I. Concept:
"Organizational plan between accounting, employee functions and coordinated procedures adopted by a company, to obtain reliable information, safeguard its assets, promote the efficiency of its operations and adherence to its administrative policy."
II. Goals:
1. Prevent and / or avoid fraud.
2. Discover thefts and embezzlements.
3. Obtain reliable and timely information.
4. Locate and correct errors.
5. Protect and safeguard your assets.
6. Promote staff efficiency.
7. Detect and control losses.
III. Elements:
Every organization must establish, at least, the following aspects that will guide the application of Internal Control:
1. Definition of the objectives and goals, both general and specific, in addition to the formulation of the necessary operational plans.
2. Definition of policies and procedures used as action guides for the execution of processes.
3. Precise delimitation of authority and levels of responsibility.
4. Adoption of regulations for the protection and rational use of resources.
5. Management and personnel administration appropriate to a valuation system.
6. Establishment of modern information systems that facilitate management and administrative control.
7. Establishment of induction, training and updating programs aimed at the organization's staff and their needs.
8. Simplification and updating of rules and procedures.
The most important elements on which an adequate Internal Control System (ICS) is based are: the control environment, accounting systems, internal accounting controls and internal administrative controls, which translate into the following sub-elements:
a) Perfectly defined objectives and plans.
They are based on standards that will serve primarily to plan and control operations to reduce the risk of uncertainty. Said objectives and plans should be: "possible and reasonable, clearly defined in writing (formalized), useful, accepted and used, flexible, communicated to the personnel and controllable".
b) Solid structure of the organization.
Provides an appropriate separation of functional responsibilities and responsibilities. This structure must have the following characteristics:
• Assignment or fixing of duties to each employee.
• Adequate segregation of duties.
• Establishment and delimitation of clear lines of authority and responsibility.
• Coordination between departments and people.
• Existence of a permanent staff training program.
c) Effective and documented procedures.
They are used to clearly determine how to carry out the tasks, which must have the following characteristics:
• Design and application at the level of the different operations.
• Books and records.
• Chart of accounts.
• Inventory and cost accounting.
• Reports.
• Useful and periodic information system.
d) Competent personnel.
That he knows how to fulfill his responsibilities effectively. It requires the following requirements:
• Careful selection of personnel before hiring.
• Staff training.
• Staff evaluation.
• Remuneration in accordance with the responsibility assumed and with the degree of skill shown.
• Annual compulsory vacations and staff rotation.
e) Control and operations review system.
• Internal audit.
• External audit.
• Tax review.
f) Asset protection system.
• Physical protection.
• Adequate insurance coverage and provisions against possible contingencies (fires, catastrophes, thefts, breakdowns and / or repairs, improvements, additions, etc.).
• Verification of custody, preservation and registration systems.
g) Useful and periodic information system.
• Accounting system.
• Reasonable financial statements.
• Reports.
• Statistical information.
• Preparation of budgets.
• Budget Analysis.
• Strategic Planning.
• Updating and implementation of policies.
IV. Beginning:
The exercise of Internal Control implies that it must be done following the principles of:
1. Equality: It consists in that the SCI must ensure that the activities of the organization are effectively oriented towards the general interest, without granting privileges to special groups.
2. Morality: All operations must be carried out not only in compliance with the rules applicable to the organization, but also with the ethical and moral principles that govern society.
3. Efficiency: Ensures that, under equal conditions of quality and opportunity, the provision of goods and / or services is done at the lowest cost, with maximum efficiency and best use of available resources.
4. Economy: Ensure that the allocation of resources is the most appropriate based on the objectives and goals of the organization.
5. Speed: It consists in that one of the main aspects subject to control must be the ability of the organization to respond in a timely manner to the needs that concern its area of competence.
6. Impartiality and Publicity: They consist of obtaining the greatest transparency in the actions of the organization, in such a way that nobody can feel affected in their interests or be subject to discrimination, both in opportunities and in access to information.
7. Valuation of Environmental Costs: It consists in that the minimization of the negative environmental impact should be an important factor in decision-making and in the conduct of its routine activities in those organizations in which its operation may have it.
V. Procedures:
1. Delimitation of responsibilities.
2. Segregate incompatible functions.
3. Divide the processing of each transaction.
4. Select skilled and capable officials.
5. Create procedures that ensure the accuracy of the information.
6. Bonds (policies).
7. Give written instructions.
8. Use control accounts.
9. Create procedures that ensure the completeness, authorization and maintenance of information.
10. Evaluate computerized systems.
11. Use pre-numbered documents.
12. Avoid the use of cash.
13. Efficient administration of bank accounts.
14. Make immediate and intact deposits of funds.
15. Identify the key control points in each process.
16. Use control charts.
17. Carry out frequent technical inspections.
18. Update security measures.
19. Use indicators.
20. Define clear and achievable goals and objectives
21. Perform periodic physical taking of assets.
SAW. Responsibility for internal control:
Internal control is fundamentally a managerial responsibility, developed in an autonomous way that, in order to bear true fruit, must be adjusted to the needs and requirements of each organization.
The responsibility for the actions lies with the manager and his delegated officials, for which it is necessary to establish an ICS that allows them to have reasonable assurance that their administrative actions comply in all respects with the (legal and statutory) rules applicable to the organization..
From the point of view of compliance with the corporate purpose and functions assigned to organizations, internal control is an indispensable and non-delegable part of managerial responsibility, since it does not end with the formulation of objectives and goals, but rather with the verification that these have been fulfilled.
The ICS must be a harmonious group, made up of the planning system, the norms, the methods, the procedures used to carry out the functions of the organization and the monitoring and evaluation mechanisms and instruments that they use to feed back their cycle of operations..
Specific Responsibilities:
1. The responsibility for establishing, maintaining and improving the ICS must be the responsibility of the highest authority of the organization.
2. In each area of the organization, the person in charge of directing it must be responsible according to the established levels of authority and lines of responsibility.
3. The internal audit or the corresponding internal control unit should be in charge of independently evaluating the organization's SCI, proposing recommendations to management for improvement.
Design, implementation and strengthening of the internal control system
I. Design of the internal control system (SCI):
The design of an adequate SCI implies not only a technical mastery of the subject, but also a knowledge of the specific environment in which it will be applied.
Taking into account that the SCI is not an objective in itself, a fundamental criterion, when conceiving and implementing such systems, is to constantly consider the cost-benefit ratio. In particular, the cost of each component of the SCI must be contrasted with the general benefit, the risks that it minimizes and the impact that it has in meeting the organization's goals. The challenge is to find the right balance in the ICS design, as excessive control can be costly and counterproductive.
Organization of the internal control function.
The existence of an office specialized in the internal control area is convenient in order to lead the design and implementation process of the system.
Development plan of the internal control function.
The institutionalization of the internal control function is a whole process, for this reason it is important that its development obeys a plan, which must be a concerted product between the internal control office and the organization's directives. Said plan must contemplate the following basic elements:
• Definition of the SCI mission.
• Definition of the scope of the functions of the internal control office in the management control area.
• Division of labor enters the line of the organization and the internal control office in the development of control activities.
• Definition and schedule for the development of computational and other tools that will support the exercise of internal control.
• Schedule of formalization, documentation and implementation of critical processes and procedures.
• Schedule for the preparation and issuance of the internal control manuals.
• Schedule of formalization, documentation and implementation of the other processes and procedures of the organization.
Work plan for the formalization and documentation of the other processes and procedures.
Not all processes and procedures must be formalized and documented before mounting the system. This is a process that may be slow at first, but it will be streamlined as the different areas of the organization understand its importance and begin to perceive the benefits.
For this reason, the priority is to start the activity with the processes and procedures that are considered critical for the entity, that is, those that may significantly affect the organization's progress and its results.
The gathering of information from these processes and procedures should be the responsibility of the areas, under the premise that they are the ones who have the information and who, once operating the system, will receive the greatest benefits.
Internal control mechanisms and instruments.
Internal control mechanisms and instruments are variable, depending not only on the nature of the organization, but also on the characteristics of the area in which they are applied.
The design of the mechanisms and instruments must be a shared activity between the responsible employees and the internal control office, in order to achieve a compromise between safety and efficiency.
Reporting and monitoring mechanisms and instruments.
The monitoring and reporting mechanisms and instruments vary according to the nature of the organization and the areas, so that they are useful, the monitoring and reporting must have a shorter period than what has been defined to obtain results in the process object of control.
Manuals or internal control guides.
Internal control manuals are parts of the system. Its preparation must be one of the central activities of the internal control office and must be explicitly contemplated within the development plan of the internal control function. In order to facilitate the updating process of these manuals, it is recommended to adopt the interchangeable sheet system. Updates should occur whenever the internal control office, in agreement with the responsible employees, concludes that the process or procedure, or that the control mechanism or instrument used must be modified.
Once produced, the internal control manuals are the primary element of the training process for responsible employees.
II. Control and administrative process:
An ICS can be properly implemented and will be maintained if the other functions of the administrative process are operating correctly, especially with regard to the following factors:
Organizational structure.
All organizations have a clearly established corporate purpose, which means that they exist to fulfill one or more functions.
In carrying out their mission, organizations must execute one or more operational processes, the results of which determine the success or failure of the organization in terms of meeting its fundamental objectives.
The organizational structure of a company must respond above all to its basic processes, clearly establishing the executive line of the organization as the set of areas that are in charge of these basic processes and separating it from the set of areas responsible for the support process (administration general, financial administration, personnel administration, legal planning).
Rationalization of procedures.
It is one of the most profitable activities an organization can do to improve its effectiveness and efficiency, it has a huge positive impact on the exercise of control in that it simplifies processes and operations, and it allows management to focus its efforts on aspects. really important of its management.
The first priority should be given to the elimination of unnecessary, repeated or superfluous procedures that do not add value or prevent or reduce risks; the second, to the simplification and improvement of the procedures that are indispensable or significant to exercise a function or defend a right. The third priority is the concentration of procedures, which by their nature allow it.
Formalization and documentation of processes and procedures.
The SCI requires the existence of organizational objectives and goals that are consistent with the corporate purpose, the functions of the organization and are clearly formulated; as well as the standardization and documentation of processes and procedures on which the organization is based, already refined from the procedural point of view.
One of the biggest problems organizations face is the lack of up-to-date and documented methods and procedures. In the absence of documentation, the organizational memory is concentrated in the head of isolated individuals and opens the possibility that the development of any process may be susceptible to different interpretations.
The reason why the situation described is so frequent is because the areas do not perceive the problem as their own. On the other hand, the formalization and documentation of processes and procedures is perceived by the areas as an unprofitable activity for them, since they must spend time giving information without receiving anything in return.
Integration of planning and budget processes.
Despite the difficulty in introducing and consolidating a results-based management culture that institutionalizes the process of setting and monitoring objectives and goals in the areas, what really matters is the achievement of organizational goals and not the isolated fulfillment of commitments. of the areas.
Management control and performance evaluation.
The implementation of a results-based management system seeks to evaluate the performance of personnel within the organization.
The institutionalization of the SCI should give a message to the organization, making it clear that, once the transition stage is exhausted, the results of the management of individuals and areas will not be indifferent to the administration of the organization.
III. General parameters in the writing of manuals:
In the drafting of functions and procedures manuals, the following parameters must be taken into account, in particular: the organization plan (organizational chart); the methods and procedures; the definition that it is a manual of functions and procedures and the simplification of work techniques.
The elaboration of the organization chart corresponds to the organic structure of any organization, to determine the hierarchy, the levels of authority, the responsibilities and the separation of functions; the basic organization in decision making, the setting of management policies –even those of control- and the legal recognition of the authority that corresponds to the projected objectives.
The organization chart reflects the size of the organization, defines the number of positions and their specialty, and the structure by which internal control reports the entire control strategy.
To facilitate the answer to management questions, each organization should establish methods or procedural techniques, flow charts, and indicators for comparison and measurement of results.
This administrative technique is summarized in a manual of functions and procedures that serves as a guide for the members of the organization and as a reference to carry out audits.
A method or procedure requires the following determinants:
• The end pursued: for what?
• The time of execution: When?
• The place of performance: Where?
• The official who executes it: Who?
• The method used to execute it How?
The manual of functions and procedures is the text by which each organization, according to its organic structure, its mission and its resources, defines the hierarchy of the positions, objectively determines their functions and establishes technical methods and procedures to achieve their objectives.
It serves as a guide for carrying out the activities, detailing step by step patterns for the execution of tasks; activities are optimized, work overload, duplication of functions are avoided and coordination between units is facilitated.
Work simplification techniques require knowledge and understanding of the following concepts:
• What is a function ?: It is the set of activities or operations that give proper and defined characteristics to a position to determine levels and authority and responsibility.
• What is a procedure ?: It is the sequential and logical normative method to develop a function.
• What is a procedure flowchart ?: It is the detailed description of all the steps carried out in a process, using conventional symbols that are standardized and allow objective and sequential recording of the procedures of the different areas of responsibility and the application of control..
How is a manual made?
• We take the organic structure (organizational chart) of the entity to which the manual will be prepared.
• We determine the levels of authority: Management positions, Heads of section or their equivalents and Junior or lower positions.
• We take all the information related to the nature of each function.
• We ask each employee to describe what he does
• The job description and what the employee does are evaluated, classifying the tasks that are really related to the position.
• A certain birds functions, each employee is told to describe the procedure on "how it does it", step by step.
• In the same way as the functions, the “how it is done” is evaluated, looking for simplicity, standardization, unity, logical sequence, simplification, and it is classified.
• Then the model forms, appendices are adapted and filled out according to the instructions of each one.
• The procedure requires, in addition to the narrative, a flow chart; it proceeds by using conventional signs.
• All formats are consolidated according to the organization chart, a table of contents, introduction, purpose, scope, use, concepts is added and, finally, it is integrated under the name of Manual of functions and procedures, with the name of the area. to which it belongs and is authorized by the general management.
IV. Control types:
There are six types of control: Management, Accounting, Administrative or Operational, Management Operational, Budgetary and Computer.
1. Management Control: Oriented to people with the aim of influencing individuals so that their actions and behavior are consistent with the objectives of the organization. The elements of Internal Management Control are:
• Clear and precise definition of goals, objectives and values.
• Participatory administration systems.
• Open communications.
• Motivation.
2. Accounting Control: Includes both the established accounting rules and procedures, as well as all the methods and procedures that have to do or are directly related to the protection of assets and funds and the reliability of the accounting, budgetary and financial records of the organizations..
The objectives of Internal Accounting Control:
• Information integrity: All operations must be registered.
• Validity of the information: all the registered operations represent economic events and duly authorized.
• Accuracy of the information: Operations registered in a timely manner, in the corresponding account and with the correct amount.
• Information Maintenance: Operations reflect the results and financial situation of the business.
• Physical security: Restricted access to assets and documents.
The elements of Internal Accounting Control are:
• Definition of authority and responsibility in relation to accounting, collection, contracting, payment, asset registration and cancellation functions, and budget, adjusted to the applicable regulations.
• Segregation of duties duly separated, in such a way that no official simultaneously exercises both physical control and accounting and budgetary control over any asset, liability and equity.
• Establishment of internal checks and independent tests to ensure the organization's transactions and efficient operation, providing protection against fraud.
• Use of internal audit procedures that represent a subsequent and selective verification of the reasonableness and appropriateness of the recorded transactions or accounting information.
3. Administrative or Operational Control: Oriented to the administrative policies of the organizations and to all the methods and procedures that are related, in the first place, with the due compliance with the legal, regulatory provisions and adherence to the policies of the management levels. and administration and, secondly, with the efficiency of operations.
It should include controls such as analysis, statistics, performance reports, personnel training programs and quality controls. The elements of the Internal Administrative Control are:
• Development and maintenance of a functional line of authority.
• Clear definition of roles and responsibilities.
• An internal verification mechanism that provides efficient operation and with maximum protection against fraud, waste, abuse, errors and irregularities.
• The maintenance of the evaluation activity represented by the internal audit in charge of reviewing the policies, legal and regulatory provisions, financial practices and operations in general as a constructive and protective service for the management and administration levels.
4. Operational Management Control: Oriented to the processes and tasks already executed. These are procedures designed to have permanent control over the processes in order to ensure the maintenance of certain performance and quality standards that serve as a basis of verification with what is budgeted. It comprises the set of plans, policies, procedures and methods that are needed to achieve the objectives of the organization. The elements of the Operational Management Control are:
• Setting work standards according to the activity.
• Setting management indicators.
• A system for evaluating results and analyzing deviations.
• Clear and precise definition of procedures, rules and policies.
• Strategic planning of functional elements of the organization
• Studies of operational and administrative productivity and efficiency.
• Clearly defined and communicated quality and performance standards.
5. Budgetary Control: It is a technical tool that supports management control, based on management by objectives. As one of the priority objectives of companies is to achieve a certain profitability, management efficiency, in relation to deviations towards that profitability, can be controlled by resorting to budgetary control.
Budgetary Control consists of periodically comparing the budget against the actual results of the period, center by center, in order to highlight the deviations.
In order to carry out its analytical comparative mission, budgetary control involves the distribution of income and expenses by cost centers, recorded by general accounting and standard setting.
The elements of the Budgetary Control are:
• A budgeting.
• A verification of the achievements.
• A notice of the deviations produced.
6. Computer Control: It is oriented to achieve the use of technology and computer science as a control tool; its objective will be to maintain effective and timely automatic controls over operations. Its main elements are:
• Clear and precise definition of the transactions to be systematized.
• Setting different levels of access to information.
V. What is an indicator for control:
It is an indication that is expressed numerically or in the form of a concept about the degree of efficiency or effectiveness of the operations of an organization, a dependency or a cost center.
The indicator compares figures or data. Based on its interpretation, an action can be qualified and more detailed analyzes can be directed towards the aspects in which deviations are presumed.
The indicator facilitates control and self-control and, consequently, decision-making insofar as it is possible to relate them to quantities, quality, costs and opportunity.
For an indicator to be useful it must meet a series of essential requirements:
• Be relevant.
• Allow decision making and set priorities in problem solving.
• Be made up of components that are independent of each other and easily identifiable; the contribution of each to the value of the indicator must be known in each case.
• Be sensitive to variations in the phenomenon you want to measure.
• Be prepared using data that is easy to collect.
SAW. Requirements in each process and in each operation:
1. Justification: That every act is duly justified.
2. Authorization: that is authorized by a competent official.
3. Procedure: That the established procedures are followed.
4. Registration: That all pertinent information be recorded.
5. Results: That the acts produce concrete results.
6. Assurances: That measures or mechanisms are available that allow the process or operation to proceed as planned and achieve the expected results.
VII. Main prevention approach:
1. Engineering: Controls the physical aspects of the risk situation, in such a way that a loss-generating event cannot occur and, if it occurs, it is reduced.
2. Human: As well as due to physical causes, many losses also occur due to actions due to failure or human habits.
3. Statistical: Through data analysis, preventive measures can be taken at points that experience indicates are vital in the organization.
4. Educational: At all levels, teaching is vital to ensure that the preventive measures that have been discovered through the other approaches are effectively put into practice.
5. Coercive: According to some authorities, the identification of preventive measures and the training of personnel to implement them is not enough. The nature of man is of such a nature that, often, without the coercion of an employer or the State, he would not exercise the pertinent actions.
VIII. Prevention systems:
Organizations that are aware of their costs understand that they must control those generated by accidents. They consider security as a necessity and as a prerequisite.
Among the main prevention systems we have:
• Hazard identification: it is necessary to identify all the risks and determine those areas or activities of an operation where losses may occur.
• Elimination of danger: Toxic, flammable or corrosive products can sometimes be replaced by safer ones.
• Protection against danger: Risks that cannot be eliminated must be avoided by protection.
• Maximum loss that can occur: It involves determining the maximum loss that could occur if absolutely everything fails.
• Loss retention: Considering the amount that could be lost in a combination of unfavorable circumstances, it is possible to determine how much of that loss a company would be willing to bear.
• Mandatory Insurance: When insurance contracts cover the consequences of unwanted events, we say that they cover a risk.
Evaluation of the internal control system
Introduction:
The second auditing standard related to the execution of the work establishes the following: ” An appropriate study and evaluation of the existing internal control must be made, so that it can be relied on as the basis for determining the nature, extent and timeliness of the audit procedures ”.
The SCI study used by the organization or area to be audited is included as an imperative that is reflected in the auditing standards and is intended to evaluate the efficiency of internal control.
The most usual procedure to evaluate the SCI is to use the so-called internal control questionnaire, which consists of a set of questions, classified by areas and arranged in such a way that their negative answer determines a weak point in the system and, therefore, a area to be taken into account in the scope and extent of the procedures to be applied in the audit.
II. Goals:
1. Establish the basis for relying on the SCI in order to determine the nature, extent and timeliness of the audit evidence to be applied in the examination.
2. Obtain a basis for formulating constructive suggestions to companies regarding the improvement of their SCI.
III. Diagnosis:
The diagnosis of internal control serves to solve questions, such as: what problems do we have? How are things going? What decisions are going to be made? What is happening? The diagnosis specifies how the control is at a given moment in an area, a process or an operation.
Six basic elements have been defined that must be present in all areas, processes and operations for there to be good control. These are:
• Mission: it must be defined, understood and accepted by each and every one of the people who make up the organization, which has a mission and each area has a specific one; Both must guide the action of all the established processes.
• Planning Systems: They include the formulation and development of plans and programs and the establishment of monitoring mechanisms and their evaluation.
• Organization: includes the existence of a structure with defined and defined functions, responsibilities and authorities, the application of norms and procedures, and the use of coordination systems at different levels or areas.
• Resources: among the resources are the financial and human resources located in an adequate, sufficient and timely manner, in each area and in each process.
• Information: Includes the mechanisms and formats for information registration and reporting, correspondence systems, and integrated information systems.
• Verification Systems: they comprise techniques and mechanisms for inspection, review, monitoring, auditing, supervision and verification.
The ultimate purpose of control is essentially to preserve the existence of any organization and to support its development. According to this approach, it is necessary to consider that any organization must rely on control instruments that allow it to minimize risks and when they arise, can manage the effects they produce.
The internal control diagnosis is the result of the integration of the diagnosis of each of its six basic elements and the analysis of their interrelationships, confronting them with the established criteria and the universally accepted control principles to determine the state in which it is, the strengths and weaknesses it has. The general steps to perform an internal control diagnosis are:
• Define the scope (where it begins and where it ends).
• Prepare working papers (norms, documents, analysis matrix, make information surveys).
• Perform the flow charts of the information comparing them with the established principles and norms.
• Synthesize strengths and weaknesses.
• Recommend improvements to the control system.
IV. Information sources:
• Organization charts (organizational charts) showing lines of authority and separation of responsibilities.
• Chart of accounts indicating the purpose and use of each account.
• Procedure manuals that describe the flow of operations.
• Job manual detailing the different responsibilities and activities of employees.
• Interviews with management and key employees.
• External, internal audit or tax review reports.
• Accounting records, documents, balance sheets, statistical reports, reconciliations, etc.
• Personal observation.
• Minutes of Assembly, board of directors, committees, etc.
• Statutes.
V. Importance:
The internal control evaluation helps the auditor determine the scope of the audit procedures necessary to develop the intended examination. Proper evaluation of an ICS requires knowledge and understanding of prescribed procedures and methods and a reasonable degree of assurance that they are being carried out as planned. The degree of confidence that the auditor places in the ICS is used to determine the intensity (scope) with which the procedures will be applied.
