COSO Committee of Sponsoring Organizations of the Treadway Commission
Committee of Sponsoring Organizations of the Treadway Commission
Internal control provides many benefits to an entity. It provides management and boards of directors with added confidence regarding the achievement of objectives, it provides feedback on how a business is functioning, and it helps to reduce surprises. Among the most significant benefits of effective internal control for many entities is the ability to meet certain requirements to access capital markets, providing capital-driven innovation and economic growth. Such access of course comes with responsibilities to effect timely and reliable reporting for shareholders, creditors, capital providers, regulators, and other third parties with which an entity has direct contractual relationships. For instance, effective internal control supports reliable external financial reporting, which in turn enhances investor confidence in providing the requisite capital.
Other benefits of effective internal control include:
-
Reliable reporting that supports management and board decision making on matters such as product pricing, capital investment, and resource deployment
-
Consistent mechanisms for processing transactions, supporting quality of information and communications across an organization, enhancing speed and reliability at which transactions are initiated and settled, and providing reliable recordkeeping and ongoing integrity of data
-
Increased efficiency within functions and processes
-
A basis for decisions where highly subjective and substantial judgment is needed
-
Ability and confidence to accurately communicate business performance with business partners and customers, which supports continuity of relationships
Further, the Framework enables management to enhance efficiency in the design, implementation, and conduct of a system of internal control. For example:
-
Understanding the importance of specifying suitable objectives may focus management's attention on those risks and controls most important to achieving these objectives.
-
Focusing on those areas of risk that exceed acceptance levels and need to be managed across the entity may reduce efforts spent mitigating risks in areas of lesser significance.
-
Coordinating efforts for identifying and assessing risks across multiple objectives may reduce the number of discrete risks assessed and mitigated.
-
Selecting, developing, and deploying controls to effect multiple principles may also reduce the number of discrete, layered-on controls.
-
Applying a common language—the Framework—encompassing operations, reporting, and compliance processes and controls may lessen the number of languages used to describe internal control across the entity.
Entities always have limits on human and capital resources and constraints on how much they can spend, and therefore they will often consider the costs relative to the benefits of alternative approaches in managing internal control options.
Generally, it is easier to deal with the cost aspect in the cost-benefit equation because in most cases financial costs can be quantified fairly precisely. Usually considered are all direct costs associated with implementing internal control actions and responses, plus indirect costs, where practically measurable. Some entities also include opportunity costs associated with use of resources.
Overall, management considers a variety of cost factors in relation to expected benefits when selecting and developing internal controls. These may include:
-
Considering the trade-offs between recruiting and retaining staff with a higher level of competency and the related higher compensation costs. For instance, a smaller, stable, privately held company may not want to, or be able to, hire a chief financial officer with the experience of working for a publicly traded company.
-
Assessing the efforts required to select, develop, and perform control activities; the potential incremental efforts that the activity adds to the business process; and the efforts to maintain and update the control activity when needed.
-
Assessing the impacts of added reliance on technology. While the effort to perform the control and the impact of added technology-based controls on the business process may be small, the cost associated with selecting, developing, maintaining, and updating the technology could be substantial.
-
Understanding how changes in information requirements may call for greater data collection, processing, and storage that could trigger exponential growth in data volume. With more data available, an organization faces the challenge of avoiding information overload by ensuring flow of the right information, in the right form, at the right level of detail, to the right people, at the right time. Establishing an information system that balances costs and benefits depends on thoughtful consideration of information requirements.
The benefit side of the cost-benefit equation often involves even more subjective evaluation. For example, benefits of effective training programs usually are apparent but difficult to quantify. Training programs are not often designed to measure the benefits or to capture the necessary data to evaluate the program. Sales training programs may not be structured to measure before-and-after employee sales results, making it difficult to determine whether the training is effective and accomplishing its objectives. Further, evaluating the benefits in relation to stakeholder expectations may be more difficult to assess. In many cases, however, the benefit of developing actions within any of the five components of internal control can be evaluated in the context of the benefit associated with achievement of the related objective.
The complexity of cost-benefit determinations is compounded by the interrelationship of controls with business operations. Where controls are integrated with management and business processes, it is difficult to isolate either their costs or benefits.
It is up to management to decide how an entity evaluates the costs versus benefits of alternative approaches to implementing a system of internal control, and what action it ultimately takes. However, cost alone is not an acceptable reason to avoid implementing internal control. The cost versus benefits considerations support management's ability to develop and maintain a system of internal control that balances the allocation of human resources in relation to the areas of greatest risk, complexity, or other factors relevant to the entity's objectives.
| Generated November 9, 2014 22:46:48 |