Understanding the importance of the corporate internal control system
The most of the time this is the result of the managers' lack of knowledge about how important is the internal control system for an effective and sucessful management of its corporate governance. Even in the C-Level I face this lack of knowledge.
In my lectures on governance subject, it is common to face discussion in how internal control increase the bureaucracy making the operational processes slow, bring a problem for the business. in fact this may be a truth, not because of the internal control itself, but because of the mistaken way of managing its corporate risks.
Normally, when the management understand the "objective - risk - control" relationship and realize the importance to have a management atitude based on this relation, they change totally their vision about internal control. They realize that having an adequate system of internal controls increases the possibility of the organization achieve its operational and strategic goals. In addition, they recognize the possibility of allocated capital savings due to the alignment of internal control with risks.
First of all, internal control may be conceptualize as being:
"An integrated process of action, conducted at all levels of the organization, that helps it achieve its operational and strategic objectives with reasonable security."
Internal control is inherent to the human being. Even in companies with no maturity in the management of the fundamentals of governance, we may find several internal controls, but not necessarily with the quality required to respond to the risks. It is very common to find a system with more control than really needed.
The great challenge of management is to develop, implement and maintain an effective internal control system, balanced with its risk apetite, which must meet the needs of the organization in achieving its objectives, being flexible and economical.
Justo to remember, a good internal control system must achieve three distinct objectives:
- Maintain the efficiency and effectiveness of operational processes, including safeguarding assets,
- Promote the integrity, consistency and reliability of information whether financial or non-financial, and
- Enable the company to comply with laws, regulations, and industry standards.
Also, we need to keep in mind that the system of internal controls is considered as the second line of defense. The first is the management and the third is the internal audit.
Thus, in order to modeling or assess the internal control system properly is important to consider the following:
- The existence of the internal control only makes sense if there is one or more risks associated with it;
- Internal control system has a hierarchy (control environment, process control and transaction controls) which need to be considered. Each of the levels are related and has its role and importance in the proper functioning of the internal control system.
- for evaluation or modeling of the control system, the specialist must have a portfolio view, that is, to know all the existing controls, in the three levels of hierarchy;
- The internal control system aims to bring the gross risk associated with the process or transaction to the level of the organization's risk appetite, no more and no less;
- All internal control, in order to be effective, requires discipline and supervision, so that it achieves the proposed goal in its conception;
- The internal control system should be periodically evaluated in order to identify necessary changes necessary to keep pace with changes in the business environment.
The internal control system is the responsibility of all within the company, being the high management responsible for the control environment, the middle managers by the level of process control and the executors by the control of the transaction.
Both in the evaluation and in the modeling of the system of internal control its cost and benefit should be noted. Control can not cost more than the risk it is mitigating.
Organizations have failed to manage their system of internal controls by applying resources beyond what is necessary, thus, in order to effectively manage the internal control system, it is recommended that the company have in its organization professionals specializing in internal controls, who will provide support to the operational managers with the fundamentals of governance.
Having an effective and optimized internal control system is fundamental to the quality of management based on the best practices of governance, which is base for the success and the perenniality of the organization.
To conclude, I always say that there is no governance if the company does not have a robust process of risk management, which, in it turns, requires an aligned and effective internal control system.
What have be my concern is the understanding of both management and worker about the importance of Internal Control.
ResponderExcluirThe understanding level of Internal Control is low, it can be known from how high the risk of their business process.
There are 4 steps to implemented Internal Control:
1. Design Internal Control based on stakeholders and management purposes.
2. Educated or socialize IC to all entity elements.
3. Implementation by Introduction level and full Implementation after, because in introduction level IC will look some suitable form to be implemented.
4. Evaluation and continous improvement.
It is true that the internal control theme does not have an adequate understanding with the managers, so it is very important a process of awareness at all levels of the organization, as well as the commitment of the top management with this subject.
ExcluirAs for the process you mentioned, I would make the following modification:
1 - Improvement of the control environment through the process of education of the managers
2 - Awareness of the responsibility of the manager as to the definition and maintenance of internal controls,
3 - Evaluate the process with risk vision and model the adequate control to respond to this risk,
4 - Continuously evaluate the efficiency of the control system, since the internal audit evaluates the effectiveness.
5 - Promote continuous improvements in the internal control system
I think that a manager will be aware of the need for controls, only when he is aware that any activity/process/transaction/ has a risk and in order to mitigate the risk he needs to design and apply controls.
ResponderExcluirSure. it is the game. In order to understand the control needs, first they need to understand the risks and its cause involved.
ResponderExcluir