Internal Controls - From Objectives to Activities

We're going to finish up our current discussion on internal controls by associating some "internal control activities" to the "internal control objectives" we discussed previously. Yesterday, we listed eight internal control objectives that the Government believes will satisfy just one of the 18 attributes of an adequate accounting system; a sound environment, framework, and organizational structure. Not all of these will be applicable to all contractors. Small businesses are not likely to have audit committees, for examples. Some contractors will devise other objectives, just as good or better than these. We suggest however, at a minimum, that contractors at least consider these.

Once contractors have established their internal control objectives for a given area, they need to devise internal control activities upon which to satisfy those objectives. Each objective needs one or more activity. Here again, DCAA has provided examples of activities that might satisfy each objective. Lets take the first objective we highlighted yesterday; integrity and ethical values. Management must convey the message that integrity and ethical values cannot be compromised, and employees must receive and understand that message through continuous demonstration of words, actions and commitment to high ethical standards.

Here are examples of control activities that DCAA believes will satisfy the objective:

• Written codes of conduct that address 
• ethical business practices, 
• conflicts of interest and 
• expected standards of ethical and moral behavior including dealings with customers, suppliers, employees and other parties.
• Management places emphasis on establishing and maintaining an effective system of internal controls and self-governance and does not condone signs of inappropriate practices.

The second bullet point is important. It constitutes what the COSO (Committee of Sponsoring Organizations) guidance terms "setting the tone at the top". Management does indeed set the tone for the entire organization. Winking at indiscretions would not be setting the proper tone. Taking corrective actions including disciplinary action when necessary, would be setting the proper tone.

Ultimately, it is up to contractor to ensure adequate systems of internal controls for their unique situation. The DCAA guidance can be very useful in jump starting the program.