A strong control environment can reduce all the financial reporting risks to zero.

journal article

The Accounting Review

Vol. 82, No. 2 (Mar., 2007)

, pp. 427-455 (29 pages)

Published By: American Accounting Association

https://www.jstor.org/stable/30243472

Abstract

We provide a theoretical investigation of the effects of the Sarbanes-Oxley Act of 2002 on auditing intensity and internal control strength. We propose a model of strategic auditing in which the auditor can use resources for both internal control tests and substantive tests, while the manager can choose the strength of internal controls and the amount of fraud. We find that control tests are a valuable tool for the auditor when control strength is informative about the likelihood of fraud. We find that Sarbanes-Oxley has the desired effect of inducing stronger internal control systems and less fraud, but does not necessarily induce higher levels of control testing. Our model suggests that audit risk increases as a result of the Sarbanes-Oxley Act.

Journal Information

The Accounting Review is the premier journal for publishing articles reporting the results of accounting research and explaining and illustrating related research methodology. The scope of acceptable articles embraces any research methodology and any accounting-related subject. The primary criterion for publication in The Accounting Review is the significance of the contribution an article makes to the literature.

Publisher Information

The American Accounting Association is the world's largest association of accounting and business educators, researchers, and interested practitioners. A worldwide organization, the AAA promotes education, research, service, and interaction between education and practice. Formed in 1916 as the American Association of University Instructors in Accounting, the association began publishing the first of its ten journals, The Accounting Review, in 1925. Ten years later, in 1935, the association changed its name to become the American Accounting Association. The AAA now extends far beyond accounting, with 14 Sections addressing such issues as Information Systems, Artificial Intelligence/Expert Systems, Public Interest, Auditing, taxation (the American Taxation Association is a Section of the AAA), International Accounting, and Teaching and Curriculum. About 30% of AAA members live and work outside the United States.

Rights & Usage

This item is part of a JSTOR Collection.
For terms and use, please refer to our Terms and Conditions
The Accounting Review © 2007 American Accounting Association
Request Permissions

Objectives

The objective of internal control over financial reporting at Neste is to provide a reasonable assurance with regard to the financial reporting and the preparation of financial statements in accordance with the applicable laws and regulations and the internal requirements. 

The system of internal controls at Neste Corporation is based on the framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

Management sets its level of risk appetite by defining the Group-level control objectives. Control Objectives set the Group’s minimum control requirements for the control activities in financial and business processes in order to mitigate the underlying key risks and establish the desired level of assurance for correct financial reporting, adherence with the regulations and policies, and prevention of fraud. Group-level control objectives are endorsed by the Executive Committee and Audit Committee and reflect the top management guidelines, auditor reports, policies and regulations Neste complies with, as well as Neste Internal Control Principle and control requirements defined in Controls over Financial Reporting standard (COFR).

Control environment

Under the Finnish Companies Act, the Board of Directors is responsible for ensuring that there is adequate control over the Company’s accounts and finances. Responsibility for arranging this control is delegated to the President and CEO, who is required to ensure that the Company’s accounts are in compliance with the law and that its financial management has been arranged in a reliable manner.

The internal control at Neste is based on the corporate structure whereby the operations are organized into organizational units. The heads of business units and finance function are responsible for establishing and maintaining appropriate, up-to-date, effective and adequate controls over financial reporting. Operational management owns the risks and controls and is responsible that controls and deficiency related corrective actions are implemented.

In order to provide additional assurance, Neste has established an Internal Control function, which is responsible for coordinating the Group-wide internal control development and monitoring. The Head of Internal Control reports on its activities on a regular basis to the Executive Committee and to the Board of Directors’ Audit Committee which monitors the effectiveness of the Company’s Internal Control. Internal Control follows up and verifies that actions are taken by the respective operational management. 

Neste has prepared and established its own Internal Control Principle in accordance with the COSO framework. Internal Control Principle emphasizes the importance of internal controls and clarify the responsibilities of the Three Lines for establishing effective controls in business processes. Neste’s values and management system containing the formal Code of Conduct are the foundation of the control environment. The President and CEO and corporate management are responsible for emphasizing the importance of ethical principles and correct financial reporting.

Risk assessment

As a prerequisite for risk assessment, the organization’s objectives need to be established. With respect to financial reporting, the general objective is to have reliable reporting and ensure that transactions are recorded and reported completely and correctly. The assessment of risk includes risks related to fraud.

Additional information on risk management principles is available in the Risk Management section of the Annual Report.

Control activities

Neste control activities include instructions, guidelines and procedures to ensure that the actions identified by management to address the relevant risks are carried out effectively. The most important guidelines related to financial reporting systems and practices are documented in Neste Internal Control Principle, Access Risk Management Principles, the Controls over Financial Reporting standard (COFR), Process charts, month end workflows and detailed Finance Instructions.

Key control activities are documented in a global control catalog covering each business or financial process. Group-level policies and guidelines are documented in the Neste Management System.

Communications

Neste corporate-level communication practices support the completeness and correctness of financial reporting. Neste personnel have access to adequate information and communication regarding accounting and reporting principles and guidelines. The main means of communicating the relevant matters for appropriate financial reporting consist of internal control training, detailed Finance Instructions containing accounting principles and guidelines for forecasting and reporting, info sessions, on-the-job training, process walk-throughs, and postings on internal channels and pages.

Neste business units prepare regular financial and management reports for the management review, including analysis and comments of financial performance. The Executive Committee and the Board of Directors receive financial reports monthly. Interim Reports are reviewed in Audit Committee meetings, and thereafter by the Board of Directors.

Monitoring

Management regularly monitors the effectiveness of the controls, as a control that was initially effective can become ineffective due to changes in the operating environment. Changes can also take place in the controls due to changed processes, IT systems or personnel.

The Board of Directors and the Audit Committee regularly review the financial performance including reviewing whether there is an adequate level of process to evaluate the risks and effectiveness of controls related to the financial reporting process at all levels of the organization. The Audit Committee oversees the Company’s finances, financial reporting, risk management, as well as the Internal Control and Internal Audit functions, as part of the Company’s corporate governance. Internal control deficiencies are communicated in a timely manner to those parties responsible for taking corrective action, and to management and the Board’s Audit Committee as appropriate. 

Corporate Internal Audit assesses annually the operational model and practices of internal control over Neste’s financial reporting as part of business- and process-level audits.

The Internal Control function also conducts separate tests to assess the adequacy of internal controls in business processes, recommends corrections and reports the gaps to the respective management teams.

What is a strong control environment?

Why is a strong control environment important?

What is control environment in risk management?

How could a strong internal control system make a good financial reporting of a company?