BASIC UNDERSTANDING OF INTERNAL CONTROL CONCEPTS AND CATEGORIES

Introduction

In European public financial management circles great attention is currently being given to the concept and the activity of “control”.  The “Road Map to an Integrated Internal Control Framework” is a top priority for the European Commission and Member States.  This article tries to develop a broader understanding of what this thing called control is and proposes some elements of good practice for control.

Traditionally, control in the EU is normally conceptualised or placed into categories such as ex ante, ex post, ongoing.  To many, this categorising can seem confusing and also tends to focus too much on controls of transactions or the timing of detailed control activities.  In the modern risk-based world, both in the public and private sectors, internal control is now seen as a total concept with a common language developed throughout the world.  Control is not limited to certain phases of activity but is present throughout the operation and functioning of an organisation.  Every operation and function is subject to internal control and can no longer be seen in isolation from other parts of the organisation.  Concentrating solely on certain phases or timings of work, e.g. ex ante, and using these rather old fashioned terms, is not necessarily the most effective or transparent of ways of understanding what control actually is.

Internal control can also mean different things to different persons. This may cause confusion or misunderstanding among key interested parties. Problems are compounded when the term, if not clearly defined, is written into law, regulations or rules. To help in the understanding of control and controls they may be usefully and interestingly divided into different types, levels and concepts.  Below is an attempt to provide explanations and information about control and controls, which will hopefully aid understanding.

Types of Control

Types of controls can be categorized as follows:

Preventive – designed to prevent the occurrence of inefficiencies, errors or irregularities.  These cannot guarantee that the controlled factor will not occur, but they do reduce the chance of it occurring.  Examples include division of duties and authorisation controls.

Detective – designed to detect and correct errors, inefficiencies or irregularities.  They may not give absolute assurance since they operate after an event has occurred or an output has been produced but they should reduce the risk of undesirable consequences as they enable remedial action to be taken.  Detective controls are most effective when they form part of a feedback loop in which their results are monitored and used to improve procedures or preventive controls.  Examples include post payment confirmation, stock verification and bank reconciliations.

Directive – designed to cause or encourage actions and events necessary to the achievement of objectives.  Examples include clear definition of policies, the setting of targets, and adequate training and staffing.

In practice, the above categories may not be clearly distinguished and a single control may operate to cover two or more functions.  Supervision, for example, covers all three types. Well organised and managed corrective actions and processes are, obviously and logically, also necessary when control weaknesses and failures occur.

Levels of Control

External auditors often use a control framework comprising of a managerial hierarchy to identify levels of controls within an organization, and this is helpful for them in determining their audit approach. They like to concentrate on senior management controls as they often include processes and systems to ensure that lower levels of controls are working satisfactorily. This control framework consists of:

At the top, senior management will use strategic information in order to make decisions affecting the business as a whole and the component activities within the business.  Controls are likely to involve a high level of aggregation and a low level of detail.

Beneath this level, middle management controls will be focused on distinct sets of data at a much greater level of detail.  Controls at this level will include budgetary monitoring and variance analysis, exception reporting and monitoring of progress.  Controls can also take the form of periodic reviews, including those by Internal Audit.

The supervisory and clerical level is the lowest control level.  At this level, control is based on detailed control procedures relating to small groups of transactions or individual transactions.  These include controls over information and information processing.
Entity Level Controls

Controls are everywhere and permeate an entity.  They have a significant impact on how it achieves its financial reporting and other objectives.  Public institutions and organisations should design and ensure the operating effectiveness of entity level controls in addition to detailed control activities at the process or transaction levels.  These controls are exemplified by the control environment itself, which includes the tone at the top, the corporate code of conduct, policies and procedures, the assignment of authority and responsibility, management’s risk assessment processes, fraud-prevention efforts and other entity-wide programs that apply to all locations and business units. Entity-level controls also monitor the results of operations and the functionality of other controls, including self-assessment programs and internal audit reviews. Oversight activities by senior management, the audit committee and the board also demonstrate these controls.

Corporate and Organisational Control Concepts

So far we have looked at control and controls primarily in terms of timing, types, levels, or individual or groups of controls to cover certain conditions.  Corporate governance, and its requirements that good internal control processes should exist in an organisation, has led to organisations taking a wider view of the whole control framework for which they are responsible.  This has resulted in a move to providing an overall assessment of an organisation’s control activities with the aim of giving an assurance as to the effectiveness of its internal control systems.  A number of frameworks have been established and adapted according to the individual characteristics of an organisation.  Perhaps the one, which has attracted the greatest following and has demonstrated its effectiveness well, is the COSO framework.

COSO definition of Internal Control

For the COSO framework model internal control is a process effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: effectiveness and efficiency of operations; reliability of financial reporting; and compliance with applicable laws and regulations. Key COSO concepts are that:

•	Internal control is a process.  It is a means to an end and not an end in itself;

•	Internal control is carried out by people.  It is not merely policy manuals and forms, but people at every level of an organisation;

•	Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board;

•	Internal control is geared to the achievement of objectives in one or more separate but overlapping categories.

The COSO framework is built around five main control areas: control environment; risk assessment and management; control activities; monitoring and corrective action; and information and communication. In these control areas we have combinations of “soft” and “hard” controls such as establishing an environment in which controls can survive and flourish (these are the “soft” controls) alongside more traditional types of “hard” controls over accounting and financial transactions.

COSO’s Principals of Internal Control
	
1	Integrity and Ethical Values	14	Information Technology	
2	Importance of Board of Directors	15	Information Needs	
3	Management’s Philosophy and Operating Style	16	Information Control	
4	Organizational Structure	17	Management Communication	
5	Commitment to Financial Reporting Competencies	18	Upstream Communication	
6	Authority and Responsibility	19	Board Communication	
7	Human Resources	20	Communication with Outside Parties	
8	Importance of Financial Reporting Objectives	21	Ongoing Monitoring	
9	Identification and Analysis of Financial Reporting Risks	22	Separate Evaluations	
10	Assessment of Fraud Risk	23	Reporting Deficiencies	
11	Elements of a Control Activity	24	Management Roles	
12	Control Activities Linked to Risk Management	25	Board and Audit Committees	
13	Selection and Development of Control Activities	26	Other Personnel

INTOSAI Control concepts and definition

According to INTOSAI internal control in public sector organisations should be understood within the context of the specific characteristics of these organisations, i.e. their focus on meeting social or political objectives; their use of public funds; the importance of the budgetary cycle; the complexity of their performance (that calls for a balance between traditional values like legality, integrity and transparency and modern managerial values like efficiency and effectiveness); and the correspondingly broad scope of their public accountability and needs for transparency.

The INTOSAI Guidance Definition

Internal control is an integral process that is effected by an entity’s management and personnel and is designed to address risks and to provide reasonable assurance that in pursuit of the entity’s mission, the following general objectives are being achieved:

•	Executing orderly, ethical, economical, efficient and effective operations;
•	Fulfilling accountability obligations;
•	Complying with applicable laws and regulations; and
•	Safeguarding resources against loss, misuse and damage.

Internal control is a dynamic integral process that is continuously adapting to the changes an organisation is facing. Management and personnel at all levels have to be involved in this process to address risks and to provide reasonable assurance of the achievement of the entity’s mission and general objectives.  Internal control is not one event or circumstance, but a series of actions that permeate an entity's activities. These actions occur throughout an entity’s operations on an ongoing basis. They are pervasive and inherent in the way management runs the organisation. Internal control is therefore different from the perspective of some observers who view it as something added on to an entity's activities, or as a necessary burden.  INTOSAI recognise the usefulness of COSO, having an effective internal audit and using risk management techniques as essential for good control

The Chain-based Control Concept

This control model implies the development of a chain of control procedures with each level or area of the control system having specified and defined objectives, which take into account and do not excessively or wastefully duplicate the work of other controls. The overall cost of controls should be in proportion to the overall benefits they bring in both monetary and political terms.  In 2004, the European Court of Auditors published Opinion No2/2004, supporting the use of such a method in the development of an integrated internal control framework, based on common principles and standards, as a means for improving the financial management of EU funds.

PIFC

Public Internal Financial Control (PIFC) is a term and concept developed by the European Commission to assist the understanding and implementation of well developed and effective control systems during the EU Accession process.  Its aim is to ensure that public funds (both national and EU) are well managed and cost effectively controlled. It should give value for money to the taxpayer.

PIFC comprises all measures to control and manage overall government income, expenditure, assets and liabilities. It covers all internal control systems and procedures in public institutions ensure that public funds are spent properly and achieve value for money. An independent internal audit is also part of the PIFC system, as is the so called Central Harmonisation Unit (CHU) based in the Ministry of Finance and responsible, amongst other things, for setting standards for internal control and internal audit and ensuring those standards are delivered to a suitably high quality.  However, the ultimate responsibility for making the PIFC system operational lies with the specifically accountable Ministers, Heads of Government institutions and other senior managers. They will be formally and strictly held responsible for setting up and guaranteeing the proper and effective functioning of PIFC within their own organisations.

Inter-relationships of Controls

Controls should not be viewed singly because they inter-relate, either in a hierarchy or in the consecutive flow of operations.  A hierarchy may be represented by controls at the various levels within a process or system, or be imposed by a higher-level system (e.g. budgetary control).  In the consecutive flow of operations, controls at one stage of processing may act to achieve similar objectives to others at different stages.  Weaknesses in one control may therefore be compensated for by other controls.  Appraisal of the adequacy of internal controls should therefore be made in relation to the objectives of control in the system as a whole.

Benefits of Control

Controls need not be exclusively restrictive.  Modern management philosophy regards control as an aid rather than a constriction.  It is a means of helping people meet their goals.  Controls become the means of auto-control and not only protect the organisation but also the employee.  Further, by establishing an appropriate system of control, managers can provide assurances to their stakeholders as to the acceptable conduct of their business. Control is especially important in large organisations where managers are unable to personally oversee everything for which they will be held accountable.

Risk Management

In recent years, many public sector organisations have focused on management of risk as the key to controlling and making organisations successful in delivering their objectives whilst improving control and protecting the interests of their stakeholders. Risk is uncertainty of outcome, and good risk management allows an organisation to:

•	Have increased confidence in achieving its desired outcomes;
•	Effectively control threats to acceptable levels; and
•	Take informed decisions about exploiting opportunities.

Risk management also allows stakeholders to have increased confidence in the organisation’s corporate governance and ability to deliver. Risk is defined as an uncertainty of outcome, whether positive opportunity or negative threat, of actions and events. The risk has to be assessed in respect of the combination of the likelihood of something happening, and the impact, which arises if it does actually happen. Risk management includes identifying and assessing risks and then responding to them.  The response, which is initiated within the organisation, to risk is called “internal control” and may involve one or more of the following:

•	Tolerating the risk;
•	Controlling the risk in an appropriate way and reducing risk to a tolerable level;
•	Transferring the risk; and
•	Terminating the activity-giving rise to the risk.

A strong system of internal control supports the achievement of the organization’s business objectives and therefore good internal control is a way of managing risk. 

Some Good Practice for Controls

•	Achieving good and cost effective control is not easy. Providing good, cost effective control is a main responsibility of senior managers.  Without good control of operations and activities, organisations cannot perform well or achieve their desired results. 

•	Control is not a person or an organisation. Control is a sophisticated process or system on many levels, activities and elements. Focusing only on control of transactions does not provide good control.

•	Control is expensive and redundant controls can inhibit the successful delivery of services and policies. Too many and too complicated controls results in a loss of control. The repetition of an action can be a good control; but duplication of controls is a waste.

•	Control systems should be designed to ensure an appropriate balance between the costs of controls and the benefits they bring in terms of managing the risk of control failure and irregularity.

•	An effective internal audit function is essential for having good control. Risk management is an essential element in a good and modern process and system of control.

•	The control environment is very important and this includes the tone at the top; the corporate code of ethics and conduct, policies and procedures; the assignment of authority, responsibility and accountability; risk assessment and management processes; and fraud-prevention strategy and efforts.  Monitoring and evaluating the results of operations and the functionality of controls, including self-assessment programs and internal and external audit, is essential. 

•	Oversight activities by senior management, the audit committee and the management board etc are very necessary to ensure and demonstrate that control is working properly.
Nick Treen (SIGMA) and George Paterson (ECA), July 2006