www1.worldbank.org

1 _____INTOSAI_____Guidelines for internal control StandardsIssued byInternal control standards CommitteeInternational Organizationof Supreme Audit InstitutionsJune 1992_____Preface_____Internal control has long been of interest to the members of theInternational Organization of Supreme Audit Institutions (INTOSAI).This interest can be traced to the 1974 Congress, where discussionswere held about the need for internal audit and the importance ofinternal control systems. Since that time, the interest ininternal controls has grown as government management has becomemore complex. This complexity does not allow management to reviewthe correctness of every individual employee task. Manygovernments are looking for ways to provide more economical,file:///C|/external%20sites/7 (1 of 43) [1/12/2003 2:26:31 PM]_____efficient, and effective services and to control deficits and often involves reorganizing old structures, revising oldprocedures, allowing managers more freedom, and increasing relianceon automated technologies.

2 In such an environment, an effectiveinternal control structure can provide reasonable assurance thatmanagement's objectives are being Committee on internal control standards was formed tostrengthen financial management and establish more focusedaccountability in the public sector. Its goal is to developguidance for establishing and maintaining effective internalcontrols. During the development of this document, the Committeerealized that these standards and guidelines can apply to allmanagers, not just financial managers, and expanded the scope tocover all government operations. Therefore, this document's use ofthe term " internal control " is not limited to the traditional viewof financial and related administrative control , but covers thebroader concept of management following member countries were involved in this project:-- Austria, Court of Audit;-- Chile, Office of the Comptroller General;file:///C|/external%20sites/7 (2 of 43) [1/12/2003 2:26:31 PM]_____-- Egypt, Central Auditing Organization;-- France, Court of Accounts;-- Jamaica, Office of the Auditor General;-- Spain, Tribunal of Accounts;-- Tanzania, Exchequer and Audit Department;-- the United States, General Accounting Office; and-- Yugoslavia, Social Accounting members identified four areas in which they believed guidancewas needed to achieve the Committee's goal.

3 These areas are-- the concepts and objectives of internal controls,-- a minimal set of internal control standards that any nationcould use as a framework to develop a specific internal controlstructure,-- the implementation of an internal control structure, and-- the periodic monitoring of the effectiveness of an internalcontrol member of the Committee researched one of these four individual research papers were combined into a draft documentthat the Committee members discussed among themselves and exposedto all INTOSAI members for comment. Those discussions and commentsfile:///C|/external%20sites/7 (3 of 43) [1/12/2003 2:26:31 PM]_____provided the Committee with insight into the use of internalcontrols by various systems of Committee discovered that while systems of government varywidely, the standards for strong internal controls are generallythe same.

4 This document attempts to capture those standards andpresent a consensus of the standards desirable in any specificinternal control structure. Government management can use thesestandards to implement an effective internal control auditors can use them to help evaluate those Committee would like to thank the following countries forsharing their knowledge of and experience in internal controlswith us and taking the time to respond to our request for NetherlandsBelgium New ZealandBelize NorwayBotswana PakistanCanada PanamaColombia PeruCosta Rica PhilippinesCzechoslovakia PortugalDenmark Qatarfile:///C|/external%20sites/7 (4 of 43) [1/12/2003 2:26:31 PM]_____Finland St. LuciaGermany Sierra LeoneHaiti South AfricaHungary SwitzerlandIndia TunisiaIreland TurkeyItaly United KingdomMauritania YemenMexico ZimbabweAfter incorporation of the comments, the Governing Board approvedthe issuance of these standards at its 35th meeting (October 1991,Washington, DC).

5 This is a "living" document that reflects thecurrent trends in designing, implementing, and evaluating internalcontrol A. BowsherComptroller General of the United StatesChairman, internal control standards Committee_____Contents_____file:///C|/ex ternal%20sites/7 (5 of 43) [1/12/2003 2:26:31 PM]_____PrefaceChapter I Overview of internal control Concepts, Objectives, andStandardsGeneral StandardsDetailed StandardsChapter II Definition and Limitations of internal ControlsDefinition and ObjectivesLimitations on internal control EffectivenessChapter III Discussion of the internal control StandardsGeneral StandardsDetailed StandardsChapter IV Establishing the Framework for internal ControlStructuresChapter V Implementing and Monitoring internal control StructuresManagement's ResponsibilitiesThe Supreme Auditor's ResponsibilitiesChapter I_____Overview of internal control Concepts,Objectives, and Standardsfile:///C|/external%20sites/7 (6 of 43) [1/12/2003 2:26:31 PM]_____1.

6 internal control is a management tool used to providereasonable assurance that management's objectives are beingachieved. Therefore, responsibility for the adequacy andeffectiveness of the internal control structure rests withmanagement. The head of each governmental organization must ensurethat a proper internal control structure is instituted, reviewed,and updated to keep it The Supreme Audit Institution also has a responsibility forensuring adequate internal control . It should encourage andsupport:-- the establishment of detailed organizational internal controlstructures for each governmental unit based on the standardspresented in this document; and-- a review of that structure to assure that the controls areworking as intended and are adequate to achieve the As they are ultimately responsible for the adequacy of theinternal control structure and its implementation, it is importantthat managements of all organizational units within governmentunderstand the nature of the internal control structure and thefile:///C|/external%20sites/7 (7 of 43) [1/12/2003 2:26:31 PM]_____objectives internal controls are to achieve.

7 An internal controlstructure is defined as the plans of an organization, includingmanagement's attitude, methods, procedures, and other measures thatprovide reasonable assurance that the following general objectivesare achieved:-- promoting orderly, economical, efficient, and effectiveoperations and quality products and services consistent with theorganization's mission;-- safeguarding resources against loss due to waste, abuse,mismanagement, errors, and fraud and other irregularities;-- adhering to laws, regulations, and management directives; and-- developing and maintaining reliable financial and managementdata and fairly disclosing that data in timely The following standards form the framework for an internalcontrol structure and have been categorized as general standardsand detailed standards :General StandardsReasonable Assurance: internal control structures are to providereasonable assurance that the aforementioned general objectiveswill be :///C|/external%20sites/7 (8 of 43) [1/12/2003 2:26:31 PM]_____Supportive Attitude: Managers and employees are to maintain anddemonstrate a positive and supportive attitude toward internalcontrols at all and Competence.

8 Managers and employees are to havepersonal and professional integrity and are to maintain a level ofcompetence that allows them to understand the importance ofdeveloping, implementing, and maintaining good internal controlsand to accomplish the general objectives of internal Objectives: Specific control objectives are to beidentified or developed for each activity of the organization andare to be appropriate, comprehensive, reasonable, andintegrated into the overall organizational Controls: Managers are to continually monitor theiroperations and take prompt, responsive action on all findings ofirregular, uneconomical, inefficient, and ineffective StandardsDocumentation: The internal control structure and all transactionsand significant events are to be clearly documented, and thedocumentation is to be readily available for and Proper Recording of Transactions and Events:file:///C|/external%20sites/7 (9 of 43) [1/12/2003 2:26:31 PM]_____Transactions and significant events are to be promptly recorded andproperly and Execution of Transactions and Events:Transactions and significant events are to be authorized andexecuted only by persons acting within the scope of of Duties: Key duties and responsibilities inauthorizing, processing, recording, and reviewing transactions andevents should be separated among : Competent supervision is to be provided to ensurethat internal control objectives are to and Accountability for Resources and Records.

9 Access toresources and records is to be limited to authorized individualswho are accountable for their custody or use. To ensureaccountability, the resources are to be periodically compared withthe recorded amounts to determine whether the two agree. Theasset's vulnerability should determine the frequency of These standards would be applicable to all governmentalorganizational units. They can be viewed as the minimum acceptablestandards that organizations follow when instituting internalfile:///C|/external%20sites/7 (10 of 43) [1/12/2003 2:26:31 PM]_____controls and provide criteria for auditors when auditing theinternal control The standards presented here are not new ideas. Many of themare currently incorporated in government operations. Theirpresentation as a framework, however, may be new. The remainder ofthis document discusses in greater detail the definition andlimitations of internal control , the standards of internal control ,the establishment of the framework for internal controls, and theimplementation and monitoring of internal control II_____Definition of Limitations of InternalControls_____Definition and Objectives7.

10 internal control structures are defined as the plans of anorganization, including management's attitude, methods, procedures,and measures that provide reasonable assurance that the objectivesare being achieved. Those objectives are-- promoting orderly, economical, efficient, and effectivefile:///C|/external%20sites/7 (11 of 43) [1/12/2003 2:26:31 PM]_____operations and quality products and services consistent with theorganization's mission;-- safeguarding resources against loss due to waste, abuse,mismanagement, errors, and fraud and irregularities;-- adhering to laws, regulations, and management directives; and--developing and maintaining reliable financial and management dataand fairly disclosing that data in timely This definition of internal control structures and theobjectives for them are intentionally broad in scope to cover allgovernment operations. However, internal controls have beenorganized and defined in various other ways.