内控的五要素ComponentsofInternalControl

1、ComponentsofInternalControl内部控制的要素Internalcontrolconsistsoffiveintegratedcomponents.内部控制包括五个相关关联的要素。ControlEnvironment控制环境Thecontrolenvironmentisthesetofstandards,processes,andstructuresthatprovidethebasisforcarryingoutinternalcontrolacrosstheorganization.Theboardofdirectorsandseniormanagementestabl

2、ishthetoneatthetopregardingtheimportanceofinternalcontrolincludingexpectedstandardsofconduct.Managementreinforcesexpectationsatthevariouslevelsoftheorganization.Thecontrolenvironmentcomprisestheintegrityandethicalvaluesoftheorganization;theparametersenablingtheboardofdirectorstocarryoutitsgovernance

3、oversightresponsibilities;theorganizationalstructureandassignmentofauthorityandresponsibility;theprocessforattracting,developing,andretainingcompetentindividuals;andtherigoraroundperformancemeasures,incentives,andrewardstodriveaccountabilityforperformance.Theresultingcontrolenvironmenthasapervasivei

4、mpactontheoverallsystemofinternalcontrol.控制环境是一套标准、流程和结构，能够为内部控制的实施提供基础。董事会和高级管理层为内部控制的重要性(包括期待的行为准则)提供高层定调(thetoneatthetop)。组织各个层级的管理活动强化了这种期望。控制环境包括了组织正直和道德的价值观；促进董事会行使公司治理的监控职责的机制；吸引、开发和保留人才的机制；严格的绩效衡量、激励和汇报机制以保证绩效实现。控制环境会对内部控制的整体体系产生全面影响。RiskAssessment风险评估Everyentityfacesavarietyofrisksfromexter

5、nalandinternalsources.Riskisdefinedasthepossibilitythataneventwilloccurandadverselyaffecttheachievementofobjectives.Riskassessmentinvolvesadynamicanditerativeprocessforidentifyingandassessingriskstotheachievementofobjectives.Riskstotheachievementoftheseobjectivesfromacrosstheentityareconsideredrelat

6、ivetoestablishedrisktolerances.Thus,riskassessmentformsthebasisfordetermininghowriskswillbemanaged.每个组织都面临着来自内外部的各类风险。风险是潜在事件发生并对组织实现其目标产生负面影响的可能性。风险评估包括了根据组织要实现的目标，动态和反复的识别和评估风险的过程。将全组织范围的影响目标实现的风险同已经建立的风险容忍度一同考量后，风险评估就为决定风险如何进行管理打下了基础。Apreconditiontoriskassessmentistheestablishmentofobjectives,lin

7、kedatdifferentlevelsoftheentity.Managementspecifiesobjectiveswithincategoriesrelatingtooperations,reporting,andcompliancewithsufficientclaritytobeabletoidentifyandanalyzeriskstothoseobjectives.Managementalsoconsidersthesuitabilityoftheobjectivesfortheentity.Riskassessmentalsorequiresmanagementtocons

8、idertheimpactofpossiblechangesintheexternalenvironmentandwithinitsownbusinessmodelthatmayrenderinternalcontrolineffective.风险评估的先决条件是组织各个层级的目标的确立。管理层要结合运营、报告和遵循的三大类目标，明确相应的具体目标，以便识别和分析相关的风险。管理层也要考虑这些目标对于组织的可持续性。风险评估还要求管理层考虑可能导致内控失效的外部环境和内部商业模式的可能变化。ControlActivities控制活动Controlactivitiesaretheactionse

9、stablishedthroughpoliciesandproceduresthathelpensurethatmanagementsdirectivestomitigateriskstotheachievementofobjectivesarecarriedout.Controlactivitiesareperformedatalllevelsoftheentity,atvariousstageswithinbusinessprocesses,andoverthetechnologyenvironment.Theymaybepreventiveordetectiveinnatureandma

10、yencompassarangeofmanualandautomatedactivitiessuchasauthorizationsandapprovals,verifications,reconciliations,andbusinessperformancereviews.Segregationofdutiesistypicallybuiltintotheselectionanddevelopmentofcontrolactivities.Wheresegregationofdutiesisnotpractical,managementselectsanddevelopsalternati

11、vecontrolactivities.控制活动是通过制度和流程所确立的行动，旨在确保管理层降低影响组织目标实现的风险的方针得以实现。在组织的各个层级，业务的各个环节，信息技术的整个环境中都应实施控制活动。从性质上，可以是预防性的，也可以是检查性的；应覆盖手工和自动控制；包括授权和批准，复核，对账和业务绩效评估。不相容职责分离也是典型的应选取和推进的控制活动。如果不相容职责分离无法实施，管理层应选择和推进替代性的控制活动。InformationandCommunication信息与沟通Informationisnecessaryfortheentitytocarryoutinternalcon

12、trolresponsibilitiestosupporttheachievementofitsobjectives.Managementobtainsorgeneratesandusesrelevantandqualityinformationfrombothinternalandexternalsourcestosupportthefunctioningofothercomponentsofinternalcontrol.信息对于组织而言，对推进内控、促进其目标实现是非常必要的。管理层从内外部获得或生成，并且使用相关的有质量的信息来支持内部控制其他要素的正常运转。Communication

13、isthecontinual,iterativeprocessofproviding,sharing,andobtainingnecessaryinformation.Internalcommunicationisthemeansbywhichinformationisdisseminatedthroughouttheorganization,flowingup,down,andacrosstheentity.Itenablespersonneltoreceiveaclearmessagefromseniormanagementthatcontrolresponsibilitiesmustbe

14、takenseriously.Externalcommunicationistwofold:itenablesinboundcommunicationofrelevantexternalinformation,anditprovidesinformationtoexternalpartiesinresponsetorequirementsandexpectations.沟通是一个持续和不断重复的提供、分享和获得必要的信息的过程，。内部沟通是一个手段，使得信息能够在整个组织向上、向下和横向扩散，能够帮助员工接受来自高管层的清晰的信息控制的职责必须认真实施。外部沟通包括两个部分：将外部的相关信息传

15、入组织内部，以及根据其要求和期望，提供信息给外部的相关方。MonitoringActivities监督活动Ongoingevaluations,separateevaluations,orsomecombinationofthetwoareusedtoascertainwhethereachofthefivecomponentsofinternalcontrol,includingcontrolstoeffecttheprincipleswithineachcomponent,ispresentandfunctioning.Ongoingevaluations,builtintobusines

16、sprocessesatdifferentlevelsoftheentity,providetimelyinformation.Separateevaluations,conductedperiodically,willvaryinscopeandfrequencydependingonassessmentofrisks,effectivenessofongoingevaluations,andothermanagementconsiderations.Findingsareevaluatedagainstcriteriaestablishedbyregulators,recognizedstandard-settingbodiesormanagementandtheboardofdirectors,anddefic