内部控制及其披露【外文翻译】

外文翻译

Internal control and its disclosure

Material Source:Laura F. Spira Author: Michael In this paper we explore the use of disclosure as a regulatory tool, using as an illustration the current UK requirements regarding the disclosure of informationabout internal control. After discussing the broad concept of regulation by disclosure, we trace the evolution of concepts of internal control and its reporting, describing the background to the Turnbull guidance for directors on internal control reporting, the basis of current UK requirements. We then examine recent examples of internal control disclosures, identifying the range of ways in which they address the disclosure requirements and considering the possible impact of the disclosure requirements on corporate behaviour and on the audiences for disclosure. We conclude with some reflections on the disclosure life cycle. The paper contributes to the literature on disclosure by specifically considering the role of disclosure as a regulatory tool and by examining the nature of specific disclosures in an area of continuing interest, that of internal control.

In his analysis of the development of the role of audit, Power observes that internal control has become increasingly important as part of a system of regulation which relies on making internal mechanisms visible through forms of self-validation and disclosure. Corporate governance requirements have frequently been couched in the form of codes of practice on the principle of ‘comply or explain’ rather than prescriptive legislation. The monitoring role of the board of directors, which forms the apex of the internal control system of an organisation, has been emphasised. The influence of particular interest groups has been important in the negotiation of these developments. Auditors, both internal and external, can claim expertise in internal control, advancing their organisational position in the case of internal auditors (Spira and Page 2003) and increasing the potential for sales of specialised services in the case of external auditors. Regulators and legislators have focused on internal control issues as a policy response to crises (Cunningham 2004).

The use of internal control as a corporate governance device reflects a subtle but signifi cant change in its conception, moving from the original ‘‘supportive’’

notion that internal control systems were an integral part of the structure of an organisation which enabled its goals to be achieved, to the more recent view of internal control as a s ubstantially ‘‘preventive’’ system, designed to minimise obstructions to goal achievement and carrying significantly greater expectations of the effectiveness of such systems. As Page and Spira (2004) note, companies have also increasingly taken ‘risk-base d’ approaches to internal control because of the increased pace of organisational change—control systems change too fast to be rigidly documented and companies may not even have full documentation relating to some of their IT based systems. For these reasons there has been an increase in ‘delegation’ of control downwards in the organisation and there is likely to be no central record of control systems.

The emergence of risk-based approaches to internal control has resulted in a confluence of internal control and risk management to the point that an influentialpublication (Jones and Sutherland 1999) issued at the same time as the Turnbull guidance referred frequently to ‘‘internal control and risk management’’ as a single concept in providing practical assistance for boards in complying with the Turnbull disclosure requirements.

The demonstration of ‘‘good’’ corporate governance is a challenge for boards of directors but describing structural mechanisms such as internal control processes may be one way of meeting demands for transparency. Thus, what was once an internal interest becomes a means of demonstrating regulatory compliance.

Concerns about internal control in the US and the UK arose initially from a desire to establish the boundaries of external auditor responsibility. The difficulties of defining internal control are illustrated in the earliest US experience, as summarised in a lecture by Mautz (1980). He quotes the 1949 AICPA definition: Internal control comprises the plan of organization and all of the coordinate methods and measures adopted within a business to safeguard its assets, check the accuracy and reliability of its accounting data, promote operational efficiency, and encourage adherence to prescribed managerial policies.

and describes the c oncern of firms’ legal counsel about the broadness of this definition. This concern led to a new definition issued in 1958 which split the four parts of the original definition between ‘‘accounting control’’ (safeguarding assets and checking reliability an d accuracy of accounting data) and ‘‘administrative control’’ (promotion of operational efficiency and encouragement of adherence to prescribed management policies) and defined auditors’ responsibility as reviewing

accounting controls only. A further narrowing took place in 1972 when the US auditing profession limited the two components of ‘‘accounting control’’ even more.

Up to this point, the definition was really only of concern to companies and their auditors but the passing of the Foreign Corrupt Practices Act in 1977 changed this. The Act was passed in response to bribery scandals and for the first time envisaged the use of internal control as regulation. It was based on a narrow conception of internal control newly described as ‘‘internal accounting control’’. It also changed the focus of internal control: whereas the concerns of ‘‘accounting control’’ had been at low organisational levels and clerical procedures, the Act now shifted attention to controls at board level for the first time.

Further concern about inadequacies in financial reporting led to a private sector initiative which established the Treadway Commission on Fraudulent Financial Reporting in 1987. Its recommendations included a call for a review of the varying concepts of internal control to develop a consistent approach. The Committee of Sponsoring Organizations (COSO 1992) subsequently produced an integrated framework for internal control in 1992, defining internal control as:

A process … designed to provide reasonable assurance regar ding the

achievement of objectives in the following categories:

? Effectiveness and efficiency of operations.

? Reliability of financial reporting.

? Compliance with applicable laws and regulations (COSO 1992, p. 9) However, the Sarbanes Oxley legislation of 2002 introduced a further definition: ‘‘internal control over financial reporting’’3 which suggests that consistency has not yet been achieved and ambiguity still exists.

In the UK, internal control first entered the corporate governance agenda when the Cadbury Committee, reporting in 1992 on the financial aspects of corporate governance, adopted the view that directors’ responsibilities with regard to internal control should be clarified. They recommended that directors should report on the effectiveness of internal control systems and that auditors should report on that statement but passed responsibility for implementing this to the accountancy profession.

In 1994 the Rutteman working party defined internal control using the US definition of 1958 and also replaced the Cadbury recommendation that directors should report on the effectiveness of internal controls with the suggestion that they may wish to do so. In 1998 the Hampel review of the Cadbury Code weakened this

recommendation even further but, for the first time, suggested that internal control and risk management were related.

This link was built on by the internal control working party chaired by Nigel Turnbull which was charged with producing guidance for directors in interpreting the Code’s req uirements for reporting on internal control, finally grasping the nettle avoided by Cadbury, Rutteman and Hampel. Using a broad definition of internal control, the Turnbull guidance views it as a key component of risk management. In terms of the apparent satisfaction of disclosers and their audiences, the guidance consultation initiated by the Financial Reporting Council Turnbull Review Group in 2005. The guidance has also been widely adopted in the public sector.

The study reported in this paper uses disclosures required by the Turnbull guidance to illustrate aspects of the use of disclosure as a regulatory tool. Having outlined the background to current concerns about internal control disclosure, the next section considers theories of disclosure.

译文

内部控制及其披露

资料来源:施普格林作者：迈克尔本文选取英国当前对于内部控制信息披露的规定作为案例，探讨了披露这项监管工具的使用。在讨论了披露管制的广义概念之后，我们跟踪了内部控制及其披露这两个概念的演变历程，其中介绍了《公司治理综合法典》指导意见中关于内部控制披露的背景，也就是英国当前规范的制定基础。然后我们通过分析最近一些有关内部控制披露的案例，来确定他们传递披露要求的途径，并考虑到披露要求对企业行为和信息使用者产生的可能的影响。最后我们探讨了一些生命周期的披露问题，以此来总结全文。这篇论文具体分析披露这项监管工具、验证内部控制信息披露的本质，给有关披露研究的文献又增添了一笔。

Power在审计的角色发展分析中发现，内部控制在监管系统中的重要性是越来越高。这套监管系统通过自我验证和信息披露达到内部机制可视化的效果。公司治理条例经常呈现为实务守则的形式，采用“遵守或解释”的形式，而不是规范立法。作为一个组织内部控制系统制高点的董事会，它的监督作用得到了强调。在这些改良的谈判中，特殊利益群体的影响力也很重要。因为是内部控制的专家，内部审计师提升了自己在组织中的地位（Spira & Page,2003），而外部审计师增加了专业服务业务的潜力。监管者和立法人员在针对危机制定

政策的时候，已经将注意力集中到了内部控制问题上（Cunningham,2004）。

作为一项公司治理的工具，内部控制的作用发生了微妙但很重大的变化。原本“支持型”主张的是“内部控制系统作为组织结构一部分是为了确保组织目标得以实现”，而最近的观点认为内部控制系统实质上是一个预防系统，旨在最大限度地减少目标执行过程中的障碍，给这类系统的有效性带来更大的期望值。正如Page和Spira（2004）提到的，因为组织变化的速度太快，公司开始逐渐在内部控制中采取以风险为基础的方法。控制系统变化太快，需要严格的记录，但是公司对于一些电算化系统可能没有完整的文件。基于这些原因，组织控制系统中可能会增添一些系统，而且很可能没有中央记录控制系统。

以风险为基础的内部控制系统，结合了内部控制和风险管理。这个观点有一个有影响力的出版物（Jones & Sutherland,1999）和《公司治理综合法典》指导意见同时发布。《公司治理综合法典》指导意见中指出，在给董事会提供有关披露要求的援助时，“内部控制”与“风险管理”经常指的是一个概念。

好的公司治理是对董事会能力的挑战，同时描述了各式各样的结构机制，内部控制可能只是满足组织透明化的一种方式。因此，曾经作为一项内部利益的内部控制，成为了遵从法规的一种手段。

在美国和英国，内部控制最初产生是为了建立外部审计师责任的界限。Mautz(1980)在一次讲座中通过总结早期美国的经验指出了定义内部控制的艰巨性。他引用了1949年美国注册会计师协会的定义：

内部控制包括组织计划和企业为保障资产安全、核查会计数据的准确性和可靠性、提高组织运作效率、鼓励遵守管理政策采取的所有方法和措施。

介绍了公司法律顾问对于这个定义广度的担忧，这个担忧导致了1958年新定义的诞生。它将原定义中的四个部分重组为：会计控制（资产保障、会计数据可靠性和准确性审核）、行政控制（提高运作效率、鼓励遵守管理政策），并规定审计师的责任只有审核会计控制。1972年，定义进一步被缩小，美国规定审计范围只限定于会计控制对应的两个部分。

到目前为止，这个定义只关注公司和他们的审计师。但是1977年颁布的《反国外行贿法案》改变了这一点。该法案是为了回应行贿丑闻，并首次设想在监管中使用内部控制系统。这个系统是一个狭义的概念，最近被称为“内部会计控制”。它也改变内部控制的侧重点：原本的会计控制关注的是低组织水平和办事程序，而该法案第一次将注意力转移到了董事会的层面。

财务报告不足的进一步被关注，导致了倡议需要一个专门的部门来监管。这个部门就是1987年建立的专门针对欺诈性财务报告的全美反舞弊性财务报告委员会发起组织（COSO委员会）。其建议中要求为不同的内部控制概念开发一套一致的方法。全美反舞弊性财务报告委员会发起组织（COSO,1992）随后