This internal control policy template has 4 pages and is a MS Word file type listed under our business plan kit documents.
Sample of our internal control policy template:
INTERNAL CONTROL POLICY POLICY STATEMENT It is the policy of [NAME OF COMPANY] ("Company") that we will maintain a system of internal controls that include both administrative controls and accounting controls. The objective of the Company's internal control system is to provide management with reasonable, but not absolute, assurance that resources are being used and accounted for appropriately. RESPONSIBILITY The responsible areas are Risk Management and Internal Controls, Internal Audit and Company coordinators whose business processes are part of the scope of the periodic assessment of internal controls. ROLES AND RESPONSIBILITIES Audit and Risk Management Committee: (a) reviews and evaluates the adequacy of the internal control assessment plan, including the scopes for process, methodology, strategy and its comprehensiveness; (b) recognizes the control deficiencies identified within the Company's internal control environment; (c) monitors the implementation of the action plans when applicable; and (d) informs the Board of Directors on significant deficiencies and actions taken towards them. Senior Management: (a) periodically monitors the evolution of the internal control assessment according to the reports issued by the Risk Management and Internal Control, Internal Audit and Independent Audit coordination teams; (b) ensures the implementation of actions defined by the coordinators subordinated to them in relation to the implementation/adequacy of internal controls; and (c) sponsors improvements to the internal control environment, always seeking a balance between the effectiveness of the processes, controls and costs, as well as alignment with the Company's strategic objectives. Risk and Internal Control Coordination: (a) assists the business areas in the identification/implementation/adequacy of internal controls, and documentation of internal controls; (b) identifies the need to implement new controls and/or the need for improvement in existing controls when the absence and/or insufficiency of these result in significant deficiencies; (c) manages the self-assessment steps of the internal controls; (d) reviews/evaluates the action plans indicated by the business areas in relation to meeting the objectives of internal controls, mitigation of risks and implementation deadlines; e) monitors the independent assessments of internal controls performed by the Internal Audit and Independent Auditors; f) is subordinate to the Financial Division. Coordinators and Teams responsible for internal controls: (a) self-assess the processes under their responsibility during a period pre-determined by the Risk and Internal Control Coordination; (b) ensure the execution of existing internal controls according to architecture and frequency, implement new internal controls and improvements to existing internal controls; and (c) report any changes in the internal control structures through changes in business (processes, people, systems) in a timely manner. Internal Audit: (a) independently evaluates the efficiency and effectiveness of internal controls; (b) recommends the implementation of new internal controls and/or improvements in existing internal controls, when the absence and/or insufficiency of these result in significant deficiencies; (c) reports deficiencies in internal controls to Senior Management and the Audit and Risk Management Committee; (d) follows the recommendations of the independent auditors; and (e) monitors the implementation of action plans for identified internal control deficiencies. Strategic Risk Management, Risk and Internal Control Coordination, and Internal Audit: a) interact with the business areas for the annual planning efforts in order to guarantee accuracy, efficiency and effectiveness of the activities; and b) share the assessment results carried out by each business area, consolidating the works to be reported to Management, the Audit Committee and Risk Management. INTERNAL CONTROL DOCUMENTATION The documentation of processes, risks and internal controls is carried out through the internal controls matrix, which is structured to guarantee the necessary information that supports the assessments of processes, systems and controls. The internal control matrix contains the following structure: process, sub-process, risk factor, control activity, frequency, responsibility, type of control (preventive/detective), nature of control (manual, automatic, manual IT dependent), relevance (key control) and the outcome of the evaluated effectiveness.
