Learning Objectives

 Internal Control: Understanding the relationship

of Objectives and Components
 Requirements of effective system of internal
control and its limitations
 Objectives
The Framework provides for three categories of
objectives, which allow organizations to focus on
differing aspects of internal control:

1. Operations Objectives
These pertain to effectiveness and efficiency of the entity’s
operation, including operational and financial performance
goals, and safeguarding assets against loss.
 Objectives
2. Reporting Objectives
These pertain to internal and external financial and non-
financial reporting and may encompass reliability,
timeliness, transparency, or other terms as set forth by
regulators, recognized standard setters, or the entity’s
policies.

2. Compliance Objectives
These pertain to adherence to laws and regulations to which
the entity is subject.
Components of Internal Control
1. Control Environment

2. Risk Assessment

3. Control Activities

4. Information and Communication

5. Monitoring
 Relationship of Objectives and
Components
A direct relationship exists between objectives, which are
what an entity strives to achieve, components, which
represent what is required to achieve the objectives, and the
organizational structure of the entity (the operating units,
legal entities, and other). The relationship can be depicted in
the form of a cube.
Relationship of Objectives and
Components
• The 3 categories of
objectives – operations,
reporting, and compliance
are represented by the
columns
• The five components are
represented by the rows
• An entity’s organizational
structure is represented
by the third dimension.
 Components and Principles
The Framework sets out seventeen principles representing
the fundamental concepts associated with each component.
Because these principles are drawn directly from the
components, an entity can achieve effective internal
control by applying all principles. All principles apply to
operations, reporting, and compliance objectives.

The principles supporting the components of internal

control are listed in the succeeding slides.
 Components and Principles
CONTROL ENVIRONMENT
1. The organization demonstrates a commitment to integrity and
ethical values.
2. The board of directors demonstrates independence from
management and exercises oversight of the development and
performance of internal control.
3. Management establishes, with board oversight, structures,
reporting lines, and appropriate authorities and responsibilities
in the pursuit of objective.
4. The organization demonstrates a commitment to attract,
develop, and retain competent individuals in alignment with
objective.
 Components and Principles
CONTROL ENVIRONMENT
5. The organization holds individuals accountable for their
internal control responsibilities in the pursuit of objectives.
 Components and Principles
RISK ASSESSMENT
6. The organization specifies objectives with sufficient clarity to
enable the identification and assessment of risks relating to
objectives.
7. The organization identifies risks to the achievement of its
objectives across the entity and analyzes risks as a basis for
determining how the risks should be managed.
8. The organization considers the potential for fraud in assessing
risks to the achievement of objectives.

9. The organization identifies and assesses changes that could

significantly affect the system of internal control.
 Components and Principles
CONTROL ACTIVITIES
10. The organization selects and develops control activities that
contribute to the mitigation of risks to the achievement of
objectives to acceptable levels.
11. The organization selects and develops general control activities
over technology to support the achievement of objectives.

12. The organization deploys control activities through policies

that establish what is expected and procedures that put policies
into action.
 Components and Principles
INFORMATION AND COMMUNICATION
13. The organization obtains or generates and uses relevant,
quality information to support the functioning of internal
control.
14. The organization internally communicates information,
including objectives and responsibilities for internal control,
necessary to support the functioning of internal control.

15. The organization communicates with external parties

regarding matters affecting the functioning of internal control.
 Components and Principles
MONITORING ACTIVITIES
16. The organization selects, develops, and performs ongoing
and/or separate evaluations to ascertain whether the
components of internal control are present and functioning.
17. The organization evaluates and communicates internal control
deficiencies in a timely manner to those parties responsible for
taking corrective action, including senior management and the
board of directors, as appropriate.
Effective System of Internal Control
✓ An effective system provides reasonable assurance
regarding achievement of an entity’s objectives.

✓ It reduces, to an acceptable level, the risk of not

achieving an entity objective and may relate to one, two, or
all three categories of objectives.
Effective System of Internal Control
✓ It requires that each of the five components and relevant
principles is present and functioning.
“PRESENT”
➢ Refers to the determination that the components and
relevant principles exist in the design and
implementation of the system of internal control to
achieve specified objectives
“FUNCTIONING”
➢ Refers to the determination that the components and
relevant principles continue to exist in the operations and
conduct of the system of internal control to achieve specified
objectives.
Effective System of Internal Control
✓ It requires that the five components operate together in
an integrated manner.
“OPERATING TOGETHER”
➢ Refers to the determination that all five components
collectively reduce, to an acceptable level, the risk of not
achieving an objective. Components are interdependent with
a multitude of interrelationships and linkages among them,
particularly the manner in which principles interact within
and across components.
Effective System of Internal Control
✓ The organization achieves effective and efficient operations
when external events are considered unlikely to have a
significant impact on the achievement of objectives or
where the organization can reasonably predict the
nature and timing of external events and mitigate the
impact to an acceptable level

✓ The organization understands the extent to which

operations are managed effectively and efficiently when
external events may have a significant impact on the
achievement of objectives.
Effective System of Internal Control
✓ The organization prepares report in conformity with
applicable rules, regulations, and standards or with the
entity’s specified reporting objectives.

✓ The organization complies with the applicable laws, rules,

regulations, and external standards.
 Limitations
Limitations preclude the Board and Management from
having absolute assurance of the achievement of the
entity’s objectives.
✓ Effective system of internal control provides reasonable
assurance of achieving the entity’s objectives, limitations
do exist. Thus, may also experience a failure.

✓ Internal control cannot prevent bad judgment or

decisions, or external events that can cause an
organization to fail to achieve its operational goals.
Limitations may result from the
1. Suitability of objectives established as a precondition to
internal control.
2. Reality that human judgment in decision making can be
faulty and subject to bias
3. Breakdowns that can occur because of human failures
such as simple error
4. Ability of management to override internal control
5. Ability of management, other personnel, and/or third
parties to circumvent controls through collusion
6. External events beyond the organization’s control