INHERENT INTERNAL CONTROL LIMITATIONS THE DRAFT PUBLIC AUDIT BILL: Comments aimed at improving public accountability Evidence concerning the presence of inherent internal control limitations in the South African government sector Background After the promulgation of the Public Finance Management Act (PFMA) in 1999, the Southern African Institute of Government Auditors (SAIGA) assisted National Treasury, affected public entities as well as national and provincial departments with the implementation of the PFMA by presenting structured Skills Transfer and Educational Programmes (STEPSä). To deliver these programmes SAIGA founded the Public Finance Management Academy (PFM Academy) which hosts the Public Finance Management Programme. One of the training programmes is entitled: "Internal Control and Risk Management" (ICRM). This is a four day training programme consisting of four units relating to the PFMA: risks the risk management process the concept of internal control internal control frameworks internal controls for individual applications within the government sector. As part of the ICRM course, participants are required to participate in open and group exercises and discussions at various stages during the course. At one particular stage course participants are required to complete an evaluation form where they are requested to assess the extent to which they believe the identified inherent internal control limitations are present in their organisations and circumstances. The results of the empirical data so obtained, are presented in this research project: Introduction and research objective A brief review of the concept of internal control A review of the inherent limitations of internal control systems Empirical research method Graphical presentation of research results Summary of major findings Introduction and research objective The concept of internal control permeate the subject literature, supporting its general significance in all types of organisations, as well as its appropriateness as a research focus area. The concept of internal control and all its concomitant principles apply to both the private sector world of business and to the government sector. The importance of internal control in the South African Government sector was brought to the fore and re-emphasised with the issue in 1999 of the Public Finance Management Act (PFMA). The PFMA requires accounting officers to ensure, amongst other things, that effective, efficient and transparent systems of financial and risk management and internal control are functioning and maintained within their departments. All other officials in government are required, amongst other things, to carry out the systems of financial management and internal control within each official’s area of responsibility. Internal control is deemed to be fundamental to achieve successful financial management in the South African Government sector – the concept pervades all areas of government, involving officials and other formal structures at all levels of government. It is however generally accepted that there are inherent limitations in any internal control system. That is to say; that no matter how well an internal control system has been designed or how well and closely it is maintained and monitored, there are certain factors inherent in the concept of internal control and in the way internal control is applied as part of the organisational, operational and information system activities, that represent constant threats to internal control effectiveness. The objective of the research is to present evidence concerning the presence of inherent internal control limitations in the South African government sector. The research study which had been undertaken is exploratory in nature. The research findings, although not conclusive because of the study's exploratory nature, can play an important role to expand the available knowledge on internal control systems and to put existing knowledge into proper perspective in the South African government sector. Evidence regarding the presence of inherent internal control limitations can be most valuable to inform government managers about the most urgent threats to the effectiveness of their internal control systems A brief review of the concept of internal control  An organisation’s internal control system can be defined as the processes, procedures, actions and policies effected by its personnel at all levels, designed to provide reasonable assurance regarding the achievement of management objectives. The well renowned "Internal Control - Integrated Framework" report of the Committee of Sponsoring Organizations of the Treadway Commission (the COSO report) links the significance of internal control to the achievement of three broad objectives that encapsulate all other organisational objectives, namely: The reliability of financial reporting (and financial, operating and management decision information), efficiency and effectiveness of operations and compliance with laws and regulations. Internal control is a broad concept that encompasses all organisational processes - not only those related to accounting and financial reporting. Internal control is paramount to the achievement of organisational success and successful management functions. When management and business decisions go wrong, reference is often made to the internal control system to seek out possible reasons. It is an organisation function that contributes to long-term effectiveness, minimising risk exposure and maintaining reliable reporting systems. Internal control is often linked and discussed in relation to fraud, business failures and corruption. Most instances of fraud and corruption can, directly or indirectly, be traced to a deficient system of internal control. Internal control also bears a close relationship to the concept of "corporate governance", i.e. the system by which organisations are directed and controlled. Principles of good corporate governance dictate that the management structure of any organisation is responsible to develop, implement and maintain a sound system of internal control and, as required in some instances, to publicly report on the effectiveness of the organisation's internal controls. [ BACK TO THE TOP ] A review of the inherent limitations of internal control systems  Internal control is not a failsafe mechanism. Internal control systems can and often do fail, with potential material consequences, especially when such failures are related to instances of fraud, corruption and business failure. Even small and apparently insignificant breaches of an organisation's internal control system can eventually add up to represent a major internal control breakdown. Any system of internal control is constantly exposed because of certain inherent factors, i.e. factors inherent within the concept of internal control as generally defined and applied. This applies to all systems of internal control, irrespective of design, size and environment. The degree to which these inherent limitations are present – or are under control – can however differ, because individual internal control systems are implemented, operated and managed differently, including the influence of subjective characteristics such as attitudes, integrity, ethical values, etcetera. The threat posed by inherent internal control limitations can never be eliminated, but it can be minimised – it can be kept in check. The following is a summary of what the subject literature views as the primary inherent internal control limitations: Lack of communication. A lack of proper communication regarding internal control procedures, benefits, needs and responsibilities from the "top", as well as the reporting of weaknesses and problems from the "bottom" have an adverse effect on the success of the internal control system. People mistakes. The effectiveness of the internal control system depends on the competence, reliability and due care of the people responsible for its operation. Mistakes/errors threaten the effectiveness of any internal control system. Override by management and/or executives. Because of the authority and responsibility of officials high up in the organisational structure, the risk pervades that they can easily override the internal control system. Inaccurate information. The introduction of inaccurate information can be used to manipulate information reflecting the effectiveness of the internal control system and/or to conceal certain deliberate actions. Illusion of control. Managers create an illusion of control, while control procedures are circumvented and misinterpreted. Management is not serious about internal control, but creates the illusion that everything is functioning as it should be. Efficiency aspects. An internal control system is threatened by inefficiencies brought about by the introduction of "shortcuts", altering the system or eliminating certain control procedures. Apathy. Employees operating the system have no interest in its functioning and tend to become careless about ensuring that the system functions as designed. Cost consideration. Internal controls must be cost effective - the result of a cost-benefit analysis. This leads to the implementation of the best system that can be afforded, which is not necessarily the best available internal control system for a specific situation. Focus on routine activities. Most internal controls tend to focus primarily on routine activities, leaving abnormal, extraordinary or ad-hoc activities/operations largely unattended. Lack of attention to operational risks. Financial risks are often well covered by the internal control system, but fundamental operational risks can easily escape attention. Unresponsive to changing circumstances. Conditions within organisations are not static, e.g. internal control systems that don’t change in reaction to new control techniques, or to changes in the organisational environment are left exposed. Fatigue. The operation of an internal control system can induce fatigue amongst employees/officials and lead to other operational inefficiencies. The system becomes cumbersome and this induces fatigue. Collusion. Lack of integrity and dishonesty of employees and officials can lead to collusion amongst two or more people to circumvent the internal control system. Game playing. This relates to an adverse attitude towards internal controls - the system is viewed as a challenge; something that must be "beaten". Sabotage. Employees and officials with malicious intent may attempt to deliberately "damage" the internal control system. Complexity. An increasingly complex internal control system can lead to operational inefficiencies, because employees are unable to cope with the system. [ BACK TO THE TOP ] Empirical research method After the promulgation of the PFMA in 1999, SAIGA founded the Public Finance Management Academy (PFM Academy) which hosts the Public Finance Management Programme. One of the training courses presented as part of the Public Finance Management Programme developed by the PFM Academy is entitled: "Internal Control and Risk Management" (ICRM). This is a four day course consisting of four units relating to the PFMA, risks, the risk management process, the concept of internal control, internal control frameworks and internal controls for individual applications within the government sector. Inherent internal control limitations also receive attention as part of the ICRM course. A total of 14 of the 16 inherent internal control limitations identified in the previous section correlate with the limitations discussed in the ICRM course (the only two inherent limitations excluded, are "lack of attention to operational risks" and "unresponsive to changing circumstances"). For purposes of the empirical research, the 14 inherent internal control limitations included in the ICRM course were deemed to be adequately representative of the relevant internal control literature. As part of the ICRM course, participants are required to participate in open and group exercises and discussions at various stages during the course. At one particular stage course participants are required to complete an evaluation form where they are requested to assess the extent to which they believe the 14 identified inherent internal control limitations are present in their organisations and circumstances. The assessment is done on a scale of 1 to 6 for each of the inherent internal control limitations. This "1 to 6"-scale represents a continuum between two extreme points, that can be interpreted as follows: "1" - strongly disagree that the limitation is present. The particular inherent internal control limitation is present to a very limited extent only. Although still a threat to the internal control system, a "1" response indicates that it is not an immediate and/or urgent concern. "6" - strongly agree that the limitation is present. The inherent internal control limitation concerned is prevalent to a large extent and represents an immediate and urgent threat to internal control effectiveness. The original population comprised all government officials who attended the ICRM course during 2000 and 2001. A total of 588 people attended 10 presentations of the ICRM course during this period. A total of 499 (85%) of the course participants submitted the relevant inherent internal control limitation evaluation form. The empirical analysis was limited to national government departments and provincial government departments (excluding respondents from local government entities, public entities, constitutional institutions and other organisations). Respondents from national and provincial departments represent 83% of the total number of evaluation forms submitted and 71% of the original population of 588 course participants. Hence, the survey sample can be defined as 149 inherent internal control evaluation forms completed by ICRM course participants from national government departments and 267 from provincial government departments. Averages relating to each of the 14 identified inherent internal control limitations were calculated for various groupings/classifications of respondents on the "1 to 6"-scale utilised. In total, 196 average assessment scores were calculated, i.e. assessments relating to 14 inherent internal control limitations for 14 categories of respondents (14 x 14). Apart from these averages, no further statistical analysis of the results was undertaken. The following 14 categories of respondents apply: All national departments (149 national departments respondents (NDRs)) All provincial departments (267 provincial departments respondents (PDRs)) Limpopo departments (33% of PDRs) Kwazulu Natal departments (17% of PDRs) Eastern Cape departments (16% of PDRs) Mpumalanga departments (11% of PDRs) South African Police Service (56% of NDRs) Department of Defence (9% of NDRs) Limpopo department of finance, economic affairs and tourism (19% of PDRs) Limpopo office of the Premier (8% of PDRs) North West Province department of health (9% of PDRs) Kwazulu Natal department of education (6% of PDRs) Eastern Cape department of labour (6% of PDRs) Mpumalanga department of education (6% of PDRs) [ BACK TO THE TOP ] Graphical presentation of research results The following graphs represent the research results in respect of the assessment of the prevalence of the identified inherent internal control limitations by the respondents in 14 different categories. In all, 196 average assessment scores on the "1 to 6"-scale utilised are presented (14 inherent limitations x 14 categories of respondents). [ BACK TO THE TOP ] Summary of major findings  The empirical research results are presented in a series of charts in respect of the 14 categories of respondents. These results present evidence concerning the presence of inherent internal control limitations in the South African government sector, and can be most valuable to inform management in government about serious risks to the effectiveness of their internal control systems. This in turn can facilitate early corrective actions to circumvent the dire consequences of large scale internal control failures in the government sector. The major findings of the research can be summarised as follows: The inherent limitations that consistently achieved the highest assessments across all the classes of respondents, are: Lack of communication, people mistakes and management override. In the South African government sector these inherent limitations, in most instances, represent the most immediate and urgent threats to the effectiveness of internal control systems. The inherent internal control limitations that in most instances (across all the classes of respondents) are least of a concern in respect of internal control effectiveness, are: Complexity, sabotage and game playing. None of the inherent internal control limitations are present to a degree that does not require management’s attention or that allows management to ignore their presence. Although certain inherent limitations are more prevalent than others, the overall presence of these limitations, as evidenced by the empirical results, is putting internal control effectiveness in the South African government sector in jeopardy. Overall, the provincial department respondents consider the inherent limitations a bigger threat than the national department respondents - 11 out of 14 limitations are evaluated higher by the respondents from provincial departments, compared to national departments. The respondents from both national departments and provincial departments indicated that the most prevalent inherent internal control limitation is "people mistakes" (assessments of 4.483 and 4.706 respectively). At the bottom end of the scale both sets of respondents again indicated the same limitation, namely "complexity". When a mean score is calculated for all 14 inherent limitations, in conjunction, per province, the following sequence is obtained in terms of provincial government internal control systems that are most at threat because of the presence of the identified inherent internal control limitations: Mpumalanga (4.506), Kwazulu Natal (4.303), Eastern Cape (4.146) and Limpopo (4.009). Because of the high assessment scores achieved overall, all four provinces find themselves in a position where their internal control effectiveness is significantly under threat. According to South African Police Service respondents, the "top five most prevalent" inherent internal control limitations, are: Cost consideration (4.558), management override (4.524), people mistakes (4.393), lack of communication (4.100) and apathy (4.092). In the case of the Department of Defense, the following inherent internal control limitations represent the "top five most prevalent": Lack of communication (5.000), illusion of control (4.923), cost consideration (4.714), apathy (4.692) and game playing (4.615). The research results indicate that each department’s unique characteristics and circumstances allow for the presence of different inherent limitations at the top and bottom ends of the evaluation scale utilised. The various assessments differ, in some instances significantly, from one category of respondents to the next. It is clear that inherent internal control limitations will be present to different degrees, depending on the environment within which an internal control system functions. It is imperative for management in the South African government sector to thoroughly understand their internal control systems, including the degree to which recognised inherent internal control limitations are present and the threat that such limitations pose to the effectiveness of their internal control systems. If this does not occur, management can with good reason be held accountable for not meeting their responsibilities relating to internal control. Inherent internal control limitations are fundamental to the concept of internal control and to how internal control systems function within different environments. A thorough awareness of their presence in any organisation and actions to minimise their prevalence and effects are required if major internal control deficiencies and/or failures are to be averted. [ BACK TO THE TOP ]
| HOME | CONTACT US | MISSION | COPYRIGHT | NPO Registration Number : 045-133-NPO| web design by DUMELANG MEDIA SERVICES |
HOME ABOUT MEMBERS TRAINING GASP 2016 SAIGA Reporting Awards PUBLICATIONS RESEARCH COMMUNICATION