Internal controls are basically an organization’s protective armor. They are akin to Tony Stark’s legendary Iron Man suits, which offer him protection against the dangers that are posed by supervillains. In the same way, internal controls protect your organization from risks that typify the information technology environment.
Internal Controls Explained
An internal control system protects your business from reputational, financial, and strategic risks. In accounting and auditing terms, these controls provide an assurance that your business setup will remain operationally efficient and effective.
Internal control systems provide reliable financial reporting as required by regulatory agencies that track credit, capital, and investment risks. For instance, Section 404of the SOX Act of 2002 stipulates that companies must file reports of their financial dealings and also provide proof that their procedures guarantee fraud prevention. This act protects investors by addressing typical financial uncertainties.
Creating Internal Controls: Objectives of the First Step
Most organizations feel that the initial and most important stage as far as establishing an internal control system is concerned, is identifying risks that need to be mitigated. Until your organization has an idea about how to position itself, you will find it difficult to formulate appropriate objectives. Addressing common risks that are inherent in those objectives will be equally difficult.
To put this into perspective, if Iron Man is fighting Thanos, he will need something that will help him withstand the villain’s potent magic. When fighting Hulk, he also needs to use an armor that can withstand the monster’s strength. Therefore, your business objectives determine risks faced by your business in the same way.
If you want to gain a foothold in the healthcare services industry, you must determine the risks that characterize electronic personal health information (ePHI). Any organization that wishes to succeed in the industry needs to accurately explore the internal controls that are stated in the Health Insurance Portability and Accountability Act of 1996.
If your organization wants to enter the financial services industry, you must likewise look at regulations and standards that govern the operation of banks. This will ensure that proper internal controls are put in place. Once such objectives are determined, you will find it easier to move forward and define the risks involved.
How Risk Management Supports Internal Controls
Once the management has defined the goals and objectives of your organization, you can begin looking at risks that are related to the strategic decisions. The inherent values of governance, risk, and compliance focus on defining common risks with the objective of enabling your organization to comply with industry standards and regulations. Monitoring also needs to be done to guarantee that all processes are working as required.
You must keep in mind that risks faced by your organization vary. For instance, physical risks are different from system intrusion risks. In as much as both sets of risks require controls, physical access risks may require you to review individual whereas system intrusion risks require you to review encryption and firewalls. Strategic corporate risk management entails creating structures that support procedures put in place to protect your assets and resources.
The Five Main Internal Controls
When you are creating an effective system of internal controls, there’s need to pool resources that will help you. The COSO Framework outlines the 5 types of internal control systems besides offering definitions to help organizations. When the SEC established the Committee of Sponsoring Organizations of the Treadway Commission, auditors and accountants were brought on board to help review fraudulent reporting. The SEC created the COSO Framework and its 5 interrelated components in 2013.
The Control Environment
Enterprise risk management and internal audit professionals define the control environment as the way that senior management and the board of directors approach the importance of the internal control system within an organization. This is typically done by reviewing actions taken through an organization’s corporate culture.
The management and directors must confirm their values through the organizational structure and operating styles that they put in place. By formalizing the segregation of duties, for instance, the management will show that it is not only acting according to industry standards but also holds itself wholly accountable.
Risk Assessment& Control Activities
When you review risks, it doesn’t simply stop with identifying them. This process also involves creating suitable preventive strategies aimed at mitigating these risks. Defining risks means reviewing them internally and externally. If your company outsourced this work to vendors, it is also advisable to protect yourself against threats that these vendors pose.
Internal mechanisms, procedures, and policies are types of control activities. You are not only supposed to act but also document all decisions regardless of how trivial they may look. This helps portray your company’s efficient coverage of risks.
The Centrality of Information and Communication
The board of directors and management often communicates whenever risks are being reviewed or policies established, these conversations also need to be maintained during the implementation of such decisions. Internally-generated reports should be provided to shareholders and auditors whenever required since they attest to the management’s commitment to documentation and sharing of information.
In addition, decisions such as the separation of payroll and human resource responsibilities and the creation of reporting channels such as whistleblower policies demonstrate the management’s commitment towards ensuring that there is an unobstructed flow of information within the organization. You should keep in mind that communication must always be appropriate to the authority level of employees.
Designing Internal Controls
To design an internal control system that suits your company, you must first pinpoint a business process that relates to the integration of your information systems and financial reporting. Organizations must design procedures pertaining to the initiation, processing, correcting, transfer, and reporting of all cash and electronic transactions. You must also review the financial reporting processes that you have put in place, and how your non-standard transactions are recorded. This will go a long way in easing the pain of internal control and monitoring.
Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT. Learn more at ReciprocityLabs.com.
