Bookworm lamb
An accountant who likes history
From Yang Yang to talk about financial management column
"Internal control is a series of control activities implemented by the board of directors, the board of supervisors, managers and all employees. Internal control plays an important role in strengthening management standardization, enhancing anti-risk ability, promoting refined management, and effectively promoting the realization of corporate strategic goals. "
From 2004, some state-owned enterprises and the first batch of listed companies in the United States began to explore the construction of internal control system under the impetus of Sarbanes-Oxley Act, and in May 2008, the Ministry of Finance, the China Securities Regulatory Commission, the National Audit Office, the China Banking Regulatory Commission and the China Insurance Regulatory Commission jointly issued Basic Standards for Enterprise Internal Control (hereinafter referred to as Basic Standards) and Supporting Guidelines for Enterprise Internal Control (hereinafter referred to as Guidelines for Enterprise Internal Control). A large number of private enterprises, such as Huawei, Haier and Midea, have successfully achieved their strategic goals and become world-class enterprises by building and implementing perfect internal control systems.
In practice, some private entrepreneurs still have great misunderstandings about internal control and its role in enterprise management, or although they recognize the role of internal control, they are very confused about its actual implementation effect.
From the perspective of internal control practitioners, this paper aims at the misunderstanding and confusion of some private entrepreneurs in the implementation of internal control system, and discusses their own views from the aspects of the role of internal control in enterprise management, the methods of internal control construction, the problems that should be paid attention to in the process of internal control construction and implementation, so as to inspire entrepreneurs and internal control staff.
First, some private entrepreneurs misunderstand internal control.
In China's private enterprises, the boss is the biggest person in charge of internal control, and the boss's attention directly determines the development of internal control. The boss's idea directly affects the position of internal control in the enterprise. Some private entrepreneurs in China have the following misunderstandings about the internal control system:
1, internal control is the resistance of enterprise development, and the existence of internal control system will hinder enterprise innovation.
When I first started investing, I once chatted with an entrepreneur and pointed out that the defects of his company's internal control hindered the implementation of the strategy. I am still deeply impressed by what the entrepreneur said at that time. He said, don't mention internal control. Don't you see that many large state-owned enterprises and multinational companies are "controlled to death"? Finally, he concluded that internal control has become the resistance of enterprise innovation, because the existence of a series of internal control systems restricts enterprise innovation, and the existence of processes affects the speed and efficiency of enterprise decision-making.
2. Internal control is aimed at the supervisory level, and it has no effect in enterprise operation as long as the requirements of the supervisory level are considered.
In practice, it is often found that the internal control of some enterprises is perfect, but the actual implementation is completely different from the requirements in the internal control manual, and even the employees of the enterprise are completely unaware of the requirements in the internal control manual. The actual behavior of management is completely above the internal control system, which exists to meet the regulatory requirements. The construction of internal control in enterprises is superficial and formal, and the achievements of internal control construction are often shelved. Successive fraud scandals of listed companies all show the failure of internal control.
3, internal control is mainly to prevent subordinates, outsiders, rather than to prevent themselves.
Some entrepreneurs believe that internal control is to prevent subordinates or other employees from encroaching on the company's assets, or making behaviors that are unfavorable to the company. The construction of internal control should start with putting an end to employee fraud and embezzlement of company assets to the maximum extent; The boss's own behavior does not need to be guarded, because the company is his own and the assets are his own. The development of internal control work is only carried out from the areas of personal concern of the boss.
Entrepreneurs realized the importance of internal control, so they spent a lot of money on the construction of internal control, but the construction results could not play a role because they were not continuously updated.
Due to the rapid development of enterprises, situations beyond the provisions of the internal control manual continue to appear, and new situations have become "no man's land", and the existence of internal control has become the basis for all departments to shirk their responsibilities; Business departments constantly optimize their own process design through continuous practice, and the existence of some processes reduces operational efficiency; The external environment has changed, the original risk points and related controls no longer exist, and the internal control manual is still being implemented according to the original requirements. The aversion to internal control is becoming more and more serious.
Second, the role of internal control system in enterprise development
In complex business activities, enterprises are faced with many risk factors, which are caused by both macro-environmental changes and their own management activities. A reasonable internal control system can effectively avoid the internal risks brought by the business activities of enterprises, and can also enhance the ability of enterprises to resist the risks brought about by macro-environmental changes by constantly adjusting the risk response measures.
1. A reasonable internal control system helps to form a systematic supervision system and effectively prevent and resist internal and external risks.
From a macro perspective, by continuously collecting information related to risk changes, the company can continuously identify risks and adjust risk response measures in time to ensure that the company can find and take measures to deal with risks in time. The policies put forward by the state to improve air quality and control environmental pollution may lead to an increase in the prices of some raw materials in processing and manufacturing enterprises. A reasonable internal control system can help entrepreneurs find problems early and take a series of measures with suppliers to reduce the risk of raw material price changes. Enterprises engaged in the production of environmental protection products can seize the opportunity and realize their own development ahead of schedule.
From the company level, by consciously introducing competition mechanism, a learning organization is established to encourage employees to learn excellent external management experience and combine with the company's reality to form the company's unique management characteristics; Improve the collective decision-making ability of the board of directors, strengthen the control of the decision-making process of enterprises, and avoid the company's strategic objectives deviating from the main business or not suitable for the specific situation of the company; According to the company's different development stages and business expansion, adjust the company's organizational structure in time and establish an organizational system suitable for the company's development needs; Establish independent audit institutions, establish fraud prevention and control mechanisms, and form a systematic regulatory atmosphere.
From the business level, prevent fraud or mistakes by setting incompatible separation of work controls. If the contract review link is set in the contract management process, and the contract review standards and responsibilities are clearly defined, the risk of payment recovery may be significantly reduced; In the process of license management, it will greatly reduce the fraud risk caused by improper use of seals and licenses by setting up the approval process of seals and licenses and clarifying the registration system of seals and licenses.
2. It is convenient to integrate resources and promote continuous innovation, thus ensuring the realization of the strategic objectives of the enterprise.
In practice, each department is independently responsible for the business under its jurisdiction, and more consideration is given to its own situation, so it is difficult to grasp the whole picture of enterprise operation. Barriers between departments will lead to untimely, incomplete, inaccurate and incorrect internal information transmission, which will seriously restrict the accuracy of decision-making. Through cross-departmental physical examination, internal control evaluation can find out the reasons why enterprise systems and processes cannot be implemented or become a mere formality, identify disjointed and repetitive links between business processes, promote enterprise business process optimization, integrate enterprise information resources and improve enterprise operation efficiency. Enterprises engaged in non-standard equipment manufacturing may greatly improve production efficiency by taking into account the procurement cycle of some products when making plans and appropriately adjusting the production tasks in the procurement waiting period. For FMCG industry, the turnover efficiency of goods will be significantly improved if the sales end summarizes the product and regional characteristics in time and feeds them back to the purchasing end.
Internal control evaluation is a dynamic mechanism of continuous improvement. By continuously collecting the information of internal and external environmental changes, combining with the industry situation, the company's operation and the company's strategic planning, this paper analyzes the possible problems in the process of strategic implementation, evaluates the company's growth potential, finds out the innovation points and risk points, and takes countermeasures in time to promote the continuous change of the organization.
Third, the internal control system construction steps
In view of the role of internal control system in enterprise management, it is very necessary to establish a perfect internal control system. So how to build a set of internal control system that meets the needs of enterprise development and can ensure the implementation in place?
1, communicate with the top management of the enterprise, analyze the problems and seize the risk points.
The implementer of the internal control system construction must fully communicate with managers and employees at all levels of the company on the external environment, internal processes and information needed for decision-making. In order to understand the possible impact on the company's performance due to factors such as strategy, operation, relationship between customers and suppliers, organizational structure and financing choice, as well as the impact on the business model due to improper business operation management, cash flow and financial risks, improper or insufficient authorization, information technology asymmetry and other factors, it is used to support enterprises to implement business models, conduct internal and external performance reports and evaluate enterprises.
Through field investigation and interview, summarize, analyze and judge the results, and evaluate the main risks that the company may face. Communicate with the management of the company about the potential risks that have been identified, and find out whether the management has taken countermeasures and the cost that it is willing to pay for the risks. In practice, the implementer of the internal control system should measure the difference between the benefits and costs brought by the risk response measures, so as to minimize the cost burden brought by excessive control.
2. Organize and establish the organizational structure of the company.
After fully understanding the company and reaching a consensus with the management on the risk response measures, the implementer of internal control should comprehensively sort out the existing governance structure and internal organizational setup according to the design specifications of organizational structure to ensure that the corporate governance structure, internal organizational setup and operating mechanism meet the requirements of modern enterprise system and corporate strategic planning. When sorting out the corporate governance structure, we should pay attention to the qualifications and performance of senior managers such as directors, supervisors and managers, as well as the operation effect of the "three meetings" and managers; When combing the internal institutions, we should pay attention to the rationality and operational efficiency of the internal institutions to avoid overlapping and lack of functions; Those who own subsidiaries should also pay attention to investment control measures, development strategy, financial budget and final accounts, major investments, financing and guarantees, use of large amounts of funds, asset disposal, appointment and removal of important personnel, and construction of internal control system.
In order to avoid the inefficiency of internal organization, the implementer of internal control should combine the business objectives of the organization and the business model of the company, sort out the overall business process of the company, analyze the existing and exploitable resources of the enterprise, determine the functions of the organization, set up corresponding departments, and design different organizational models according to the management objectives and product characteristics. For example, the business processes of manufacturing companies that provide standard products are supply, production and sales, while those of companies that provide customized products may be sales, supply and production; In terms of department setting, companies that provide customized products should consider pre-sales technical support, while companies that provide standardized products have a relatively weak role in pre-sales technical support. For companies with relatively standard products and slow technological changes, functional models can be selected; For enterprises with outstanding product customization characteristics, multi-product lines and cross-regional or transnational operations, matrix mode can be selected.
Clear departmental responsibilities and performance appraisal indicators are the minimum requirements to prevent inefficiency. When sorting out the internal organization, the implementer of internal control should formulate clear, specific and measurable performance indicators, which should include financial performance standards and strategic performance standards. For the purchasing department, unqualified yield, timely arrival rate, order accuracy, relationship with suppliers and satisfaction rate of other departments in the process can all be used as departmental assessment indicators.
3. Sort out the details of specific business processes and do a good job in risk point analysis and monitoring measures.
In order to solve the problems such as how to connect different positions between departments and within departments, and how to avoid the potential risks that may exist in the overall process operation, it is necessary to have clear business processes, clear job responsibilities and corresponding control systems based on the potential risks of specific businesses. Take the enterprise engaged in customized product production as an example to accept orders and sign contracts. During the acceptance, it is necessary to consider whether the company's design ability can meet the special requirements of customers and whether the company's production system can be delivered on time; On the basis of confirming that the customer's order can be accepted, negotiate with the customer on specific matters such as product performance, quality requirements, sales price, sales quantity, credit policy, delivery method, delivery date, delivery place, payment method and liability for breach of contract. The contract approver should review the above specific matters, and only the approved and authorized personnel can sign contracts with customers. At this stage, the risk points and precautions that need to be monitored are: whether the design ability can meet the requirements of customers, and if it cannot be met internally, whether there are enough external resources to supplement it; What is the current production capacity? If the production capacity is saturated, can it be entrusted to other companies? Whether the product involves special parts, how long the procurement cycle of special parts is, and whether there are substitutes; What is the product price reported to the customer? Is it a new customer or an old customer; What is the customer's credit status; What's the payment method of the customer? Whether the liability for breach of contract is clear, etc. The departments involved in this process include product design department, production planning department, purchasing department, finance department, credit department, legal department and other related positions. The implementer of internal control shall specify the specific control requirements of the above-mentioned business, and specify the precautions and judgment standards of each risk point.
4, formulate job responsibilities, clear job requirements and assessment criteria.
In each functional module (such as purchasing function), according to the specific business control requirements of basic business and extended business projects, set detailed job responsibilities, and clarify the professional ability and experience requirements of relevant post personnel; Make the assessment indicators as quantitative as possible.
5. Check the organizational structure, form systems and tables, compile internal control manuals and issue them for implementation.
Use the business flow chart to check the organizational structure chart and post setting chart formed by the above work, and find the blind spot of post setting. For example, analyze whether the business process route is controlled within the line segment of 2-3 people; Whether a business process route can realize a function; Whether there are job control defects not covered by the business process; Whether extended functions are involved in business process operations; Whether it is convenient to obtain, allocate and support resources. According to the inspection results, adjust the organizational structure and job responsibilities appropriately.
Reorganize the responsibilities of tested functional departments and posts, form a standard document defining specific job responsibilities, job objectives and job requirements, define their rights, information transmission paths and resource circulation paths, and prepare job descriptions; Form a system and form a summary. Prepare the internal control manual and issue it in the name of the board of directors.
Four. Problems needing attention in the construction and implementation of internal control system
The completion of the internal control manual is not the end. To make the internal control system work perfectly, enterprises should pay attention to the following issues.
1, the person in charge of internal control should have a strong comprehensive quality.
Internal control is to control the overall risk of the company, and the personnel responsible for internal control should participate in the company's operation more systematically and comprehensively than those in other professional departments; We should not only have professional knowledge, but also have strong comprehensive ability, be able to find problems and find solutions to them, and also have strong communication skills.
2, in the process of internal control construction should fully listen to the opinions of employees at all levels.
The construction of internal control system is a systematic work involving all employees, which requires repeated communication from top to bottom to ensure that all employees can understand and participate in the work, fully solicit or listen to their opinions, ensure that they can obtain information that management can't see, and fully listen to their opinions when formulating measures.