International Control in Private and Public Companies - Essay Example

One of the primary differences between internal control in private and public companies is that public companies are obligated by the SEC to comply with the mandates of the Sarbanes-Oxley Act (SOX) of 2002. Section 404 deals with management report on internal control over financial reporting. Based on section 404 public companies are required to provide a managerial assessment of internal control within its annual report. Section 404 also includes guidelines for design of internal control and operating effectiveness of controls. Private companies are exempt from compliance with the Sarbanes-Oxley Act. The internal controls of private companies vary depending on the size of the companies, the industry, and the expectations of the stakeholder groups. 2. The five components of internal control are control environment, risk assessment, control activities, information and communication, and monitoring. These five components are based on the COSO internal control framework. An effective control environment is required for the other four components to work effectively. For a control environment to be effective the executive managerial team must be committed to it. Identifying and evaluating risk is a critical component of any auditing work including internal control assessment. A good control environment makes it easier for the audit to detect and assess business risks. Based on SAS 94 most control activities related to policies and procedures are associated with segregation of duties, information processing, physical controls, and performance reviews. Information and communication between the auditors and the managers is required for an audit to be performed efficiently. Monitoring assesses the quality of an internal audit. The component that I selected for evaluation is information and communication. An audit problem associated with this component of internal control can be very problematic. As an auditor if I had problems with this component due to a lack of cooperation from the managerial staff I would resolve the problem by seeking the intervention of the board of directors of the company. 3. I agree with you that the frequency in which private companies test their internal control is much lower than for public companies. The two reasons for this occurrence is due to the legal requirements of the Sarbanes-Oxley Act and because private companies do not have as many stakeholder groups to satisfy. Public companies have to respond to lenders, suppliers, government, regulatory agencies, employees, investors, business partners, the community, and the environment. I think that private companies often disregard the importance of internal controls. This makes private companies more susceptible to fraud and illicit financial behavior. 4. I agree with you that the size of a company influences the need for internal controls. There are some private companies that move billions of dollars in revenues every year. Such companies should by their own initiative implement internal control standards similar to those used by public companies. When companies do not institute tough internal control mechanisms they are susceptible to financial fraud. Collusion among the managerial staff is more likely to occur in companies that do not perform proper internal audit and internal control mechanisms. In terms of small businesses sometimes internal audits are too costly. If costs of information exceed its benefits companies should not invest in acquiring that information. 5. As you mentioned in your response only public companies are required to comply with the Sarbanes-Oxley Act. One of the reasons that private companies cannot comply with SOX is because it is extremely costly to comply with the Act. I think that public companies have benefited a lot from the implementation of SOX. The accounting profession is now able to provide information that is more reliable that ever. Auditors must adequately control risks because risks that are not identified can hurt a company because the firm cannot implement remedial actions to manage the risk factor. 6. I agree with you that issues in the control environment should be dealt with by focusing on the top. The executive management team has a lot of influence over the control environment of a company. During the Enron case the control environment was non-existent since the top managerial team colluded to commit financial fraud. As you mentioned in your response often managers can change the tone of its control environment by altering its mission statement, value statements, and overall objectives. The internal control mechanism of a company should enable the company the ability to detect any wrongdoing. 7. In the case that a company was using security guards as a control mechanism to watch over the employees’ behavior a firm could ensure the quality of its laborers by running tight background checks on its security personnel. I think companies can benefit from incorporating technological tools to monitor employees. For instance the online surfing behavior of the employees can be monitored by incorporating encrypted passwords for each employee to access the information system of the company. There are software applications that can block certain websites which minimizes the unauthorized use of the internet for personal reasons. 8. I tend to agree with you that control activities are often a weakness or shortfall of many corporations. Many companies are exposed to a lot of unnecessary risks due to a lack of proper implementation of control mechanisms. Often the greatest threat to the financial assets of a company comes from within. A lack of documentation is a bad practice because it leaves the company without supporting evidence to track all the economic activity of a company. Corrupt managers utilize any weakness in a system to collude with other unethical employees in order to enrich their pockets. Read More