Internal control is the process designed to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Safeguarding assets against theft and unauthorized use, acquisition, or disposal is also part of internal control. Control environment. The management style and the expectations of upper-level managers, particularly their control policies, determine the control environment. An effective control environment helps ensure that established policies and procedures are followed. The control environment includes independent oversight provided by a board of directors and, in publicly held companies, by an audit committee; management's integrity, ethical values, and philosophy; a defined organizational structure with competent and trustworthy employees; and the assignment of authority and responsibility.
Control activities. Control activities are the specific policies and procedures management uses to achieve its objectives. The most important control activities involve segregation of duties, proper authorization of transactions and activities, adequate documents and records, physical control over assets and records, and independent checks on performance. A short description of each of these control activities appears below.
• Segregation of duties requires that different individuals be assigned responsibility for different elements of related activities, particularly those involving authorization, custody, or record-keeping. For example, the same person who is responsible for an asset's record-keeping should not be responsible for physical control of that asset having different individuals perform these functions creates a system of checks and balances.
• Proper authorization of transactions and activities helps ensure that all company activities adhere to established guide lines unless responsible managers authorize another course of action. For example, a fixed price list may serve as an official authorization of price for a large sales staff. In addition, there may be a control to allow a sales manager to authorize reason able deviations from the price list.
• Adequate documents and records provide evidence that financial statements are accurate. Controls designed to ensure adequate record-keeping include the creation of invoices and other documents that are easy to use and sufficiently informative; the use of pre -numbered, consecutive documents; and the timely preparation of documents.
• Physical control over assets and records helps protect the company's assets. These control activities may include electronic or mechanical controls (such as a safe, employee ID cards, fences, cash registers, fireproof files, and locks) or computer-related controls dealing with access privileges or established backup and recovery procedures.
• Independent checks on performance, which is carried out by employees who did not do the work being checked, help ensure the reliability of accounting information and the efficiency of operations. For example, a supervisor verifies the accuracy of a retail clerk's cash drawer at the end of the day. Internal auditors may also verity that the supervisor performed the check of the cash drawer.
There are four basic principles of internal control. Every good system of internal control has all four principles, not just two or three.
The principles are:
1. Appropriate division of duties;
2. Qualified personnel;
3. Sound, written procedures for authorizing, recording, and reporting transactions; and
4. Actual performance consistent with the first three principles
Control activities. Control activities are the specific policies and procedures management uses to achieve its objectives. The most important control activities involve segregation of duties, proper authorization of transactions and activities, adequate documents and records, physical control over assets and records, and independent checks on performance. A short description of each of these control activities appears below.
• Segregation of duties requires that different individuals be assigned responsibility for different elements of related activities, particularly those involving authorization, custody, or record-keeping. For example, the same person who is responsible for an asset's record-keeping should not be responsible for physical control of that asset having different individuals perform these functions creates a system of checks and balances.
• Proper authorization of transactions and activities helps ensure that all company activities adhere to established guide lines unless responsible managers authorize another course of action. For example, a fixed price list may serve as an official authorization of price for a large sales staff. In addition, there may be a control to allow a sales manager to authorize reason able deviations from the price list.
• Adequate documents and records provide evidence that financial statements are accurate. Controls designed to ensure adequate record-keeping include the creation of invoices and other documents that are easy to use and sufficiently informative; the use of pre -numbered, consecutive documents; and the timely preparation of documents.
• Physical control over assets and records helps protect the company's assets. These control activities may include electronic or mechanical controls (such as a safe, employee ID cards, fences, cash registers, fireproof files, and locks) or computer-related controls dealing with access privileges or established backup and recovery procedures.
• Independent checks on performance, which is carried out by employees who did not do the work being checked, help ensure the reliability of accounting information and the efficiency of operations. For example, a supervisor verifies the accuracy of a retail clerk's cash drawer at the end of the day. Internal auditors may also verity that the supervisor performed the check of the cash drawer.
There are four basic principles of internal control. Every good system of internal control has all four principles, not just two or three.
The principles are:
1. Appropriate division of duties;
2. Qualified personnel;
3. Sound, written procedures for authorizing, recording, and reporting transactions; and
4. Actual performance consistent with the first three principles