Internal Control - Integrated Framework

   Executive Summary

Senior executives have long sought ways to better control the enterprises they run. Internal

controls are put in place to keep the company on course toward profitability goals and

achievement of its mission, and to minimize surprises along the way. They enable management

to deal with rapidly changing economic and competitive environments, shifting customer

demands and priorities, and restructuring for future growth. Internal controls promote efficiency,

reduce risk of asset loss, and help ensure the reliability of financial statements and compliance

with laws and regulations.

Because internal control serves many important purposes, there are increasing calls for better

internal control systems and report cards on them. Internal control is looked upon more and

more as a solution to a variety of potential problems.

Internal Control

Internal control means different things to different people. This causes confusion among

businesspeople, legislators, regulators and others. Resulting miscommunication and different

expectations cause problems within an enterprise. Problems are compounded when the term, if

not clearly defined, is written into law, regulation or rule.

This report deals with the needs and expectations of management and others. It defines and

describes internal control to: 

1.  Establish a common definition serving the needs of different parties. 

2.  Provide a standard against which business and other entities--large or small, in the

public or private sector, for profit or not--can assess their control systems and determine

how to improve them. 

Internal control is broadly defined as a process, effected by an entity's board of directors,

management and other personnel, designed to provide reasonable assurance regarding the

achievement of objectives in the following categories: 

1.  Effectiveness and efficiency of operations. 

2.  Reliability of financial reporting. 

3.  Compliance with applicable laws and regulations. 

The first category addresses an entity's basic business objectives, including performance and

profitability goals and safeguarding of resources. The second relates to the preparation of

reliable published financial statements, including interim and condensed financial statements

and selected financial data derived from such statements, such as earnings releases, reported

publicly. The third deals with complying with those laws and regulations to which the entity is

subject. These distinct but overlapping categories address different needs and allow a directed

focus to meet the separate needs.

Internal control systems operate at different levels of effectiveness. Internal control can be

judged effective in each of the three categories, respectively, if the board of directors and

management have reasonable assurance that: 

   They understand the extent to which the entity's operations objectives are being achieved. 

1.  Published financial statements are being prepared reliably. 

2.  Applicable laws and regulations are being complied with. 

3.  While internal control is a process, its effectiveness is a state or condition of the process

at one or more points in time.

Internal control consists of five interrelated components. These are derived from the way

management runs a business, and are integrated with the management process. Although the

components apply to all entities, small and mid-size companies may implement them differently

than large ones. Its controls may be less formal and less structured, yet a small company can

still have effective internal control. The components are:

Control Environment

The control environment sets the tone of an organization, influencing the control consciousness

of its people. It is the foundation for all other components of internal control, providing discipline

and structure. Control environment factors include the integrity, ethical values and competence

of the entity's people; management's philosophy and operating style; the way management

assigns authority and responsibility, and organizes and develops its people; and the attention

and direction provided by the board of directors.

Risk Assessment

Every entity faces a variety of risks from external and internal sources that must be assessed. A

precondition to risk assessment is establishment of objectives, linked at different levels and

internally consistent. Risk assessment is the identification and analysis of relevant risks to

achievement of the objectives, forming a basis for determining how the risks should be

managed. Because economic, industry, regulatory and operating conditions will continue to

change, mechanisms are needed to identify and deal with the special risks associated with

change.

Control Activities

Control activities are the policies and procedures that help ensure management directives are

carried out. They help ensure that necessary actions are taken to address risks to achievement

of the entity's objectives. Control activities occur throughout the organization, at all levels and in

all functions. They include a range of activities as diverse as approvals, authorizations,

verifications, reconciliations, reviews of operating performance, security of assets and

segregation of duties.

Information and Communication

Pertinent information must be identified, captured and communicated in a form and timeframe

that enable people to carry out their responsibilities. Information systems produce reports,

containing operational, financial and compliance-related information, that make it possible to run

and control the business. They deal not only with internally generated data, but also information

about external events, activities and conditions necessary to informed business decision-making

and external reporting. Effective communication also must occur in a broader sense, flowing

down, across and up the organization. All personnel must receive a clear message from top

management that control responsibilities must be taken seriously. They must understand their

own role in the internal control system, as well as how individual activities relate to the work of

others. They must have a means of communicating significant information upstream. There also

needs to be effective communication with external parties, such as customers, suppliers, regulators and shareholders.

Monitoring

Internal control systems need to be monitored--a process that assesses the quality of the

system's performance over time. This is accomplished through ongoing monitoring activities,

separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of

operations. It includes regular management and supervisory activities, and other actions

personnel take in performing their duties. The scope and frequency of separate evaluations will

depend primarily on an assessment of risks and the effectiveness of ongoing monitoring

procedures. Internal control deficiencies should be reported upstream, with serious matters

reported to top management and the board.

There is synergy and linkage among these components, forming an integrated system that

reacts dynamically to changing conditions. The internal control system is intertwined with the

entity's operating activities and exists for fundamental business reasons. Internal control is most

effective when controls are built into the entity's infrastructure and are a part of the essence of

the enterprise. "Built in" controls support quality and empowerment initiatives, avoid

unnecessary costs and enable quick response to changing conditions.

There is a direct relationship between the three categories of objectives, which are what an

entity strives to achieve, and components, which represent what is needed to achieve the

objectives. All components are relevant to each objectives category. When looking at any one

category--the effectiveness and efficiency of operations, for instance--all five components must

be present and functioning effectively to conclude that internal control over operations is

effective.

The internal control definition--with its underlying fundamental concepts of a process, effected by

people, providing reasonable assurance--together with the categorization of objectives and the

components and criteria for effectiveness, and the associated discussions, constitute this

internal control framework.

What Internal Control Can Do

Internal control can help an entity achieve its performance and profitability targets, and prevent

loss of resources. It can help ensure reliable financial reporting. And it can help ensure that the

enterprise complies with laws and regulations, avoiding damage to its reputation and other

consequences. In sum, it can help an entity get to where it wants to go, and avoid pitfalls and

surprises along the way.

What Internal Control Cannot Do

Unfortunately, some people have greater, and unrealistic, expectations. They look for absolutes,

believing that: 

Internal control can ensure an entity's success--that is, it will ensure achievement of basic

business objectives or will, at the least, ensure survival. 

Even effective internal control can only help an entity achieve these objectives. It can provide

management information about the entity's progress, or lack of it, toward their achievement. But

internal control cannot change an inherently poor manager into a good one. And, shifts in

government policy or programs, competitors' actions or economic conditions can be beyond

management's control. Internal control cannot ensure success, or even survival.  Internal control can ensure the reliability of financial reporting and compliance with laws and

regulations. 

This belief is also unwarranted. An internal control system, no matter how well conceived and

operated, can provide only reasonable--not absolute--assurance to management and the board

regarding achievement of an entity's objectives. The likelihood of achievement is affected by

limitations inherent in all internal control systems. These include the realities that judgments in

decision-making can be faulty, and that breakdowns can occur because of simple error or

mistake. Additionally, controls can be circumvented by the collusion of two or more people, and

management has the ability to override the system. Another limiting factor is that the design of

an internal control system must reflect the fact that there are resource constraints, and the

benefits of controls must be considered relative to their costs.

Thus, while internal control can help an entity achieve its objectives, it is not a panacea.

Roles and Responsibilities

Everyone in an organization has responsibility for internal control.

Management

The chief executive officer is ultimately responsible and should assume "ownership" of the

system. More than any other individual, the chief executive sets the "tone at the top" that affects

integrity and ethics and other factors of a positive control environment. In a large company, the

chief executive fulfills this duty by providing leadership and direction to senior managers and

reviewing the way they're controlling the business. Senior managers, in turn, assign

responsibility for establishment of more specific internal control policies and procedures to

personnel responsible for the unit's functions. In a smaller entity, the influence of the chief

executive, often an owner-manager, is usually more direct. In any event, in a cascading

responsibility, a manager is effectively a chief executive of his or her sphere of responsibility. Of

particular significance are financial officers and their staffs, whose control activities cut across,

as well as up and down, the operating and other units of an enterprise.

Board of Directors

Management is accountable to the board of directors, which provides governance, guidance and

oversight. Effective board members are objective, capable and inquisitive. They also have a

knowledge of the entity's activities and environment, and commit the time necessary to fulfill

their board responsibilities. Management may be in a position to override controls and ignore or

stifle communications from subordinates, enabling a dishonest management which intentionally

misrepresents results to cover its tracks. A strong, active board, particularly when coupled with

effective upward communications channels and capable financial, legal and internal audit

functions, is often best able to identify and correct such a problem.

Internal Auditors

Internal auditors play an important role in evaluating the effectiveness of control systems, and

contribute to ongoing effectiveness. Because of organizational position and authority in an entity,

an internal audit function often plays a significant monitoring role.

Other Personnel

Internal control is, to some degree, the responsibility of everyone in an organization and

therefore should be an explicit or implicit part of everyone's job description. Virtually all

employees produce information used in the internal control system or take other actions needed to effect control. Also, all personnel should be responsible for communicating upward problems

in operations, noncompliance with the code of conduct, or other policy violations or illegal

actions.

A number of external parties often contribute to achievement of an entity's objectives. External

auditors, bringing an independent and objective view, contribute directly through the financial

statement audit and indirectly by providing information useful to management and the board in

carrying out their responsibilities. Others providing information to the entity useful in effecting

internal control are legislators and regulators, customers and others transacting business with

the enterprise, financial analysts, bond raters and the news media. External parties, however,

are not responsible for, nor are they a part of, the entity's internal control system. 

Organization of this Report 

This report is in four volumes. The first is this Executive Summary, a high-level overview of the

internal control framework directed to the chief executive and other senior executives, board

members, legislators and regulators.

The second volume, the Framework, defines internal control, describes its components and

provides criteria against which managements, boards or others can assess their control

systems. The Executive Summary is included.

The third volume, Reporting to External Parties, is a supplemental document providing guidance

to those entities that report publicly on internal control over preparation of their published

financial statements, or are contemplating doing so.

The fourth volume, Evaluation Tools, provides materials that may be useful in conducting an

evaluation of an internal control system.

What to Do

Actions that might be taken as a result of this report depend on the position and role of the

parties involved:

Senior Management

Most senior executives who contributed to this study believe they are basically "in control" of

their organizations. Many said, however, that there are areas of their company--a division, a

department or a control component that cuts across activities--where controls are in early stages

of development or otherwise need to be strengthened. They do not like surprises. This study

suggests that the chief executive initiate a self-assessment of the control system. Using this

framework, a CEO, together with key operating and financial executives, can focus attention

where needed.

Under one approach, the chief executive could proceed by bringing together business unit

heads and key functional staff to discuss an initial assessment of control. Directives would be

provided for those individuals to discuss this report's concepts with their lead personnel, provide

oversight of the initial assessment process in their areas of responsibility and report back

findings. Another approach might involve an initial review of corporate and business unit policies

and internal audit programs. Whatever its form, an initial self-assessment should determine

whether there is a need for, and how to proceed with, a broader, more in-depth evaluation. It

should also ensure that ongoing monitoring processes are in place. Time spent in evaluating internal control represents an investment, but one with a high return.

Board Members

Members of the board of directors should discuss with senior management the state of the

entity's internal control system and provide oversight as needed. They should seek input from

the internal and external auditors.

Other Personnel

Managers and other personnel should consider how their control responsibilities are being

conducted in light of this framework, and discuss with more senior personnel ideas for

strengthening control. Internal auditors should consider the breadth of their focus on the internal

control system, and may wish to compare their evaluation materials to the evaluation tools.

Legislators and Regulators

Government officials who write or enforce laws recognize that there can be misconceptions and

different expectations about virtually any issue. Expectations for internal control vary widely in

two respects. First, they differ regarding what control systems can accomplish. As noted, some

observers believe internal control systems will, or should, prevent economic loss, or at least

prevent companies from going out of business. Second, even when there is agreement about

what internal control systems can and can't do, and about the validity of the "reasonable

assurance" concept, there can be disparate views of what that concept means and how it will be

applied. 

Corporate executives have expressed concern regarding how regulators might construe public

reports asserting "reasonable assurance" in hindsight after an alleged control failure has

occurred. Before legislation or regulation dealing with management reporting on internal control

is acted upon, there should be agreement on a common internal control framework, including

limitations of internal control. This framework should be helpful in reaching such agreement.

Professional Organizations

Rule-making and other professional organizations providing guidance on financial management,

auditing and related topics should consider their standards and guidance in light of this

framework. To the extent diversity in concept and terminology is eliminated, all parties will

benefit.

Educators

This framework should be the subject of academic research and analysis, to see where future

enhancements can be made. With the presumption that this report becomes accepted as a

common ground for understanding, its concepts and terms should find their way into university

curricula.

We believe this report offers a number of benefits. With this foundation for mutual

understanding, all parties will be able to speak a common language and communicate more

effectively. Business executives will be positioned to assess control systems against a standard,

and strengthen the systems and move their enterprises toward established goals. Future

research can be leveraged off an established base. Legislators and regulators will be able to

gain an increased understanding of internal control, its benefits and limitations. With all parties

utilizing a common internal control framework, these benefits will be realized.