3-Internal control structure

The internal control structure is derived from the way management runs an operation or function and is integrated with the management process.

Although the components apply to the entire firm, small and mid-size departments may implement them differently than large ones do. Together, they are designed to provide reasonable assurance that overall established objectives and goals are met.

1 Control environment

The control environment sets the tone of an organization, influencing the control consciousness of its people. Control environment factors include

• (1) the integrity, ethical values and competence of the entity's people;

• (2) management's philosophy and operating style;

• (3) the way management assigns authority and responsibility and organizes and develops its people; and

• (4) the attention and direction provided by Administration

2 Risk assessment

Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Examples include:

• Monthly meetings to discuss risk issues

• Internal audit risk assessment

• Formal internal departmental risk assessment

3 Control activities

Control activities are the policies and procedures that help ensure management directives are carried out. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. Additional examples are:

• Purchasing limits

• Approvals

• Security

• Specific policies

4 Information and communication

Pertinent information must be identified, captured and communicated in a form and timeframe that enable people to carry out their responsibilities. Information systems produce reports containing operational, financial and compliance-related information that makes it possible to run and control the organization. Effective communication also must occur in a broader sense, flowing down, across and up the organization. Examples include:

• Vision and values or engagement survey

• Issue resolution calls

• Reporting

• Firms communications (e.g., emails, meetings)

5 Monitoring

Internal control systems need to be monitored, a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. Internal control deficiencies should be reported upstream, with serious matters reported to top management and the Regents. Examples include:

• Monthly reviews of performance reports

• Internal audit function

4- Internal control types

• Preventive and detection controls

• Hard vs. soft controls

• Manual vs. automated controls

• Key vs. secondary controls

Control activities within your Firm may include the following:

• Implementing segregation of duties where duties are divided (segregated) among different people, to reduce the risk of error or inappropriate actions. No one person has control over all aspects of any financial transaction.

• Making sure transactions are authorized by a person delegated approval authority when the transactions are consistent with policy and funds are available.

• Ensuring records are routinely reviewed and reconciled, by someone other than the preparer or transactor, to determine that transactions have been properly processed.

• Making certain that equipment, inventories, cash and other property are secured physically, counted periodically and compared with item descriptions shown on control records.

• Providing employees with appropriate training and guidance to ensure that they (1) have the knowledge necessary to carry out their job duties, (2) are provided with an appropriate level of direction and supervision and (3) are aware of the proper channels for reporting suspected improprieties.

• Making sure that the policies and operating procedures are formalized and communicated to employees. Documenting policies and procedures and making them accessible to employees helps provide day-to-day guidance to staff and promotes continuity of activities in the event of prolonged employee absences or turnover.

(Osma, B. G., Gomez-Conde, J., & Lopez-Valeiras, E. 2022).