Response to Internal Control

Mike Corby wrote an interesting summary regarding internal control in one of his posts. Even though I do not think that his article was incorrect by any means, I found it very interesting. I thought that I would extend his post and also relate it to my previous post, where I discussed credit rating agencies and their failure to properly rate the companies that partook in risky trading.

Internal control, as mentioned by Mike, is a well executed check and balance system throughout a company that uses audits to oversee operations. These internal audits ensure compliance of regulations by creating ways to lessen risks and loss of assets. Mike is spot on with this definition of internal control, but he failed to mention both aspects of internal control. According to Wikipedia there are two aspects to internal control. The first is from an accounting perspective, which is what Mike was referring to, and secondly is from an organizational perspective. The organizational perspective involves detecting and protecting the company from fraud and also safeguards the company's resources, both physical and non-physical.

When it comes to three credit ratings; Finch, Moody's and S&P failed to have some internal control system in place. They disregarded a check and balance system to make sure that they have the correct rating system and that old ratings were not used over and over even if they were not updated and correct. This was clearly shown by these agencies as they gave high ratings even to companies that partook in risky mortgage-backed securities. If a proper internal control system was in place, this disaster may have been averted and these credit agencies might still have a good reputation.

The SEC now requires corporations to include an internal control report during their annual report. The Sarbanes-Oxley Act, requires companies to have a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting and also management's report of the effectiveness of the company's internal control system. Lastly, this act also requiers an auditor to substantiate the management's report mentioned above.

The SEC seems to be taking the right steps in regulating companies, but another section of this act states that all companies need to report these internal control statements except for registered investment companies. I feel this is a thoughtless move on the part of the SEC. Why would they regulate everyone else, but not investment companies? I feel that the SEC should regulate everyone and not favor a select few and tragedies like the Madoff corporation will not happen again. So should the SEC not favor the the three big credit rating agencies and allow more competition to enter the market and also strictly regulate them, thus also resulting another check and balance system.

http://www.nysscpa.org/cpajournal/2007/1007/essentials/p34.htm