Importance of Internal Controls in Corporate Governance Mechanisms

At the core of business management are the rules, practices, and processes that define how an organization is directed, operated, and controlled. This system, known as corporate governance, aims to create more ethical business practices by aligning the interests of stakeholders. Ethical and transparent corporate governance practices contribute to an organization’s financial viability.

One of the most important components of effective corporate governance is enterprise risk management (ERM), which involves identifying, analyzing, prioritizing, and mitigating risks. Regulatory compliance often mandates risk assessment as part of business operations.

Mechanisms of Corporate Governance

Corporate governance involves directing, controlling, and evaluating an organization. It includes establishing governance structures and principles, typically overseen by a supervisory board, to define the distribution of rights and responsibilities among stakeholders and foster a culture of integrity.

Corporate governance helps manage potential conflicts of interest between shareholders and management or among shareholders. Unlike daily operational management, corporate governance focuses on the board’s role in setting company values.

To enforce a code of conduct, organizations use both external and internal corporate governance control mechanisms to protect assets, reduce inefficiencies, and support business objectives.

External Mechanisms

External control mechanisms are managed by entities outside the organization, such as regulators, governments, trade unions, and financial institutions. Their objectives include assessing debt management and legal compliance, often imposed through union contracts or regulatory guidelines.

Independent Audits

Independent audits are a key external mechanism. An external auditor reviews the organization’s financial statements and issues an opinion on their reliability. These audits serve both internal and external stakeholders by providing insight into financial performance and internal mechanisms.

Regulatory bodies may also suggest best practice guidelines, and organizations report compliance status to external stakeholders. The Sarbanes-Oxley Act (SOX), enacted in 2002, is a notable compliance regulation for public companies in the US, aimed at increasing accuracy and transparency in financial disclosures and preventing fraudulent accounting practices.

SOX Compliance

All US public companies must comply with SOX, which requires annual proof of risk controls during external audits. SOX compliance costs can range from $500,000 to $1 million, but this is typically less than the penalties for non-compliance. Benefits include robust internal controls, greater public confidence, and reduced opportunities for fraud.

Internal Mechanisms

Internal mechanisms are the primary controls organizations use to monitor activities and take corrective actions. These mechanisms serve internal objectives such as smooth operations, clear reporting lines, and performance measurement systems.

A strong internal control system includes policies, procedures, and technical safeguards to protect assets and prevent errors or inappropriate actions. Internal audits can assess the effectiveness of these controls.

The Internal Control-Integrated Framework, developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), defines five components for designing a sound internal control structure:

• ​Internal control environment
• ​Risk assessment
• ​Internal control activities
• ​Information and communication
• ​Monitoring

Each component includes principles and points of focus for designing, implementing, monitoring, and assessing internal control processes.

Role of Internal Control in Corporate Governance

Internal controls are the policies, procedures, and technical safeguards that protect assets by preventing errors and inappropriate actions. They are the practical means by which organizations ensure compliance with their ethical standards.

Internal controls help organizations monitor activities and take corrective actions to achieve goals related to reliable financial reporting, efficient operations, and legal compliance. They also help produce an audit trail for both internal and external audits.

For example, SOX Section 404 requires management to certify the effectiveness of internal controls over financial reporting. A clear audit trail supports SOX compliance and increases stakeholder confidence.

Goals of internal corporate governance controls include:

• ​Safeguarding assets: Preventing asset loss due to mistakes or fraud.
• ​Minimizing errors: Ensuring financial information is carefully reviewed.
• ​Promoting efficiency: Preventing mistakes to improve efficiency.
• ​Minimizing risk: Conducting regular risk assessments to identify and improve areas of inaccuracy.

Internal control activities fall into three categories:

• ​Preventative: Attempt to prevent risks from occurring.
• ​Detective: Identify incidents after they occur.
• ​Corrective: Take action to remedy vulnerabilities.

Procedures for Internal Control of Corporate Governance

Effective internal controls rely on stakeholder responsibilities:

• ​The board of directors sets values, rights, responsibilities, and corresponding controls.
• ​Management maintains the system and communicates expectations.
• ​Staff and operating personnel carry out internal control activities.

Common procedures include:

Authorization

Establishes which employees have authority to execute certain transactions, preventing invalid transactions. Approval authority requirements ensure transactions are reviewed and approved by appropriate managers.

Documentation

Includes all paper and electronic records supporting transactions. Documentation provides evidence of transactions, ensures accuracy and completeness, and aids in researching discrepancies. Standardized documentation supports consistency and easier review.

Reconciliation

Compares transactions and activities with supporting documentation, resolving discrepancies. Ensures system balances match those of external entities (banks, suppliers, etc.). Errors or discrepancies should be detected, investigated, and resolved promptly.

Security

Encompasses administrative, physical, and technical safeguards:

• ​Administrative: Departmental processes to protect assets and data.
• ​Physical: Protection of physical data and assets from theft or damage.
• ​Technical: Protection of electronic data from theft, damage, or loss.

Security is essential for ongoing operations, information accuracy, privacy, and legal compliance.

Segregation of Duties

No single person should control all aspects of a transaction. Responsibilities are shared to reduce the risk of fraud and errors. Key functions to separate include:

• ​Performing transactions
• ​Authorization or acceptance
• ​Reconciliations
• ​Asset custodianship

Segregation may be by department or individual, depending on organizational size and structure. The level of risk determines the method for segregating duties.