business’s control environment is represented by the size of the umbrella. Risk assess-
ment, control procedures, and monitoring are the fabric that keeps the umbrella from
leaking. Information and communication link the umbrella to management. In the fol-
lowing paragraphs, we discuss each of these elements.Control Environment
A business’s control environment is the overall attitude of management and employees
about the importance of controls. One of the factors that influences the control envi-
ronment is management’s philosophy and operating style. A management that overem-
phasizes operating goals and deviates from control policies may indirectly encourage
employees to ignore controls. For example, the pressure to achieve revenue targets
may encourage employees to fraudulently record sham sales. On the other hand, a
management that emphasizes the importance of controls and encourages adherence to
control policies will create an effective control environment.310 Chapter 7 Sarbanes-Oxley, Internal Control, and Cash
Control Environment
Management’s
Philosophy
and Operating StyleOrganizational
StructurePersonnel PoliciesCEOemployeesThe business’s organizational structure, which is the framework for planning and
controlling operations, also influences the control environment. For example, a de-
partment store chain might organize each of its stores as separate business units. Each
store manager has full authority over pricing and other operating activities. In such a
structure, each store manager has the responsibility for establishing an effective con-
trol environment.
Personnel policiesalso affect the control environment. Personnel policies involve the
hiring, training, evaluation, compensation, and promotion of employees. In addition,
job descriptions, employee codes of ethics, and conflict-of-interest policies are part of
the personnel policies. Such policies can enhance the internal control environment if
they provide reasonable assurance that only competent, honest employees are hired
and retained.
To illustrate the importance of the control environment, consider the case where
the head of a bank’s loan department perpetrated a fraud by accepting kickbacks from
customers with poor credit ratings. As a result, the bank lost thousands of dollars from
bad loans. After discovering the fraud, the bank president improved the bank’s control
environment by implementing a program that allowed employees to report suspicious
conduct anonymously. In addition to encouraging employees to report suspicious con-
duct, the employees were warned that employee fraud might occur anywhere and in-
volve anyone.