!

@#

Entity-Level Controls
Strengthening Internal Control Through More
Effective and Efficient Entity-Level Controls
 E n t i t y - L e v el C o n t r o l s

Strengthening Internal Control Through More Effective and Efficient

Entity-Level Controls
The international clamor for increased accountability and transparency has prompted stakeholders around the globe to press
companies to better manage risks through stronger internal controls. Internal control and corporate governance measures are
being considered in – or have been enacted by – Australia, Canada, China, the member countries of the European Union, India,
Japan, South Africa, the United States and other countries.
Key elements of a strong internal control structure include a top-down risk assessment, effective and efficient communications
and monitoring, robust control activities, and a well-established control environment. Entity-level controls strengthen internal
control overall by helping companies to meet their regulatory, business, and operational priorities.
Entity-level controls set the tone and establish the expectations of the organization’s control environment. Entity-level controls
can be used to monitor the extent to which that tone and those expectations are being fulfilled. In short, entity-level controls help
management deliver on its promise to stakeholders to run their companies effectively and efficiently.
The benefits of effective and efficient entity-level controls can be significant and may include:
 Reduction of the likelihood of a negative risk event by establishing and reinforcing the infrastructure that sets the control
consciousness of the organization;
 A broad risk coverage over financial reporting and operations. For companies conducting evaluations of internal controls, the
presence of effective entity-level controls can contribute to a more effective and efficient evaluation strategy;
 Generation of efficiencies in other business and operational processes;
 Reinforcement for all stakeholders of the importance of internal controls to the success of the business.

Balancing Levels of Control and Efficiency

�������������������������

��������� ���������
���������������������

���������������

����������� ���������

 Enhancing the Value of I n t e r na l A u d i t

 ���������������
�������������

Entity-Level Controls Defined

Entity-level controls generally have a wide scope impact on the achievement of the company’s objectives for internal control.
Entity-level controls, listed in the chart below, are organized in categories consistent with the basic components of internal control
– monitoring, information and communication, control activities, risk assessment and control environment – as defined by the
U.S.-based Committee of Sponsoring Organizations of the Treadway Commission (COSO).
While there are other alternative frameworks, such as the AS/NZS 4360 Risk Management Standard, the COSO framework is still
the most commonly used, and is widely accepted by organizations searching for guidance on internal control and business risk.

���������������������
���������� ��������������� ������� ���� �������
������������� ���������� ���������� �����������

� ������������������ � �������� � ������������ � ��������������� � ���������������

���������� �������������� ���������� ����������� � ����������
� ����������� ��������������� � �������������� � ��������������� ���������������
���������� ��������� ������� ���������� �������������
��������� � ������������ � �������������� ���������� ��������������
� ����������������� ������������� ������ � ��������������������
��������� ������������������� � ������� ���������
� ����������� � �������� �������������� � ����������������
��������� ������������� � ���������������� ��������������
� ���������� ������������� ������������
������������������� ��������� ����������
����������������� � ������ ����������
����������

The impact that entity-level controls can have on an organization may vary based on the control and the company. Some entity-level
controls help define the overall control conscience of the organization, but do not directly mitigate specific financial statement
or operating risks. Other entity-level controls are implemented at the sub-process, process, location, business unit, or company-
wide level. These controls are generally used to monitor specific business and financial risks, and operate at the level of precision
necessary to directly detect and correct breakdowns in the application of a company’s policies and procedures. Example areas
within an organization where entity-level controls may typically be found include the following:

Monitoring
 Ongoing Monitoring Activities – Periodic review of process and controls using relevant management reporting tools. For
example, these would include monthly review of aging of accounts receivable to determine the extent of reserves required for
doubtful debts.
 Independent Assessment Mechanism – Use of external specialists or professionals to review and assess internal controls. For
example, this might include the use of external tax professionals to review the controls around tax positions developed by the
in-house tax team.
 Variance Analysis Reporting – Comparison and reporting of actual performance against pre-determined benchmarks, if used
appropriately, can serve as an early-warning mechanism. For example, a steady increase in debtor turnover might indicate
varying levels of collection-related issues.
 Remediation Mechanism – This refers to a systematic approach to resolving identified internal control issues. While an
issue could be identified by either an internal or an external monitoring mechanism, the remediation mechanism is usually
management-owned.


 E n t i t y - L e v el C o n t r o l s

 Management Triggers Embedded within IT Systems – Most enterprise applications configure business rules in a manner as
to prevent, require pre-approval, or alert relevant management personnel in the event that certain pre-set thresholds are not
observed. For example, a sales application could deploy a control preventing sales transactions above the specified credit
limit of a customer. As another example, an application may allow the same transaction, but only after having secured certain
approvals. Or, as a final example, the same application could be set to simply alert the relevant management personnel after
such a transaction has been recorded.

Information and Communication

 Internal Communication and Performance Reporting – This refers to the lines of communication that run through an
organization’s structure, both top-down and bottom-up, including peer communication. Performance reporting is part of
internal communication, and usually involves a two-way process of setting expectations and monitoring performance against
agreed-upon expectations.
 Tone Setting – Tone setting refers to various components of the “tone at the top,” that are the building blocks of the character
of an organization. Having set the right tone, it is equally important to have open channels of communication so that those
within and outside the organization understand and act upon it. Examples of such components of tone include code of ethics
and corporate governance practices.
 Board/Audit Committee Reporting – Board members, including independent directors, assume fiduciary responsibilities
which require them to have access to accurate and relevant information. While most countries have enacted laws regarding
formal reporting to the Board of Directors and the Audit Committee of the Board, these usually constitute baseline procedures
and requirements. Companies are free to adopt more stringent measures regarding Board/Audit Committee Reporting, such as
holding more frequent formal Audit Committee Meetings than required by law.
 External Communication – This refers to the communication to the shareholders, stock market, customers, regulators,
vendors, and other entities outside the company’s formal boundaries. The annual report is an example of external
communication around the company performance, financial statements, vision, goals and targets.

Control Activities
 Policies and Procedures – Policies are the business rules and formalized practices that the organization and its employees need
to observe. These policies and procedures are governed by both legal/regulatory requirements, and management philosophy.
For example, accounting policies are typically aligned to prevailing accounting standards, whereas credit policy is dependent
on management’s risk appetite.
 Internal Audit Reviews – Internal audit serves as a tool for both the Audit Committee and management to deep-dive into
identified high risk areas for identification of issues and recommendations on their remediation. Internal audit frequently
reports to the Audit Committee, and can be either internally- or externally-staffed.
 Segregation of Duties – This concept requires an independent review of work performed by an individual, preventing an
individual from being able to both start – and complete – a critical transaction. Segregation of duties is a key anti-fraud control.
 Accounts Reconciliations – Periodic reconciliation of accounts helps identification of errors, omissions and even fraud. For
example, a reconciliation of customer accounts could identify payments received, but not applied, to the correct customer account.
 System Balancing and Exception Reporting – System balancing refers to built-in system checks to verify the integrity of data
transferred from another application. Examples include a mechanism for comparing batch totals between an original data
source and data transferred into a new application. Exception reporting relates to reporting of exception items to management
so that more effective use of management time can be achieved. For example, the Sales Manager could potentially review all
sales transactions for a day. But it is more time-efficient if the review and approval process is focused on transactions that are
not sold at the list price, or sold above a certain pre-determined percentage of discount.

 Enhancing the Value of I n t e r na l A u d i t

 Change Management – This refers to management of changes to processes, people, organizational structure, etc, in a manner
as to minimize business disruptions that might otherwise harm overall business performance.

Risk Assessment
 Risk Assessment Methodology – Risk assessment methodology refers to a systematic approach to identify, assess and
prioritize risks.
 Risk Assessment Analytical Techniques – Analytical techniques, if used appropriately, can serve as a tool in the risk
assessment process. Since risk is an outcome of perception, analytical techniques help remove subjectivity, to a certain extent,
by collation and presentation of data in a systematic manner for assessment of potential impact and likelihood of occurrence
of risks.

Control Environment
 Code of Conduct – This refers to the norms to which the organization voluntarily agrees to comply. For example, the
company’s code of conduct might include a policy prohibiting employees from accepting gifts from vendors.
 Governance – Governance is a mechanism for monitoring how the resources of an organization are being put to an efficient
use by management, with an emphasis on transparency and accountability.
 Assignment of Authority and Responsibility – The term “authority” refers to the right to perform the organization’s activities.
The term “responsibility” refers to the obligation to perform assigned activities. It is important for the achievement of control
objectives that authorities and responsibilities be consistent with the goals of its business activities and assigned to
appropriate personnel.
 Hiring and Retention Practices – Hiring and retaining skilled resources is critical to an organization’s success. Policies
and procedures around job definition, recruitment, training, performance appraisal, employee retention programs, and
management of employee exits are important components of managing human resources.
 Fraud Prevention Prevent/Detect Controls and Analytical Procedures – This refers to the anti-fraud controls and procedures
used by management to prevent, detect and mitigate fraud. Examples might include segregation of duties, setting up an ethics
hotline and periodic job rotation.

�
��������
���������� ����������
���������������� �������������
������������ ����������
��������������

�����������������

�
���������������
������������������
���������������������
�����������������
�������

�
����������������
�����������������
�����������������
���������


 E n t i t y - L e v el C o n t r o l s

Bolstering the Overall Internal Control Environment

Whether compelled by governmental regulation, industry guidelines, or business executives seeking accountability, companies
around the globe are evaluating the effectiveness of their internal controls.
As part of a top-down risk assessment, which helps identify and prioritize relevant business and financial risks, the identification
and evaluation of effective entity-level controls may be used to understand how identified risks are mitigated, and redirect
evaluation and other resources toward priority risk areas. This helps increase both the effectiveness and efficiency of
management’s risk assessment and controls evaluation.
The benefits of entity-level controls can be further enhanced by focusing on those controls that are most effective at mitigating
identified risks.

Evaluating Entity-Level Controls

Before entity-level controls can be leveraged, it is important to evaluate these controls to determine whether they are designed
and operating effectively. Risks can only be mitigated if the entity-level control is designed specifically to address the identified
risks.
When evaluating entity-level controls, it is important to consider how the entity-level controls function in relation to a series of
control objectives. The four basic steps of this evaluation include:
Identify risks – Use a top-down approach to identify and categorize potential risk.
Identify entity-level controls and link to risks – Examine current entity-level controls to determine what controls have been
placed into operation. Also, identify important entity-level controls that may be missing in the current framework. Then link the
entity-level controls best suited to address the identified risks.
Evaluate the design and operating effectiveness of entity-level controls – Determine how effectively each entity-level
control addresses identified risks by considering, among other things: sensitivity; competency of the reviewer; frequency and
consistency of the control’s operation; whether the control is reliable and repeatable; and whether appropriate review and follow-
up action is taking place.
Leverage entity-level controls as appropriate to mitigate risks – By leveraging strong entity-level controls, management will be
able to develop a more effective and efficient controls evaluation strategy.

Entity-Level Controls Assessment Approach

���������������
�������� ������������� ��������
�������� ������������ ������������
����� ������������ ������������� �����������
���������������
������������� �������� ��������������

 Enhancing the Value of I n t e r na l A u d i t

Entity-Level Controls: A Key Element in a More Effective and Efficient
Internal Control Structure
Leading companies are constantly striving to increase the effectiveness and efficiency of their internal control structure. They
want improved internal control along with—not in place of—an increase in efficiency. In addition, they desire an internal
control environment that helps to generate improved business and operational performance. Entity-level controls can provide a
foundation upon which companies are able to build a more effective and efficient internal control environment.
Entity-level controls allow management to establish expectations, provide guidance, and develop communication channels by
which they can more effectively reach all levels of the organization. Entity-level controls provide management with a tool it can
use to monitor adherence to the company’s expectations.
Working in concert with each other, well-designed and effective entity-level controls help management better meet business and
financial objectives, and should be considered a key element of a leading-class internal control structure.

 When was the last time your organization conducted a top-down, enterprise-wide risk assessment?
 How confident are you that your key strategic, operational, financial and compliance risks are being
properly controlled?
 Do the managers in your business fully understand your entity-level controls, and fully appreciate the
importance of these controls to the overall internal control structure?
Questions
to Ask  Have you inventoried your entity-level controls, and considered how they help mitigate specific risks?
 Have you conducted an analysis to determine how your entity-level controls can impact the controls
evaluation objectives that may apply to your company?
 Do you think your company could benefit from conducting an entity-level controls assessment?


About Ernst & Young
Ernst & Young, a global leader in professional services, is committed to restoring the public’s trust in
professional services firms and in the quality of financial reporting. Its 114,000 people in 140 countries
pursue the highest levels of integrity, quality, and professionalism in providing a range of sophisticated services
centered on our core competencies of auditing, accounting, tax, and transactions. Further information about
Ernst & Young and its approach to a variety of business issues can be found at [Link]/perspectives.
Ernst & Young refers to the global organization of member firms of Ernst & Young Global Limited, each of
which is a separate legal entity. Ernst & Young Global Limited does not provide services to clients.

Ernst & Young [Link]

© 2007 EYGM Limited. This publication contains information in summary form and is
All Rights Reserved. therefore intended for general guidance only. It is not intended
to be a substitute for detailed research or the exercise of
EYG No. DZ002 professional judgment. Neither EYGM Limited nor any other
member of the global Ernst & Young organization can accept
any responsibility for loss occasioned to any person acting
or refraining from action as a result of any material in this
publication. On any specific matter, reference should be made
to the appropriate advisor.