Internal Control-Integrated Framework

COSO defines internal control as follows: "A Process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations, Reability of financial reporting, and Compliance with applicable laws and regulation." 

The implication for internal auditors is that we must evaluate control over all three categories of objectives in order to render an opinion on "adequacy and effectiveness of overall system internal control." Internal Auditor that focus almost exclusively on financial and compliance controls --as many still do--cannot say they they are evaluating all of internal control. 

The definition reflects certain fundamental concepts: 

• Internal controlis is a process. It's a means to an end, not an end in itself. • Internal control is affected by people. It's not merely policy manuals and forms, buat people ata every level of an organization .
• Internal control can be expected to provide only reasonabel assurance, not absolute assurance, to an entity's management and board. 
• Internal Control is geared to the achievement of objectives in one or more separate overlapping categories. The COSO emphasis on people and process calls for dynamic, interactive evaluation techniques. If internal control is "not merely policy manuals and forms" then evaluating internal control has to involve more than verifying compliance with policies and procedures. Traditional audit techniques --flowcharting, internal control questionnaires, sampling techniques, and transaction testing--focus almost exclusively on control activities (approvals, segregationof duties, reconciliations, etc). 

But COSO presents control activities as only ane of five components of control. COSO calls the five components of internal control: • Control Environment • Risk Assessment • Control Activities • Information and Communication • Monitoring Which of the five components to be the most important ?? 

The obvious answers is the CONTROL ENVIRONMENT -- it's the largest and, as COSO's text says, it is "the foundation on which everythings rests"