Principle 12 of the Singapore Code of Corporate Governance states: 'The board should ensure that the management maintains a sound system of internal controls to safeguard the shareholders' investments and the company's assets.'
A sound system of internal controls helps to provide reasonable assurance that the company:
• adheres to laws, regulations, and management directives;
• promotes efficient, and effective operations and achieves planned outcomes;
• safeguards resources against fraud, waste and abuse;
• develops and maintains reliable financial and management information and reporting.
The responsibility for providing an adequate and effective internal control system rests with the management of the company. It is therefore essential that all managers in the company understand the importance of establishing and maintaining effective internal controls. The tone that management sets through their actions, policies, and communications can result in a culture of either positive or lax control.
Can management then task employees to play an active role in maintaining a sound system of internal controls through the management tone set within the company?
The Role of Employees
Employees are the eyes and ears of a company; if something is amiss, they likely will know about it before management or the auditors. However, do employees understand the significance of controls and the consequences of a control weakness? Or do employees deem internal controls as additional work responsibilities for them?
The 2010 Global Fraud Study conducted by the Association of Certified Fraud Examiners (ACFE) asked survey respondents to identify which of several common issues they considered to be the primary factor that allowed fraud to occur. The survey findings revealed that a lack of internal controls, such as segregation of duties, was cited as the biggest deficiency in 38% of the fraud cases. In more than 19% of the cases, internal controls were in place but were overridden by the perpetrator or perpetrators in order to commit and conceal the fraud.
The survey results also indicated that employee support programs, surprise audits and fraud training for staff members at all levels were associated with median loss reductions of more than 50%. Interestingly, financial statement audits - the most commonly implemented control was among the controls with the smallest associated reduction in median loss.
Training and Communications
Most employees are unaware of the risks faced by their companies in the absence of appropriate training and communications. Not knowing what the risks are, employees will be unable to take preventive or corrective actions.
It is therefore of great importance to make employees be aware of their obligations concerning internal controls. One of the most effective ways to create awareness is through formal communication and training. While many companies communicate such issues in an ad hoc manner, efforts taken without planning and prioritisation may fail to provide employees with a clear message that their control responsibilities are to be taken seriously.
Management should first identify the high-risk areas in the company. This can be achieved through a workshop attended by management and staff from different areas of the business (e.g., finance, procurement, sales, human resource, etc). Each will have a different perspective that may be counter to another attendees' perspective.
Having identified the risk areas (e.g. procurement of IT equipment etc.), management can proceed to formulate a training and communications plan and develop business risk management initiatives that are:
• Comprehensive and based upon job functions and risk areas
• Integrated with other training efforts, whenever possible
• Effective in a variety of settings, using multiple methods and techniques
• Regular and frequent, covering the relevant employee population
Management should also put in place a formal training programme to educate employees. The programme should concentrate on the following areas:
• Why are internal controls important?
• What are the differences between standard work procedures and internal control procedures?
• How to identify control weaknesses?
• How to rectify identified control weaknesses?
• Internal controls and fraud prevention
In addition to training, the board can consider providing management and supervisory staff with constant and easy access to internal controls advisory support. Just as parents engage tutors for their children to support them in achieving good grades for a better future; the board can also provide management and supervisory staff with support from external expertise to ensure the sustainability and scalability of the company.
The free access to external support will help motivate management and staff in building a stronger internal control environment, as it essentially eliminates the fear of revealing management or staff's incompetence to their superiors when they may not possess the necessary knowledge to implement new controls or evaluate the design effectiveness of existing control procedures.
Monitoring
Once the above steps have been carried out, management should implement proper alert mechanisms, such as a whistleblowing policy and process, to facilitate employees to tackle exceptional business processes or practices. It is essential to communicate these reporting mechanisms to employees as part of their risk management and internal controls training. Employees need to know how to handle concerns and potential violations, and who they should go to for advice.
With a proper training, communications and monitoring plan in place, as well as increased staff's involvement, the board and management will be in a better position to perform their respective oversight functions and provide an opinion on the state of internal controls within the company. More importantly, the board and management will be even more aware and vigilant about potential business risk issues within the company and be more equipped to defend the company against those vulnerabilities.
Sylvia Lim is a Certified Public Accountant and Certified Internal Auditor based in Singapore. She is the Director of Excellence Link Associates, Asia's First Internal Controls Coaching and Consulting Firm. Sylvia specialises in training and consulting on business risk management and internal controls.
Visit http://www.excellencelink.com for more information on Excellence Link Associates.
Article Source: http://EzineArticles.com/?expert=Sylvia_Lim
Article Source: http://EzineArticles.com/6119885
Tidak ada komentar:
Posting Komentar