Internal Control Implementation at
for attestation of the Internal Control System is almost here.
— The attorneys and accountants have done
— New processes and
procedures are in place.
one more critical job: successfully training employees so that there is common
knowledge and skills around these new processes.
— Common interpretation of the processes and a new ethical climate
are essential to making it all work on a day to day basis.
— Is this last step required?
— Absolutely it is, because the SEC
requirement is for tests of the new system to be effective.
— There is no credit for just having them in
effective controls is only the first step.
Everyone who plays a role in implementing internal controls needs to
have a common interpretation of the requirements.
— This is where the difficulties start ¶ interpretations!
— Virtually all employees are asked to certify
that their departments have implemented effective internal controls; they do so
in good faith and based on their interpretation of the control requirements.
— Their boss then assumes that these employees
have the same interpretation of the control requirements that the boss has.
conversations ever happened in your company?
— ?Jane, we really need to get ABC Components
paid this week.
— We need them to ship
more components to us and they say they must be paid for the last shipment.
— I just can?t wait for all of the paperwork
in our system.
— Can you authorize
— ?I know how
slow things are.
— Let?s get them paid
now and we?ll work out the back-up documents with Accounting later.≤
— ?I just
received a letter from a Big Customer confirming that they plan to buy 2,000
— Since this is March 31, I
want to be sure we book the sale this quarter.
Let?s ship the order today and notify Accounting immediately.≤
probably won?t go out until tomorrow.≤
— ?Just put
the paperwork through to ship it today.
We can?t always control whether or not the shipping company picks up on
any given day.≤
What procedures should be followed in
each of these situations?
— What is the importance
of following the right procedures?
can an exception be made to a procedure?
In the first situation, the manager rationalized that this was a special
case and he or she would fix the problem later by submitting appropriate
documentation. The manager, in the second case, rationalized that a letter of intent
was as good as an order and that the exact timing of the shipment was not
important as long as the paperwork was submitted.
These situations illustrate the problem
that companies face when they implement control requirements in accordance with
the requirements of SOX and the SEC.
employees face a situation where they must take action to meet a performance
measure, their interpretation of a procedure or control may be different than
what was intended.
— If employees do not
know the reason for the procedure, the importance of the controls and the
correct interpretation of the process, the company is exposed to significant
Every month in their SEC filings,
companies disclose material weaknesses or significant deficiencies in internal
——— The disclosures often use
phrases like: ?irregularities≤, or ?insufficient supervision of personnel≤, or
?lack of training related to procedures≤.
Although fraud is always a possibility, what typically creates problems
is a misinterpretation of what is acceptable and what is not acceptable, what
is expected and what is prohibited.
What does this mean for the CEO and CFO
of publicly traded companies that will be required to certify their company?s
internal controls starting June 15, 2004?
It means they will be relying on everyone in the company to correctly
interpret and implement procedures and internal controls.
— Significant attention has been paid to
enhancing internal controls.
— New checks
and balances, new process, new requirements, new systems will be rolled out in
— How these are implemented
will make the difference between an effective system of internal controls and
one with many problems.
— Now it is time
to look at how these controls will be institutionalized and ensure accurate
key employees answer these questions consistently?
How do I avoid conflict of interest?
What is my role in protecting company assets?
What policies and procedures should I follow in my
What internal control requirements are parts of my
What is my level of authority and the authority
of those around you?
What behaviors are expected, or acceptable, and
what is unacceptable?
Most, if not all, employees would be
able to answer at least some of the above questions.
— The key issue is whether or not they would answer them as
expected or would there be a variety of different answers.
policies and procedures are not enough. Two employees can read the same
document and have very different interpretations. They may also have very
different views on how important a procedure is to the company.
—— Training can provide a cost effective way
to ensure employees have a common interpretation of the control
effective internal controls training program must be targeted to the needs of
— There is little value received
from training the receiving personnel on how to do account reconciliation.
—— The unique need for information on control
requirements within each group, such as finance, accounting, purchasing,
operations and support staff, must be identified.
—— In some cases, people may only need limited training to stress
the importance, requirements and boundaries of the process as well as where to
go for clarification.
— This may be the
situation for employees responsible for receiving products and materials.
— In other cases, such as accounts payable,
there may be more control requirements that necessitate detailed training.
training also reduces risk by providing opportunities for employees to clarify
their roles and responsibilities.
Controls are often thought of as an accounting issue.
— The operations personnel may see it as
something outside of their role. Responsibilities are clarified through
also provides for discussion so that employees express their interpretations
and get their questions answered, rather than being allowed to make assumptions
about what is expected.
can easily be avoided if employees had an opportunity to get answers.
— In the absence of clear information people
are often very good at filling in the blanks.
risk and start the learning process using training conducted in classrooms, interactive
distance learning or synchronous web based trainin.
— These provide critical information, opportunities for questions
and practice using the information.
learning process must be supported by just-in-time training such as on-line job
aids, resources for quick answers to questions and coaching from immediate
supervisors and subject area experts.
may misinterpret procedures.
management has a challenge.
— CEOs and
CFOs must be confident when they certify the accuracy of the financials and
effectiveness of internal controls for their company.
——— How can companies minimize the risk of misinterpretation and be
assured that employees are knowledgeable and skilled regarding control
requirements and procedures?
is an integrated training effort that targets skills and knowledge for the job
function, uses a variety of training methods and provides opportunities for all
employees to discuss issues and ask questions.
Missing Link in Implementing Effective Internal Controls≤,
Ethics Program Adding Value≤,
Out About Ethics≤,
Carmichael and more:
Controls Justification≤, It's not a cost/benefit analysis. It's risk
To learn more about Bradley Lambert
Inc. please visit us at
us what you think.
Thanks for reading the Bradley Lambert Articles.
2004 Bradley Lambert Inc.
6151 W. Century Blvd., Suite 1110, Los Angeles, CA
310-670-1400, fax 310-568-0681