What are Systems for Internal Control over Financial Reporting (ICFRS)?

The Internal Control over Financial Reporting System (ICFRS) is a framework of internal processes and controls designed to ensure the accuracy and reliability of an organization’s financial information. Its purpose is to mitigate risks, ensure regulatory compliance, and provide confidence to investors and other stakeholders. It covers everything from risk identification and management to continuous monitoring, ensuring that financial data accurately reflects the company’s situation.

The Spanish legislation governing securities markets and financial instruments derives from European rules, following the transposition of the Markets in Financial Instruments Directive, known as MiFID. That transposition was carried out through two instruments: Law 47/2007, which substantially amended Law 28/1988 on the Spanish Securities Market (LMV), and Royal Decree 217/2008, which established the legal regime applicable to entities providing investment services.

Securities market transparency requirements have evolved over the years. In particular, the rules requiring listed entities to report financial information have grown progressively more complex. To meet these demands, an entity’s internal control systems cannot remain static: they must evolve over time and be capable of providing reasonable assurance as to the reliability of the financial information supplied to the market.

To achieve this, the elements of an internal control system –control environment, risk assessment, control activities, information and communication, and monitoring– must be coordinated and operate together with the aim of preventing, detecting, compensating, mitigating or correcting errors with material impact, or fraud in financial information. These elements are described below:

• The entity’s control environment: it sets the behavioural standards of an organization and has a direct influence on how aware staff are of internal control.
• Financial information risk assessment: this assessment makes it possible to analyze the potential risks to achieving objectives related to the reliability of financial information. Examples include calculation errors or the misapplication of standards, accounting fraud, undisclosed information, incorrect estimates or projections, and others of various kinds.
• Control activities: control activities must be carried out at several levels of the organization in order to reduce the risk of errors, omissions or fraud that could affect the reliability of financial information.
• Information and communication: information and communication systems identify and distribute information on transactions and other events affecting the entity within a timeframe that allows those involved to perform their assigned duties.
• Monitoring of how the system operates: monitoring the system is crucial to maintaining reasonable assurance that the risks identified are being effectively controlled, whether through prevention, detection, mitigation, compensation or correction.

GlobalSuite Solutions offers a management software that helps in optimizing processes and reducing uncertainty regarding risks. In the case of “financial information risk assessment”, GlobalSuite® allows us to specify financial information control objectives and identify and analyze risks (with customizable risk methodologies), associated with achieving these objectives as a basis for determining which controls should be implemented, among other functions. Likewise, as regards control activities, the software allows us to manage the controls applicable to the entity and to assess each one according to whether it is preventive in nature or intended to detect, mitigate, compensate for or correct its potential impact. It also includes a document manager in which control activities –appropriate policies and procedures– can be stored for every stage of the financial reporting process, including critical judgments, estimates, valuations, projections and closing entries.

To reinforce the transparency and quality of the public information supplied to the market in relation to Systems for Internal Control over Financial Reporting (ICFRS), it is considered appropriate for an external auditor to be involved in reviewing them and to issue a report on the matter. GlobalSuite® includes an audit module that supports this management process.

In conclusion, an ICFRS is the set of processes that an entity’s governing bodies carry out in order to provide reasonable assurance as to the reliability of the financial information that will be published in the markets. To meet this obligation more effectively, additional means of managing risks and control measures are needed — such as the management software from GlobalSuite Solutions.