Monitoring Internal Control Systems Johann Rieser Senior Auditor, Ministry of Finance, Vienna

What is internal control? COSO (1992) Internal control is broadly defined as a process effected by an entity’s board of directors, management and other personnel designed to provide reasonable assurance regarding achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations

What is internal control? European Court of Auditors Internal control is an integral process that is effected by an entity’s management and personnel and is designed to address risks and to provide reasonable assurance that in pursuit of the entity’s mission, the general objectives are being achieved: Reasonable assurance equates to a satisfactory level of confidence under given considerations of costs, benefits, and risks.

Why Internal Control  Internal control is designed to assist organizations in achieving their objectives;  It helps organizations to fulfil financial and compliance objectives;  It helps to improve the performance of the organization.

COSO framework Monitoring Monitoring is implemented to help ensure „that internal control continues to operate effectively“.  - timely identification of risks and control weakness;  - accurate and reliable information for management;  - helps to provide correct financial statements;  - leads to more organizational efficiency;  - is proactive!

Monitoring – who?  People are what make internal control work.  It is accomplished by individuals within an organization, by what they do and say. Consequently, internal control is effected by people.  People must know their roles and responsibilities, and limits of authority.

Monitoring – who?  An organization's people include management and other personnel.  The implementation of internal control requires significant management initiative and intensive communication by management with other personnel.  Internal control is a tool used by management and directly related to the entity’s objectives. However, all personnel in the organization play important roles in making it happen.

Monitoring – who? 1 –Management implements and evaluates Expressing a positive tone from the top regarding internal control and the importance of monitoring have a direct impact on the effectiveness of ICS and influences the way employees conduct and react!

Monitoring – who? 2 – assigns monitoring roles (built in not built on) Monitoring operates most effectively when the roles and responsibilities are appropriate and clearly articulated and a regular evaluation takes place! needs:  competence and objectivity;  knowledge of the risk management and control system;  integrity without personal involvement and interest.

Monitoring – who? 3 – design monitoring procedures For IMPORTANT controls over MEANINGFUL risks  what controls to monitor;  what monitoring procedures to employ, and  how often to employ them.

Monitoring – who? 4 – reporting and assessing results Needs suitable and sufficient information to provide reasonable assurance; Suitable – relevant, reliable and timely; Sufficient – quantity of information;

Monitoring – how?  monitoring programs built into information systems;  analysis and follow-up of reports;  Supervisory reviews of controls;  Self assessments by management/board about the effectiveness of the oversight functions;  Periodic testing and evaluation by Internal Audit  Quality assurance by external and internal audit

Methodology? Governance is the key!  Management Accountability  Delegation and segregation of duties  Role of Internal Audit

Management Accountability  Performance-based public management – is taking responsibility for the performance of the organisation and system and being accountable for its results, thus the Managerial Accountability (MA) of public managers has become a crucial issue.  Measuring and monitoring organisations and individuals enables public administrations to deliver their objectives

Delegation and segregation of duties  delegation of authority and assignment of responsibility is clearly defined;  authority limits are defined and communicated;  Individuals are held accountable for results;

Role of Monitoring  Only an effective internal control system can provide “reasonable assurance” for the management;  It enables management to determine whether the ICS continues to operate effectively over time;  it improves the organisations effectiveness and efficiency by addressing and treating risks;  it promotes good control operation.

Thank you very much…… Questions?