Internal Controls elements

Internal control system operates at different levels of effectiveness. Determining whether a particular internal control system is effective is a judgment resulting from an assessment of whether the five components - Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring - are present and functioning. Effective controls provide reasonable assurance regarding the accomplishment of established objectives.

Control Environment

The control environment sets the tone of the organization and influences the control consciousness of its people. Leaders of each division, area or activity establish a local control environment. This is the foundation for all other components of internal control, providing discipline and structure.

Risk Assessment

The process of identifying and analyzing risk is an ongoing process and is a critical component of an effective internal control system. Attention must be focused on risks at all levels and necessary actions must be taken to manage. Risks can pertain to internal and external factors. After risks have been identified they must be evaluated.

Control Activities

Control activities are the policies and procedures that help ensure management directives are carried out. They help ensure that necessary actions are taken to address defined risks. Control activities occur throughout the organization, at all levels, and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties.

Information & Communication

Relevant information must be identified, captured and communicated in a form and time frame that enables people to carry out their responsibilities. All personnel must receive a clear message on their control responsibilities. Direct Supervisor is obliged to train personnel on individual control activities relate to their work.

Monitoring

Internal control systems is monitored in three ways. Ongoing monitoring occurs in the ordinary course of operations. Separate evaluation is performed by Internal Control & Compliance on the selected processes or activities. On annual bases independent audit is performed by Internal Audit. Internal control deficiencies should be reported upstream, with serious matters reported immediately to top administration and governing boards.