What “Effective” Means
Although similar requirements exist in many countries, the principal driver for implementing an effective internal controls system should be the enlightened self interest of the company.
Effective internal control is intended to give reasonable assurance of the achievement of corporate objectives at all levels. An internal control framework should be used for the design and evaluation of an internal control system. The COSO framework is the most widely applied of three published frameworks.1 COSO (the Committee of Sponsoring Organizations of the Treadway Commission) defines internal control as follows:
“Internal control is broadly defined as a process, effected by the entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
-
Effectiveness and efficiency of operations.
-
Reliability of financial reporting.
-
Compliance with applicable laws and regulations.”
Other definitions of internal control categorize the objectives of internal control differently, but fundamentally, effective internal control gives reasonable assurance that all of management’s objectives will be achieved. For instance, the King Report2 defines internal control as follows:
“The board should make use of generally recognized risk management and internal control models and frameworks in order to maintain a sound system of risk management and internal control to provide a reasonable assurance regarding the achievement of organizational objectives with respect to:
-
Effectiveness and efficiency of operations;
-
Safeguarding of the company’s assets (including information);
-
Compliance with applicable laws, regulations and supervisory requirements;
-
Supporting business sustainability under normal as well as adverse operating conditions;
-
Reliability of reporting;
-
Behaving responsibly towards all stakeholders.”
Before a conclusion can be reached that internal control is effective, both results and processes must be considered. For the former, the test is whether there have been any known outcomes attributable to significant breakdowns in internal control. Absence of these does not lead automatically to the conclusion that internal control is effective: it is possible that there may have been breakdowns of internal control yet to be discovered; it is also possible that serious weaknesses exist within the system of internal control that have not yet been exploited. So the second test must also be applied, which is to assess the quality of the control processes or “components.”
- Page 2 of 6
- Previous section Executive Summary
- Next section Design Characteristics of an Effective Internal Controls System
www.qfinance.com