Home / Economics

Turnbull Report 1999 on Internal Control (Turnbull Report)


a change and become more complex and help the unit manage risk at an acceptable level.

The 2013 COSO report consists of four parts:

- Part 1: Executive Summary

The general presentation of the content of the Internal Control Framework helps senior managers and state management agencies grasp the most general content of Internal Control.

Maybe you are interested!

- Part 2: Internal Control Framework and Appendices The Internal Control Framework is the most important content of the COSO Report.

2013. The content of the framework includes the definition of internal control, the requirements of effective internal control, including the constituent elements and principles of internal control, providing guidance for managers at all levels in the unit to know how to design, implement and evaluate the effectiveness of internal control.

Turnbull Report 1999 on Internal Control (Turnbull Report)

The appendix provides additional reference information including: a glossary of terms, notes for small businesses, and a summary of changes in the 2013 Report compared to the 1992 report (although the appendix is ​​not considered part of the Framework).

- Part 3: Illustrative Tools for Assessing Effectiveness of a System of Internal Control

This section provides templates and practical examples to assist managers in applying the internal control framework, especially when evaluating the effectiveness of internal control.

- Part 4: Internal Control Over External Financial Reporting: A Compendium of Approaches and Examples.


This section provides methods and practical examples of applying the requirements of internal control (including its components and principles) to the preparation of external financial statements.

The 2013 COSO report was released with many important new points [76]:

- The most notable change in the COSO 2013 Framework is the encoding of internal control components into 17 principles to ensure a standard that can be widely applied to many types of businesses in many countries.

- COSO 2013 adds requirements for an effective internal control system: must ensure both the factors and corresponding principles must operate practically and effectively.

- COSO 2013 has been associated with the development of information technology with business operations. Internal control also wants to develop, it cannot ignore the role of information technology in production, business and control activities.

1.2.2. COBIT framework on internal control

In 1996, the Information Systems Audit and Control Association (ISACA) issued an international standard for information technology (IT) management, including best practice frameworks for IT management called COBIT. COBIT was originally developed based on a set of control objectives to help the financial audit community perform better control and audit work in the IT-related environment. Recognizing the value in expanding the framework beyond auditing, ISACA issued additional versions to expand corporate governance and risk management. COBIT helps improve IT performance and efficiency, helps IT understand business needs, helps managers understand and invest in IT throughout the business's operations. In addition, it also helps the Board of Directors, CEO and managers increase the value of IT and minimize related risks. In 2019, ICASA issued COBIT 2019


on the basis of COBIT 5. COBIT 2019 changes in line with the development of information technology to provide quality information and ensure reliability.

The purpose of COBIT is to “research, develop, promote and disseminate IT control objectives for business managers and auditors to apply in their work” .

According to COBIT's perspective, internal control develops in conjunction with the information technology environment with 3 assessment, orientation, and monitoring processes covering 4 areas: Planning, construction, operation, and monitoring [75].

1.2.3. Turnbull Report 1999 on internal control (Turnbull Report)

The Turnbull Report was published by the Internal Control Committee of the Institute of Chartered Accountants in England and Wales, first published in September 1999. The report provides a suitable framework for evaluating the effectiveness of internal control with financial reporting. According to the Turnbull Report, internal control consists of three elements: control environment; information and communication systems; and monitoring.

The report aims to:

- Ensure effectiveness and efficiency of operations.

- Ensure the quality of management reports and financial reports.

- Ensure compliance with applicable laws and regulations.

It is the responsibility of the Board of Directors to evaluate internal control. The Board of Directors is responsible to the Board of Directors for monitoring internal control.

The assessment of the effectiveness of internal control is an essential part of the Board's responsibility. The Board will need to form its view of its effectiveness after due diligence and investigation based on the information and assurance provided to it. Management is responsible to the Board for monitoring internal control and for ensuring that the Board has done so.


The Turnbull Guide says that a company's internal control: includes the policies, procedures, duties, behaviours and other aspects of a company taken together:

- Facilitate effective and efficient operations by enabling it to respond appropriately to business operations, significant compliance and other risks to achieve the company's objectives. This includes ensuring assets are used appropriately, limiting fraud and errors and ensuring that liabilities are identified and managed.

- Helps ensure the quality of internal and external reporting. This requires maintaining records and procedures that produce timely, relevant and reliable information from within and outside the organization.

- Helps ensure compliance with applicable laws and regulations and internal codes of business ethics.

1.2.4. COCO framework on internal control

The COCO internal control model is quite similar to the COSO model and has the same perspective in design and implementation. The COCO model was developed by the Canadian Institute of Chartered Accountants in 1995 (Feng et al., 2015). The purpose of COCO is to see the importance of internal control from the resources, systems, structures, processes and tasks of the organization. From there, it aims at three main objectives: effectiveness and efficiency of operations; reliability of internal and external reporting; compliance with rules and regulations, including existing internal policies. These objectives are consistent with the COSO framework. When properly implemented, the COCO framework tends to help companies achieve the performance goals set by shareholders, managers and owners. Gottschalk (2014) points out that the purpose of the COCO framework is to promote operational efficiency in retail companies.


The COCO framework states that weak or ineffective internal controls can lead to vulnerabilities for internal irregularities that can lead to business failure (Gottschalk, 2014). The development of COCO by the Canadian Institute of Chartered Accountants increases the strategic elements that form part of both COSO and COCO. Both models have a positive impact in supporting and enhancing the management of business operations, maintaining the effectiveness and efficiency of operations. COCO provides the necessary information to help the managers of the unit make accurate decisions (Gottaschalk, 2014) [67].

The COCO framework is designed based on the COSO model, so the two models have many similarities. Specifically, internal control according to COCO has 4 factors (Objectives; Commitment; Capacity and Monitoring) and 20 evaluation criteria. These factors have many similarities with the 5 constituent factors of COSO 2013. The evaluation criteria of COCO have a broader approach than the 17 principles of COSO 2013 and are closer to the management activities of enterprises.

1.2.5. SAC Report

The Systems Assurance and Control (SAC) report was issued in 1977 by the Institute of Internal Auditors with the primary objective of mitigating risks in the e-business market. The SAC report focuses on managing risks from technology and changes in e-business.

SAC defines internal control as a set of processes, tasks, activities, subsystems and people that work together to ensure the effectiveness of objectives.

The objectives of SAC's internal control are to ensure the reliability of financial statements; ensure the effectiveness and efficiency of operations; and comply with relevant laws and regulations.


Internal control elements under SAC include:

- Control environment: Includes organizational structure, control frameworks, policies, procedures and external influences.

- Manual system and automatic system: Automatic system includes system and application software.

- Control procedures: Including general controls, loss controls and application controls.

SAC considers internal control as a system in which people are an indispensable part [70].

1.2.6. Reasons for choosing the internal control model according to COSO 2013

Through the systematization of the contents of internal control frameworks and models, it is found that the COSO internal control framework since its inception and development has always been a recognized and used control framework as the basis for building internal control models in many countries around the world. Within the scope of the thesis, the author uses the COSO 2013 Internal Control Framework for the following reasons:

- Firstly, as the author mentioned above, internal control is currently in the development stage, so internal control is no longer limited to the scope of cash control, accounting control, or financial control, information technology control separately... but internal control needs to be considered as a comprehensive concept related to business activities and management in the enterprise. Through the overview and systematization of control frameworks in the previous sections, it can be seen that other internal control frameworks have not met the comprehensiveness and high management nature like the COSO internal control framework. Specifically, the COSO 2013 control framework is not only related to financial and non-financial reporting but is expanded to the areas of operations and compliance, corporate governance and risk management.


- Second, popularity: COSO 2013 report is widely used in academic works related to internal control, regulations of competent authorities in countries, professional organizations of auditing and accounting in the world, most of the world's large companies prioritize the application of COSO framework in designing and operating internal control. This affirms that COSO 2013 has high applicability in theory and practice, contributing to promoting development in many fields and industries in the world.

- Third, with high guidance, the COSO 2013 Report specifically, clearly and in detail states the principles and factors serving the design, operation and assessment of internal control.

- Fourth, the COSO framework demonstrates the connection between internal control, risk management and corporate governance. According to the viewpoint on internal control mentioned above, internal control, in addition to requiring good control of resources, also requires adaptation and coping with fluctuations from changes, from uncertain factors, or risks from the external business environment or the internal environment of the enterprise, thereby ensuring that the enterprise achieves its goals. In other words, internal control must be closely linked to risk management. The COSO framework has partly demonstrated this when the process of identifying and assessing risks is one of the five elements that make up internal control.

- Fifth, the COSO 2013 report has made major changes compared to the COSO 1992 report to better suit the context of economic development and objective events affecting the success or failure of businesses. Specifically, in the internal control framework of the COSO 2013 report, perhaps the biggest change compared to the 1992 report is in 7 contents:

+ 17 principles of systematization;

+ The role of goal setting clarified;

+ Reflects the increasing and relevant role of technology;


+ Combine discussion to enhance governance;

+ Expand target reporting;

+ Enhanced ability to review anti-fraud expectations;

+ Increased focus on non-financial reporting objectives. [81]

1.3. Elements of internal control according to COSO 2013 reporting template

Based on the 7 main aspects that have been adjusted, COSO 2013 provides 17 principles that are expanded according to the structural model by 5 factors that make up internal control based on COSO 1992. The COSO 2013 report clearly provides the role of each principle in the design and operation of internal control, as well as assessing the effectiveness of internal control. The five factors that make up COSO are widely accepted by Rutteman, Turnbull, SEC, PCAOB and are used as criteria to measure the effectiveness of internal control. COSO's internal control framework is applicable to many types of activities and many different fields. In the content of the thesis, the author approaches the 5 factors of COSO including: control environment, risk assessment, control activities, information and communication systems and monitoring activities.

The elements of internal control are closely related and interact with each other to achieve the unit's objectives. The control environment creates the space and framework for each individual to carry out his/her control responsibilities. Managers assess the risks that threaten the achievement of the unit's objectives. Control activities are carried out to ensure that the manager's instructions to handle risks are implemented. Meanwhile, appropriate information needs to be collected and the information exchange process must take place smoothly throughout the unit. The above process needs to be evaluated and adjusted when necessary through monitoring activities [71].

Comment


Agree Privacy Policy *