外文翻译--企业内部控制的决定因素和后果

附件1：外文资料翻译译文

企业内部控制的决定因素和后果：

一个权变理论为基础的分析

1 简介

人们普遍认为，内部控制制度能帮助企业降低风险、保证财务报表的可靠性和加强对法律法规的遵守。因此，一些企业的倒闭现象和一些欺诈行为的广泛宣传逐渐增加，针对企业特定的经营环境，从而使企业对内部控制制度更加重视。有效地管理对加强企业内部控制的有效性，并有效地传达给董事会和股东具有更大的压力。例如审计人员、供应商、顾客跟内部控制也有关系，因为它们可能影响长期财务报告的可信度、管理人员的责任和企业的组织形式。

尽管内部控制是影响公司的一个重要因素，证据表明，内部控制结构的实际表现在组织结构中是不存在的。正如金尼所提到的那样，该议题还未被研究人员所开发。关于内部控制的专业文献对于发展国际管制框架已经取得了一定的进展，但迄今为止，内部控制研究的数量是有限的。Selto和Windener出版的研究和分析的专业文章，发现在管理控制的研究中，关于内部控制专题的文学比实际文学少。人们越来越重视内部控制业务发挥的作用，缺乏现有的研究，所以建立新的研究需要和机会是当务之急。

这项研究有助于了解内部控制结构及其在公司环境中的成效。即使内部控制框架提出了内部控制的一个标准化的结构和目标，他们认为根据公司的特点来判断内部控制的不同需要。然而无论是框架还是先前的文学都不能提供一个适合于企业特点及其控制系统关系的图片。因此，本研究利用一个应急的方法来审查内部控制结构的设计及其在不同环境下观察到的成效。研究报告分析了结构方程关系模型和芬兰提出的741公司的实证结果。这项研究结果使内部控制几个重要方面的研究知识增加了局限性。首先，研究提出利用实证研究结果对内部控制及其在实践中的有效性进行研究。世界各地有一些组织把内部控制框架作为基金会开展活动。无论如何，还有一些关于实践框架以外的证据，从而对模式有一个更深

入的研究的重视。除了少数以外，早期研究通常集中于特定的控制因素，如控制环境、通讯或风险评估。在这项研究中，内部控制的概念作为一个整体在不同情况下进行研究。第二，内部控制理论的应急措施尚未充分研究，甚至在文学之前，即使这种关系能够更好的了解内部控制在组织中的关键作用。第三，从知识管理的角度来看对内部控制认识的不足。迄今文献集中于外部各方，他们认为尽管该组织涉及的是内部控制，实际上是管理的责任。因此，本研究重点强调对管理层的看法和所接受调查的企业。第四，本研究探讨的重要特征是应把一个组织的内部控制为考虑重点。这样做的目的是以确定哪些因素有助于解释内部的变化能影响控制系统及其观察效果。但是，该模型的研究是在产量不同的情况下的研究结果，研究了二元和多元的设置。因此，本文采用了适用于内部控制研究的应急方法和扫描电镜技术，通过内部控制结构和替代情况下观察到的效果来了解其共同点和分歧，这是对内部控制探讨的一个重大贡献。因此，这项研究提供了一个方法来识别不同组织的特殊需要。

2 研究框架

控制系统的设计能够协助管理人员以实现其公司的目标和期望的结果。内部控制系统可能增强了企业的检测和报告程序以及对法律和法规的遵守。通过内部控制这种有效的方式能够使其在企业中发挥关键的作用。但是，正如我们所看到的，从实际调查结果来看，内部控制不存在于真空。COSO框架指出两个组织应该不会有类似的内部控制系统，除非该组织是相同的。组织环境对于内部控制系统可能会有所不同，在内部控制框架提出的这项声明是类似的应变理论，该理论声称每个组织都有选择考虑采取最适当的应变特性控制系统，还提供了各种关于内部控制制度在实践中的解释。然而，权变理论构成了一种新的方法来研究内部控制，理论基础和特点的选择从应急性控制文献获取。因此，管理控制是一个重要的控制因素，一直是权变理论研究的组织体系。在文献回顾以及对这些研究的基础上进行研究分析，其目的是了解内部控制结构的特点和影响其观察的成效。 3 内部控制框架

根据内部控制广泛的内容，它涵盖了一个组织的各个方面，有一个明确的要

求就是要有一个共同的控制的概念。著名的框架包括一个有效地内部控制的定义和目前内部控制结构的组成部分。例如COSO规定，内部控制可以被判定为有效时，董事和管理委员会将会明白在何种程度上能够实现实体业务的目标，公布的财务报表的准确可靠，使用的合理保证以及对法律法规的遵守。因此，在这中间的内部控制研究效益的定义以及如何实现内部控制管理观念上的目标可以得到解释。同样，不同的条款对一个适当的内部控制框架结构的描述有以下五个部分组成，分别为：

1 控制环境部分界定了一个组织和它的运作方式。这个部分是指一种使人们能够进行活动和履行控制职责的气氛。它在公司中创建了一种整体的控制文化。

2 风险评估部分，是指在风险处理的过程中威胁到该公司目标的实现，它涉及到识别、分析和评估相关的风险。

3 控制活动部分，是指通过政策、程序和做法以确保管理的目标得以实现并有效地实施缓解风险的战略。

4 信息和通信部分，该部分确保相关信息被识别和获取，使工作人员通过有效地沟通来履行其职责和责任。

5 监测部分是指评估质量的过程，它涵盖了有管理人员或进程外的其他各方进行内部控制的外部监督和定期评估。

在本研究中定义的内部控制结构的五个组成部分。据说，为了有一个适当的内部控制系统的框架，内部控制这些组成部分必须提出并正常运行。大部分在这一领域研究重点就是研究特定的控制因素。Stringer和Carey检查了所有五个组成部分，并使用了质的研究方法和单独部分的研究。

在这项研究中可以看到，利用内部控制的组成部分和有效性来分析内部控制的潜在变量。应当指出的是在这项研究中，分析水平是理论和具体的个人控制或判断而并非主要焦点。此外，公司的分析水平是CEO和其他企业人员应该具备的企业管理水平。

4 研究方法

该样本是取自MicroMedia数据库，其中包含的信息来自于超过16万家的芬兰公司。数据库的特点是，它包括首席执行官的电子邮件地址。对样本的选择标

准是：（一）公司的员工数量应该超过14人；（二）公司的年度营业额应在300万欧元左右；（三）所有行业都包括在内，除了金融业、保险业及公共管理；（四）现有的首席执行官的电子邮件地址是可用的。其目的是要确保在芬兰的样本中，大规模的公司包括两个第一准则，这一点很重要。因为这是由最高管理层直接参与的弥补不太复杂的控制系统，因此内部控制系统结构的存在对于小公司来说不那么明显。此外，我们的目标是要覆盖至少一个中层经理，以确保公司的内部控制制度的存在。选择的标准除了在金融及保险服务和公共管理机构以外，它们更容易受到公司内部控制的监管。还有一个重要的选择标准是由于网上调查是获取首席执行官电子邮件地址的主要方法，它的目的是要确保目标人群和数量。在评价过程结束1469公司发现了一些符合的选择标准。通过收集问卷调查的实证数据，我们从众多企业有效地收集了大量的统计资料，并与管理层进行直接接触，这一点很重要。因为确定内部控制的有效性是主观的对已进入内部控制系统的运行管理进行详细的了解，而不提供使用档案数据收集的信息，例如外部审计师。问卷有三个部分组成，第一部分，例如在一个公司把审计人员作为控制变量，它可能影响内部控制的质量。在这一部分对变量进行调整，以提高有效性和可靠性。第二部分着重于内部控制结构，包括对内部控制的组成部分的问题，即控制环境、风险、评估活动、信息与沟通、监控。第三部分探讨内部控制管理有效性的评估，包括对财务活动的效率和可靠性、管理信息的及时性和有效性以及适用的法律法规问题。

附件2：外文原文（复印件）

Determinants and consequences of internal control in firms:

a contingencytheory based analysis

1 Introduction

It is generally believed that an internal control system reduces risks and helps firms ensure the reliability of financial statements and compliance with laws and regulations. So, an increasing number of business failures and some widely publicized frauds have encouraged firms to put more emphasis on their internal control systems, which are specific to their particular operating environment. Management is under increased pressure to enhance the effectiveness of internal control and to effectively communicate this to the board of directors and shareholders. Reference groups like auditors, suppliers and customers are also interested in internal controls since they may affect long-term confidence in reporting, accountability and in the corporate form of organization.

Despite the fact that internal control is an essential factor affecting the firm, the evidence of the actual performance of an internal control structure within the organizational environment is almost non-existent, and the topic relatively unexplored by researchers, as noted by Kinney. The professional literature on internal control has made progress toward developing international control frameworks, but so far the amount of internal control research is limited. Selto and Widener analyze published research and professional articles and find that there were fewer internal control topics in the management control research literature than in practical literature. Increasing emphasis on the role played by internal control in business, and the lack of existing research, creates new research needs and opportunities.

This study contributes to the understanding of the internal control structure and its observed effectiveness in company contexts. Even though the internal control frameworks present a standardized structure and objectives for internal control, they still advise that the need for effective internal control varies according to a firm’s

characteristics. However, neither frameworks nor prior literature provide an adequate picture of the relationships between a firm’s characteristics and its control system. Therefore, this study utilizes a contingency approach to examine the design of the internal control structure and its observed effectiveness in different contexts. The study examines relationships using structural equation modeling and presents empirical results from 741 firms in Finland.

The results of this study add to the limited internal control research knowledge in several important respects. First, the study presents empirical findings using measurement models for internal control and its effectiveness in practice. There are organizations worldwide which have used internal control frameworks as a foundation for conducting activities. At any rate, there is little evidence about frameworks outside practice, and thus the models deserve more intensive research attention . With a few exceptions earlier studies have usually concentrated on particular control elements, such as the control environment, communication or risk assessment. In this study the internal control concept is examined as a whole in different contexts. Second, the action of contingency theory on internal control has not been examined sufficiently within the prior literature even though that relationship plays a critical role in better understanding internal control within organizations. Third, there is a lack of knowledge about internal control from the point of view of management. The literature has so far concentrated on the external parties’ view, although organizing internal control in the organization is in fact the responsibility of management. Therefore, in this study the perceptions of the management of the surveyed firms are the focus.Fourth, this study examines important contingency characteristics that should be taken into account when focusing on the internal control in an organization. The aim is to determine which characteristics are helpful in explaining variations in an internal control system and its observed effectiveness. However, the model examined, yields different results when examined in a bivariate or in a multivariate setting. Therefore, this paper demonstrates how a contingency approach and SEM technique may be applied to internal control research. Understanding commonalities and differences in internal control structures and observed effectiveness in alternative

contexts makes a significant contribution to the internal control discussion. Thus, the study provides a means to identify the special needs of different organizations. The rest of the paper is organized as follows. The next section presents a research framework and the following section presents definitions of constructs and the literature related to the research questions. The fourth section explains the survey design and measurement of variables. Following that, the paper elaborates on the empirical analysis using the SEM method based on data collected from 741 Finnish firms. The sixth section includes a discussion of the results. The last section ends with the conclusions and limitations of the study.

2 Research framework

Control systems are designed to assist managers to achieve their firm’s goals and desired outcomes. An internal control system potentially enhances a firm’s monitoring and reporting processes, as well as ensuring compliance with laws and regulations. In this way effective internal control has a critical role to play in a firm’s success. But, as we can see from the practical findings, internal control does not exist in vacuum. The COSO framework states that two organizations should not have similar internal control system unless the organizations are identical. The need for, and the specifics of, internal control systems may vary in organizational contexts. This statement presented in the internal control framework is analogous to contingency theory that claims that each organization has to choose the most suitable control system by taking into account contingency characteristics. The contingency approach therefore offers an explanation for the variety of internal control systems found in practice.

3 Internal control framework

According to the broad view of internal control, it covers all aspects of an organization and there was a clear demand for a method of pulling together control concepts to form an integrated internal control framework. Well-known frameworks include a definition of effective internal control and present the components of the internal control structure. For example COSO states that internal control can be

judged to be effective when the board of directors and management have reasonable assurances that they understand the extent to which the entity’s operational objectives are being achieved, the published financial statements are being prepared reliably, and the applicable laws and regulations are being complied with. Therefore, in this study effectiveness of internal control is defined in terms of management’s perceptions of how well these three internal control objectives are met.

Similarly, in the frameworks a proper internal control structure is described in different terms, but the following five components can be identified:

1 The control environment component defines the ethos of an organization and the way it operates. This component refers to the creation of an atmosphere in which people can conduct their activities and carry out their control responsibilities. It creates the overall control culture in the firm.

2 The risk assessment component refers to the processes of dealing with the risks that pose a threat to achieving the firm’s objectives. It involves the identification, analysis and assessment of relevant risks.

3 The control activities component refers to policies, procedures and practices that assure management that the objectives are achieved and the risk mitigation strategies are carried out effectively.

4 The information and communication component ensures that relevant information is identified, captured and communicated in a form and time frame that allows personnel to carry out their duties and responsibilities effectively.

5 The monitoring component refers to a process of assessing the quality of control. It covers ongoing and periodical evaluations of the external supervision of internal controls by management or other parties outside the process.

In this research these five components define the internal control structure.2 It is stated in the frameworks that in order to have an adequate internal control system these components of internal control must be presented and function properly. Most of the research in this field focuses on examining particular control elements. Stringer and Carey examines all five components but use a qualitative approach and examine the components separately.

In this study internal control components and observed effectiveness are used as latent variables in the analysis. It should be noted that the level of analysis is theoretical and specific individual controls or judgments are not the main focus of the study. Furthermore, the level of analysis in the firms is at the corporate control level as applied by the CEO and other corporate officers.

4 Research method

The sample was drawn from the MicroMedia Database, which contains information on over 160,000 Finnish firms. A special characteristic of the database is that it also contains CEOs’ e-mail addresses. The selection criteria of the sample were: (i) the number of employees in the firm should be over 14, (ii) the annual turnover of the company should be over 3 million euros, (iii) all industries were included, except financing and insurance services, and public administration, (iv) existing direct email addresses for the CEOs were to be available.

The aims of the two-first criteria were to ensure that the sample consisted of medium and large size companies in Finland. This was important because in small firms direct involvement by the top management compensates for less sophisticated control systems, and therefore, the existence of an internal control structure is not so obvious. Moreover, the aim was to cover firms with at least one middle level manager to ensure the existence of an internal control system. The third selection criterion excluded financing and insurance services and public administration organizations, because they are more regulated by internal controls than are companies in other industries. The last important selection criterion, due to the Web-based survey method, was the direct e-mail address of the CEO. It was intended to ensure the engagement of the target population and a large enough number of responses. At the end of the evaluation process 1,469 companies were found which met the selection criteria. Empirical data were collected through a web-based questionnaire. This method made it possible to efficiently collect statistical information from numerous firms and make direct contact with management. This was important, because determining internal control effectiveness is subjective and management has current and detailed insight

into the operation of the internal control system. The information collected is not available from archival data used, for example, by external auditors. To check the relevance and the construct of the questionnaire it was pre-tested with a small group of academics and CEOs, which resulted in some modifications to the wording and in the presentation of the questionnaire. The questionnaire consists of three parts. The first part includes questions on control variables and contingency characteristics. For example the existence of an internal auditor in the firm was used as a control variable; it may have influence on the quality of internal control. The variables in this part were adapted from earlier studies to enhance the validity and reliability of the measures. The second part focuses on the internal control structure and includes questions on the components of internal control; that is, the control environment, risks, control activities, information and communication, and monitoring. The third part examines management’s evaluations of internal control effectiveness and includes questions on the efficiency and effectiveness of activities, reliability and timeliness of financial and management information, and compliance with applicable laws and regulations.