A Regulatory Perspective

Abstract

Purpose: The purpose of this chapter is to provide a regulatory perspective on internal control. We will therefore describe and discuss some of the internal control regulations which are imposed on firms.

Synopsis: The regulatory environment has a significant influence on the internal control practices of firms. A fundamental feature of most corporate governance regulations are their focus on transparency and disclosure. The use and usefulness of management reporting on internal control and auditor reporting on internal control have been widely debated. The Cadbury code in the United Kingdom has been a pioneer in corporate governance regulation. This code is semi-mandatory with a comply-or-explain character and has become a blueprint for other corporate codes and exported to many countries. The Cadbury code covers both financial and non-financial controls. One main controversy with the Cadbury code concerned paragraph 4.5 which prescribed that directors should report on the organization’s internal control system. Later, in 1999, the Financial Reporting Council released guidance on internal control, guidance which was subsequently revised in 2005. This document is to help directors with reference to the provisions in section C.2 of the Combined Code, which relates to internal control. Following high-profile management fraud in the United States, the Sarbanes-Oxley Act of 2002 was implemented. Section 404 of this Act prescribes that managers must assess an organization’s internal control over financial reporting, and that the external auditor must assess and report on both management’s assessment and the effectiveness of internal controls. This unique piece of regulation has been somewhat controversial due to its relatively strict requirements and widely discussed during the last few years. In 2004 Sweden implemented its own corporate governance code. Originally, the code included strict internal control reporting requirements, but these provisions were subsequently downsized. In 2008, a revised code was released and further updates, based on the implementation of European Union directives, are expected. These changes will make mandatory the disclosure of a corporate governance report and also the existence of an audit committee for concerned listed companies. These regulations can be viewed from an agency theory perspective which explains how the interests of principals and agents need to be better aligned. Institutional theory however, helps understand the quick and severe responses to public and visible corporate crises.