Starting with the obvious, one might ask, “How important is the development of a system of internal control to a board of directors?” A secondary question arises shortly thereafter, “What expertise does our organization have in developing such a system?”
In 1992, and as amended in 1994, the COSO (Committee of Sponsoring Organizations of the Treadway Commission) Study defined internal control as;
“A process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
In the context of history repeating itself with scandals, internal control has been established as a fundamental responsibility of every organization’s board of directors. Although it may be delegated to management or others, ultimate responsibility attaches to every board.
Using the example of an automobile, it needs both an accelerator and a brake. An organization needs both a plan of operation and a system of internal control. Adopting a plan of operation without a system of internal control is similar to driving an automobile without the use of a braking mechanism. It is dangerous and negligent. In the context of a board’s responsibility to exercise due diligence and due care, it is imperative that every board ensure that an adequate system of internal control is developed and implemented.
The development of a long range plan and the utilization of an annual budgeting process comprise two important components to an overall system of internal control. But adequate internal control involves much more. It begins with the development and maintenance of an appropriate cultural environment that embraces high ethical standards. This is often referred to as the “Control environment”. In addition, an adequate system of internal control includes appropriate risk assessment, control activities, information and communication, and monitoring. Another dimension involves how an organization structures itself to achieve its control objectives and implement its components.
A board’s responsibility to effect an adequate system of internal control is fundamental to its core responsibilities. Nevertheless, few boards or their organizations have the experience and expertise to design and develop internal control systems. Still, auditors will evaluate an organization’s system of internal control every time they audit its financial statements.