Question

When looking at the definition of internal control as contained in COSO’s Internal Control-Integrated Framework and the professional standards are quite broad and comprehensive.

1. Define internal control and its purpose.

2. Explain the major concepts that are included in the definition of internal control.

Answer 1

The Committee of Sponsoring Organizations (COSO) came out with internal controls framework in 2013. It defined internal control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance of the achievement of objectives in the following categories:

• Effectiveness and efficiency of operations
• Reliability of financial reporting
• Compliance with applicable laws and regulations”

Thus, internal controls are the controls formulated by the management in an organisation to improve its operations, financial reporting and compliances. The objectives of internal controls is mainly with respect to the user of the financial statements and include:

1. Effectiveness and efficiency of operations: an organisation defines and documents various operational internal controls which needs to be tested and updated regularly. Operating controls pertain to the day to day operations of the entity and its effectiveness and efficiency suggests that the operations adhere to professional standards.

2. Reliability of financial reporting: Internal controls will ensure that the financial reporting and financial statement adhere to various professional standards.

3. Compliance with applicable laws and regulations: Compliance to Internal controls will suggest that an entity has complied with various laws and regulations that are applicable to them.

In an “effective” internal control system, the following five components will help an organisation achieve its objectives:

1. Control environment: Various formulated policies and procedures, Management Values, Board of Directors, Audit Committee, Organisational structure, assignment of responsibility and authority etc.

2. Risk Assessment: Risk identification, risk analysis, objectives of the management at entity level and various process level, changes etc

3. Control Activities: Policies and Procedures, security, network security, backups etc.

4. Information and Communication: Quality and effectiveness of information and communication.

5. Monitoring: Regulation monitoring of processes, evaluations, reporting deficiencies etc