Internal Control Over Financial Reporting (ICFR)

Internal control over financial reporting is the set of processes designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with the applicable accounting framework. For SEC registrants, management must assess and report on ICFR effectiveness annually under Sarbanes-Oxley Section 404(a), and accelerated and large accelerated filers must also obtain an auditor attestation under Section 404(b).

Most companies frame their ICFR program around the COSO 2013 Internal Control - Integrated Framework, which organizes control across five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Documentation typically works down from entity-level controls through significant processes to individual control activities, mapping each to the relevant financial statement assertions - existence, completeness, accuracy, valuation, rights and obligations, and presentation.

Controls are commonly categorized as preventive or detective, manual or automated, and as key or non-key. Information technology general controls covering access, change management, and computer operations underpin the reliability of automated controls and of the reports used in manual controls - which is why IT general control failures so often cascade into pervasive deficiencies.

Deficiencies are evaluated by severity. A control deficiency exists when a control fails to operate as designed or is inadequately designed. A significant deficiency is less severe than a material weakness but important enough to merit attention by those charged with governance. A material weakness is a deficiency, or combination of deficiencies, creating a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis - and it requires public disclosure and an adverse ICFR opinion.