Most not-for-profit organizations understand the importance of documenting and implementing strong internal control systems. Although strong internal controls may add time to day-to-day processes, the investment is well worth the effort for a number of reasons.
Most notably, good internal control is good business. It helps organizations ensure that operating, financial and compliance objectives are met. The consequences of not meeting these core objectives can be devastating, particularly in tough economic times.
Components of Internal Control Systems
An appropriately designed internal control system consists of five components:
- Control environment
- Risk assessment
- Information and communication
- Control activities
- Monitoring
These work together to mitigate the risk of an organization’s failure to achieve its objectives. Of these five components, monitoring is the least understood.
Importance of Monitoring
If left unmonitored, controls tend to deteriorate over time. Monitoring helps ensure that internal controls continue to operate effectively. When monitoring is designed and implemented appropriately, organizations benefit because they are more likely to identify and correct internal control problems on a timely basis. Internal control deficiencies can be identified and communicated in a timely manner to those parties responsible for taking corrective action and to management and the board as appropriate.
Monitoring includes a wide range of activities routinely performed by managers in the running of their departments that can provide feedback on the functioning of other components of the internal control system. Management of smaller organizations regularly perform such procedures but do not always take credit for their contribution to internal control effectiveness.
Elements of Effective Monitoring
Effective monitoring can best be achieved when it is based on three broad elements including:
- A supportive tone at the top.
- An effective organizational structure that assigns monitoring roles to people with appropriate capabilities, objectivity, and authority.
- A starting point or “baseline” of known effective internal control from which ongoing monitoring and separate evaluations can be established.
Monitoring Procedures for Organizations
Organizations may select from a wide variety of monitoring procedures, including but not limited to:
- Periodic evaluation and testing of controls by internal personnel,
- Continuous monitoring programs built into information (computer) systems,
- Analysis of, and appropriate follow-up on operating reports or metrics that might identify anomalies indicative of a control failure,
- Supervisory reviews of controls, such as reconciliation reviews as a normal part of processing,
- Self-assessments by boards and management regarding the tone they set in the organization and the effectiveness of their oversight functions, and
- Audit committee inquiries of internal personnel and external auditors.
Monitoring Process
Management can begin the monitoring process by encouraging the people with control system responsibility to seek out additional resources and training so they can properly consider how best to implement effective monitoring or ascertain whether it has already been incorporated into certain areas.
One such resource is COSO’s Monitoring Guidance which is available for purchase at www.coso.org.
Further, personnel with appropriate skills, authority and resources should consider:
• whether the meaningful risks to objectives have been properly identified,
• which controls are “key controls” that will best support a conclusion regarding the effectiveness of internal control in those risk areas,
• what information will be most useful in determining whether the controls are continuing to operate effectively, and
• whether effective monitoring is currently being performed that is not well used in the evaluation of internal controls, resulting in unnecessary and costly further testing.
Management and the board of directors should understand the concepts of effective monitoring and how it serves their respective interests. As the board learns more about monitoring, it will develop the knowledge necessary to ask management probing and relevant questions in relation to any area of meaningful risk.
Over time, effective monitoring can lead to organizational efficiencies and reduced costs associated with financial reporting, including audit costs, because problems are identified and ad- dressed in a proactive, rather than reactive, manner.
Interested in learning more about internal control systems? Contact Jacobson Jarvis today—we have over 30 years of experience helping not-for-profit organizations just like yours.
About the Author:
Featured image via Pxhere