Internal Control structure and Management philosophy

An effective internal control structure includes a company’s plan of organization and all the procedures and actions it takes to:

• Ensure compliance with company policies and federal law.
• Protect its assets against theft and waste.
• Ensure accurate and reliable operating data and accounting reports.
• Evaluate the performance of all personnel to promote efficient operations.

Companies protect their assets by:

Segregation of employee duties Segregation of duties requires that someone other than the employee responsible for safeguarding an asset must maintain the accounting records for that asset. Also, employees share responsibility for related transactions so that one employee’s work serves as a check on the work of other employees.

Assignment of specific duties to each employee When the responsibility for a particular work function is assigned to one employee, that employee is accountable for specific tasks. Should a problem occur, the company can quickly identify the responsible employee.

Rotation of employee job assignments Some companies rotate job assignments to discourage employees from engaging in long-term schemes to steal from them. Employees realize that if they steal from the company, the next employees assigned to their positions may discover the theft.

Use of mechanical devices Companies use several mechanical devices to help protect their assets. Check protectors (machines that perforate the check amount into the check), cash registers, and time clocks make it difficult for employees to alter certain company documents and records.

Record Keeping. Companies should maintain complete and accurate accounting records. One or more business documents support most accounting transactions. These source documents are an integral part of the internal control structure. For optimal control, source documents should be serially numbered.

Employees. Internal control policies are effective only when employees follow them. To ensure that they carry out its internal control policies, a company must hire competent and trustworthy employees. Thus, the execution of effective internal control begins with the time and effort a company expends in hiring employees. Once the company hires the employees, it must train those employees and clearly communicate to them company policies, such as obtaining proper authorization before making a cash disbursement. Frequently, written job descriptions establish the responsibilities and duties of employees. The initial training of employees should include a clear explanation of their duties and how to perform them.

Legal requirements. In publicly held corporations, the company’s internal control structure must satisfy the requirements of govt. law.

The components of internal control are:

Risk assessment. After the entity sets objectives, the risks (such as theft and waste of assets) from external and internal sources must be assessed. Examining the risks associated with each objective allows management to develop the means to control these risks.

Control environment. The control environment is the basis for all other elements of the internal control structure. The control environment includes many factors such as ethical values, management’s philosophy, the integrity of the employees of the corporation, and the guidance provided by management or the board of directors.

Control activities. To address the risks associated with each objective, management establishes control activities. These activities include procedures that employees must follow. Examples include procedures to protect the assets through segregation of employee duties and the other means we discussed earlier.

Monitoring. After the internal control structure is in place, the firm should monitor its effectiveness so that it can make changes before serious problems arise. In testing components of the internal control structure, companies base their thoroughness on the risk assigned to those components.

Information and communication. Information relevant to decision making must be collected and reported in a timely manner. The events that yield these data may come from internal or external sources. Communication throughout the entity is important to achieve management’s goals. Employees must understand what is expected of them and how their responsibilities relate to the work of others. Communication with external parties such as suppliers and shareholders are also important.

The internal control environment includes five factors.

Competence of the entity’s people: Competence is the knowledge and skills necessary for particular functions. So does an organization set up the tone of hiring only competent employees? First, management determines the knowledge and skills required for each position, then establishes the job descriptions for these positions. Furthermore, there is a well-designed hiring process and performance review process to ensure that new hires and employees are competent to perform their assigned tasks and assist the organization in achieving their objectives.

Integrity and ethical value: Many organizations seek a high level of integrity and ethical value. But how do organizations obtain them? Usually, those organizations have a clear Code of Conduct and/or Conflict of Interests policies. They periodically communicate these polices to employees to promote honesty and integrity. In addition, some organizations adopt business best practices and emphasize internal controls, which is also clear evidence that the organizations are striving to integrate the integrity and ethical value into the daily business operations.

Management’s Philosophy and Operating style: Management may not achieve its business objectives if it does not introduce and maintain a philosophy and operating style that supports the business objectives and strategies. Management’s philosophy and operating style include management’s attitudes towards the organization objectives, the approaches to minimize the business risks and attitude toward internal controls over financial reporting. For example, if management sets up an unrealistic financial goal and aggressively persuades employees to achieve the goal, what will happen? The chance of misstatement in financial statements becomes higher.

Direction provided by the board of directors: An effective Board of Directors and Audit Committee provide an important oversight function and, because of management’s ability to override controls, they play an important role in the control environment, helping to set a positive tone at the top. For private companies, often there is no Audit Committee. However, to have the Board of Directors is very important for private companies as well. It oversees the organization’s plans and performance, provides management directions with experiences, and oversees the organization’s internal control function.

Authority and Responsibility: The control environment is greatly influenced by the extent to which individuals recognize that they will be held accountable. Accountability plays a critical role in carrying out internal controls in an organization. Sections 302 and 404 of the Sarbanes-Oxley Act (SOX) hold management in an organization accountable for financial reporting to ensure financial reporting is accurate and timely. In the organization, management holds employees accountable for all activities and business practices to ensure the organization is in compliance with SOX. To have an accurate, effective and timely financial reporting system, management must ensure that adequate reporting relationships and authorization hierarchies are in place.