Page 312 - COSO Guidance Book

Example 10-1

Assume that a jewelry store has annual losses of $40,000 that results from shoplifting. The
store’s owner has considered hiring a security guard to deter shoplifting. The owner would not
pay the security guard more than $40,000 a year. If the owner were to pay a salary greater than
$40,000 a year, the cost of the control (the security guard) would exceed the expected benefit
from eliminating shoplifting.

Many academics and practitioners have used probability theory to estimate the benefits of an internal
control. Assume, as in the previous example, that it is estimated that a security guard would decrease the
likelihood of shoplifting by 80%. In this case, the cost (if the guard’s salary was $40,000) would exceed
the benefit of $32,000 (80% × $40,000, the amount of shoplifting that is reduced by the guard’s
presence). The store owner would investigate other means to reduce shoplifting because the cost of the
control would be $8,000 more than the benefit.

Accounting and auditing literature also have addressed the diminishing returns of adding more and more
controls. For example, assume in the previous case that the security guard is 80% effective in preventing
shoplifting. The owner of the store might also install a camera system. It is estimated that the presence
of these two controls would increase the likelihood of preventing shoplifting to 85%. Still the store
4
manager might implement a third control, using mystery shoppers to observe operations. This
additional control, when combined with the other two, might increase the likelihood of preventing
shoplifting to 90%. Therefore, adding controls beyond a certain point does not have a significant impact
on reducing the probability of an undesirable event occurring (in this case, shoplifting).

How internal controls benefit small public companies

Historically, companies have gone public to have the benefit of access to public markets; public markets
provide the funds for expansion and growth. An additional benefit cited by many is that the cost of capital
(that is, interest rates and so on) are lower for publicly held companies because of the stringent
regulatory requirements they must adhere to, including annual audits of historical financial statements.
Thus, a strong system of internal control over financial reporting might reduce costs of capital.

Many companies have complained about the costs of complying with section 404 of SOX, which involves
internal control reporting. Some corporate leaders, on the other hand, have extolled the benefits obtained
from compliance with section 404 through streamlining existing systems, eliminating redundant systems
and duplicate controls, and creating documentation that is useful for training and operations. Brad Hayes,
the former CFO of LabCorp (a Fortune 500 company), has stated on several occasions how section 404
has helped his company achieve economies of scale in numerous areas.

4
A mystery shopper is a person hired by the company to pretend to be a customer to conduct surveillance for
illegal acts or for other observational purposes, such as the quality of customer service.

© 2020 Association of International Certified Professional Accountants. All rights reserved. 10-4