Internal Controls

Corporate governance is the system of rules and relationships through which a company is directed and controlled on behalf of its shareholders. Internal control is one of its main tools.

The IIA's three lines model puts the same idea in layers: operating management owns and manages risk (first line); risk, compliance and control functions support and challenge (second line); internal audit gives independent assurance (third line).

COSO (2013) defines internal control as a process, effected by the board, management and other personnel, designed to provide reasonable assurance about achieving objectives in three categories: operations, reporting and compliance.

flowchart LR
  CE[Control environment] --> RA[Risk assessment]
  RA --> CA[Control activities]
  CA --> IC[Information and communication]
  IC --> MA[Monitoring activities]
  MA -. deficiencies reported .-> CE

For a system to be effective, all five components and all relevant principles must be present and functioning, and operating together.

• Preventive controls stop errors or fraud before they happen (authorization, segregation of duties, passwords, edit checks).
• Detective controls find problems after they occur (reconciliations, reviews, exception reports, physical counts).
• Corrective controls fix problems found (backup restores, error-correction procedures). Directive controls (policies, training) encourage good behavior.
• Inherent limitations: human error and judgment, collusion, management override, and the cost-benefit constraint. So controls give reasonable, never absolute, assurance.

AS 2201 governs the audit of ICFR integrated with the financial-statement audit. The auditor uses a top-down, risk-based approach: start at the financial statements and entity-level controls (control environment, period-end reporting), then focus on significant accounts, relevant assertions and the controls that address their risks. Work is scaled to risk; the auditor may use the work of competent, objective internal auditors.

One or more material weaknesses → ICFR is not effective and the auditor issues an adverse ICFR opinion. Strong indicators: restatement to correct a material error, fraud by senior management (of any size), material misstatement found by the auditor that controls missed, ineffective audit-committee oversight.

• Anti-bribery provisions: prohibit US issuers, US persons and companies, and anyone acting in the US from corruptly offering anything of value to a foreign official (or party, or candidate) to obtain or retain business. Payments through agents count if the company knew or should have known.
• Accounting provisions (issuers only, whether or not they operate abroad): keep books and records that accurately and fairly reflect transactions in reasonable detail, and maintain a system of internal accounting controls.
• Exception: facilitating (grease) payments for routine government action (processing visas, connecting utilities), not discretionary decisions.
• Affirmative defenses: the payment was lawful under the foreign country's written laws, or was a reasonable, bona fide expense (e.g. travel for a product demonstration).

Internal auditing provides independent, objective assurance and advice that improve an organization's governance, risk management and control. Its authority comes from a board-approved charter.

• Organizational independence: the chief audit executive reports functionally to the audit committee (approval of charter, plan, budget, hiring and removal of the CAE) and administratively to senior management (usually the CEO).
• Individual objectivity: auditors should not audit operations they managed within the past year or design controls they later audit.
• Unrestricted access to records, people and property is set in the charter.
• Internal auditors recommend; management decides and implements. Auditors do not take on operating responsibilities.

1. Risk-based annual plan approved by the audit committee.
2. Engagement planning: objectives, scope, criteria, resources, work program.
3. Fieldwork: gather sufficient, reliable, relevant evidence; document in working papers.
4. Communication: draft discussed with management, then a final report including management's response and action plan.
5. Follow-up: confirm corrective action was taken, or that senior management accepted the risk of not acting.

Segregation of duties means no one person can both commit an error or fraud and conceal it. Separate four functions:

In IT, separate systems development (analysts, programmers) from operations (computer operators), and keep the database administrator, security administrator and data control roles apart. Programmers must not have access to live data or move their own changes into production.

IT general controls apply to the whole environment: access security, change management (program changes tested and approved), IT operations (job scheduling, backups) and systems development. Application controls apply to one application's transactions.

• Physical: locked server rooms, badges, visitor logs, environmental controls (fire suppression, UPS).
• Authentication: something you know (password), have (token, phone) or are (biometric). Multi-factor combines two different types.
• Authorization: role-based access and least privilege; review access periodically and remove it promptly when people leave or change jobs.
• Network: firewalls, encryption in transit and at rest, intrusion detection, patching.
• Logging: audit trails of who did what, reviewed for unusual activity (detective).

• Keep backups off-site (or in a separate cloud region), test restores regularly, and keep at least one copy offline or immutable against ransomware.
• Grandfather-father-son rotation keeps three generations of backups.
• A business continuity plan covers the whole business (people, facilities, suppliers); the disaster recovery plan is its IT part.