Components of an internal control system
/A system of internal control has five components. An accountant must be aware of these components when designing an accounting system, as does anyone who audits the system. The components of an internal control system are noted below.
Control Environment
The control environment is the attitude of management and their employees regarding the need for internal controls. If the controls are taken seriously, this greatly enhances the robustness of the system of internal control. Conversely, if management tends to work around the system of controls, then it is highly likely that employees will ignore the controls, too.
Risk Assessment
The risk assessment is the process of reviewing the business to see where the most critical risks lie, and then designing controls to address those risks. This assessment must be conducted on a regular basis, to take into account any new risks introduced by changes in the business. This is a more important issue when a business is constantly changing its products and acquiring other businesses, since these activities imply the existence of significant changes to the underlying processes, which introduce new risks.
Control Activities
Control activities are the use of accounting systems, information technology, and other resources to ensure that appropriate controls are put in place and operating properly. For example, there may be accounting systems in place to periodically conduct inventory audits and fixed asset audits. In addition, there may be off-site backups to minimize the risk of lost data.
Related AccountingTools Course
Information and Communication
Information about controls should be communicated to management in a timely manner, so that shortfalls can be addressed promptly. The amount of information communicated should be appropriate to the needs of the recipient. Thus, major control breaches should be communicated to senior management at once, while minor issues can be dealt with at a lower level of the organization. In order to communicate control issues in a timely manner, there must be a system in place to identify control issues promptly and put these concerns in the hands of someone with the authority to forward issues to people at any level of an organization’s reporting hierarchy.
Monitoring
The monitoring component of an internal control system ensures that controls are functioning effectively over time. It involves regular assessments, audits, and corrective actions to maintain the integrity of financial reporting and operational processes. The key aspects of monitoring include the following:
Ongoing monitoring activities. Includes day-to-day procedures that are built into business operations. These procedures include supervisory reviews, reconciliations, and automated system alerts, and help to detect and correct issues in real time.
Separate evaluations. Includes periodic assessments that are performed by internal audit teams or external auditors. These assessments focus on testing the design and effectiveness of controls, and are typically scheduled annually or semi-annually.
Identification and reporting of deficiencies. Any weaknesses or failures in internal controls are identified and reported. Deficiencies are categorized as control deficiencies, significant deficiencies, or material weaknesses, depending on their severity.
Corrective actions. Management implements necessary corrective measures, which ensure that previously identified issues are resolved and do not recur.
Related Articles
Continuous Controls Monitoring
Evaluation of Internal Controls