Internal Control Practical Guide

The KPMG Review Internal Control: A Practical Guide This book has been prepared to assist clients and others in understanding the implications of the ICAEW publication Internal Control: Guidance for Directors on the Combined Code. Whilst every care has been taken in its preparation, reference to the guidance should be made, and specific advice sought where necessary. No responsibility for loss occasioned to any person acting or refraining from action as a result of any material in this publication can be accepted by KPMG. KPMG is registered to carry on audit work and authorised to carry on investment business by the Institute of Chartered Accountants in England and Wales. c KPMG October 1999 All rights reserved. No part of this publication may be reproduced, stored in any retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior permission of the publisher. Designed and produced by Service Point (UK) Limited Printed by Service Point (UK) Limited Foreword From discussions with many Board directors over the years since the Cadbury and the Rutteman guidelines were issued, there has been much criticism of regulators and consultants alike that organisations are being driven to create bureaucratic processes - divorced from managing the business - with the sole purpose of complying with regulations. The spirit of Cadbury was right, the enactment was flawed. By taking the easy option of reporting on internal financial control companies created an annual review process disconnected from managing the business. The Combined Code and Turnbull guidance recognise that this was neither beneficial for organisations, nor provided the comfort sought that governance was being enhanced. There has always been an opportunity to enhance business performance through better management of risk. With Turnbull, the connection between managing the business and managing risk is now explicit. This guide has been written with this objective in mind and recognises that whilst one size does not fit all, the principles and practical issues are common. It has relevance to the Board member and line manager alike. I owe my thanks to those who have provided me with the challenge over the years to provide practical solutions. I believe this book meets those challenges by providing genuinely practical guidance which, in my view, is as much about enabling performance as it is about embedding risk and control. My thanks in particular to Timothy Copnell and Christopher Wicks, without whose efforts this book could not have been produced. Mark Stock Head of Corporate Governance Services KPMG Contents Executive summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2 Objectives. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 1.3 Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1.4 Effective date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2 The importance of internal control and risk management . . . . . . . . . 14 3 Maintaining a sound system of internal control. . . . . . . . . . . . . . . . . . 18 3.1 Responsibility for the system of internal control. . . . . . . . . . . . . . . . . . . . 18 3.2 The system of internal control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 3.3 Understanding the nature and context of control . . . . . . . . . . . . . . . . . . . 22 4 Reviewing the effectiveness of internal control. . . . . . . . . . . . . . . . . . . 27 4.1 Responsibility for reviewing the effectiveness of internal control . . . . . . 27 4.2 The process for reviewing effectiveness . . . . . . . . . . . . . . . . . . . . . . . . . . 30 4.3 Business objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 4.4 Risk identification and assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 4.5 Identification of appropriate controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 4.6 Monitoring of controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 5 Disclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5.1 The new requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5.2 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 5.3 Specimen statements on internal control. . . . . . . . . . . . . . . . . . . . . . . . . . 54 6 Internal audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.2 The revised requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 6.3 The role of internal audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 6.4 Other assurance providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 7 The KPMG methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Appendices I Recommended immediate actions and decisions . . . . . . . . . . . . . . . . . 65 II Specimen statements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 III Internal control benchmarking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 IV Board timetable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 V Criteria for reviewing the effectiveness of internal control. . . . . . . . . 80 VI Questions to ask when assessing the effectiveness of internal control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 VII KPMG offices in the UK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 ... - tailieumienphi.vn