Internal control is a mechanism where companies themselves build and operate the sound and efficient organizational structure, and it contributes to achieving IT governance.
2 - 1 What is Internal Control?
Internal control is a mechanism (e.g., internal regulations, institutions, procedures) of monitoring the organizational activities of all members of the organization, and if there are any problems, it makes improvements and increases the organizational capability. Internal control is defined in the “Standards for Management Assessment and Audit concerning Internal Control Over Financial Reporting” which is released by the “Financial Services Agency” as follows:
[Definition of internal control] Internal control is defined as a process performed by everyone in an organization and incorporated in the organization’s operating activities in order to provide reasonable assurance of achieving four objectives: effectiveness and efficiency of business operations, reliability of financial reporting, compliance with applicable laws and regulations relevant to business activities, and safeguarding of assets. Internal control consists of six basic components: control environment, risk assessment and response, control activities, information and communication, monitoring, and response to IT (Information Technology). • Control environmentIt determines the tone of an organization, influences the awareness of its people toward control, and lays the foundation for all other basic components. • Risk assessment and responseIt identifies, analyzes, and assesses factors that represent risks that could adversely affect the achievement of the organization’s objectives, and selects appropriate responses to those risks. • Control activitiesIt defines policies and procedures established to ensure that the orders and instructions of the management are followed in an appropriate manner. Control activities include segregation of duties that clearly define the division of responsibility and authority of work. • Information and communication It involves ensuring that necessary information is identified, understood, processed,
The bordered definition gives four objectives and six basic components. Below the internal dividing rule, the first component descriptions run through information and communication, which continues on printed page 387.
p. 387 · PDF 394
and accurately communicated throughout the organization and among parties involved.• Monitoring (monitoring activity)It continuously monitors/assesses/corrects whether or not internal control is functioning effectively. There are separate monitoring conducted from perspectives (e.g., internal auditor) that are independent of business operations, and ongoing monitoring that is conducted by the business operations department itself. • Response to IT (Information Technology) It refers to establishing appropriate policies and procedures to achieve goals and to respond appropriately to IT inside/outside the organization during the course of business activities. It consists of responses to IT environment and also the use and control of IT.
Laws related to internal control are the Companies Act, Financial Instruments and Exchange Act, and so on. Specifically, Article 24.4.4 (Internal control report) of the Financial Instruments and Exchange Act, also called internal control report system (J-SOX Act), makes it mandatory to submit an internal control report to the prime minister. Therefore, management has been forced to continuously evaluate and improve internal control. In addition, there is another method called CSA (Control Self Assessment) where not just management but every person who actually performs control activities verifies and evaluates effectiveness of the his/her own control activities. CSA workshop is used as an effective tool for implementing the COSO framework.
• COSO frameworkIt is a framework of internal control published by COSO (the Committee of Sponsoring Organization of the Treadway Commission). If we compare the definition of internal control in COSO with the definition given by the Financial Services Agency, COSO’s definition does not have the purpose “safeguarding of assets” and the basic component “response to IT (Information Technology).”
• Internal control may not operate effectively because of misjudgment, carelessness, or collusion among two or more individuals. • When the user department and the information system department are not independent, checks and balances do not function effectively, and integrity of data may be lost. • Internal control may not necessarily respond to unexpected changes in internal or external environments or non-routine transactions. • Convenience and cost effectiveness are required in design and operation of internal control. • Internal control may be ignored because of fraudulent behavior or illegitimate objectives by the management.
The bordered list gives five original limitations of internal control, including human error or collusion, departmental independence, unexpected changes, convenience and cost effectiveness, and management behavior.
