INTERNAL CONTROL

INTERNAL CONTROL

1. It is the set of actions, activities, plans, policies, standards, records, procedures and methods, including the environment and attitudes developed by authorities and their personnel in charge, with the objective of preventing possible risks affecting a public entity. It is based on a structure based on five functional components: Control environment Risk assessment Management control activities Information and communication Supervision.

   • Offers reasonable security of:
     • Reduce corruption risks Achieve established objectives and goals Promote organizational development Achieve greater efficiency, effectiveness and transparency in operations Ensure compliance with the regulatory framework Protecting the resources and assets of the State, and the proper use of them To have reliable and timely information Encourage the practice of values Promote accountability of officials for the mission and objectives entrusted and the use of assigned assets and resources.
     • WHY IS INTERNAL CONTROL IMPORTANT IN A COMPANY?
       • Its primary objective is to safeguard the resources of the company or business, avoiding losses due to fraud or negligence, as well as to detect any deviations that may occur in the company and that may affect the fulfillment of the organization's objectives.
   • Internal controls comprise five key components, which are listed below:
     • Control environment. Entity's risk assessment process. Information systems. Control activities. Follow-up (or monitoring) of controls.
       • COMPONENTS
         • Control environment This component is the basis for the rest of the control components; a weak control environment means that no matter how well designed the rest of the components are, they cannot be fully relied upon. The control environment sets the level of discipline and structure in the company.
         • Entity risk assessment process The risk assessment process component of the entity's risk assessment process consists of the auditor evaluating the adequacy of the entity's internal process for identifying the company's business risks (relevant to financial reporting), estimates of the significance of those risks, assessment of the probability of occurrence, and decision making with respect to those risks.
         • Information Systems An information system is made up of the infrastructure, software, people, procedures and data that a business or company has to manage it, achieve its objectives and identify and respond to risk factors.
         • Control activities Control activities are the policies and procedures that help ensure that management's directives are carried out. These controls relate to risks that, if not mitigated, would jeopardize the achievement of the company's objectives.
           • Control activities can be classified into the following four types: Preventive. Controls to avoid errors or irregularities. Detection. Controls to identify errors or irregularities after they have occurred in order to take corrective action. Compensation. Controls to provide some degree of security when it is unaffordable to apply other more direct controls. Examples: second signatures, third party oversight, internal selective oversight, etc. Directional. Controls to guide personnel towards desired objectives, e.g. policies and procedures.
         • Follow-up (or monitoring) of controls Follow-up or monitoring evaluates the effectiveness of internal control implementation over time and its objective is to ensure that the controls are working properly or, if not, to take the necessary corrective actions. Monitoring allows the company's management to know if the internal controls are effective, properly implemented, used and complied with on a daily basis, or if they need modification or improvement.

2. The objectives of internal controls can be grouped into four categories:

   • Strategic. Financial information. Operations. Compliance with legal provisions and regulations.