What is Internal control?

The mechanisms and procedures built into an organization's operations and carried out by everyone in it in order to achieve the organization's objectives. In the framework of Japan's internal control reporting system (J-SOX), the objectives are effectiveness and efficiency of operations, reliability of reporting, compliance with laws and regulations related to business activities, and safeguarding of assets, and the basic components are the control environment, risk evaluation and response, control activities, information and communication, monitoring, and response to IT. It is based on the U.S. COSO framework.

Japanese name: 内部統制

Internal control appears in 5 practice questions across 1 topic, including IT Service Management and Systems Audit.

Field: IT Service Management and Systems Audit

The four objectives

Effectiveness and efficiency of operations means carrying out operations effectively and efficiently in line with business objectives. Reliability of reporting means that reports such as financial reports can be trusted; under J-SOX, the reliability of financial reporting in particular is evaluated. Compliance means observing the laws and norms related to business activities. Safeguarding of assets means ensuring that assets are acquired, used and disposed of under proper procedures and approval. Japan adds safeguarding of assets to the three objectives of the COSO framework (operations, reporting and compliance).

The six basic components

The control environment sets the tone of an organization and is the foundation of the other components, including management's integrity and ethical values, organizational structure, and assignment of authority and responsibility. Risk evaluation and response identifies and evaluates risks that hinder achieving the objectives and chooses responses. Control activities are policies and procedures such as approvals, reconciliations and segregation of duties. Information and communication means correctly capturing the necessary information and communicating it appropriately inside and outside the organization. Monitoring is the ongoing evaluation of whether internal control is working effectively, with ongoing monitoring and separate (independent) evaluations. Response to IT means carrying out controls that use IT and controls over IT itself in light of the IT environment; it is the component Japan added to the five components of COSO.

IT general controls and IT application controls

Controls in response to IT are divided into IT general controls and IT application controls. IT application controls are built into individual business systems and ensure that transaction data are processed correctly, such as input data checks, automatic calculations and master data consistency checks. IT general controls maintain an environment in which application controls work effectively, covering system development and maintenance, operations management, access management and management of outsourcing. If general controls are weak, the programs that implement application controls may be changed without authorization, and the application controls can no longer be relied on either.

Try it: questions about Internal control

In the framework of Japan's internal control reporting system under the Financial Instruments and Exchange Act (J-SOX), which of the following is one of the four objectives of internal control?

AIncreasing market share
BSpeeding up new product development
CSafeguarding of assets

Show answer and explanation

Answer: C. Safeguarding of assets

In the J-SOX framework, the objectives of internal control are four: effectiveness and efficiency of operations, reliability of reporting (including the reliability of financial reporting), compliance with laws and regulations related to business activities, and safeguarding of assets. This adds safeguarding of assets to the three objectives (operations, reporting and compliance) of the U.S. COSO framework. Increasing market share and speeding up development are business goals or strategies, not objectives of internal control.

Among the basic components of internal control, which of the following describes the control environment appropriately?

AIdentifying, analyzing and evaluating risks that hinder the achievement of the organization's objectives, and choosing responses to them
BThe component that sets the tone of the organization and is the foundation of all the other basic components, including management's integrity and ethical values, organizational structure, and assignment of authority and responsibility
CPolicies and procedures, such as approvals, reconciliations and segregation of duties, established so that management's orders and instructions are properly carried out

Show answer and explanation

Answer: B. The component that sets the tone of the organization and is the foundation of all the other basic components, including management's integrity and ethical values, organizational structure, and assignment of authority and responsibility

In the Japanese framework of internal control, there are six basic components: the control environment, risk evaluation and response, control activities, information and communication, monitoring, and response to IT (information technology). The control environment sets the tone of the organization, influences the control consciousness of the people in it, and is the foundation of the other basic components. It includes management's integrity and ethical values, management policies, the functioning of the board of directors and corporate auditors, organizational structure, assignment of authority and responsibility, and personnel policies.

FAQ

Can internal control completely prevent fraud and errors?

No. It has limits in the face of collusion between staff, management overriding internal control, and transactions that were not anticipated. Internal control is regarded as giving reasonable, not absolute, assurance that the objectives will be achieved.

How is internal control related to systems audits?

Internal control is a mechanism that management is responsible for designing and operating. Systems audits and internal audits evaluate, from an independent standpoint, whether the parts of that mechanism related to information systems are working effectively, and they correspond to the separate (independent) evaluations within the monitoring component of internal control.

Internal control in the explanations

In the J-SOX framework, the objectives of internal control are four: effectiveness and efficiency of operations, reliability of reporting (including the reliability of financial reporting), compliance with laws and regulations related to business activities, and safeguarding of assets.
In the framework of Japan's internal control reporting syst…
In the Japanese framework of internal control, there are six basic components: the control environment, risk evaluation and response, control activities, information and communication, monitoring, and response to IT (information technology).
Among the basic components of internal control, which of th…
Monitoring is the process of continuously evaluating whether internal control is working effectively.
Monitoring, a basic component of internal control, consists…

Questions that mention Internal control (5)

Books on IT Service Management and Systems Audit Ad

Search Amazon for semiconductor IT Service Management and Systems Audit

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary