A Strong Internal Control Environment

A strong internal control framework consists of five interrelated components, each of which is derived from the way management runs a business and integrated with the management process.

The five components are:

Control Environment

The control environment sets the tone of an organisation, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.

Control environmental factors include the integrity, ethical values, and competence of the organisation’s people; management’s philosophy and operating style; the way management assigns authority and responsibility and organises and develops it people; and the attention and direction provided by the board of directors.

Risk Assessment

Every organisation faces a variety of risks from external and internal sources that must be assessed. A pre-condition to risk assessment is establishment of objectives, linked at different levels and internally consistent.

Risk assessment is the identification and analysis of relevant risks to the achievement of objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and address the special risks associated with change.

Control Activities

Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to the achievement of the entity’s objectives.

Control activities occur throughout the organisation, at all levels, and in all functions. They include a range of activities as diverse as approval, authorisations, verifications, reconciliations, review of operating performance, security of assets and segregation of duties.

Information and Communication

Pertinent information must be identified, captured and communicated in a form and time frame that enables people to carry out their responsibilities.

Information systems produce reports containing operational, financial and compliance-related information that make it possible to run and control the business. They deal not only with internally generated data but also with information about external events, activities and conditions necessary for informed business decisions and external reporting.

Effective communication also must occur in a broader sense, flowing down, across and up the organisation.

All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream.

There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.

Monitoring

Internal control systems need to be monitored – a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities and other actions personnel take in performing their duties.

The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures, internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

The Bent Spear Incident

An unacceptable error that resulted in an unprecedented string of leadership, supervision and procedural failures.

Just after 9am on Wednesday 29th August 2007, a group of United States airmen entered a bunker on North Dakota’s Minot Air Force Base with orders to collect a set of unarmed cruise missiles bound for a weapons graveyard.

They quickly pulled out a dozen cylinders, all of which appeared identical from a cursory glance and hauled them to a waiting B-52 bomber.

The airmen attached the grey missiles to the plane’s wings, six on each side.

After eyeballing the six missiles on the right side, a flight officer signed a manifest that listed a dozen unarmed missiles.

The officer did not notice that the six on the left contained nuclear warheads, each with enough destructive power of up to 10 Hiroshima bombs.

That detail would escape notice for 36 hours during which the missiles were flown across the country to a Louisiana air base that had no idea that nuclear warheads were coming.

That August flight was the first known incident in which the military lost track of its nuclear weapons since the dawn of the atomic age.

The episode triggered a rare “Bent Spear” nuclear incident report and was immediately reported to the Defence Secretary, Robert Gates and President Bush. “Bent Spear” events are ranked second in seriousness only to “Broken Arrow” incidents which involve the loss, destruction or accidental detonation of a nuclear weapon.

The Internal Control Failings

A simple error in a missile storage room led to missteps at every turn, as ground crews failed to notice the warheads, and as security teams and flight crew members failed to provide adequate oversight and check the cargo thoroughly. An elaborate nuclear safeguard system developed during the Cold War and laced with rigorous accounting and command procedures was ignored.

Inadequate Tracking

A munitions custodian officer is supposed to keep track of the nuclear warheads. Before the missiles are moved, two-man teams are supposed to look at check sheets, bar codes and serial numbers denoting whether the missiles are armed. This did not happen.

Once the missiles were incorrectly certified as unarmed, a requirement for unique security precautions – such as the presence of specially armed security police, the approval of a senior base commander and a special ranking system – was not activated.

Deficient Monitoring

Air Force rules required members of the jet’s flight crew to examine all of the missiles and warheads before the plane too off. This did not happen.

Just one person examined only the six unarmed missiles and skipped the armed missiles on the left wing.

Additionally, the North Dakota mission control centre failed the verify the status of the warheads in a database. The airmen replaced these monitoring processes with their own “informal” system.

Lack of Segregation

The North Dakota base made the mistake of allowing nuclear-warhead-equipped missiles and unarmed missiles to be stored in the same bunker. It was standard Air Force procedure to rely on the segregation of nuclear weapons from conventional ones.

The Investigation

The Air Force undertook a six week investigation the results of which have been released.

The investigation found that there had been an “erosion” of adherence to standards at the two bases involved.

The Air Force conducted a service-wide stockpile inventory to verify there were no additional discrepancies and enhanced management directives regarding the storage, tracking and labelling of all weapons.

The Air Force noted that personnel lack neither the time nor the resources to perform the inspections, indicating that the weapons officers had become lackadaisical in their duties.

It was noted that the Air Force had not handled airborne nuclear weapons for more than a decade, implying that most of the airmen lacked experience with the procedures.

***

The Air Force announced last Friday that it would discipline 70 airmen involved in the incident.

Four Colonels were relieved of their duties and the entire 5th Bomb Wing has lost their certification to handle sensitive weaponry.