Accountancy & Management: Internal control takes centre stage: In the debate on corporate governance, confusion reigns. Roger Trapp looks at efforts to unravel the issues

WITHIN the next month Sir Adrian Cadbury and his committee are expected to publish their response to the consultation initiated by their draft report in the summer on the financial aspects of corporate governance.

Whatever is contained in that final report, there is no doubt that the document - along with economic conditions sharply contrasting with those of the Eighties and the spectacular collapses of the Bank of Credit and Commerce International and the Maxwell empire - has heightened discussion and concern about the way British companies are run.

But for all this debate, there is still some ignorance of the issues and the terms used to describe them. And it is apparent confusion about 'internal control' and 'internal financial control' in even the Cadbury report that has prompted the Chartered Institute of Management Accountants to produce a guide.

Published tomorrow, A Framework for Internal Control is designed to provide a better - indeed, common - understanding of the two phrases. In short, 'internal control' includes 'internal financial control'. But an accurate definition of internal control is made especially important by the greater reliance on it likely as a result of the Cadbury recommendations, said Roger Gray, Cima's director of public affairs.

Nevertheless, eager as it is to contribute to the corporate governance debate, as a body whose members play an important part in the control of companies, Cima is obviously most keen to help management to achieve higher standards and directors to carry out their role properly. So in attempting to answer the question 'What is good internal control?' the body has come up with a highly practical document, Mr Gray said.

As a result, the organisation feels the most important part of the paper produced by the auditing group for its law and parliamentary committee is the check-list of ideal contents of a framework for internal control.

Reflecting the group's understanding of best practice, the 11-point list ranges from such basic elements as safeguards to reduce the risk of fraud through supervision and authorisation guidelines to accounting methods.

The check-list serves to emphasise the institute's belief that responsibility for internal control extends way beyond the finance department, to all managers.

And they can best produce adequate and credible independent control by ensuring that the head of internal audit reports to a board member or sufficiently senior manager while having direct access to an organisational chairman or chief executive and audit committee chairman.

The independence of the audit committee is best secured by its members being non-executive directors who have a working knowledge of the company.

In smaller companies, it is considered acceptable for the role of an internal audit department and committee to be filled by a suitable non-executive director, as set out in a recent Cima paper.

Continuing the paper's practical emphasis, there are also guidelines on risk assessment and suggested terms of reference for internal audits and committees. The report goes on to state that senior executives must demonstrate their commitment to this area and to ensuring their staff's integrity and competence. In short, as Philip Hewitt, Cima president, said: 'Effective internal control is management's responsibility.'

Such an approach will no doubt find a welcome among the institute's members, counterparts in the public practice firms who are often roundly criticised for

the quality of their external audits.

But as Pat Redrup, chairman of Cima's auditing group, pointed out, to concentrate on external audits is to miss a trick when weak operating controls can lead to great losses.

Meanwhile, there are problems associated with the suggestions that external auditors should comment on the quality of internal controls. In particular, external auditors' training will lead them to focus on the financial aspects while tending to rely on internal controls for the rest. This increases the importance of the internal controls.

And with the Auditing Practices Board about to consider the issue, it is clear that this is an area of financial management that is going to be on the agenda for some time, especially since it is a moving target.

As Mr Hewitt said: 'An internal control system is not static.' Each company's system must be reviewed regularly to ensure that the most effective set-up is in place at any one time.

(Photograph omitted)