The architect is missing

RECENT HIGH-PROFILE BUSINESS FAILURES AND INCIDENTS OF financial statement fraud have led me to wonder about the adequacy of the internal control standards for U.S. organizations. Although reports from the Treadway Commission, as well as certain statutory provisions, help provide the basis for a control

system that assures proper financial reporting, an important element seems to be absent. There is an implied assumption in the reports and professional literature that someone, somehow has actually designed an appropriate system. Yet, nowhere is there explicit, straightforward identification of who is - or should be - responsible for this task. In other words, the architect of the system of internal controls is missing.

Internal Control-Integrated Framework, the landmark report from the Committee of Sponsoring Organizations of the Treadway Commission, includes the statement that "internal control is broadly defined as a process, effected by an entity's board of directors, management and other personnel." In addition, the document's executive summary states: "Senior managers, in turn, assign responsibility for establishment of more specific internal control policies and procedures to personnel responsible for units." Although the responsibility for internal controls seems clear from the report, there is no reference to the specific qualifications of those who create the control system. The implication, then, is that the control "policies and procedures" require no unique expertise.