Fundamentals of Risk Management

411

---

Risk assurance
412
audit is validating the controls and procedures in place to manage risk, it is inappro-
priate for internal auditors to fulfil an executive function by assisting management 
with the identification, design and implementation of those risk control measures.
A sound system of internal control reduces, but cannot eliminate, the possibility of poor 
judgement in decision making, human error, control processes being deliberately 
circumvented by employees and others, management overriding controls, and the 
occurrence of unforeseeable circumstances.
A sound system of internal control therefore provides reasonable, but not absolute, 
assurance that a company will not be hindered in achieving its business objectives, or in
the orderly and legitimate conduct of its business, by circumstances that may reasonably be 
foreseen. A system of internal control cannot, however, provide protection with certainty 
against a company failing to meet its business objectives or all material errors, losses, fraud, 
or breaches of laws or regulations.
expectations of internal control
Internal financial controls are just one part of a charity’s overall control framework. The wider 
framework should cover all the charity’s systems and activities.
Executive management, staff and volunteers are responsible for ensuring that the 
controls put in place by the trustees are implemented. There should be a culture of control 
embedded in the operations of the organization; this culture is created by the trustees and 
senior management, who should lead by example in adhering to internal financial controls 
and good practice.
The trustees should, at least annually, ensure a review is conducted of the effectiveness of 
the internal financial controls. This should include an assessment of whether the controls are 
relevant to, and appropriate for, the charity and not too onerous or disproportionate.
A key feature of internal financial controls is to ensure that no single individual has
sole responsibility for any single transaction from authorization to completion and review.
It is important where the trustees administer the charity personally, more likely in smaller 
charities, that there is sufficient segregation of duties amongst them, so that no one trustee
is overburdened or exercises sole responsibility.
Internal financial control in a charity