The Five Components of Internal Control
Written by: Joe Ward
Believe it or not, internal control is your job, too! In fact, it is mandated by the Budget and Accounting Procedures Act of 1950, which required agencies to establish systems of internal control. The Federal Managers Financial Integrity Act of 1982 strengthened this system by requiring agency heads to report annually according to prescribed internal control standards and guidance of the Government Accountability Office (GAO) and Office of Management and Budget (OMB). There are five components of internal control, 17 associated principles, and 47 attributes. This article will focus primarily on the five components.
Control Environment
The first component, the control environment, is probably the most important of the five standards because it impacts all the others. In fact, the control environment is the foundation. It has five principles pertaining to setting the tone at the top, demonstrating a commitment to competence, and establishing oversight, structure, responsibility, and enforcing accountability. Think of the difference between parents who set and enforce ‘house rules’ on things like homework, social media access, bedtime, etc., and those that do not. Generally, the former produces better outcomes.
Risk Assessment
The second component, risk assessment, has four principles that address defining objectives, identifying, analyzing, and responding to all types of risk and change. Managers have a responsibility for not only identifying risk but establishing the level of risk they are willing to accept. For example, if the agency goal is an 85 percent customer satisfaction rate, the agency is willing to accept 15 percent of customers being unsatisfied — the risk tolerance level.
Control Activities
The third component is control activities. As the name suggests, the three associated principles pertain to designing and implementing control activities. Think of control activities as the policies, procedures, and mechanisms put in place to accomplish agency objectives. For example, if your objective is to keep your home and family safe, locking the doors and installing a security system would be examples of control activities.
Information and Communication
The fourth component, information and communication, has three principles of which processing data into quality information and communicating to both internal and external audiences are hallmarks. “Seven times, seven ways” is sometimes used to describe how management must continually understand their audience and communicate both internally and externally to stakeholders. Townhall meetings, intranet, email, focus groups, and surveys are examples of how this might be accomplished.
Monitoring
The final component, monitoring, has two principles outlining responsibilities for monitoring and correcting deficiencies. Think of the start of a new year and new year’s resolutions. Many people set goals to get in shape and lose weight. Let’s say you start the year off at 174 pounds and have a goal to get to 150. That means you need to lose 24 pounds or about 2 pounds a month on average. Suppose you set this goal but never weigh yourself at the start of the year, or during the year for that matter. You could likely end the year weighing more than 174 pounds. An effective monitoring system requires one to establish a baseline (identify your starting point) as well as periodic and recurring monitoring (daily, weekly, monthly, quarterly, etc.) so that adjustments can be made along the way to reach the established milestones and goals.
Where should I begin?
Here are a few resources that you can go to right now to get closer to meeting your professional objectives related to internal control.
- OMB Circular A-123 – Management’s Responsibility for Enterprise Risk Management and Internal Control – This memo provides guidance to federal managers on improving the accountability and effectiveness of federal programs and operations by establishing, assessing, correcting, and reporting on internal control.
- GAO – Standards for Internal Control in the Federal Government, commonly known as the Green Book, provides the most comprehensive information available on internal controls.
- AGA – The Internal Controls Workgroup of the Association of Government Accountants (AGA) has developed numerous resources that provide detailed information about internal control business processes, individual components developed by The Committee of Sponsoring Organizations of the Treadway Commission (COSO), principles, attributes, and best practices.
- Management Concepts – We offer close to 30 courses that cover internal control, many of which are accredited and may be applied to a certification program. In addition, we offer private group training that can be customized for the internal controls training needs of your organization. For a fresh perspective on how internal controls drive mission success, see this infographic.
