A theoretical foundation for defining and representing internal controls

内部控制广泛地指公司为保护资产、确保财务数据的完整性、遵守法律和改善业务运营而实施的实践。近年来，内部控制的失败导致了安然、安达信和世通等大公司的破产。作为回应，美国通过了《萨班斯-奥克斯利法案》（Sarbanes-Oxley Act）等新法律，要求公司经理和审计师每年正式证明公司内部控制的力度。尽管内部控制在实践中具有重要意义，并被广泛研究，但核心问题尚未得到研究。最根本的是，对内部控制的含义或性质进行定义的工作很少。虽然这是一个高度理论性的问题，但它也是一个高度实践性的问题，因为企业如果不深入了解内部控制是什么，就无法证明内部控制的强度。因此，本研究计划的长期目标是：为定义和表示组织中的内部控制提供理论基础和相关方法。研究计划的短期具体目标如下：1.研究计划的短期目标。开发一套必要和充分的概念来定义和表示内部控制。2. 开发一种准确表示内部控制的方法，并在软件工具中实现它。3. 测试所建议的软件工具是否有助于执业审核员理解和测试控制。这项研究有几个贡献。对于学术界而言，该研究将澄清内部控制的本质，并有助于为内部控制的定义、分类和表示提供一般的理论基础。在实践中，该研究将提供一个软件应用程序和方法，帮助从业者记录、理解和测试组织中的内部控制。

Internal controls broadly refer to practices that companies implement to safeguard assets, ensure the integrity of their financial data, comply with laws, and improve business operations.  In recent years, internal control failures have led to the ruin of major corporations such as Enron, Arthur Anderson, and WorldCom.  In response, new laws such as the Sarbanes-Oxley Act in the USA have been passed that require corporate managers and auditors to formally attest to the strength of companies' internal controls on an annual basis.      Although internal controls are critical in practice and widely researched, core issues remain unstudied.  Most fundamentally, little work has been conducted to define the meaning or nature of internal controls.  While such a problem is highly theoretical, it is also a highly practical problem because companies cannot attest to the strength of internal controls without a deep understanding of what those controls are.  Thus, the long-term objective of this research program is: to develop a theoretical foundation and an associated method for defining and representing internal controls in organizations.  The specific short-run objectives of the research program are as follows: 1. Develop a necessary and sufficient set of concepts for defining and representing internal controls. 2. Develop a method for accurately representing internal controls and implement it in a software tool.   3. Test whether the proposed software tool helps practicing auditors to understand and test controls.    The research promises several contributions.  For academics, the research will clarify the nature of internal controls and contribute to a general theoretical foundation for defining, classifying, and representing internal controls.  For practice, the research will provide a software application and method that will help practitioners to document, understand, and test internal controls in organizations.