Fundamental Concepts

10.2.2 - Fundamental Concepts (Rev. 13001, Issued: 12-13-24, Effective: 10-01-24, Implementation: 01-15-25) Three fundamental concepts provide the underlying framework for designing and applying the internal control standards. A. A continuous built-in component of operations Internal control includes measures and practices that are used to mitigate risks and exposures that could potentially prevent an organization from achieving its goals and objectives. Internal control is not one event or circumstance, but a series of actions that permeate an organization's activities. These actions are pervasive and are inherent in the way management runs the organization. Internal controls involve an organization-wide commitment that defines and implements a continuous process of assessing, monitoring, and tracking activities and risks, through an integrated and effective communication mechanism. B. Are affected by people An organization's management directs internal control, which is carried out by the people within that organization. Management's commitment to establish strong internal control affects the organization's practices. Management sets goals and policies, provides resources, and monitors and evaluates the performance of the organization. The organization's internal control environment is established by these policies and is controlled by available resources. Although internal control begins with this established environment, the employees make it work and must be adequately trained. It is the manner in which the entire organization embraces the internal control that affects their accountability and operational results. C. Provide reasonable assurance, not absolute assurance Reasonable assurance indicates that an internal control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance regarding achievement of an entity's objectives, and further indicates that the likelihood of achievement of these objectives is affected by limitations inherent in all internal control systems. Examples of limitations are: a. Judgment - the effectiveness of controls will be limited by decisions made by human judgment under pressures to conduct business based on information at hand; b. Breakdowns - even well designed internal controls can break down. Employees sometimes misunderstand instructions or simply make mistakes. Errors may also result from new technology and the complexity of computerized information systems; c. Management Override - high-level personnel may be able to override prescribed policies and procedures for personal gain or advantage. This should not be confused with management intervention, which represents management actions to depart from prescribed policies and procedures for legitimate purposes; d. Collusion - control systems can be circumvented by employee collusion. Individuals acting collectively can alter financial data or other management information in a manner that cannot be identified by control systems. End Section 10.2.2 – Fundamental Concepts: Back to Table of Contents