d. Control Environment
1) The control environment is a set of standards, processes, and structures that pervasively affects the system of internal control. Five principles relate to the control environment.
a) The organization demonstrates a commitment to integrity and ethical values by
i) Setting the tone at the top. Through words and actions, the board of directors and management communicate their attitude toward integrity and ethical values
ii) Establishes standard of conduct. The board and management create expectations that should be understood at all organizational levels and by outside service providers and business partners.
iii) Evaluating the performance of individuals and teams based on the established standard of conduct.
iv) Correcting deviations in a timely and consistent manner.
b) The board demonstrates independence from management and exercises oversight for internal control. The board
i) Establishes oversight responsibility. The board identifies and accepts its oversight responsibilities.
ii) Applies relevant experience by defining, maintaining, and periodically evaluating the skills and expertise needed among its members to ask difficult questions of management and take appropriate actions.
iii) Operates independently. The board include enough members who are independent and objective in evaluations and decision making.
For example, in some jurisdictions, all members of the audit committee must be outside directors.
iv) Provides oversight. The board is responsible for oversight of management’s design, implementation, and conduct of internal control.
c) Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities. Management
i) Considers all structures of the entity. Variables considered in establishing organizational structures include the following:
* Nature of the business
* Size and geographic scope of the entity
* Risk, some of them outsourced, and connections with outside service providers and partners.
* Assignment of authority to different management levels
* Definition of Reporting lines
* Reporting requirements
ii) Establishes and evaluates reporting lines. The trend in corporate governance has been to allow employees closer to day-to-day operations to make decisions.
iii) Designs, assigns, and limits authorities and responsibilities.
d) The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
i) Policies and practices reflect expectations of competence. Internal control is strengthened when management specifies what competencies are needed for particular jobs.
ii) The board and management evaluate competence and address shortcomings. Employees and outside service providers have the appropriate skills and knowledge to perform their jobs.
iii) The organization attracts, develops, and retains individuals. The organization is committed to hiring individuals who are competent and have integrity. Ongoing training and mentoring are necessary to adapt employees to the control requirements of a changing environment.
iv) Senior management and the board plan prepare for succession.
e) The organization holds individuals accountable for their internal control responsibilities in pursuit of objectives. Management and the board
i) Enforce accountability through structures, authorities, and responsibilities
ii) Establish performance measures, incentives, and rewards
iii) Evaluate performance measures, incentives, and rewards for ongoing relevance
iv) Consider excessive pressures
v) Evaluate performance and reward or discipline individuals