E.16 COSO Internal Control—Integrated Framework

  1. This procedure is to acquaint all management personnel with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) report. The report provides a basis for mutual understanding of internal control and its benefits and limitations.

  2. The following data was extracted from the Executive Summary of Internal Control—Integrated Framework. That document was prepared in response to recommendations of the United States National Commission on Fraudulent Financial Reporting, commonly referred to as the Treadway Commission. COSO, of which the Institute of Internal Auditors (IIA) is a member, was formed to support implementation of Treadway Commission recommendations.

  3. Following is an introductory discussion of internal control from the Committee of Sponsoring Organizations: Executive Summary, pages 1-5, ©AICPA, reprinted with permission from the American Institute of Certified Public Accountants, Inc., Jersey City, New Jersey.

What Internal Control Is

  1. Internal control means different things to different people. This causes confusion among business people, legislators, regulators, and others. Resulting miscommunication and different expectations cause problems within an enterprise. Problems are compounded when the term, if not clearly defined, is written into law, regulation, or rule.

  2. This report deals with the needs and expectations of management and others. It defines and describes internal control to

    1. establish a common definition serving the needs of different parties; and

    2. provide a standard against which business and other entities—large or small, in the public or private sector, for profit or not—can assess their control systems and determine how to improve them.

  3. Internal control is broadly defined as a process, affected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

    1. Effectiveness and efficiency of operations

    2. Reliability of financial reporting

    3. Compliance with applicable laws and regulations

  4. The first category addresses an entity's basic business objectives, including performance and profitability goals and safeguarding of resources. The second relates to the preparation of reliable published financial statements, including interim and condensed financial statements and selected financial data derived from such statements, such as earnings releases, reported publicly, as well as controls related to safeguarding of assets. The third deals with complying with those laws and regulations to which the entity is subject. These distinct but overlapping categories address different needs and allow a directed focus to meet the separate needs.

  5. Internal control systems operate at different levels of effectiveness. Internal control can be judged effective in each of the three categories, respectively, if the board of directors and management have reasonable assurance that

    1. they understand the extent to which the entity's operations objectives are being achieved;

    2. published financial statements are being prepared reliably; and

    3. applicable laws and regulations are being complied with.

  6. While internal control is a process, its effectiveness is a state or condition of the process at one or more points in time.

  7. Internal control consists of five interrelated components. These are derived from the way management runs a business, and are integrated with the management process. Although the components apply to all entities, small and mid-size companies may implement them differently than large ones. Its controls may be less formal and less structured, yet a small enterprise can still have effective internal control. The components are as follows:

    1. Control Environment—The control environment sets the tone of an organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values, and competence of the entity's people; management's philosophy and operating style; the way management assigns authority and responsibility, and organizes and develops its people; and the attention and direction provided by the board of directors.

    2. Risk Assessment—Every entity faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory, and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change.

    3. Control Activities—Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the entity's objectives. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties.

    4. Information and Communication—Pertinent information must be identified, captured and communicated in a form and timeframe that enables people to carry out their responsibilities. Information systems produce reports containing operational, financial and compliance-related information, which make it possible to run and control the business. They deal not only with internally generated data, but also with information about external events, activities, and conditions necessary to informed business decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across and up the organization. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information upstream. There also needs to be effective communication with external parties, such as customers, suppliers, regulators, and shareholders.

    5. Monitoring—Internal control systems need to be monitored—a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the board.

  8. There is synergy and linkage among these components, forming an integrated system that reacts dynamically to changing conditions. The internal control system is intertwined with the entity's operating activities and exists for fundamental business reasons. Internal control is most effective when controls are built into the entity's infrastructure and are a part of the essence of the enterprise. "Built in" controls support quality and empowerment initiatives, avoid unnecessary costs, and enable quick response to changing conditions.

  9. There is a direct relationship between the three categories of objectives, which are what an entity strives to achieve, and components, which represent what is needed to achieve the objectives. All components are relevant to each objectives category. When looking at any one category—the effectiveness and efficiency of operations, for instance—all five components must be present and functioning effectively to conclude that internal control over operations is effective.

  10. The internal control definition—with its underlying fundamental concepts of a process, affected by people, providing reasonable assurance—together with the categorization of objectives and the components and criteria for effectiveness, and the associated discussions, constitute this internal control framework.

What Internal Control Can Do

  1. Internal control can help an entity achieve its performance and profitability targets, and prevent loss of resources. It can help ensure reliable financial reporting. And it can help ensure that the enterprise complies with laws and regulations, avoiding damage to its reputation and other consequences. In sum, it can help an entity get to where it wants to go, and avoid pitfalls and surprises along the way.

What Internal Control Cannot Do

  1. Unfortunately, some people have greater, and unrealistic, expectations. They look for absolutes and believe the following:

    1. Internal control can ensure an entity's success—that is, it will ensure achievement of basic business objectives or will, at the least, ensure survival.
      Even effective internal control can only help an entity achieve these objectives. It can provide management information about the entity's progress, or lack of it, toward their achievement. But internal control cannot change an inherently poor manager into a good one. And, shifts in government policy or programs, competitors' actions or economic conditions can be beyond management's control. Internal control cannot ensure success, or even survival.

    2. Internal control can ensure the reliability of financial reporting and compliance with laws and regulations.
      This belief is also unwarranted. An internal control system, no matter how well conceived and operated, can provide only reasonable—not absolute—assurance to management and the board regarding achievement of an entity's objectives. The likelihood of achievement is affected by limitations inherent in all internal control systems. These include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of simple error or mistake. Additionally, controls can be circumvented by the collusion of two or more people, and management has the ability to override the system. Another limiting factor is that the design of an internal control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs.

  2. Thus, while internal control can help an entity achieve its objectives, it is not a panacea.

Roles and Responsibilities

  1. Everyone in an organization has responsibility for internal control:

    1. Management—The chief executive officer is ultimately responsible and should assume "ownership" of the system. More than any other individual, the chief executive sets the "tone at the top" that affects integrity and ethics and other factors of a positive control environment. In a large enterprise, the chief executive fulfills this duty by providing leadership and direction to senior managers and reviewing the way they're controlling the business. Senior managers, in turn, assign responsibility for establishment of more specific internal control policies and procedures to personnel responsible for the unit's functions. In a smaller entity, the influence of the chief executive, often an owner-manager, is usually more direct. In any event, in a cascading responsibility, a manager is effectively a chief executive of his or her sphere of responsibility. Of particular significance are financial officers and their staffs, whose control activities cut across, as well as up and down, the operating and other units of an enterprise.

    2. Audit Committee—Management is accountable to the Auditor General, who provides governance, guidance, and oversight. Effective Audit Committee members are objective, capable, and inquisitive. They also have knowledge of the activities and environment of the Office of the Auditor General of Canada (Office), and commit the time necessary to fulfill their responsibilities. Management may be in a position to override controls and ignore or stifle communications from subordinates, enabling a dishonest management, which intentionally misrepresents results, to cover its tracks. A strong, active committee, particularly when coupled with effective upward communications channels and capable financial, legal, and internal audit activities, is often best able to identify and correct such a problem.

    3. Internal Auditors—Internal auditors play an important role in evaluating the effectiveness of control systems, and contribute to ongoing effectiveness. Because of organizational position and authority in an entity, an internal audit activity often plays a significant monitoring role.

    4. Other Personnel—Internal control is, to some degree, the responsibility of everyone in an organization and therefore should be an explicit or implicit part of everyone's job description. Virtually all employees produce information used in the internal control system or take other actions needed to effect control. Also, all personnel should be responsible for communicating upward problems in operations, noncompliance with the code of conduct, or other policy violations or illegal actions.

  2. A number of external parties often contribute to achievement of an entity's objectives. External auditors, bringing an independent and objective view, contribute directly through the financial statement audit and indirectly by providing information useful to management and the board in carrying out their responsibilities. Others providing information to the entity useful in effective internal control are legislators and regulators, customers and others transacting business with the enterprise, financial analysts, bond raters, and the news media. External parties, however, are not responsible for, nor are they a part of, the entity's internal control system.

Last modified:
2018-02-22