ArchivesInternal Control Archives — C. Lynn Northrup, CPA, CPIM

Monitoring Internal Control

COSO issued new information and direction on monitoring internal control during January 2009 in a three volume publication titled Guidance on Monitoring Internal Control. Monitoring of internal control is performed through application of ongoing evaluations and separate evaluations to ascertain whether other components of internal control continue to function as designed and intended. These evaluations facilitate identification of internal control deficiencies. The deficiencies then need to be communicated to appropriate officials responsible for taking corrective action and where appropriate to higher levels of management and the board of directors.It is important to realize that business risks change over time. The internal control system must be capable of determining that the internal control system continues to be relevant and able to address any new risks. Monitoring should address requirements for revisions in the design of controls as risks change. It also provides assurance regarding the ability of the internal control system to contain risks at an acceptable level in order to provide for effective and efficient operations.

Monitoring follows a risk based approach in evaluating risks linked to achieving operational objectives. It is important to establish a monitoring foundation that includes procedures for evaluating risks, assessing controls, and reporting the results together with any required corrective action steps.

One of the primary elements of the monitoring includes establishing an effective tone at the top of the organization giving a high priority to an effective internal control system. Effective “tone at the top” ensures that the management team and the board of directors are supportive of the evaluation process. Successful monitoring of internal control requires the selection and utilization of evaluators who have a baseline understanding of internal control. They also will have the suitable capabilities, resources, and authority to conduct a meaningful assessment of the internal control system.

Since the enactment of the Sarbanes-Oxley Legislation I have developed multiple training programs dealing with assessment of internal control in addition to my book, Profitable Sarbanes-Oxley Compliance. Please feel free to contact me with your internal control questions and to discuss how to create and implement an internal control monitoring program.