A strong internal control framework consists of five interrelated components, each of which is derived from the way management runs a business and integrated with the management process.
The five components are:
Control Environment
The control environment sets the tone of an organisation, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.
Control environmental factors include the integrity, ethical values, and competence of the organisation’s people; management’s philosophy and operating style; the way management assigns authority and responsibility and organises and develops it people; and the attention and direction provided by the board of directors.
Risk Assessment
Every organisation faces a variety of risks from external and internal sources that must be assessed. A pre-condition to risk assessment is establishment of objectives, linked at different levels and internally consistent.
Risk assessment is the identification and analysis of relevant risks to the achievement of objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and address the special risks associated with change.
Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to the achievement of the entity’s objectives.
Control activities occur throughout the organisation, at all levels, and in all functions. They include a range of activities as diverse as approval, authorisations, verifications, reconciliations, review of operating performance, security of assets and segregation of duties.
Information and Communication
Pertinent information must be identified, captured and communicated in a form and time frame that enables people to carry out their responsibilities.
Information systems produce reports containing operational, financial and compliance-related information that make it possible to run and control the business. They deal not only with internally generated data but also with information about external events, activities and conditions necessary for informed business decisions and external reporting.
Effective communication also must occur in a broader sense, flowing down, across and up the organisation.
All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream.
There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.
Monitoring
Internal control systems need to be monitored – a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities and other actions personnel take in performing their duties.
The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures, internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.
The five components are:
Control Environment
The control environment sets the tone of an organisation, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure.
Control environmental factors include the integrity, ethical values, and competence of the organisation’s people; management’s philosophy and operating style; the way management assigns authority and responsibility and organises and develops it people; and the attention and direction provided by the board of directors.
Risk Assessment
Every organisation faces a variety of risks from external and internal sources that must be assessed. A pre-condition to risk assessment is establishment of objectives, linked at different levels and internally consistent.
Risk assessment is the identification and analysis of relevant risks to the achievement of objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and address the special risks associated with change.
Control Activities
Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to the achievement of the entity’s objectives.
Control activities occur throughout the organisation, at all levels, and in all functions. They include a range of activities as diverse as approval, authorisations, verifications, reconciliations, review of operating performance, security of assets and segregation of duties.
Information and Communication
Pertinent information must be identified, captured and communicated in a form and time frame that enables people to carry out their responsibilities.
Information systems produce reports containing operational, financial and compliance-related information that make it possible to run and control the business. They deal not only with internally generated data but also with information about external events, activities and conditions necessary for informed business decisions and external reporting.
Effective communication also must occur in a broader sense, flowing down, across and up the organisation.
All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream.
There also needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.
Monitoring
Internal control systems need to be monitored – a process that assesses the quality of the system’s performance over time. This is accomplished through ongoing monitoring activities, separate evaluations, or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities and other actions personnel take in performing their duties.
The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures, internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.
0 comments:
Post a Comment