Monitoring Internal Control

In January 2009 COSO issued Guidance on Monitoring Internal Control Systems. This publication was intended to provide in depth input on how to apply the monitoring component of the original COSO framework. It is essential for all parties working with internal control to understand how a monitoring framework and foundation can improve the effectiveness of business processes.

Internal control processes have raised questions and issues since the creation of the Sarbanes-Oxley Act of 2002. Management is required to assess internal control systems and provide quarterly certifications. Further, external auditors are required to audit management’s assessment in conjunction with an audit of the financial statements. The framework for establishing internal control systems was developed by COSO (known as the Committee of Sponsoring Organization of the Treadway Commission). The original framework, Internal Control – Integrated Framework was introduced in 1992 and clarified with the issuance of guidance for smaller companies in 2006.

Monitoring of internal control is performed through application of both ongoing evaluations and separate evaluations. These evaluations ascertain whether other components of internal control continue to function as designed and intended. In addition, these evaluations facilitate identification of internal control deficiencies and communicate them to appropriate officials responsible for taking corrective action. More serious deficiencies are communicated to higher levels of management and to the board of directors when appropriate.

Business risks change over time. The internal control system needs to be capable of determining that the controls in place are relevant and effective in addressing new risks. A monitoring process must be capable of addressing the need for revisions in the design of controls based on changing risk. Effective internal control systems must be capable of containing risks at an acceptable level to ensure effective and efficient operations on an ongoing basis.

Monitoring is a process of assessing risks linked to achieving operational objectives. The COSO model requires establishing a monitoring foundation consisting of procedures for evaluating risks. Monitoring activities include assessment of controls and reporting the results of the assessment together with any required corrective action steps.

An effective monitoring foundation is dependent on establishing an effective “tone at the top” of the organization and a high priority on effective internal controls. This requires that the top management team and the board of directors be involved in the evaluation process. Monitoring of internal control is dependent on the selection and utilization of evaluators which have a solid baseline understanding of internal control. They also need to have suitable capabilities, resources, and authority to conduct a meaningful assessment of internal control.

Evaluators need to be both competent and objective in addition to having a thorough knowledge of the internal control system and its related processes. It is essential that evaluators understand how the controls should operate and what constitutes a control deficiency. Objectivity is determined based on an evaluator’s ability to assess the internal control system without any concern for personal consequences resulting from the evaluation. There should be no vested interest in manipulation of the results of the evaluation either for personal benefit or self-preservation.

A monitoring foundation requires that the management team and the board of directors will ensure objectivity and select competent evaluators. This sets the “tone at the top” and provides for a solid control environment to ensure effectiveness of the other four components of COSO framework.

If “tone at the top” is weak and ineffective, then any monitoring effort is destined for failure. Every aspect and component of internal control is dependent on the attitude and beliefs communicated and conveyed by the management team and the board. If there is a negative attitude toward monitoring, this will be reflected in the attitudes of employees and how they perform the monitoring process. Management and the board set the tone at the top and it is important for them to walk the walk and not just talk the talk.

The board is responsible for governance and oversight in their role of providing guidance to the management team. Boards of publicly traded companies have legal responsibilities that were enhanced by the Sarbanes-Oxley Act of 2002. This has translated into more competent boards of both public and private companies.

We now have both a legal and moral responsibility to provide a process for objectively monitoring internal control. The new COSO guidance on monitoring clears up many questions dealing with monitoring and documenting internal control. Guidance on Monitoring Internal Control Systems is available from COSO and the AICPA. Also, I am developing a self-study program for Bisk which will be available in a few months or contact me with your internal control questions.

This blog

Lynn Northrup, CPA, CPIM - Lynn's focus is on building business value for both family-owned businesses and other CPAs. I also specialize in lean accounting, process improvement, internal control, and assessment of audit risk. Other accomplishments include publishing two books, development of self study programs for Bisk Education, and an Adjunct Professorship at Villanova University. My wife Jessica and I live in southwestern Colorado and we look forward to contributing to the AccountingWEB community.

More from this blog

Bloggers crew

Steve Knowles has spent 25 years in business and practice in the UK, but he also worked in the states and the years haven't dulled his way of seeing an alternative view to everyone else, and every day is a new adventure.

42478

Joel M. Ungar, CPA is a lifelong resident of the Detroit area and a graduate of The University of Michigan. He is a principal with Silberstein Ungar, PLLC, a Top 15 auditor of SEC public reporting companies.

74693

Allan Boress, CPA, with over 25 years as a practitioner and consultant to the accounting profession. Mr. Boress is the author of 12 published books in 6 different languages, including a best-seller, The "I-Hate-Selling" Book.

47454

Larry Perry, CPA, CPA Firm Support Services, LLC, is the author of accounting and auditing manuals, author and presenter of live staff training seminars, and author of webcast and self-study CPE programs. He blogs about small audits, reviews, and compilations.

87125
Sandra Wiley, COO and Shareholder, is ranked by Accounting Today as one of the 100 Most Influential People in Accounting as a result of her prominent role as an industry expert on HR and training as well as influence as a management and planning consultant. She is also a founding member of The CPA Consultant's Alliance. Sandra is a certified Kolbe™ trainer who advises firms on building balanced teams, managing employee conflict and hiring staff.
19949

Maria Calabrese, CIR, Human Resources manager for Fazio, Mannuzza, Roche, Tankel, LaPilusa, LLC in Cranford, New Jersey, Maria's topics revolve around the world of: Mentoring, Performance management, and The "Y Generation," a.k.a. "The whY generation".

54570

William Brighenti is a CPA, Certified QuickBooks ProAdvisor, and Certified [Business] Valuation Analyst, operating an accounting, tax, and QuickBooks consulting firm in Hartford, Connecticut, Accountants CPA Hartford.

79239

Ken Garen, CPA, is the co-founder and President of Universal Business Computing Company (www.ubcc.com), a software development firm of high-volume, high-productivity accounting and payroll technology.

24536

Eva Rosenberg, MBA, EA, is the publisher of TaxMama.com, and author of the weekly syndicated Ask TaxMama column. She provides answers to tax questions from taxpayers and tax professionals worldwide.

62972

Amy Vetter, CPA, CITP is the CPA Programs Leader for Intacct Corporation responsible for leading the CPA/BPO Partners nationally.

33918
Brian Strahle is the owner of LEVERAGE SALT, LLC where he provides state and local tax technical services to accounting firms, law firms and tax research organizations across the United States. He also writes a weekly column in Tax Analysts State tax Notes entitled, "The SALT Effect." For more info, visit his website: www.leveragestateandlocaltax.com
100996
Scott H. Cytron, ABC, is president of Cytron and Company, known for helping companies and organizations improve their bottom line through a hybrid of strategic public relations, communications, marketing programs and top-notch client service. An accredited consultant, Scott works with companies, organizations and individuals in professional services (accounting, finance, medical, legal, engineering), high-tech and B2B/B2C product/service sales.
25203

Rita Keller is a nationally known CPA firm management consultant, speaker, author, mentor and blogger. She has over 30 years hands-on experience in CPA firm management, marketing, technology and administrative operations.

51431
Stacy Kildal is the mom of two fantastic kids, an Advanced Certified QuickBooks ProAdvisor, Certified Enterprise Solutions ProAdvisor, Sleeter Group Certified Consultant, a nationally recognized member of the Intuit Trainer and Writer Network, and co-host of RadioFree QuickBooks.
27032
Michael Alter's blog specializes in providing practical advice to those who seek greater profitability and practice management tactics that enhance deeper client relationships.
31347

Sally Glick, CMO, Principal, Marketer of the Year in 2003 and AAM Hall of Famer in 2007, leads a lively discussion of the constantly expanding roles of marketing and the professional marketers that drive this initiative in accounting firms of all sizes.

98400

The IMA Young Professionals Blog features the insights of IMA’s Young Professionals Committee. Committee members share advice and experiences on careers, continuing education, work/life balance, and other issues affecting young accounting and finance professionals.

32529

FEI Financial Reporting Blog provides highlights from SEC, PCAOB, FASB, IASB, and other regulatory news, including reporting under Sarbanes-Oxley Sect 404. It is written by Edith Orenstein, Director of Technical Policy Analysis at FEI.

109283

Sue Anderson has 30 years of experience in continuing education for accountants. Currently she is the program director for online CPE provider CPE Link.

59684

Jim Fahey is COO of Apple Growth Partners, a regional CPA firm in Ohio. His focus is on the effective and efficient use of technology within the firm by all team members.

38572
Caleb Newquist is the Editor-in-Chief of Sift Media US, overseeing content for both AccountingWEB and Going Concern.
65512

Leita Hart-Fanta, CPA, CGFM, and CGAP is the author of "The Yellow Book Interpreted" and owner of Yellowbook-CPE.com a website devoted to training for governmental auditors.

91346

AccountingWEB is more than just a U.S. team of journalists and financial and technology experts - we have an international side, too! Members of our British team who publish AccountingWEB.co.uk share their ideas, insights, and perspectives from across the pond.

52434