Internal control

Internal control is a system, built within any goal-oriented process, for increasing likelihood that the process works as planned. It contributes to achievement of objectives and other expectations set to the process, including expectations about acceptable or allowed behavior¹. The concept of internal control has been strongly associated with financial management, especially with the Sarbanes-Oxley Act.

Frameworks

Frameworks, also called models, have emerged to make it easy to understand and analyse internal control and to communicate about it. These frameworks describe the purpose and structure of internal control, including control objectives and control elements.

Control objectives are derived from general business objectives. They can address such things as achievement of expectations as regards operational effectiveness and efficiency; reporting; and compliance with laws, regulations and standards.

Control elements are the means by which control objectives are aspired after. The elements can be put in three broad categories:

1. behavior of management and other staff. This can be affected e.g. with code of ethics; accountability; communication; rewards and sanctions; and example by managers.
2. information needed for control: in particular departures from standards and budgets, and other anomalies, as well as information by systems to prevent errors.
3. control arrangements - such as authorization of a transaction, review of work done, reconciliation, computer assisted check, passwords, and segregation of duties.

Creation of internal control

Internal control is created in planning, organizing and directing of a process. Direction gives the objectives which to derive control objectives from. Builders of a process plan how the process should proceed. They identify usual cases of disturbance, and prepare the process for them with controls and other internal control elements. It is not possible to protect process against all risks, e.g. against collusion by several workers or management override of controls. Thus there are inherently limitations to internal control ².

Monitoring and assessing internal control

It is a task of the board of directors, or other such body or person, as part of corporate governance, to ensure the internal control works as intended. The internal structure of the company shall be reviewed continuously by the board to ensure that there are clear lines of accountability for management throughout the organisation³. An organization can hire internal auditors or buy internal audit services to audit of internal control. Internal control is also assessed and audited by external auditors on areas relevant to their assignment.

References

¹ Matti Mattila: Tehtävänä valvonta (1997); ISBN 978-952-92-3090-7, page 7

² Matti Mattila: Tehtävänä valvonta (1997); ISBN 978-952-92-3090-7, page 7

³ OECD Principles of Corporate Governance, page 62

See also

IT Governance Institute: Control Objectives for Information and related Technology (2007)

Matti Mattila: ECAR model (2007)

The Canadian Institute of Chartered Accountants: Guidance on Control (1995)

The Committee of Sponsoring Organizatons of the Tradway Commission Internal control - integrated framework (1992)