Understanding internal control.

• Author: Gauthier, Stephen J.
• Position: Committee of Sponsoring Organizations - Cover Story

The concept of internal control is hardly new. All the same, recent private sector scandals and subsequent federal legislation have significantly renewed interest in this important, but frequently neglected topic. This article will examine what every public sector financial manager and board member should know about internal control.

BACKGROUND

Until recent years, a response to the basic question, "What is internal control?" likely would have elicited a series of examples-segregation of incompatible duties, periodic bank reconciliations, use of receiving reports--rather than a true definition. That is to say, internal control tended to be viewed as a collective term used to describe a disparate assortment of policies and procedures rather than as a separate and coherent concept in its own right. Such was the situation that confronted the Treadway Commission on Fraudulent Financial Reporting when it first took up its mandate in the mid-1980s.

After examining the underlying causes of fraudulent financial reporting, the Treadway Commission placed much of the blame on inadequate managerial involvement with internal control. The commission assigned at least partial responsibility for this lack of involvement to a general failure to provide managers with a clear understanding of what internal control really is and why it should be a matter of concern to them.

In response to these findings, the various organizations that sponsored the Treadway Commission formed an ongoing Committee of Sponsoring Organizations that sought to remedy the deficiencies exposed by the Treadway Commission. The result of this effort was the groundbreaking report Internal Control--Integrated Framework, which was released by COSO in 1992. To this day, the "COSO Report" serves as the essential foundation for any serious discussion of internal control.

In the private sector, the COSO Report provides the criteria normally used for evaluating internal control, including the internal control assessments mandated for publicly traded companies by the federal Sarbanes-Oxley legislation that was passed in the wake of the Enron and WorldCom scandals. In the public sector, the Government Finance Officers Association in a recent recommended practice has taken the position that government financial managers, in fulfillment of their ethical responsibilities, should "obtain the information and training needed to meaningfully take responsibility for internal control," and "in particular" should obtain "a sound understanding of ... internal control as set forth by [COSO]." (1)

THE FUNDAMENTAL NATURE OF INTERNAL CONTROL

Regardless of the sector within which they serve (i.e., public, private, or not-for-profit), all managers must strive to: (1) operate effectively and efficiently, (2) produce reliable external financial reports, and (3) comply with applicable laws and regulations.

Responsible managers cannot leave the achievement of these objectives to chance. Rather, they must take concrete action to ensure the effectiveness and efficiency of operations, reliable financial reporting, and legal and regulatory compliance. It is the sum of these actions that constitute internal control. Put differently, internal control could be defined as the sum of the tools and techniques used by management to ensure that it achieves its objectives. Thus, by its very nature, internal control is fundamentally a managerial concern.

RESPONSIBILITY FOR INTERNAL CONTROL

An analogy may be useful in understanding the proper assignment of responsibility for internal control among managers, board members, and auditors. A student is primarily responsible for completing homework assignments. The reason for assigning primary responsibility to the student is as much practical as it is ethical; since the purpose of a homework assignment is to sharpen the student's skills, no one else can do a student's homework for the student without fundamentally compromising that objective. While a parent, tutor, or fellow student may provide valuable help to the student in completing an assignment, in the end, only the student's direct involvement can achieve the desired end.

That is not to say, of course, that parents or guardians can somehow absolve themselves of their own responsibility for the completion of their charges' homework on the grounds that it is the student who is primarily responsible. Parents or guardians remain ultimately responsible for ensuring that a student meets his or her responsibility for homework. Although parents or guardians cannot actually do the homework for the student, they have a duty to make sure the student does so. Finally, teachers and tutors, while they can be of invaluable assistance to both students and their parents or guardians, cannot replace either. In the end, homework remains the primary responsibility of the student and the ultimate responsibility of the parents or guardians.

This analogy holds true for internal control if the students, parents or guardians, teachers, and tutors of the previous example are replaced by management, the governing board, the independent auditor, and the internal auditor...