What Is Internal Control?
ICFR is one element of the broader concept of internal control. Internal
control includes all of the processes and procedures that management puts in
place to help make sure that its assets are protected and that company activities
are conducted in accordance with the organization’s policies and procedures.
For example, requiring that the contents of a warehouse be periodically
counted and reconciled to the inventory recorded on the company’s books is
a control over the existence and accuracy of inventory.
In 1992, the Committee on Sponsoring Organizations of the Treadway
Commission (“COSO”), an initiative of several groups with an interest in
effective internal control, released a framework to assist companies in structuring
and evaluating controls that address a broad range of risks. That framework
defines internal control as “a process, effected by an entity’s board of
directors, management, and other personnel, designed to provide reasonable
assurance regarding the achievement of objectives relating to operations, reporting,
and compliance.”
Internal Control Over Financial Reporting
ICFR — the subject of this Guide — means the controls specifically designed
to address risks related to financial reporting. In simple terms, a public company’s
ICFR consists of the controls that are designed to provide reasonable
assurance that the company’s financial statements are reliable and prepared in
accordance with GAAP.
Inaccuracies in a financial statement may occur, for example, due to mathematical
errors, the misapplication of GAAP, or intentional misstatements
(fraud). A system of ICFR should address these possibilities. The risk of
fraudulent financial reporting is a key consideration in the design and operation
of public company internal controls. For example, market expectations
for revenues, earnings, or other targets may create pressures on management
to meet these thresholds. Effective ICFR helps assure that corporate records
are not purposefully misstated in response to those pressures. Controls should
therefore be designed and implemented with the risk of fraud in mind and
tailored to the particular circumstances of the company.