should set appropriate policies on internal control & seek
regular assurance to satisfy that the system is operating effectively.
• In deciding the policies for internal control and assessing what
constitutes an effective system of internal control, the board should
consider the following factors:
1. The nature and extent of the risks facing the company;
2. The extent and categories of risks that the board regards as
acceptable for the company to bear.
3. The likelihood that the risks will materialise.
4. The company’s ability to reduce the incidence and impact on the
business of the risks that do materialise.
5. The costs of operating particular controls relative to the benefits
to be obtained from managing the risks they control. 14

15. The internal control system should:
1. Be embedded in the operations of the company and form
part of its culture.
2. Be capable of responding quickly to risks which the
business may face as they emerge and develop.
3. Include procedures for reporting immediately to the
management responsible of control failings and any
corrective action that should be undertaken.
15
Establishing internal control system – (2)

16. Internal audit overview
• Internal audit is defined as an independent appraisal activity
established within an organisation as a service to it. It is a
control which functions by examining and evaluating the
adequacy and effectiveness of other controls.
• If the board of directors and the audit committee do not have
the time to carry out a detailed review themselves, and they
can rely on information provided to them by internal auditors
• Internal auditors may be full-time employees of the company
or external professionals appointed by the company to carry
out specific investigations.
• There must be a system for monitoring and review by higher
level management
16

17. The possible tasks of internal audit –(1)
1. Reviewing the internal control system. Traditionally, an
internal audit department would carry out checks on the
financial controls in an organisation. The checks would be to
establish whether suitable financial controls exist and if so,
whether they are applied properly and are effective. It is not
the function of internal auditors to manage risks, only to
monitor and report them, and to check that risk controls are
efficient and cost-effective.
2. Special investigations. Internal auditors might conduct
special investigations into particular aspects of the
organisation’s operations (systems and procedures), to check
the effectiveness of operational controls.
17

18. The possible tasks of internal audit –(2)
3. Examination of financial and operating information.
Internal auditors might be asked to investigate the timeliness
of reporting and the accuracy of the information in reports.
4. Value for money (VFM) audits. This is an investigation
into an operation or activity to establish whether it is
economical, efficient and effective.
5. Reviewing compliance by the organisation with particular
laws or regulations. This is an investigation into the
effectiveness of compliance controls..
18

19. 6. Risk assessment. Internal auditors might be asked to
investigate aspects of risk management, and in particular the
adequacy of the mechanisms for identifying, assessing and
controlling significant risks to the organisation, from both
internal and external sources.
7. Internal auditors might be involved in providing continuous
support to the risk management process. If a company has
established a risk oversight committee with responsibility for
the oversight and reporting of risks, a senior internal auditor
might be one of the committee members. The internal audit
department might even have responsibility for coordinating
risk management within the company, and reporting to the
board or audit committee about risks on a company-wide
basis. 19
The possible tasks of internal audit –(3)

20. Investigation of internal controls
Internal auditors are commonly required to check the soundness of
internal financial controls. In assessing the effectiveness of individual
controls, and of an internal control system generally.
• Factors to be considered:
1. Automated controls are by no means error- or fraud-proof, but
may be more reliable than similar manual controls.
2. Non-discretionary controls are checks and procedures that must
be carried out. Discretionary controls are those that do not have
to be applied, either because they are voluntary or because an
individual can choose to dis-apply them.
3. Finding if the controls extensive enough or carried out
frequently enough ? Are the controls applied rigorously? For
example, is a supervisor doing his job properly? (to check
whether the controls are effective in achieving their purpose) 20