The Concept of Reasonable Assurance
No system of ICFR can provide absolute assurance. Internal control systems
are operated by individuals, and individuals inevitably make mistakes.
Further, while effective ICFR is a legal requirement for some public companies,
cost considerations may affect the design of control systems. For these
reasons, it is impossible to create a practical control system that will detect
or prevent all potential errors. In addition, intentional misconduct, such as
fraud, collusion, or management override, may prevent controls from operating
as intended, regardless of how well they are designed.
Accordingly, control systems can provide reasonable, but not absolute, assurance
that financial statements are reliable and prepared in accordance with
GAAP. What is reasonable depends on the facts and circumstances of each
particular situation. The securities laws define reasonable assurance as the
degree of assurance that would satisfy prudent officials in the conduct of their
own affairs.
The Control Environment
One key component of ICFR is the control environment — the structures
and values within the organization. Controls designed to generate reliable
financial reporting are more likely to succeed if the company’s culture,
including the “tone-at-the-top” established by senior management, reflects
the importance of integrity and ethical values and a commitment to reliable
financial reporting. Some indicators of a positive control environment include
statements and actions of the board of directors and senior management that
demonstrate support for effective controls; issuance and enforcement of an
appropriate corporate code of conduct; and training programs that equip
employees to identify and deal with ethical issues.
Control Activities
Control activities — the specific policies and procedures designed to mitigate
financial reporting risk — are another key component of ICFR. Control
activities are as varied as the business activities of public companies. Three
concepts — segregation of duties, preventive and detective controls, and
entity-level and process-level controls — are helpful to understanding control
activities.