发布时间 : 星期二 文章如何监测内部控制的外文翻译更新完毕开始阅读7c3df155fad6195f302ba610
The Journal of Corporate Accounting & Finance / May/June 2008
How to Monitor Internal Controls
1
Jan Colbert
Introduction ：
Internal controls are critical for any organization to function effectively. And with an effective system of controls in place, you minimize risk. But how should you monitor controls to ensure their quality and performance?
Internal control is critical to the effective functioning of any organization. Boards of directors, CEOs, and internal auditors all work to attain the entity’s objectives; the system of internal control is the means by which these parties help to ensure that those objectives are met. Controls help an entity to operate efficiently. In addition, with an effective system of controls in place, risk is minimized. Also, controls serve to promote the reliability of both operations and information that is produced relative to the operations. DISCUSSION DOCUMENT ISSUED
In its seminal document “Internal Control—Integrated Framework,” the Committee of Sponsoring Organizations of the Treadway Commission (COSO; 1992) defines internal control as: A process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations. 2
The Committee went on to explain that a system of internal control includes five components. They are: ? control environment, 1
Jan Colbert, CIA, CPA, Cr. FA, PhD, is a professor of accounting at Eastern Kentucky University in Richmond. She writes on COSO topics, the Sarbanes-Oxley Act, corporate governance issues, internal controls, and other matters. Dr. Colbert teaches auditing and assurance services, as well as various statistics, accounting, and corporate governance courses in the MBA program.
? risk assessment,
? information and communication, ? control activities, and ? monitoring.
COSO’s definition and the five components have proven useful to a variety of groups, including boards of directors and CEOs. Respectively, these groups have responsibilities for oversight of a system of internal control and for the design and operation of the system. Further, internal auditors have found COSO’s guidance useful. This group may be asked by the board or management to test controls.
COSO recently published a Discussion Document that addresses monitoring, one of the five components originally identified in COSO’s 1992framework. The publication is entitled “Internal Control— Integrated Framework: Guidance on Monitoring Internal Control Systems” (COSO, 2007). In the document, COSO stresses the significance of monitoring, a control component entities often underutilize.
Because boards of directors, CEOs, and internal auditors all play valuable roles with respect to an entity’s internal control, each component of internal control, including monitoring, is significant to all of these groups. Also, external auditors have an interest in monitoring. The independent audit firm is mandated by the Sarbanes-Oxley Act of 2002 to examine the client’s system of internal control. All five components, including monitoring, must be considered. Further, the internal control audit must be integrated with the examination of the financial statements. Prior to the integrated audit, management, led by the CEO and perhaps with the support of the internal audit activity, assesses the effectiveness of the system of internal control. The external auditor then opines on the controls. The board of directors, in its oversight role, will peruse the reports produced by internal audit and by management and the CEO. The guidance in the Discussion Document regarding monitoring serves as an aid to each of these groups as they labor in their respective roles. WHAT IS MONITORING? Monitoring constitutes assessing the quality of the performance of the system of internal control over time. Such assessments of the functioning of controls help the entity to ascertain that controls are operating effectively. Monitoring as Part of Internal Control In performing monitoring activities, appropriate personnel take part in examining both the design of the system and its operation. Such examinations must be performed in a timely manner in order
to provide the maximum benefit to the entity. Management is then responsible for taking appropriate action in response to findings. Parties with an interest in internal control can place significant reliance on the system of internal control if both appropriate monitoring activities are conducted and management acts on the results. When a high degree of reliance can be attached to the monitoring aspect of internal control, testing of other aspects of the system, especially control activities, might appropriately be reduced. Ongoing, Continuous Monitoring Some monitoring activities will be ongoing and continuous. That is, they are built into the system and are executed along with the normal activities of operations. Typically, continuous monitoring activities are automated. The system then produces exception reports that are reviewed by management, and appropriate actions can be taken. Separate Monitoring
Besides employing ongoing, continuous monitoring techniques, the entity might also choose to utilize separate monitoring activities. These entail distinct monitoring by management or perhaps by the internal auditors. Separate monitoring may take place as a result of the information gathered from ongoing, continuous activities or in response to specified risks. DESIGNING MONITORING
As managers design the system of internal control, they will identify risks to the entity of achieving its objectives. These risks should be prioritized and resources allocated to address the risks. As management designs its system of internal control, consideration will be given to who will be participating in the monitoring activities, when and how often they will be performed, and to the elements of monitoring. Each of these aspects of the design of the monitoring component is discussed below and noted in Exhibit 1. Exhibit 1
Designing the Monitoring Component of Internal Control ? Identify risks and prioritize.
? Determine who will perform the monitoring activities. ? Consider the timing of monitoring activities.
? Decide how often monitoring activities will occur. Risks, Priorities, Resources
To appropriately design the system of internal control, management begins by assessing the risks the organization faces of not achieving its objectives. A system of internal control, including the monitoring component, can then be designed to
address those risks. To most effectively utilize monitoring activities, they should be prioritized. That is, for transactions and events that carry more risk and, thus, are more critical, monitoring activities should be increased. Such activities may be performed more often. An alternative is that there might be greater coverage during each examination. For example, if sales returns for a manufacturer have increased due to poor quality, the company might elect to inspect more product before shipment, or inspections could take place daily rather than on a weekly cycle.
Sufficient resources must be devoted to monitoring activities. By designating appropriate levels of funds, management sends a strong message as to how significant monitoring activities are.
Besides monitoring, another significant aspect of the design of the system of internal control relates to the control environment. The control environment refers to the tone at the top of the organization. When the board and the CEO stress the critical nature of the monitoring component of the system, these parties send a strong message.
One way of operationalizing the tone at the top is to establish an organizational structure conducive to the enhancement of controls. Qualified, dedicated personnel should then be hired to implement and operate the system. As part of the monitoring component of internal control, formal channels of communication with those empowered to take action should be established. The results of the monitoring activities should quickly be channeled to individuals who have the authority and the capability to react. Timely corrective actions help the organization achieve its objectives in an effective and efficient manner.
Who Performs Monitoring?
For monitoring to be effective, appropriate personnel must perform the activities. Individuals may engage in monitoring as one aspect of their work. For others, such as inspectors, quality control personnel, and internal auditors, monitoring is the focus of their positions. Management must design the system of internal control such that monitoring occurs and is conducted in a timely manner by knowledgeable employees. Only then can the results of monitoring be addressed. Entity personnel must clearly understand what information can be acted upon at the level of the individual receiving the results and what should be forwarded to the next