Are boards control-literate? - In My Opinion - internal control

Internal Auditor, Oct, 2003 by Jack T. Beavers

KENNETH DAYTON, FORMER CHAIRMAN OF THE BOARD FOR DAYTON Hudson Corp., may have been correct when he stated, "The board of directors is the Achilles' heel of the American corporation ... every time you find a business in trouble, you find a board of directors either unwilling or unable to fulfill its responsibilities." Indeed, the board of directors is supposed to be where the buck stops with regard to directing and managing the activities of an enterprise, as well as the ultimate safeguard for protecting shareholder interests. Many boards, however, appear to lack familiarity with one of the key mechanisms for ensuring the success of their business--internal control systems. In fact, directors' expertise in control systems seems woefully inadequate.

Board-level responsibility for internal controls has been well-established. Beginning with the landmark 1992 publication by The Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal Control-Integrated Framework, the board has been defined as a governing tool for effective control systems. According to the COSO framework, "internal control is a process, effected by an entity's board of directors, management, and other personnel."

Another seminal document, the 1999 Report and Recommendations of the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees, also points to the board's role in control processes. The report states that audit committees should "ensure management develops and adheres to a sound system of internal control."

Still, the recent series of high-profile financial failures demonstrates board ineffectiveness in overseeing control systems. At Enron, for example, the board appears to have been either unwilling or unable to fulfill its responsibilities. Although it's possible that Enron's board members did not understand the necessity of strong internal controls, it's more likely that they understood the need but did not possess the knowledge or skills to implement an effective control system.

The collapse of Enron and other firms precipitated intervention by the U.S. government, confirming its distrust in the ability of boards to meet their control-related responsibilities. Under the Sarbanes-Oxley Act of 2002, the U.S. Securities and Exchange Commission requires companies to disclose whether or not their audit committee includes at least one financial expert with "an understanding of internal controls and procedures for financial reporting." In addition, a policy recently issued by U.S. Federal banking and thrift regulatory agencies encourages financial institutions to evaluate their internal controls against the COSO framework and states that the board and senior management are responsible for ensuring that the company's internal control system operates effectively.

After-the-fact legislation and new policies, however, do little for a company already in trouble due to an ineffective board. To prevent future board failures, business stakeholders may well need to become more proactively involved in the selection and approval process for board members. With this in mind, I believe the first question to ask a candidate for board membership should be, "What do the letters in the acronym COSO stand for?"

To comment on this essay, e-mail the author at jbeavers@theiia.org. The opinions expressed are solely those of the author.

JACK T. BEAVERS, PE, CBM, is an engineering auditor consultant at CITGO Petroleum Corp. in Corpus Christi, Texas.