What is internal control

Definition and Historical Foundations of Internal Control

  • Definition of Internal Control (OSO):

    • Internal control is defined by OSO as a process affected by an entity's board of directors, management, and other personnel.
    • It is designed to provide reasonable assurance regarding the achievement of objectives related to operations, reporting, and compliance.

  • Historical Context and the Treadway Commission:

    • The original COSO internal control integrated framework was established following recommendations from the Treadway Commission.
    • The Treadway Commission specifically identified that existing approaches to designing and evaluating internal controls were insufficient.
    • Prior to the issuance of the 1992 framework, internal control approaches suffered from key structural limitations:
    • Most approaches focused narrowly on individual control activities (e.g., segregation of duties, testing computer systems).
    • There was no overarching framework to guide how to design, identify, and evaluate systems of internal control.
    • Auditors and internal financial personnel relied primarily on checklists to determine whether specific controls were present.
    • Without an overarching framework, checklist approaches provided little to no linkage to the organizational objectives that an effective internal control process could address.

  • The 1992 Framework Foundation:

    • The 1992 framework (the original internal control framework) resolved pre-existing limitations by closely associating internal control with accomplishing organizational objectives.
    • It was built on a foundation of five fundamental components:
    • Control Environment
    • Risk Assessment
    • Control Activities
    • Information and Communication
    • Monitoring

Evolution and Seven Significant Changes in the Updated Framework

  • Overview of Framework Redesign:

    • The redesign of the internal control integrated framework in 2013 introduced seven significant changes to modernize and expand internal control design, implementation, and evaluation.

  • Change 1: Broadened Scope of the Reporting Objective:

    • Modifications were made to the financial reporting objective to establish a broader objective of reporting.
    • This change expanded both the scope of reporting and the media through which reporting may be conducted.
    • In past distinctions (such as in 2022), the internal control framework dealt specifically with financial reporting; this update aligns the thought leadership behind CUSTO's internal control framework with its position in the enterprise risk management framework.

  • Change 2: Explicit Relationship Between Objectives, Risks, and Controls:

    • Emphasizes the direct relationship between objectives, risks, and internal control.
    • Establishes that internal control exists specifically to reduce or mitigate risk to an acceptable level.

  • Change 3: Integrated and Synergistic Operation:

    • Emphasizes the integrated nature of internal control systems.
    • Evaluating the effectiveness of internal control requires analyzing how all five components operate together synergistically to achieve objectives.

  • Change 4: Introduction of a Principles-Based Approach:

    • Introduces a principles approach to evaluating each component of the internal control framework.
    • Represents a dramatic departure from the evaluation approach utilized in the original 1992 framework.

  • Change 5: Explicit Inclusion of Fraud Risk Assessment:

    • Makes explicit the requirement to assess broad risk as part of the mandatory risk analysis.
    • Broad risk assessment was previously emphasized more in enterprise risk management, but the internal control framework was explicitly adjusted to cover fraud risk as well.

  • Change 6: Expanded Emphasis on Compliance and Operations Objectives:

    • Expands the discussion and emphasis regarding the importance of compliance and operations objectives.
    • Reiterates that the principles of good internal control are fully appropriate for operations and compliance objectives.
    • Historical Context: The COSO internal control framework was initially established due to a series of financial reporting failures and fraudulent financial reporting. Consequently, prior frameworks (such as FSO's internal control framework) focused excessively on internal control over financial reporting at the expense of operations and compliance objectives.

  • Change 7: Updated Guidance for Emerging Areas:

    • Provides updated guidance in emerging business areas, specifically:
    • Information Technology (IT)
    • Organizational relationships
    • Dependencies
    • Monitoring
    • Updates were necessary due to substantial changes in the nature of business over the preceding twenty plus years.

Five Fundamental Components of Internal Control

  • 1. Control Environment:

    • Sets the tone of the organization.
    • Functions as the foundation for all other components of internal control.

  • 2. Risk Assessment:

    • Primary purpose is to identify and analyze relevant risks that threaten the achievement of the entity's objectives.

  • 3. Control Activities:

    • Comprises policies and procedures that ensure management's objectives and directives are carried out effectively.
    • Specific examples include:
    • Approvals and authorizations
    • Verifications
    • Evaluation
    • Safeguarding of assets
    • Security
    • Segregation of duties

  • 4. Information and Communication:

    • Ensures that relevant information is identified, captured, and communicated in a timely fashion.
    • Guarantees that individuals have access to internally and externally generated information needed for decision-making purposes.

  • 5. Monitoring:

    • Functions as the feedback loop for the internal control system.
    • Provides a facility for management and stakeholders to evaluate the effectiveness of the internal control framework and the overall system of internal controls within the organization.