Internal control (内部統制) is the set of mechanisms an organization builds and runs day to day on its own, so that work proceeds properly and efficiently and fraud and errors are prevented.
Internal control
4 objectives (before the 2023 revision)
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with laws and regulations
Safeguarding of assets
6 basic components
Control environment
Risk assessment and response
Control activities
Information and communication
Monitoring
Response to IT
Japan's Financial Services Agency standard (the version before its 2023 revision) sets 4 objectives to aim for and 6 basic components (基本的要素) that put them into practice. Responsibility lies with management, while staff in each department also take part in day-to-day operation through their own work. A typical tool is segregation of duties (職務分掌), which splits roles and authority so that people check one another.
AnalogyIt is like a household where one person does the shopping and another keeps the budget book and checks the balance. Because no one handles everything alone, misuse or miscounting is easier to spot.
How to rememberControl traces back to the medieval counter-roll, a second copy of the accounts kept by another person for checking: the same idea as splitting duties.
Exam points
ExamFinal responsibility for setting up and running internal control (内部統制) rests with management (経営者). Front-line staff also carry part of its operation through their own work.
ExamSegregation of duties (職務分掌) separates the people who request and carry out a transaction from those who approve and check it. Not leaving a whole chain of processing to one person creates mutual checks that prevent fraud and errors.
ExamIn compliance with laws and regulations (法令等の遵守), one of the objectives, "laws and regulations" covers not only statutes but also industry association standards, internal company rules and social norms.
Monitoring (モニタリング) is one of the basic components of internal control: the ongoing activity of checking and evaluating whether controls keep working as intended.
Ongoing monitoring
Separate evaluations
Who does it
The business unit itself
Internal audit or another unit independent of the work
How it is done
Built into the normal workflow and kept up continuously
Held apart from daily work, periodically or as needed
There are two kinds: ongoing monitoring (日常的モニタリング), which the responsible unit keeps up as part of its workflow, and separate evaluations (独立的評価), carried out by people independent of the work such as internal audit. Any deficiencies found are reported to management and others and lead to a review of the controls.
AnalogyIt is like keeping a car safe in two ways: watching the gauges while you drive, and having a mechanic inspect it at the regular safety check.
How to rememberMonitor comes from Latin monere, "to warn": the one who keeps watch and raises the alarm.
Exam points
ExamMonitoring (モニタリング) is the process of continuously evaluating whether internal control (内部統制) keeps working properly.
Reputation risk (レピュテーションリスク) is the possibility that a company's reputation and credibility fall, hurting its business dealings and results.
Triggers include scandals, data leaks and poor handling of accidents, which can lead to lost customers, cancelled business deals and a falling share price. Even when the direct financial loss is small, lost trust usually takes a long time to win back. Preventing fraud and errors through internal control also helps protect a company's reputation.
AnalogyLike a sandcastle, it takes a long time to build and only a moment to collapse.
How to rememberReputation goes back to Latin reputare, "to think over": it is what others think of you, and the risk is that this opinion turns against you.
IT governance (ITガバナンス) is the organizational mechanism and capability through which management has a strategy drawn up for using IT to reach business goals and steers its execution in the right direction.
Evaluate
Direct
Monitor
Monitor: check whether results are being achieved and policies followed, and feed this into the next evaluation.
3 / 3
The aim is to tie IT investment and use to business strategy and raise the company's competitiveness and value. JIS Q 38500:2015 describes what management does with three activities: Evaluate current and future IT use, Direct by setting policies and plans and assigning responsibility, and Monitor results and compliance with policy. This Monitor names an activity of management and belongs to a different framework from monitoring (モニタリング), the basic component of internal control.
AnalogyIt is like a ship's captain who sets the destination and route, then checks the ship's position along the way and orders course corrections.
How to rememberGovernance comes from the Greek word for steering a ship, the same root as government.
Exam points
ExamResponsibility for establishing and promoting IT governance (ITガバナンス) lies with management (経営者).
ExamIT governance is one of the essential components that support corporate governance (コーポレートガバナンス), the framework that keeps a company's management in check.
ExamFor ethical behavior to take root in an organization, senior management must first lead by example. This is one of the responsibilities that management carries in IT governance.
IT management (ITマネジメント) is the hands-on planning and control of systems, from planning and development through operation and maintenance, in line with the policies and rules set by IT governance.
It is mainly handled by the heads and staff of the information systems department. They turn the policies set by management into concrete plans and procedures, carry them out and report on progress back to management.
AnalogyIt is like the engineers and crew who follow the captain's orders, actually run the engines and keep the ship's equipment in shape every day.
How to rememberManage goes back to Latin manus, "hand": the side that gets its hands on the actual work.
Exam points
Mix-upIT governance (ITガバナンス) sets the direction for using IT and oversees execution, while IT management (ITマネジメント) does the practical work of planning, building and running IT along that direction.
ExamThe System Management Standards (システム管理基準) are a code of practice published by Japan's Ministry of Economy, Trade and Industry, describing how to manage IT so that information system investments pay off and IT risks stay under control.
Sets the direction for IT use and oversees execution
Plans, builds and runs IT along the set direction
Main players
Management (the board and other senior leaders)
Heads and staff of the information systems department
Key points
Internal control is a system an organization builds and runs itself; final responsibility lies with management, and everyone in the organization takes part in running it.
Monitoring is the component of internal control that continuously evaluates whether controls keep working.
Reputation risk, the chance that a damaged reputation causes harm, can take a long time to recover from even when the direct loss is small.
IT governance is the responsibility of management, and JIS Q 38500:2015 frames management's activities as Evaluate, Direct and Monitor.