【文章內(nèi)容簡(jiǎn)介】 ties, should obtain the information and training needed to meaningfully take responsibility for internal control, and in particular should obtain a sound understanding of... internal control as set forth by [COSO].1 2 Internal control theory outlined THE FUNDAMENTAL NATURE OF INTERNAL CONTROL Regardless of the sector within which they serve (., public, private, or notforprofit), all managers must strive to: ( 1 ) operate effectively and efficiently, (2) produce reliable external financial reports, and (3) ply with applicable laws and regulations. Responsible managers cannot leave the achievement of these objectives to chance. Rather, they must take concrete action to ensure the effectiveness and efficiency of operalions, reliable financial reporting, and legal and regulatory pliance. It is the sum of these actions that constitute internal control. Put differently, internal control could be defined as the sum of the tools and techniques used by management to ensure that it achieves its objectives. Thus, by its very nature, internal control is fundamentally a managerial concern. RESPONSIBILITY FOR INTERNAL CONTROL An analogy may be useful in understanding the proper assignment of responsibility for internal control among managers, board members, and auditors. A student is primarily responsible for pleting homework assignments. The reason for assigning primary responsibility to the student is as much practical as it is ethical。 since the purpose of a homework assignment is to sharpen the student39。s skills, no one else can do a student39。s homework for the student without fundamentally promising that objective. While a parent, tutor, or fellow student may provide valuable help to the student in pleting an assignment, in the end, only the student39。s direct involvement can achieve the desired end. That is not to say, of course, that parents or guardians can somehow absolve themselves of their own responsibility for the pletion of their charges39。 homework on the grounds that it is the student who is primarily responsible. Parents or guardians remain ultimately responsible for ensuring that a student meets his or her responsibility for homework. Although parents or guardians cannot actually do the homework for the student, they have a duty to make sure the student does so. Finally, teachers and tutors, while they can be of invaluable assistance to both students and their parents or guardians, cannot replace either. In the end, homework remains the primary responsibility of the student and the ultimate responsibility of the parents or guardians. This analogy holds true for internal control if the students, parents or guardians, teachers, and tutors of the previous example are replaced by management, the governing board, the independent auditor, and the internal auditor. Management is primarily responsible for internal control, because internal control, as explained earlier, is, by its very nature, fundamentally a management concern (., the tools and techniques used by managers to achieve management objectives). Board members, in turn, cannot wash their hands of responsibility for internal control on the grounds that management is primarily responsible, because it is the job of a governing board to ensure that management meets all of its responsibilities. Thus, the governing board is ultimately responsible for internal control. The independent auditor of the financial statements, like a teacher, validates management39。s success (in preparing reliable financial statements) and is avai able to provide assistance, as needed. Still, even the best teacher cannot make up for a disengaged student or uninvolved parents or guardians. Finally, the role of internal auditors, like that of tutors, is to help those whom they serve to succeed. Noheless, an inter nal auditor can only assist management, not replace it, with regard to internal control. It is one thing, of course, to insist that the governing board is ultimately responsible for internal control. The real issue remains: How can a governing board effectively fulfill its responsibility in this regard? The most practical solution is to establish an audit mittee, which ideally can serve the focal point for the board39。s internal controlrelated efforts, ensuring that the whole matter of internal control is regularly brought before the board for its attention and dealt with Similarly, an internal audit function can be invaluable in helping managers, especially those managers with a programmatic rather than a financial background, who may be less familiar with internal 3 Ensuring that the internal control adequacy Once management and the governing board have assumed their respective responsibility for internal control, how can they know that they have trul y fulfilled their obligations? How much control is enough? Before the COSO Report, it was more mon to speak of internal controls (plural) than of internal control (singular). COSO, however, viewed internal control as much more than the sum of its parts (individual policies and procedures). COSO envisioned internal control as a unified structure or framework into which individual control elements or ponents are integrated. That is, COSO offered a conceptually holistic approach to internal control in place of the earlier, essentially piecemeal approach. COSO also identified five essential ponents that needed to be in place to ensure that such a framework of internal control is adequate or prehensive: * There must be a sound control environment (corporate culture) * There must be a regular, ongoing assessment of risk * Controlrelated policies and procedures must be designed, implemented, and maintained to address the risks thus identified * There must be adequate munication * There must b