By Ishara Kadawathe CBA, B.Sc. - Associate Controller, CFO Plans.
What is an internal control system?
It is a series of actions that occur throughout an entity’s operations and is used to guide the operations by the management in order to achieve the objectives of an entity in relation to the operational effectiveness and efficiency, financial reporting reliability, and compliance with laws & regulations.
Compliance with internal controls safeguards the business efficiency, continuity, and regulatory compliance.
What’s more important, a car’s exterior or interior?
Some meticulously shined and polished cars have completely dump interior while some cars with about 6 months’ worth of dirt and road grime on the exterior, but the interior is spotless. Few cars are of course shiny on the outside and spotless in the inside! Obviously, the choice is up to the owner, but it has a long-term impact on the life cycle of the car.
Identically, some entities have well established internal controls but the outcome rises gradually while others show a drastic increase in results with poor attention to internal controls. The companies that make it to the very top get the controls ready from the get-go.
Most of the internal & external stakeholders such as Suppliers, Customers, and Employees, will not maintain a long-term relationship with an entity that has weak internal controls as it becomes a burden for themselves.
Components an effective control system
Control environment – The foundation of all other components, is a set of standards, processes, and structures. It consists of integrity and ethical value, independence of the Board from management and culture lays emphasis on accountability for controls within the entity.
Risk assessment – Identification and assessing the various risks that an entity faces.
Control activities – The mechanism established by the management through policies and procedures in order to respond to the risk in the internal control system.
Information and communication – Information and communication between management and employees. For a successful approach, it should not just flow from management to employees, but in both directions.
Monitoring – Process of assessing the performance of the implemented controls.
Responsible roles in internal controls
Everyone in the entity has a collective responsibility for internal controls. Generally, it can be categorized as,
- Oversight body – The oversight body is mainly responsible for overseeing the strategic direction of the entity which includes overseeing management’s design, implementation, and operation of the internal control system. Usually, it comprises of a few members of the senior management.
- Management – Responsibility of all activities of the entity including design, implementation, and operating effectiveness of an entity’s internal control system lies with the management.
- Staff – plays a supportive role in management design, implementation, and operation of the internal control system. Specifically, reporting of issues should be a facilitated recurring function.
External Auditors are not a part of the entity’s internal control system. However, management may evaluate and incorporate recommendations of external auditors.
Formation of internal controls
The type of the internal controls that are most suitable for the entity depends on the nature of the business. There are some areas that need strict controls due to the high risk of fraud or loss. Therefore it is necessary to study each aspect of the entity thoroughly and form relevant controls in place. Segregation of duties, automated controls, regular reconciliations, physical controls, spot checks, duty rotations, validation checks, independent approval levels, supervision, skilled employees, etc. are a few examples that entities use to control procedures.
Why controls don’t always work?
Some activities may not be covered by the procedure manuals and there will be insufficient knowledge of policies or regulations. Further, when two or more persons come together to perform a task, there is a possibility of collusion beyond the internal controls. Also, the management or employees may try to override internal controls for their own benefit. In addition, the implemented controls should be followed with intended objectives. Otherwise, it can be a waste of time and resources. Furthermore, the lack of segregation of duties will lead to an inefficient control process. By conducting a sound monitoring process, the above limitations can be minimized.
Evaluation of internal control system
A continuous evaluation of an effective internal control system provides a reasonable assurance that the entity will achieve its objectives. Further, it ensures that the five components are integrated seamlessly.
Working with an entity that has a good internal control system is beneficial for all the stakeholders. It adds value to the entity both in the short-run as well as in the long-run. It streamlines the staff and makes them accountable with specified guidelines. Clear internal controls always minimize errors and save time while assuring the information accuracy. Having internal controls and procedure manuals will reduce training & induction time for new employees. Ultimately an entity with a sound internal control system leads to achieving its goals as intended.