(1) Importance of control environment – An issuer’s control environment is the foundation upon which all other components of DC&P and ICFR are based and influences the tone of an organization. An effective control environment contributes to the reliability of all other controls, processes and procedures by creating an atmosphere where errors or fraud are either less likely to occur, or if they occur, more likely to be detected.
An effective control environment also supports the flow of information within the issuer, thus promoting compliance with an issuer’s disclosure policies. An effective control environment alone will not provide reasonable assurance that any of the risks identified will be addressed and managed. An ineffective control environment, however, can undermine an issuer’s controls, policies and procedures designed to address specific risks.
(2) Elements of a control environment – A key element of an issuer’s control environment is the attitude towards controls demonstrated by the board of directors, audit committee and senior management through their direction and actions in the organization. An appropriate tone at the top can help to develop a culture of integrity and accountability at all levels of an organization which support other components of DC&P and ICFR. The tone at the top should be reinforced on an ongoing basis by those accountable for the organization’s DC&P and ICFR.
In addition to an appropriate tone at the top, certifying officers should consider the following elements of an issuer’s control environment:
(a) organizational structure of the issuer – a structure which relies on established and documented lines of authority and responsibility may be appropriate for some issuers, whereas a structure which allows employees to communicate informally with each other at all levels may be more appropriate for some issuers;
(b) management’s philosophy and operating style – a philosophy and style that emphasises managing risks with appropriate diligence and demonstrates receptiveness to negative as well as positive information will foster a stronger control environment;
(c) integrity, ethics, and competence of personnel -controls, policies and procedures are more likely to be effective if they are carried out by ethical, competent and adequately supervised employees;
(d) external influences that affect the issuer’s operations and risk management practices – these could include global business practices, regulatory supervision, insurance coverage and legislative requirements; and
(e) human resources policies and procedures – an issuer’s hiring, training, supervision, compensation, termination and evaluation practices can affect the quality of the issuer’s workforce and its employees’ attitudes towards controls.
(3) Sources of information about the control environment – The following documentation might provide useful information about an issuer’s control environment:
(a) written codes of conduct or ethics policies;
(b) procedure manuals, operating instructions, job descriptions and training materials;
(c) evidence that employees have confirmed their knowledge and understanding of items (a) and (b);
(d) organizational charts that identify approval structures and the flow of information; and
(e) written correspondence provided by an issuer’s external auditor regarding the issuer’s control environment.