譯聲翻譯公司提供專(zhuān)業(yè)COSO報(bào)告翻譯服務(wù)
美國(guó)COSO英文報(bào)告-內(nèi)部控制翻譯
COSO報(bào)告是美國(guó)COSO委員會(huì)（由美國(guó)AICPA、AAA、IIA、IMA、FEI五個(gè)組織成立的“發(fā)起人委員會(huì)”）于1992年提出的報(bào)告，是目前世界上最具權(quán)威性的關(guān)于內(nèi)部控制的文獻(xiàn)和標(biāo)準(zhǔn)。許多會(huì)計(jì)論文都引用了COSO報(bào)告的內(nèi)容，但是我們一直沒(méi)有機(jī)會(huì)看到COSO報(bào)告的原文。最近筆者有幸得到一份COSO報(bào)告的英文原件，并翻譯了其中的第一部分：實(shí)施綱要。本譯稿得到了國(guó)際內(nèi)部審計(jì)師協(xié)會(huì)理事張翌軒先生的指點(diǎn)和認(rèn)可。
COSO報(bào)告
內(nèi)部控制整體框架 1994年第二版
◆實(shí)施綱要
◆框架
◆對(duì)外部當(dāng)事人的報(bào)告 1992年9月
◆對(duì)外部當(dāng)事人的報(bào)告的附錄 1994年5月
COSO 委員會(huì)
實(shí)施綱要
高級(jí)經(jīng)理們需要很長(zhǎng)的探索道路去更好地控制他們所管理的企業(yè)。內(nèi)部控制被放在保持公司在經(jīng)營(yíng)過(guò)程中有助于收益率目標(biāo)和它的使命的業(yè)績(jī)的位置上，以及使前進(jìn)方向上的突發(fā)事件（的影響）最小化。他們能夠在迅速變化的經(jīng)濟(jì)和競(jìng)爭(zhēng)環(huán)境中管理交易、精明的客戶(hù)的需求和優(yōu)先要求，并重構(gòu)未來(lái)的成長(zhǎng)。內(nèi)部控制促進(jìn)效率、減少資產(chǎn)損失的風(fēng)險(xiǎn)和有助于保證財(cái)務(wù)報(bào)表的可信度以及對(duì)法律和規(guī)章制度的遵守。
由于內(nèi)部控制服務(wù)于許多重要的目的，更好的內(nèi)部控制系統(tǒng)和他們的報(bào)告的需求日益增加，內(nèi)部控制顯得能越來(lái)越多地解決各種潛在的問(wèn)題。
內(nèi)部控制是什么
內(nèi)部控制對(duì)于不同的人有不同的理解，它引起了商人、立法機(jī)構(gòu)、監(jiān)管機(jī)構(gòu)和其他人之間的混亂，因而在企業(yè)內(nèi)部發(fā)生了錯(cuò)誤的傳遞和期望的差異。如果不清晰地進(jìn)行定義，那么，當(dāng)它們被寫(xiě)進(jìn)法律、規(guī)章、規(guī)則時(shí)，問(wèn)題是被混淆的。
這個(gè)報(bào)告兼顧了經(jīng)理層和其他人的需要和期望，它定義和描述內(nèi)部控制：
● 建立一個(gè)通用的定義服務(wù)于不同群體的需要；
● 提供一個(gè)針對(duì)商業(yè)或其他企業(yè)（大的或小的；私人的或公眾的的部門(mén)；營(yíng)利的或不是營(yíng)利的）的標(biāo)準(zhǔn)——能夠評(píng)估他們的控制系統(tǒng)和討論怎樣去改進(jìn)它們。
內(nèi)部控制廣泛地被定義為由企業(yè)董事會(huì)、經(jīng)理層和其他人員實(shí)施的一個(gè)過(guò)程，它被設(shè)計(jì)為達(dá)到所關(guān)注的以下領(lǐng)域的目標(biāo)提供合理的保證：
● 有效率和效益的經(jīng)營(yíng)運(yùn)作；
● 可靠的財(cái)務(wù)報(bào)告；
● 遵循可適用的法律和規(guī)章。
第一個(gè)領(lǐng)域是一個(gè)基于商業(yè)目的的實(shí)體所從事的活動(dòng)，包括經(jīng)營(yíng)業(yè)績(jī)、收益率目標(biāo)和資源保護(hù)；第二個(gè)領(lǐng)域關(guān)系到被公布的可靠的財(cái)務(wù)報(bào)告的制作，包括中期的和簡(jiǎn)化的財(cái)務(wù)報(bào)表以及選自每張報(bào)表的財(cái)務(wù)數(shù)據(jù)，例如：收入的放棄、所報(bào)告的政策；第三個(gè)領(lǐng)域是處理遵守這些法律和規(guī)章對(duì)企業(yè)的影響。那些特殊的、然而領(lǐng)域互相交叉的不同需要，允許直接集中于特殊的需要。
內(nèi)部控制系統(tǒng)在不同的有效性水平上開(kāi)展，各自地，如果董事會(huì)和經(jīng)理層有以下的合理的保證，內(nèi)部控制在三個(gè)領(lǐng)域中的每一個(gè)都可以被認(rèn)為是有效的：
● 他們了解企業(yè)經(jīng)營(yíng)目標(biāo)已經(jīng)達(dá)到的范圍和程度；
● 公布的財(cái)務(wù)報(bào)表已經(jīng)被可靠地編制；
● 適用的法律和規(guī)章已經(jīng)得到了遵守。
整個(gè)內(nèi)部控制是一個(gè)過(guò)程，它的有效性是（體現(xiàn)）在一個(gè)或多個(gè)時(shí)點(diǎn)上運(yùn)作過(guò)程的狀態(tài)和情況。
內(nèi)部控制由五個(gè)相關(guān)的要素組成，這是來(lái)自經(jīng)理層管理一個(gè)企業(yè)的思路和完整的管理過(guò)程。雖然這些要素適用于所有的實(shí)體（企業(yè)），小型或中型公司執(zhí)行它們可能要比大型企業(yè)困難一些，它的控制可能少一些形式和少一些結(jié)構(gòu)，然而小型公司仍然能夠有一個(gè)有效的內(nèi)部控制。這些要素是：
● 控制環(huán)境——控制環(huán)境建立于一個(gè)組織的最高層，影響它的員工的控制理念，它是所有其他內(nèi)部控制要素的基礎(chǔ)，提供了（控制的）紀(jì)律和結(jié)構(gòu)�？刂骗h(huán)境要素包括企業(yè)員工的正直誠(chéng)實(shí)、倫理價(jià)值觀和能力；管理的哲學(xué)和經(jīng)營(yíng)風(fēng)格；經(jīng)營(yíng)者分配權(quán)力和責(zé)任的路徑；以及它的人力資源的組織和發(fā)展和由董事會(huì)提供的關(guān)注和指導(dǎo)。
● 風(fēng)險(xiǎn)評(píng)估——每個(gè)企業(yè)都面臨各種來(lái)自?xún)?nèi)部和外部的必須進(jìn)行評(píng)估的風(fēng)險(xiǎn)，風(fēng)險(xiǎn)評(píng)估的前提是確定在不同水平上有限的和內(nèi)部協(xié)調(diào)一致的目標(biāo)，風(fēng)險(xiǎn)評(píng)估是鑒別和分析成功達(dá)到目標(biāo)的有關(guān)風(fēng)險(xiǎn)，形成怎樣管理風(fēng)險(xiǎn)的討論基礎(chǔ)。由于經(jīng)濟(jì)、行業(yè)、管理和經(jīng)營(yíng)條件將繼續(xù)發(fā)生變化，必須有一個(gè)鑒別和處理這種與變化相關(guān)的特殊風(fēng)險(xiǎn)的機(jī)制。
● 控制活動(dòng)——控制活動(dòng)是幫助保證管理措施得以實(shí)現(xiàn)的政策和程序。它們幫助采取必要的行動(dòng)去應(yīng)對(duì)風(fēng)險(xiǎn)，成功達(dá)到企業(yè)的目標(biāo)�？刂苹顒�(dòng)發(fā)生于企業(yè)的各個(gè)層面、所有水平和所有職能，它們包括的活動(dòng)范圍擴(kuò)展到審核、批準(zhǔn)、復(fù)查、核對(duì)、運(yùn)作執(zhí)行的檢查、資產(chǎn)保護(hù)和職責(zé)分工等。
● 信息和溝通——有關(guān)的信息必須被鑒別、記載和以一定形式和適當(dāng)?shù)臅r(shí)間與有能力去完成他們的職責(zé)的人員之間交流。信息系統(tǒng)產(chǎn)生包括經(jīng)營(yíng)、財(cái)務(wù)和有關(guān)部門(mén)信息的報(bào)告，以管理和控制企業(yè)。它不僅涉及內(nèi)部產(chǎn)生的信息，而且有關(guān)外部活動(dòng)、行為和條件的信息必須提供給企業(yè)作出決策和對(duì)外報(bào)告。有效的溝通同樣必須在廣闊的領(lǐng)域發(fā)生——向下、平行、向上流動(dòng)于一個(gè)組織內(nèi)。所有的人都必須收到來(lái)自最高層關(guān)于控制責(zé)任必須被嚴(yán)肅對(duì)待的清晰的信息，他們必須理解他們自己在控制系統(tǒng)中的角色和任務(wù)，以及個(gè)人的活動(dòng)如何與其他人的工作相聯(lián)系，他們必須有一種與上層溝通特殊信息的方法，他們同樣需要有效地與外部組織，例：客戶(hù)、供應(yīng)商、立法機(jī)構(gòu)和股東進(jìn)行溝通。
● 監(jiān)督——內(nèi)部控制系統(tǒng)必須受到監(jiān)督——這個(gè)系統(tǒng)在過(guò)去時(shí)期執(zhí)行質(zhì)量的測(cè)試過(guò)程。它通過(guò)不斷的監(jiān)督活動(dòng)、獨(dú)立的評(píng)價(jià)，或二者都進(jìn)行來(lái)完成。持續(xù)的監(jiān)督活動(dòng)發(fā)生于經(jīng)營(yíng)的過(guò)程之中，它包括常規(guī)的管理和運(yùn)行管理活動(dòng)，以及員工執(zhí)行他們的職務(wù)的其他活動(dòng)。獨(dú)立的評(píng)價(jià)的范圍和頻率，主要取決于對(duì)于風(fēng)險(xiǎn)的評(píng)價(jià)和持續(xù)監(jiān)督執(zhí)行的效率。內(nèi)部控制的差異應(yīng)當(dāng)向上級(jí)報(bào)告，嚴(yán)重事項(xiàng)的報(bào)告應(yīng)當(dāng)給最高管理當(dāng)局和董事會(huì)。
這些要素的每一個(gè)都是互相協(xié)調(diào)和聯(lián)系的，一個(gè)完整的系統(tǒng)能有效地對(duì)變化的條件作出反應(yīng)，內(nèi)部控制系統(tǒng)與企業(yè)的經(jīng)營(yíng)活動(dòng)纏結(jié)在一起，并基于商業(yè)的理由而存在。當(dāng)控制建筑于企業(yè)的基層和作為企業(yè)的基礎(chǔ)的一部分時(shí)，內(nèi)部控制就有了更高的效益。得到有質(zhì)量的和積極授權(quán)支持的內(nèi)在的控制，避免了不必要的成本和能夠?qū)ψ兓臈l件迅速作出反應(yīng)。
企業(yè)要達(dá)到的三個(gè)領(lǐng)域的目標(biāo)和達(dá)到目標(biāo)需要描述的要素是直接相關(guān)的，所有要素與每一個(gè)領(lǐng)域的目標(biāo)相關(guān)，當(dāng)觀察任何一個(gè)領(lǐng)域——例如運(yùn)作的效率和效益，所有五個(gè)要素都必須被提出和有效執(zhí)行，對(duì)包括運(yùn)作全過(guò)程的內(nèi)部控制都是有效的。
內(nèi)部控制的定義——與它的潛在的過(guò)程的基本概念、人員的效率、由目標(biāo)領(lǐng)域和要素以及有效性標(biāo)準(zhǔn)共同提供的合理保證、相關(guān)的討論，構(gòu)筑了內(nèi)部控制的框架。
內(nèi)部控制能做什么
內(nèi)部控制能幫助企業(yè)達(dá)到它的績(jī)效和收益目標(biāo)，并預(yù)防資源的損失，它能幫助保證可靠的財(cái)務(wù)報(bào)告，它能幫助企業(yè)遵守法律和規(guī)章制度，避免對(duì)它的名譽(yù)的損害和其他后果，總之它能幫助一個(gè)企業(yè)在想去做的地方達(dá)到它的目的和避免缺陷，并令人驚訝地向前進(jìn)。
內(nèi)部控制不能做什么
不幸地，一些人抱有太大和不切實(shí)際的期望。他們完全地、絕對(duì)地期待，相信：
● 內(nèi)部控制能保證一個(gè)企業(yè)成功——那就是它將保證達(dá)到基本的經(jīng)營(yíng)目標(biāo)，或?qū)⒅辽俦ＷC（在競(jìng)爭(zhēng)中）生存。
恰當(dāng)、有效的內(nèi)部控制僅僅能幫助一個(gè)企業(yè)達(dá)到這些目標(biāo)，它將提供給經(jīng)理層關(guān)于企業(yè)發(fā)展或它的缺陷的信息，以利于他們達(dá)到（這些目標(biāo)）。但是內(nèi)部控制不能將一個(gè)天生蹩腳的管理者變成一個(gè)好的，以及改變政府的政策和程序、競(jìng)爭(zhēng)者的行為或超出管理者所能控制的經(jīng)濟(jì)條件。內(nèi)部控制不能保證成功，甚至生存。
● 內(nèi)部控制能保證財(cái)務(wù)報(bào)告的可靠性和遵從法律和規(guī)章。
這種信任同樣是毫無(wú)根據(jù)的。一個(gè)內(nèi)部控制系統(tǒng)，無(wú)論怎樣設(shè)計(jì)和運(yùn)作，它僅僅能提供合理的——不是絕對(duì)的——對(duì)經(jīng)理層和董事會(huì)提供關(guān)于達(dá)到企業(yè)目標(biāo)保證。由于所有的內(nèi)部控制系統(tǒng)固有的局限性，達(dá)到的可能性是虛假的。這包括決策判斷可能不完善、和可能由于簡(jiǎn)單的誤差或誤解而導(dǎo)致失敗這種現(xiàn)實(shí)；此外，控制也可能由于二個(gè)或更多的人共謀而被繞過(guò)；經(jīng)營(yíng)者有權(quán)力無(wú)視這個(gè)系統(tǒng)；另一個(gè)限制性因素是一個(gè)內(nèi)部控制系統(tǒng)的設(shè)計(jì)必須反映資源約束的事實(shí)，以及控制的利益必須與它的成本相匹配。
因而，內(nèi)部控制在整體上能幫助企業(yè)達(dá)到它的目的，但它不是萬(wàn)應(yīng)靈藥。
角色和責(zé)任
組織的每一個(gè)人對(duì)內(nèi)部控制都負(fù)有責(zé)任。
● 經(jīng)理層——行政部門(mén)的首長(zhǎng)是負(fù)有最終的責(zé)任的，將表現(xiàn)為系統(tǒng)的“所有者”。比任何其他個(gè)人更多的，行政首長(zhǎng)要建立影響正直、道德和確立控制環(huán)境其他要素的“來(lái)自最高層的聲音”。在大多數(shù)公司，行政首長(zhǎng)通過(guò)提供對(duì)高級(jí)管理人員的領(lǐng)導(dǎo)和指導(dǎo)以及檢查他們的控制這個(gè)企業(yè)的做法來(lái)履行職責(zé)。高級(jí)管理人員，事實(shí)上，為設(shè)立大多數(shù)特殊的內(nèi)部控制政策和對(duì)單元職能的個(gè)人職責(zé)程序分配責(zé)任。在較小的企業(yè)，行政首長(zhǎng)的影響力，通常經(jīng)理就是業(yè)主，常常是更直接的。在任何情況下，在一個(gè)層疊的責(zé)任（結(jié)構(gòu)）中，一個(gè)經(jīng)理是他或她的責(zé)任范圍內(nèi)的有效的行政首長(zhǎng)，特別重要的是財(cái)務(wù)官員和他們的員工的控制活動(dòng)在上下之間直通經(jīng)營(yíng)和企業(yè)的其他單元。
● 董事會(huì)——經(jīng)理層有責(zé)任向董事會(huì)提供治理、指導(dǎo)和失誤（的情況）。有效的董事會(huì)的成員是客觀的、有能力的和“好問(wèn)”的，他們同樣有關(guān)于企業(yè)活動(dòng)和環(huán)境的知識(shí)，并有履行他們的董事會(huì)的責(zé)任的必要的時(shí)間。經(jīng)理層也許處于一個(gè)無(wú)視控制的位置，忽視或窒息與下屬的溝通，授權(quán)給一個(gè)故意誤導(dǎo)結(jié)果去掩蓋其痕跡的不誠(chéng)實(shí)的管理人員。一個(gè)強(qiáng)有力的、活躍的董事會(huì)，特別是當(dāng)他結(jié)合了有效的向上溝通的渠道、財(cái)務(wù)能力、法律和內(nèi)部審計(jì)職能時(shí)，是能夠經(jīng)常地和最好地識(shí)別和糾正那些問(wèn)題。
● 內(nèi)部審計(jì)師——內(nèi)部審計(jì)師在評(píng)價(jià)控制系統(tǒng)的有效性中扮演了重要的角色，貢獻(xiàn)了推進(jìn)的效率。因?yàn)榻M織的地位和在一個(gè)企業(yè)中的威信，內(nèi)部審計(jì)職能經(jīng)常扮演一個(gè)重要的提出忠告的角色。
● 其他人員——內(nèi)部控制在一定程度上是組織里每個(gè)人的責(zé)任，因此每個(gè)人的工作的明確的或隱含的部分都將被描述。實(shí)際上每一個(gè)員工都將產(chǎn)生用于內(nèi)部控制系統(tǒng)的信息，或從事其他必須被控制的活動(dòng)。同樣，所有的人都有責(zé)任向上溝通運(yùn)行中的問(wèn)題，例如，不遵守行為準(zhǔn)則、其他對(duì)政策的違反或非法活動(dòng)。
外部組織的成員常常對(duì)達(dá)到組織的目標(biāo)作出貢獻(xiàn)，外部審計(jì)師進(jìn)行獨(dú)立的和客觀的檢查，直接通過(guò)對(duì)財(cái)務(wù)報(bào)表的審計(jì)和間接地由對(duì)董事會(huì)和經(jīng)理層提供有用的信息來(lái)實(shí)施他們的責(zé)任。其他提供對(duì)企業(yè)有效的內(nèi)部控制有用的信息的人是立法機(jī)構(gòu)、監(jiān)管機(jī)構(gòu)、客戶(hù)和其他與企業(yè)有商業(yè)交往的人、財(cái)務(wù)分析師、債券持有人、新聞媒體。外部組織，無(wú)論如何，對(duì)此沒(méi)有責(zé)任，他們不屬于企業(yè)的內(nèi)部控制系統(tǒng)。
這個(gè)報(bào)告的結(jié)構(gòu)
這個(gè)報(bào)告共有4卷（注：COSO報(bào)告在1992年9月出版共4卷，一個(gè)關(guān)于外部組織的報(bào)告作為附件在1994年5月出版，在1994版中，前三卷和附件合訂為一冊(cè)，“評(píng)價(jià)工具”在第二冊(cè)），第一卷是實(shí)施綱要，一個(gè)高水平的內(nèi)部控制框架的概要用以指導(dǎo)行政首長(zhǎng)和其他高級(jí)行政官員、董事會(huì)成員、立法機(jī)構(gòu)、監(jiān)管機(jī)構(gòu)。
第二卷，框架，定義內(nèi)部控制，描述它的組成部分，提供針對(duì)經(jīng)理層、董事會(huì)成員或其他人評(píng)估他們的控制系統(tǒng)的準(zhǔn)則。
第三卷，對(duì)外部組織的報(bào)告是對(duì)在準(zhǔn)備他們發(fā)表的財(cái)務(wù)報(bào)表的內(nèi)部控制（情況）的公開(kāi)報(bào)告的那些實(shí)體提供指導(dǎo)的補(bǔ)充文件。
第四卷，評(píng)價(jià)工具，提供對(duì)執(zhí)行內(nèi)部控制系統(tǒng)的有用的材料。
去做什么
可以因這個(gè)報(bào)告帶來(lái)成果的活動(dòng)取決于這個(gè)階層的角色和定位，包括：
● 高級(jí)管理層——大多數(shù)對(duì)這項(xiàng)研究作出貢獻(xiàn)的高級(jí)行政官員相信他們主要是使他們的組織處于“控制之下”。許多人說(shuō)，他們的公司的范圍無(wú)論怎樣劃分，一個(gè)部門(mén)，或貫穿活動(dòng)的一個(gè)控制單元——控制在處于早期發(fā)展階段的地方或其他地方都需要加強(qiáng)，他們不喜歡感到意外。這個(gè)研究建議行政首長(zhǎng)開(kāi)始一項(xiàng)對(duì)控制活動(dòng)的自我評(píng)估。利用這個(gè)框架，一個(gè)CEO，與關(guān)鍵的運(yùn)作和財(cái)務(wù)執(zhí)行官一起，能把注意的焦點(diǎn)集中于必要的地方。有一種方法，行政首長(zhǎng)將與經(jīng)營(yíng)單元領(lǐng)導(dǎo)人和關(guān)鍵職能的員工進(jìn)行討論，開(kāi)始控制評(píng)估，為這些個(gè)人提供指令去和他們的領(lǐng)導(dǎo)人討論這個(gè)報(bào)告的概念，提供在他們的責(zé)任范圍內(nèi)最初評(píng)估過(guò)程的缺陷，反饋發(fā)現(xiàn)的結(jié)果。其他的方法，可以包括一項(xiàng)對(duì)公司和經(jīng)營(yíng)單元政策和內(nèi)部審計(jì)程序的最初檢查。無(wú)論它的形式是什么，最初的自我評(píng)估將決定它是否需要，怎樣運(yùn)作一項(xiàng)更為廣泛的、深入得多的評(píng)估。它將同樣確保正在進(jìn)行的監(jiān)測(cè)過(guò)程是適當(dāng)?shù)��；ㄙM(fèi)時(shí)間評(píng)價(jià)內(nèi)部控制被稱(chēng)為一項(xiàng)投資，但它是有高回報(bào)的一項(xiàng)。
● 董事會(huì)成員——董事會(huì)成員將與高級(jí)管理人員討論企業(yè)內(nèi)部控制系統(tǒng)的狀況和提出其缺點(diǎn)是必要的。他們將從內(nèi)部和外部審計(jì)師那里尋求所獲。
● 其他人員——管理人員和其他人員將考慮他們的控制責(zé)任怎樣存在于按照這個(gè)框架的管理行為中，并與更多的高層人員討論加強(qiáng)控制的主意。內(nèi)部審計(jì)師將考慮在內(nèi)部控制系統(tǒng)中他們要關(guān)注的寬度和可能希望去比較他們的評(píng)價(jià)資料和評(píng)價(jià)工具。
● 立法機(jī)構(gòu)和監(jiān)管機(jī)構(gòu)——起草和執(zhí)行法律的政府官員承認(rèn)事實(shí)上任何公布（的文件）都可能有誤解和不同的預(yù)期。內(nèi)部控制在二個(gè)方面存在非常廣泛的預(yù)期，第一，他們對(duì)控制系統(tǒng)能完成什么有不同想法，要注意，一些觀察者相信內(nèi)部控制系統(tǒng)必須或應(yīng)該預(yù)防經(jīng)濟(jì)損失，或至少防止企業(yè)的經(jīng)營(yíng)失�。坏诙�，甚至當(dāng)內(nèi)部控制系統(tǒng)能夠和不能夠做什么以及關(guān)于“合理保證”概念的效力達(dá)成一致時(shí)，對(duì)概念的意義和怎樣被利用仍然有完全不同的見(jiàn)解，公司行政官員在一項(xiàng)所主張的控制失敗之后，后見(jiàn)之明地表示對(duì)涉及監(jiān)管機(jī)構(gòu)可以怎樣解釋公開(kāi)報(bào)告主張的“合理保證”的重視。在立法者或執(zhí)法者與經(jīng)理層交流內(nèi)部控制運(yùn)行不正常的報(bào)告之前，將就共同的內(nèi)部控制框架包括內(nèi)部控制的局限性達(dá)成一致，這個(gè)框架將有助于達(dá)成一致，
● 專(zhuān)業(yè)組織——制定的規(guī)則和其他專(zhuān)業(yè)組織提供的財(cái)務(wù)管理指南，審計(jì)和根據(jù)這個(gè)框架考慮他們的標(biāo)準(zhǔn)和指南的有關(guān)主題，在這個(gè)范圍內(nèi)，概念和術(shù)語(yǔ)的差異將被消除。
● 教育和培訓(xùn)機(jī)構(gòu)——這個(gè)框架是學(xué)術(shù)研究和分析的課題，能夠預(yù)見(jiàn)將有進(jìn)一步的提高。根據(jù)推測(cè)，這個(gè)報(bào)告已在被共同理解的基礎(chǔ)上被接受。它的概念和術(shù)語(yǔ)將找到進(jìn)入大學(xué)課程的它們的道路。
我們相信，這個(gè)報(bào)告提供了大量的利益。在相互理解的基礎(chǔ)上，所有的部分將以共同的語(yǔ)言和更有效的溝通進(jìn)行交流。企業(yè)行政部門(mén)將定位于對(duì)照標(biāo)準(zhǔn)評(píng)價(jià)控制系統(tǒng)，加強(qiáng)這個(gè)系統(tǒng)和使他們的企業(yè)接近于被接受的目標(biāo)。進(jìn)一步的研究能影響被接受的基礎(chǔ)。立法機(jī)構(gòu)和監(jiān)管機(jī)構(gòu)將能得到內(nèi)部控制、它的利益和局限的增加的理解。所有的部門(mén)利用共同的內(nèi)部控制框架，這些利益將被實(shí)現(xiàn)。
Legislators and Regulators
-Government officials who write or enforce
laws recognize that there can be misconceptions and different expectations
about virtually any issue. Expectations for internal control vary widely in two
respects. First, they differ regarding what control systems can accomplish. As
noted, some observers believe internal control systems will, or should, prevent
economic loss, or at least prevent companies from going out of business.
Second, even when there is agreement about what internal control systems can
and can't do, and about the validity of the "reasonable assurance"
concept, there can be disparate views of what that concept means and how it
will be applied. Corporate executives have expressed concern regarding how regulators
might construe public reports asserting "reasonable assurance" in
hindsight after an alleged control failure has occurred. Before legislation or
regulation dealing with management reporting on internal control is acted upon,
there should be agreement on a common internal control framework, including
limitations of internal control. This framework should be helpful in reaching
such agreement.
Professional Organizations
--Rule-making and other professional
organizations providing guidance on financial management, auditing and related
topics should consider their standards and guidance in light of this framework.
To the extent diversity in concept and terminology is eliminated, all parties
will benefit.
Educators
--This framework should be the subject of
academic research and analysis, to see where future enhancements can be made.
With the presumption that this report becomes accepted as a common ground for
understanding, its concepts and terms should find their way into university
curricula.
We believe this report offers a number of
benefits. With this foundation for mutual understanding, all parties will be
able to speak a common language and communicate more effectively. Business
executives will be positioned to assess control systems against a standard, and
strengthen the systems and move their enterprises toward established goals.
Future research can be leveraged off an established base. Legislators and
regulators will be able to gain an increased understanding of internal control,
its benefits and limitations. With all parties utilizing a common internal
control framework, these benefits will be realized.
Senior Management
--Most senior executives who contributed to
this study believe they are basically "in control" of their
organizations. Many said, however, that there are areas of their company--a
division, a department or a control component that cuts across
activities--where controls are in early stages of development or otherwise need
to be strengthened. They do not like surprises. This study suggests that the
chief executive initiate a self-assessment of the control system. Using this
framework, a CEO, together with key operating and financial executives, can
focus attention where needed. Under one approach, the chief executive could proceed
by bringing together business unit heads and key functional staff to discuss an
initial assessment of control. Directives would be provided for those
individuals to discuss this report's concepts with their lead personnel,
provide oversight of the initial assessment process in their areas of
responsibility and report back findings. Another approach might involve an
initial review of corporate and business unit policies and internal audit
programs. Whatever its form, an initial self-assessment should determine
whether there is a need for, and how to proceed with, a broader, more in-depth
evaluation. It should also ensure that ongoing monitoring processes are in
place. Time spent in evaluating internal control represents an investment, but
one with a high return.
Board Members
--Members of the board of directors should
discuss with senior management the state of the entity's internal control
system and provide oversight as needed. They should seek input from the
internal and external auditors.
Other Personnel
--Managers and other personnel should
consider how their control responsibilities are being conducted in light of
this framework, and discuss with more senior personnel ideas for strengthening
control. Internal auditors should consider the breadth of their focus on the
internal control system, and may wish to compare their evaluation materials to
the evaluation tools.
This report is in four volumes. The first
is this Executive Summary, a high-level overview of the internal control
framework directed to the chief executive and other senior executives, board
members, legislators and regulators.
The second volume, the Framework, defines
internal control, describes its components and provides criteria against which
managements, boards or others can assess their control systems. The Executive
Summary is included.
The third volume, Reporting to External
Parties, is a supplemental document providing guidance to those entities that
report publicly on internal control over preparation of their published
financial statements, or are contemplating doing so.
The fourth volume, Evaluation Tools,
provides materials that may be useful in conducting an evaluation of an internal
control system.
What to Do
Actions that might be taken as a result of
this report depend on the position and role of the parties involved:
Internal Auditors
--Internal auditors play an important role
in evaluating the effectiveness of control systems, and contribute to ongoing
effectiveness. Because of organizational position and authority in an entity,
an internal audit function often plays a significant monitoring role.
Other Personnel
--Internal control is, to some degree, the
responsibility of everyone in an organization and therefore should be an
explicit or implicit part of everyone's job description. Virtually all
employees produce information used in the internal control system or take other
actions needed to effect control. Also, all personnel should be responsible for
communicating upward problems in operations, noncompliance with the code of
conduct, or other policy violations or illegal actions.
A number of external parties often
contribute to achievement of an entity's objectives. External auditors,
bringing an independent and objective view, contribute directly through the
financial statement audit and indirectly by providing information useful to
management and the board in carrying out their responsibilities. Others
providing information to the entity useful in effecting internal control are
legislators and regulators, customers and others transacting business with the
enterprise, financial analysts, bond raters and the news media. External
parties, however, are not responsible for, nor are they a part of, the entity's
internal control system.
Organization of this Report
This belief is also unwarranted. An
internal control system, no matter how well conceived and operated, can provide
only reasonable--not absolute--assurance to management and the board regarding
achievement of an entity's objectives. The likelihood of achievement is
affected by limitations inherent in all internal control systems. These include
the realities that judgments in decision-making can be faulty, and that
breakdowns can occur because of simple error or mistake. Additionally, controls
can be circumvented by the collusion of two or more people, and management has
the ability to override the system. Another limiting factor is that the design
of an internal control system must reflect the fact that there are resource constraints,
and the benefits of controls must be considered relative to their costs.
Thus, while internal control can help an
entity achieve its objectives, it is not a panacea.
Roles and Responsibilities
Everyone in an organization has responsibility
for internal control.
Management
--The chief executive officer is ultimately
responsible and should assume "ownership" of the system. More than
any other individual, the chief executive sets the "tone at the top"
that affects integrity and ethics and other factors of a positive control
environment. In a large company, the chief executive fulfills this duty by
providing leadership and direction to senior managers and reviewing the way
they're controlling the business. Senior managers, in turn, assign
responsibility for establishment of more specific internal control policies and
procedures to personnel responsible for the unit's functions. In a smaller
entity, the influence of the chief executive, often an owner-manager, is
usually more direct. In any event, in a cascading responsibility, a manager is
effectively a chief executive of his or her sphere of responsibility. Of
particular significance are financial officers and their staffs, whose control
activities cut across, as well as up and down, the operating and other units of
an enterprise.
Board of Directors--Management is
accountable to the board of directors, which provides governance, guidance and
oversight. Effective board members are objective, capable and inquisitive. They
also have a knowledge of the entity's activities and environment, and commit
the time necessary to fulfill their board responsibilities. Management may be
in a position to override controls and ignore or stifle communications from
subordinates, enabling a dishonest management which intentionally misrepresents
results to cover its tracks. A strong, active board, particularly when coupled
with effective upward communications channels and capable financial, legal and
internal audit functions, is often best able to identify and correct such a
problem.
The internal control definition--with its
underlying fundamental concepts of a process, effected by people, providing
reasonable assurance--together with the categorization of objectives and the
components and criteria for effectiveness, and the associated discussions,
constitute this internal control framework.
What Internal Control Can Do
Internal control can help an entity achieve
its performance and profitability targets, and prevent loss of resources. It
can help ensure reliable financial reporting. And it can help ensure that the
enterprise complies with laws and regulations, avoiding damage to its reputation
and other consequences. In sum, it can help an entity get to where it wants to
go, and avoid pitfalls and surprises along the way.
What Internal Control Cannot Do
Unfortunately, some people have greater,
and unrealistic, expectations. They look for absolutes, believing that:
? Internal control can ensure an entity's
success--that is, it will ensure achievement of basic business objectives or
will, at the least, ensure survival.
Even effective internal control can only
help an entity achieve these objectives. It can provide management information
about the entity's progress, or lack of it, toward their achievement. But
internal control cannot change an inherently poor manager into a good one. And,
shifts in government policy or programs, competitors' actions or economic
conditions can be beyond management's control. Internal control cannot ensure
success, or even survival.
Internal control can ensure the reliability
of financial reporting and compliance with laws and regulations.
Monitoring
--Internal control systems need to be
monitored--a process that assesses the quality of the system's performance over
time. This is accomplished through ongoing monitoring activities, separate
evaluations or a combination of the two. Ongoing monitoring occurs in the
course of operations. It includes regular management and supervisory
activities, and other actions personnel take in performing their duties. The
scope and frequency of separate evaluations will depend primarily on an
assessment of risks and the effectiveness of ongoing monitoring procedures.
Internal control deficiencies should be reported upstream, with serious matters
reported to top management and the board.
There
is synergy and linkage among these components, forming an integrated system
that reacts dynamically to changing conditions. The internal control system is
intertwined with the entity's operating activities and exists for fundamental
business reasons. Internal control is most effective when controls are built
into the entity's infrastructure and are a part of the essence of the
enterprise. "Built in" controls support quality and empowerment
initiatives, avoid unnecessary costs and enable quick response to changing
conditions.
There
is a direct relationship between the three categories of objectives, which are
what an entity strives to achieve, and components, which represent what is
needed to achieve the objectives. All components are relevant to each
objectives category. When looking at any one category--the effectiveness and
efficiency of operations, for instance--all five components must be present and
functioning effectively to conclude that internal control over operations is
effective.
Control Environment
--The control environment sets the tone of
an organization, influencing the control consciousness of its people. It is the
foundation for all other components of internal control, providing discipline
and structure. Control environment factors include the integrity, ethical
values and competence of the entity's people; management's philosophy and
operating style; the way management assigns authority and responsibility, and
organizes and develops its people; and the attention and direction provided by
the board of directors.
Risk Assessment--Every entity faces a
variety of risks from external and internal sources that must be assessed. A
precondition to risk assessment is establishment of objectives, linked at
different levels and internally consistent. Risk assessment is the
identification and analysis of relevant risks to achievement of the objectives,
forming a basis for determining how the risks should be managed. Because
economic, industry, regulatory and operating conditions will continue to
change, mechanisms are needed to identify and deal with the special risks
associated with change.
Control Activities
--Control activities are the policies and
procedures that help ensure management directives are carried out. They help
ensure that necessary actions are taken to address risks to achievement of the
entity's objectives. Control activities occur throughout the organization, at
all levels and in all functions. They include a range of activities as diverse
as approvals, authorizations, verifications, reconciliations, reviews of
operating performance, security of assets and segregation of duties.
Information and Communication
--Pertinent information must be identified,
captured and communicated in a form and timeframe that enable people to carry
out their responsibilities. Information systems produce reports, containing
operational, financial and compliance-related information, that make it
possible to run and control the business. They deal not only with internally generated
data, but also information about external events, activities and conditions
necessary to informed business decision-making and external reporting.
Effective communication also must occur in a broader sense, flowing down,
across and up the organization. All personnel must receive a clear message from
top management that control responsibilities must be taken seriously. They must
understand their own role in the internal control system, as well as how
individual activities relate to the work of others. They must have a means of
communicating significant information upstream. There also needs to be
effective communication with external parties, such as customers, suppliers, regulators
and shareholders.
The first category addresses an entity's
basic business objectives, including performance and profitability goals and
safeguarding of resources. The second relates to the preparation of reliable
published financial statements, including interim and condensed financial
statements and selected financial data derived from such statements, such as
earnings releases, reported publicly. The third deals with complying with those
laws and regulations to which the entity is subject. These distinct but
overlapping categories address different needs and allow a directed focus to
meet the separate needs.
Internal control systems operate at
different levels of effectiveness. Internal control can be judged effective in
each of the three categories, respectively, if the board of directors and
management have reasonable assurance that:
They understand the extent to which the
entity's operations objectives are being achieved.
Published financial statements are being
prepared reliably.
Applicable laws and regulations are being
complied with.
While internal control is a process, its
effectiveness is a state or condition of the process at one or more points in
time.
Internal
control consists of five interrelated components. These are derived from the
way management runs a business, and are integrated with the management process.
Although the components apply to all entities, small and mid-size companies may
implement them differently than large ones. Its controls may be less formal and
less structured, yet a small company can still have effective internal control.
The components are:
Internal Control - Integrated Framework
Executive Summary
Senior executives have long sought ways to
better control the enterprises they run. Internal controls are put in place to
keep the company on course toward profitability goals and achievement of its
mission, and to minimize surprises along the way. They enable management to
deal with rapidly changing economic and competitive environments, shifting
customer demands and priorities, and restructuring for future growth. Internal
controls promote efficiency, reduce risk of asset loss, and help ensure the
reliability of financial statements and compliance with laws and regulations.
Because internal control serves many
important purposes, there are increasing calls for better internal control
systems and report cards on them. Internal control is looked upon more and more
as a solution to a variety of potential problems.
What Internal Control Is
Internal control means different things to
different people. This causes confusion among businesspeople, legislators,
regulators and others. Resulting miscommunication and different expectations
cause problems within an enterprise. Problems are compounded when the term, if
not clearly defined, is written into law, regulation or rule.
This report deals with the needs and
expectations of management and others. It defines and describes internal
control to:
Establish a common definition serving the
needs of different parties.
Provide a standard against which business and
other entities--large or small, in the public or private sector, for profit or
not--can assess their control systems and determine how to improve them.
Internal control is broadly defined as a
process, effected by an entity's board of directors, management and other
personnel, designed to provide reasonable assurance regarding the achievement
of objectives in the following categories:
Effectiveness and efficiency of operations.
Reliability of financial reporting.
Compliance with applicable laws and
regulations.
美國(guó)COSO英文報(bào)告翻譯-內(nèi)部控制翻譯
