Page 313 - COSO Guidance Book

Internal controls appropriate for

smaller companies

Management of smaller entities might view internal control as an additional overhead burden; they might
not perceive the value of implementing a system of internal control. The framework lists the following
challenges to smaller companies relative to internal control:

 Obtaining sufficient resources to achieve adequate separation of duties
 Balancing management’s ability to dominate activities with significant opportunities for improper
management override of processes to appear that business performance goals have been met
 Recruiting individuals with requisite expertise to serve on the board of directors and committees
 Recruiting and retaining personnel with sufficient experience and skill in operations, reporting,
compliance, and other disciplines
 Taking critical management attention from running the business to provide sufficient focus on
internal control
 Controlling IT and maintaining appropriate general and application control over computer information
systems with limited technical resources

The framework suggests that smaller public companies can meet these challenges and implement cost-
effective and efficient controls. The methods to implement cost-effective and efficient controls are
addressed in the following information.

Segregation of duties

Management might compensate for the lack of an adequate number of employees that allows for
segregation of duties by increasing both the amount and detail of management’s monitoring function.
Some examples are as follows:

 Review reports of detailed transactions
 Review selected transactions
 Observe assets periodically
 Check reconciliations

Management override

Many smaller companies are dominated by one or a few members of management who can override
internal controls. The risk of management override can possibly be mitigated by having a corporate
culture where integrity and ethical values are held in high esteem and practiced every day. Other options
include having an effective internal audit function and a qualified board of directors and audit committee
that takes its responsibilities seriously in preventing or detecting instances of inappropriate management
override.

© 2020 Association of International Certified Professional Accountants. All rights reserved. 10-5