An effective internal control system is a priority | KPMG | CA
Share with your friends

An effective internal control system is a management and board priority

An effective internal control system is a priority

This is the second article of a three-part series covering CEO and CFO certifications.



KPMG in Canada


Related content

Internal controls, systems, board of directors, management

A system of internal control provides an organization with reasonable assurance that its objectives and obligations relating to external reporting and compliance with laws and regulations will be achieved. Conversely, the absence of appropriate controls could impact CEO and CFO certifications under NI 52-109, and attract unnecessary regulatory scrutiny—particularly if management cannot certify to the appropriateness of their controls or weak controls lead to a reporting failure. To avoid issues and ensure the overall effectiveness of the internal control system, proactive management and directors are essential.

Seven considerations for management:

  1. Walk the talk—Management must set the appropriate tone concerning the importance of internal control. Clear guidance and direction from the top facilitate the achievement of the entity’s objectives.
  2. Decide how to approach controls—Internal controls should reflect identified risks. People, capabilities, skills and judgments—all of which affect internal control—differ between entities. Controls need to reflect the organization’s environment and industry, as well as the complexity of its structure, culture and operations.
  3. Right-size controls—COSO 2013 sets out the components of internal control and the principles that underlay each component. The principles are as applicable to smaller entities as they are to larger ones, however, approaches will vary.
  4. Ensure evidence—Management should ensure there is persuasive evidence to support its determination that the system of internal control is in effective. This is further explored in Part 3 of this series called, What is persuasive evidence as it relates to an internal control systems?
  5. Evaluate—Ongoing monitoring is part of the system of internal control itself. Management should regularly engage with the board of directors concerning internal control matters: changes made, the evaluation process and any deficiencies identified, including timely remediation.
  6. Keep current—It is necessary to regularly review and update controls to ensure they keep pace with changes in the organization. Business acquisitions or divestitures, new product development, personnel changes, new technologies and changing regulations are all factors that could impact internal control.
  7. Assess cost vs. benefit—Decide how the entity evaluates costs versus the benefits of alternative systems of internal control. Cost alone is not an acceptable reason to avoid implementing internal control.

Four considerations for the board of directors:

  1. Operate independently
    Ensure the board has members who are independent from management and objective in evaluation and decision making.
  2. Apply relevant proficiency
    Ensure the board regularly evaluates the skills and expertise needed among its members to enable them to ask probing questions of senior management and take commensurate actions. Appropriate knowledge, attention and communication among board members is an effective means of offsetting the effects of any improper management override, should it exist.
  3. Set the tone at the top
    Together with management, set the appropriate tone; demonstrate through directives, actions and behaviour the importance of integrity and ethical values that support the functioning of the system of internal control.
  4. Establish and exercise oversight responsibilities
    (See appendix A [PDF 68 KB]) Explicitly acknowledge and actively pursue oversight responsibilities. Provide a constructive challenge to management to ensure appropriate structures and processes exist to provide the board with sufficient, appropriate and timely information.

Key questions for management and boards to consider:

  • Are management and the board of directors effectively fulfilling their roles in the internal control process?
  • Do we have a dynamic system of internal control that changes with the organization?
  • Are we confident that the system of internal control is effective?
  • Do our auditors have any comments on/concerns about the system of internal control?
  • Do communications from our regulators indicate any issues with the system of internal control?

Implementing and maintaining an appropriate, effective internal control system is critical in today’s regulatory environment—and taking the right steps to make that happen should be both a management and board priority.


Next steps:

Connect with us


Request for proposal