Internal Controls - Its a Contractor's Responsibility

It is important to remember that contractors must have effective systems of internal controls and that management is solely responsible for establishing and maintaining adequate internal controls. Some contractors have a notion that the Government will come along some day and tell them what internal controls they should implement. Some managers believe that by keeping their fingers on the pulse, they do not need internal controls. Others, sadly, do not want strong systems of internal controls because they fear that it would encumber their management style and prerogatives.

Internal controls are important and necessary, never more so than in the Government contracting environment. Internal controls provide reasonable (not absolute) assurance that financial reporting is reliable, that operations are running effectively and efficiently, and that applicable laws and regulations are being complied with.

Internal controls consist of five interrelated components:

1. Control environment - this is the foundation to all other components. The board or senior management establish the "tone from the top" regarding the importance of internal control and expected standards of conduct. It provides discipline, process, and structure.
2. Risk assessment - this involves a dynamic and iterative process for identifying and analyzing risks to achieving the entity's objectives, forming a basis for determining how risks should be managed.
3. Control activities - these are the actions established by policies and procedures to help ensure that management's directives to mitigate risks to the achievement of objectives are carried out. Control activities are performed at all levels of the entity and at various stages within business processes.
4. Information and communication - necessary for the entity to carry out internal control responsibilities in support of achievement of its objectives. Communication occurs both internally and externally and provides the organization with the information needed to carry out day-to-day internal control activities.. Communication enables all personnel to understand internal control responsibilities and their importance to the achievement of objectives.
5. Monitoring - used to ascertain whether each of the five components of internal control are present and functioning. Findings are evaluated and deficiencies are communicated in a timely manner, with serious matters reported to senior management and to the board.

When it comes to establishing effective internal control systems, one size does not fit all. Internal controls must be considered in the context of company size, organizational characteristics, the nature of the business (e.g. type of contracts), complexity of operations, applicable regulatory requirements, and more. Sometimes it seems that contract auditors want more controls than what contractors deem necessary. Sometimes they're right, sometimes not. Tomorrow we will look at the guidance that auditors follow in assessing whether select internal control systems are adequate.