Justification for an Internal Control System

The changing of the regulatory climate prompts a reevaluation of how risk is managed. Due to the higher standards, controllers are now positioned with providing leadership a better understanding of the control environment as well as the impact on internal and external financial reporting. Insurance and portfolio theory are approaches that are currently in place, and while valid, an internal control system would be more beneficial to analyze and manage risks that the organization may encounter.

Insurance Approach

The transference of risk in the form of insurance is a risk management approach that has been used for thousands of years. This approach is a basic form of risk management that transfers risk to a third party. It primarily addresses common potential business related risks such as general liability, professional liability (errors and omissions), property, worker’s compensation, directors and officers, life, and auto. Utilizing insurance as a method of risk management acknowledges that business itself is risky, but the liability of certain risks can be minimized. This method is valid and necessary in all businesses, but it does not encompass all facets of an organization’s potential risk.

Portfolio Theory Approach

Introduced in the early 1950s by economist Harry P. Markowitz, the portfolio theory became a new approach to apply to risk management, which looks at risks as part of a set instead of individually. An organization’s risks can be optimized when risks are either uncorrelated or negatively correlated thereby lessening the volatility of the risks. Analysis of risks as part of a set allows a company to make adjustments to the risk portfolio. Management will balance high risks with low risks; they will decide in which areas they can be more risky and in which areas they must take less or no risk (McCarthy, Flynn, & Brownstein, 2004). Again, this method is valid and necessary in all businesses, but there are still potential risks that are not being managed.

Internal Control System

Over time, as business risks have grown more complex, it has become good business to be more proactive rather than just reactive to risk. An internal control system is a process by which organizations create and maintain environments that cannot be corrupted and deter fraudulent activities by management and employees. An effective