Governance, Risk and Ethics

Assignment # 01

Submitted To: Hamad Shamas

Submitted By: Abdullah Butt l1f19bsaf0121

Date: 22nd November 2021

Control Environment

A control environment is made up of a compilation of an entity’s organizational structure,

processes, policies, and standards that are utilized to maintain control across the organization.
The board of directors and executive management of a business establish the company culture
and attitude regarding the importance of maintaining controls and set the expectations of
standards of conduct within the organization—often referred to as “the tone at the top.

There are five key components of internal control (sometimes referred to as the principles of
internal control) that include the following:

Control Environment Risk Assessment

Control Activities

Information and Communication

Monitoring Activities

Internal Control Environment

Each organization must start by establishing its internal control environment. It has been said
that five things are needed to successfully effect change—vision, skills, incentives, resources,
and a plan. Efforts to change without a vision create confusion. Experience has shown that a lack
of skills, incentives, resources, or a plan will result in anxiety, resistance, frustration, and failure.
Interestingly, when it comes to implementing or improving internal control within an
organization, the control environment is a pervasive factor that impacts all of the other aspects of
internal control. Consequently, a poor “tone at the top” by the board of directors or executive
management will likely hinder or damage the other components of internal control.

Internal Control Risk Assessment

The next step in the design and implementation of internal control for an organization is to
identify and analyze threats or risks to the achievement of the entity’s objectives. Our blog post
on Risk Management describes the risk assessment component of internal control in greater
detail. This is an iterative process that should be performed at least annually if not sooner when
significant changes occur to the organization, its industry, or the regulatory environment.

Control Activities

Risks that management determines that the entity must mitigate in order to achieve its objectives
are addressed by control activities. This is a critical element of internal control. Through policies
and procedures, control activities or actions are put into place to address those risks.
Control activities can be any number of actions within an organization and are categorized by
type and nature. They should be specific actions that can be observed and documented for future
inspection or re-performance by a third-party. Please see our blog post on the different types of
controls for additional detail. This will give you examples of internal controls that you might
consider implementing in your organization.
It is important that an organization use a risk-based approach in designing its control activities or
internal control framework. This means that controls are designed to address the risk factors
identified in its internal risk assessments rather than using a pre-defined control list. While some
frameworks are widely accepted (such as COSO’s internal control framework), each
organization is different and faces different challenges. This requires that an organization
customize even the best framework to align with its needs.

Information and Communication

It is critical that personnel within the organization understand their responsibilities for internal
control. This is best achieved when individuals can relate the impact that their activities have on
the achievement of the business’ goals and objectives. This communication should be an ongoing
process. Organizations with truly effective internal control provide training to personnel on a
regular basis, keep current policies and procedures available to personnel, and communicate
other critical information in a timely manner via company meetings or emails as needed.

Monitoring Activities

Monitoring activities consist of continual evaluations of the implementation and operation of the
five (5) components of an internal audit. Findings should be evaluated against criteria established
by the board of directors, management policies, industry standards, and regulators. Deficiencies
should be communicated to management and board of directors, as needed. Management should
follow-up on these items through resolution.