New York State Internal Control Association

1

• New York State Internal Control Association

Control Environment - Tone at the Top
February 28, 2002
Soft Controls Committee
Paul Casey Kelly Chrzanowski
Carole Clements Niels Hansen
Donna Lorenson Steve Suriano
2
Control Environment
Objectives

• What are the components?
• What does a good control environment look like?
• How do you evaluate your organization?

3
Control Environment
COSO Pyramid
4
Control Environment
Key Components

• Ethical Values and Integrity
• Managements Operating Style and Philosophy
• Competence
• Morale
• Supportive Attitude
• Mission
• Structure

5
Definition of Internal Control

• Internal control or an internal control system
  is the integration of the activities, plans,
  attitudes, policies, and efforts of the people of
  an organization working together to provide
  reasonable assurance that the organization will
  achieve its objectives and mission.

6
Control Environment

• Mission
• Statement of organizational purpose
• Provides direction
• Motivates staff
• Increases organizational focus

7
Mission and Strategic Planning
Strategic Planning

• Disciplined effort to produce fundamental
• decisions and actions that shape and guide
• what an organization is, what it does, and why
• it does it, with a focus on the future.

8
Mission and Strategic Planning

• Developing a Strategic Plan
• Objectives
• Performance Measures
• Reporting
• Evaluation/Change
• Training
• Examples of Strategic Plans
• State Education Department
• Dormitory Authority Balanced Scorecard

9
Integrity and Ethical Values

• The effectiveness of internal controls depends on
  the integrity and ethical values of the people
  who create, administer, and monitor them
• Integrity and ethical values are essential
  elements of the control environment affecting
  the design, administration and monitoring of
  other internal control components

10
Integrity and Ethical Values
Include the following

• Tone at the Top
• Corporate Culture
• Code of Conduct
• Removing temptation for unethical behavior
• Dealing with people outside the organization

11
Integrity and Ethical Values
Tone at the Top

• Ethical tone is established at the top and
  communicated throughout the agency
• Management encourages integrity and ethical
  values
• Action is taken on potential problems
• Management is aware of ethical issues inherent in
  the operation of its action plans

12
Integrity and Ethical Values
Tone at the Top continued.

• Adherence to laws and policies is encouraged by
  management
• Management shows a commitment to excellence
• Respect is shown for employee rights
• Management encourages adherence to professional
  standards

13
Integrity and Ethical Values
Corporate Culture

• Includes ethical and behavioral standards, how
  theyre communicated and how theyre reinforced
  in practice
• Top management plays a key role
• Official policies specify what management wants
  to happen but corporate culture determines what
  actually happens
• Employees indicate that peer pressure exists for
  appropriate moral and ethical behavior

14
Integrity and Ethical Values
Code of Conduct

• Agency has established and uses a Code of Conduct
• Possible types of disciplinary actions are
  communicated throughout the agency
• Disciplinary action is taken in response to
  departures from approved policies and procedures
  or violations of the Code of Conduct

15
Integrity and Ethical Values
Removing Temptation for Unethical Behavior

• Management sets realistic goals
• Management encourages a sense of shared
  accountability among employees
• Processes and control systems promote compliance
  with regulations
• Management provides incentives for adherence to
  ethical values
• Compensation and promotion are based on
  performance

16
Integrity and Ethical Values
Dealing with Outside Organizations

• Dealings conducted on a high ethical plane
• Accurate reporting
• Management cooperation with auditors
• Under billings by suppliers or overpayments by
  customers are quickly corrected

17
Commitment to Competence

• HR Policies Procedures
• Common understanding
• Consistency
• Compliance
• Accessible to everyone
• Skill Knowledge level for every position
• Job descriptions periodic review
• Qualifications education, experience
• Resources to do the job
• Equipment, software good work environment
• Policy and procedure manuals

18
Commitment to Competence contd..

• Recruiting Hiring
• Employment application
• Canvassing process (Civil Service)
• HR screening
• Interview process
• Background check credit, criminal, reference,
  education
• Employee Orientation
• First day
• Probation

19
Commitment to Competence contd..

• Training
• Commitment
• Ethics/Internal Controls
• Skills
• Cross-Training
• General Development Training

20
Commitment to Competence contd..

• Performance Evaluations
• Routine communication
• Training
• Structured/Consistent
• Interview staff feedback
• Future developments training
• Non-compliance Inappropriate Behavior
• Disciplinary action
• Reward Recognition
• Employee Development Program

21
Supportive Attitude

• Managements support for internal controls sets
  the tone for the entire organization.

22
Supportive Attitude
Showing Support for Internal Controls

• Encourages and allocates resources to Internal
  Control training
• Meets with Internal Control personnel

23
Supportive Attitude
Showing Support for Internal Controls contd..

• Discourages circumventing internal controls and
  policies control overrides are limited and
  fully documented
• Supports the Internal Audit function

24
Supportive Attitude
Showing Support for Internal Controls contd..

• Acts on recommendations from internal/external
  audits and internal control reviews
• Staffs the internal control and internal audit
  functions with competent personnel-appropriate
  experience, skills, and abilities

25
Control Environment
Key Components

• Mission
• Ethical Values and Integrity
• Competence
• Supportive Attitude

26
Evaluating the Control Environment
External Perspective

• Characteristics of an effective board or audit
  committee
• Independence from management
• Experience and stature of the members
• Extent of involvement and scrutiny of activities
• Interaction with internal and external auditors

27
Evaluating the Control Environment
External Perspective

• Oversight Groups
• Internal Audit
• Reporting relationship
• Assessing competence and objectivity
• Regulatory oversight
• Frequency and extent of review procedures
• Results
• Corrective action plans and follow-up

28
Evaluating the Control Environment
External Perspective

• Management characteristics
• Structure
• Integrity and ethical values
• Aggressive vs. conservative policies and
  practices
• Compensation and incentives

29
Evaluating the Control Environment
External Perspective

• Human Resources
• Organizational structure
• Assignment of authority and responsibility
• Policies and procedures
• Staff Turnover
• Training

30
Evaluating the Control Environment
External Perspective

• Techniques for Assessing Effectiveness
• Interviews
• Questionnaires
• Observation
• Evidential matter
• Prior experience

31
Evaluating the Control Environment
External Perspective

• Substance over Form!!!

32
Evaluating the Control Environment
Internal Measures

• Mission Statement
• Strategic Plan
• Performance Measurement
• Ethics
• Competence
• Supportive Attitude

33
Conclusion

• A control environment consists of the
  elements of an organization that all its
  employees experience, including the leadership.
  These are the philosophical, sociological and
  psychological aspects of human work interactions
  that impact individual behaviors, attitudes and
  effectiveness. Ethics is at the core of the
  control environment. Leadership sets the ethical
  tone. Ethical leaders seek to correct what does
  not work and endeavor to find and maintain
  competent staff. Morale tends to flourish with
  such leaders.

34
Questions and Discussion