Internal Control Review (ICR) is an overall assessment of the internal control system and its adequacy of each business area in an organization to address the relevant risks. Through control review, an organization’s resources are directed, monitored, and measured in an effective manner. It plays an important role in protecting the organization’s tangible and intangible resources.

Whereas, Internal audit as defined by the Institute of Internal Auditors is “an activity that provides independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

The framework of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) defines internal control as “a process effected by an entity’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories”:

1. Effectiveness and efficiency of operations.
2. Reliability of financial reporting.
3. Compliance with applicable laws and regulations.

As per the COSO model, the components of the internal control system are:

1. Control Environment: This sets the tone for the organization, influencing the control consciousness of its people. It is the foundation for all other components of internal control.
2. Risk Assessment: The identification and analysis of relevant risks to the achievement of objectives, forming a basis for how the risks should be managed.
3. Control Activities: The policies and procedures that help ensure management directives are carried out.
4. Information & Communication: Systems or processes that support the identification, capture, and exchange of information in a form and time frame that enables people to carry out their responsibilities.
5. Reporting & Monitoring: Processes used to identify, monitor and report the quality of internal control performance or deficiencies to appropriate levels.

As per the Executive Bylaw Module fifteen, issued by Capital Market Authority “CMA” which states an independent audit firm shall be assigned to evaluate and review the internal audit systems and prepare a report in this regard (Internal Control Report), which shall be submitted to the Authority per annum. Accordingly, we are providing the internal control review services in alignment with the Capital Market Authority’s Regulations.

We, in SFAI, are licensed to prepare an annual report on assessment of internal control review for KSE-listed companies and companies licensed by Capital Markets Authority.