In response to the increased emphasis placed on internal controls, not-for-profit organizations have been working diligently to document and improve their internal control systems. Although, for many, this has taken a great deal of time – the investment is well worth the effort for a number of reasons. Most notably, good internal control is good business. It helps organizations ensure that operating, financial and compliance objectives are met. The consequences of not meeting these core objectives can be devastating, particularly in these tough economic times.
As you know, internal control consists of five components: control environment, risk assessment, information and communication, control activities and monitoring. These work in tandem to mitigate the risk of an organization’s failure to achieve its objectives. Of these five components, monitoring appears to be the least understood. If left unmonitored, controls tend to deteriorate over time. Monitoring helps ensure that internal controls continue to operate effectively. When monitoring is designed and implemented appropriately, organizations benefit because they are more likely to identify and correct internal control problems on a timely basis. Internal control deficiencies can be identified and communicated in a timely manner to those parties responsible for taking corrective action and to management and the board as appropriate.
Monitoring includes a wide range of activities routinely performed by managers in the running of their departments that can provide feedback on the functioning of other components of the internal control system. Management of smaller organizations regularly perform such procedures but do not always take credit for their contribution to internal control effectiveness.
Effective monitoring can best be achieved when it is based on three broad elements including (a) a supportive tone at the top; (b) an effective organizational structure that assigns monitoring roles to people with appropriate capabilities, objectivity and authority; and (c) a starting point or “baseline” of known effective internal control from which ongoing monitoring and separate evaluations can be established.
Organizations may select from a wide variety of monitoring procedures, including but not limited to:
- periodic evaluation and testing of controls by internal personnel,
- continuous monitoring programs built into information (computer) systems,
- analysis of, and appropriate follow-up on operating reports or metrics that might identify anomalies indicative of a control failure,
- supervisory reviews of controls, such as reconciliation reviews as a normal part of processing,
- self-assessments by boards and management regarding the tone they set in the organization and the effectiveness of their oversight functions, and audit committee inquiries of internal personnel and external auditors.
Management can begin the monitoring process by encouraging the people with control system responsibility to seek out additional resources and training so they can properly consider how best to implement effective monitoring or ascertain whether it has already been incorporated into certain areas. One such resource is COSO’s Monitoring Guidance which is available for purchase at www.coso.org.
Further, personnel with appropriate skills, authority and resources should consider:
- whether the meaningful risks to objectives have been properly identified
- which controls are “key controls” that will best support a conclusion regarding the effectiveness of internal control in those risk areas
- what information will be most useful in determining whether the controls are continuing to operate effectively, and
- whether effective monitoring is currently being performed that is not well used in the evaluation of internal controls, resulting in unnecessary and costly further testing.
Management and the board of directors should understand the concepts of effective monitoring and how it serves their respective interests. As the board learns more about monitoring, it will develop the knowledge necessary to ask management probing and relevant questions in relation to any area of meaningful risk. Over time, effective monitoring can lead to organizational efficiencies and reduced costs associated with financial reporting, including audit costs, because problems are identified and addressed in a proactive, rather than reactive, manner.