A theoretical foundation for defining and representing internal controls

点击翻译按钮获取中文摘要

Internal controls broadly refer to practices that companies implement to safeguard assets, ensure the integrity of their financial data, comply with laws, and improve business operations.  In recent years, internal control failures have led to the ruin of major corporations such as Enron, Arthur Anderson, and WorldCom.  In response, new laws such as the Sarbanes-Oxley Act in the USA have been passed that require corporate managers and auditors to formally attest to the strength of companies' internal controls on an annual basis.      Although internal controls are critical in practice and widely researched, core issues remain unstudied.  Most fundamentally, little work has been conducted to define the meaning or nature of internal controls.  While such a problem is highly theoretical, it is also a highly practical problem because companies cannot attest to the strength of internal controls without a deep understanding of what those controls are.  Thus, the long-term objective of this research program is: to develop a theoretical foundation and an associated method for defining and representing internal controls in organizations.  The specific short-run objectives of the research program are as follows: 1. Develop a necessary and sufficient set of concepts for defining and representing internal controls. 2. Develop a method for accurately representing internal controls and implement it in a software tool.   3. Test whether the proposed software tool helps practicing auditors to understand and test controls.    The research promises several contributions.  For academics, the research will clarify the nature of internal controls and contribute to a general theoretical foundation for defining, classifying, and representing internal controls.  For practice, the research will provide a software application and method that will help practitioners to document, understand, and test internal controls in organizations.