Internal Controls & Ethics

Overview

• What you’ll learn: The principles of internal controls, segregation of duties, the fraud triangle, the Sarbanes-Oxley Act (SOX), and the ethical foundations of accounting.
• Prerequisites: Lesson 6 — Accrual vs. Cash Basis Accounting
• Estimated reading time: 16 minutes

Introduction

The Grand Historian records: The annals of accounting are littered with cautionary tales — Enron, WorldCom, Tyco, Wirecard — empires built on fabricated numbers, brought low by the inevitable reckoning. In each case, the failure was not merely technical; it was moral. The ledgers did not cook themselves. Human beings, faced with pressure, opportunity, and rationalization, chose to deceive.

Internal controls and professional ethics are the twin pillars that prevent the treasury from being plundered. Controls create systems that make fraud difficult; ethics create cultures that make fraud unthinkable. Without both, even the most sophisticated accounting system is merely an elaborate tool for concealment.

What Are Internal Controls?

Internal controls are the policies, procedures, and practices an organization implements to:

• Safeguard assets from theft, loss, or misuse
• Ensure accuracy and reliability of financial records
• Promote operational efficiency
• Ensure compliance with laws, regulations, and company policies

The Five Components (COSO Framework)

The Committee of Sponsoring Organizations (COSO) defines five integrated components of internal control:

Segregation of Duties

The most fundamental internal control principle: no single person should control all phases of a transaction. Divide responsibilities among different people so that one person’s work serves as a check on another’s.

The three functions that must be separated:

1. Authorization: Approving transactions (e.g., approving a purchase order)
2. Custody: Physical control of assets (e.g., handling cash or inventory)
3. Record-keeping: Recording transactions in the books (e.g., making journal entries)

When one person handles all three — authorizing, holding assets, and recording — the opportunity for undetected fraud is enormous. The accountant who approves invoices, signs checks, and records payments can create fictitious vendors and pay himself with impunity.

The Fraud Triangle

Criminologist Donald Cressey identified three conditions that are present in virtually every case of fraud:

• Pressure (Motivation): Financial difficulties, gambling debts, substance abuse, living beyond one’s means, or unrealistic performance targets.
• Opportunity: Weak internal controls, lack of oversight, excessive trust without verification, or a position with both custody and record-keeping authority.
• Rationalization: “I’m just borrowing it.” “The company owes me.” “No one will notice.” “Everyone does it.” The mental justification that makes the act seem acceptable.

Remove any one leg of the triangle, and fraud is far less likely. Internal controls primarily target opportunity — making it harder to commit fraud and harder to conceal it.

The Sarbanes-Oxley Act (SOX)

In 2002, in the smoking ruins of the Enron and WorldCom scandals, the United States Congress enacted the Sarbanes-Oxley Act — the most significant overhaul of financial regulation since the Securities Acts of the 1930s.

Key provisions:

• Section 302: CEO and CFO must personally certify the accuracy of financial statements. No more “I didn’t know.”
• Section 404: Companies must document, test, and report on the effectiveness of internal controls over financial reporting.
• Section 802: Criminal penalties for altering, destroying, or concealing documents to obstruct investigations (up to 20 years in prison).
• Section 906: Criminal penalties for certifying financial statements known to be inaccurate (up to 20 years in prison).
• PCAOB: Created the Public Company Accounting Oversight Board to oversee the auditing profession.

Professional Ethics in Accounting

The accounting profession rests on public trust. If investors cannot trust the numbers, the capital markets collapse. The major professional codes include:

• Integrity: Be honest and straightforward in all professional relationships.
• Objectivity: Do not allow bias, conflict of interest, or undue influence to override professional judgment.
• Professional Competence: Maintain knowledge and skill at the level required for competent service.
• Confidentiality: Do not disclose information acquired in the course of professional work without proper authorization.
• Professional Behavior: Comply with laws and regulations; avoid actions that discredit the profession.

Key Takeaways

• Internal controls safeguard assets, ensure accurate records, promote efficiency, and ensure compliance.
• The COSO framework defines five components: control environment, risk assessment, control activities, information/communication, and monitoring.
• Segregation of duties separates authorization, custody, and record-keeping among different people.
• The fraud triangle (pressure, opportunity, rationalization) explains why fraud occurs; controls target opportunity.
• SOX requires CEO/CFO certification of financial statements and documented internal controls.
• Professional ethics — integrity, objectivity, competence, confidentiality — are the bedrock of public trust.

What’s Next

In Lesson 8, you will survey the major accounting standards and frameworks — IFRS vs. GAAP, the roles of the FASB and IASB — and understand why the world has not yet agreed on a single set of accounting rules.