How effective are organizations' internal controls? Insights into specific internal control elements

Abstract

Based on survey responses from approximately 500 Chief Audit Executives (CAEs) and other internal auditors, this article provides an insider's view of the perceived strength of organizations' internal controls (i.e., internal control over financial reporting) in the Control Environment, Risk Assessment, and Monitoring components of the Committee of Sponsoring Organizations' (COSO 1992a) Internal Control-Integrated Framework. Although the respondents largely rate control strength as relatively high, we identify several areas for potential improvement of internal controls, especially related to assessing the "tone at the top," as well as following up on deviations from policy and management override of controls. In analyzing individual control elements, we find that public companies' controls are consistently rated as more effective than those of other organizations. We also find a number of interesting differences across key industries, especially in the Monitoring component, where banks and other financial services firms appear to have more robust Monitoring controls than do healthcare and other services firms. The component-level analysis reveals that internal control component strength is positively related to the CAE reporting primarily to the audit committee, public company status, and the average tenure of the internal audit function staff, among other findings. Based on the survey findings, we describe key implications relevant to internal and external auditors, accounting researchers and educators, and management.