內部稽核工作的再思考：企業內部控制及組織營運管理的整合案例分析

內部稽核，依「公開發行公司建立內部控制制度處理準則」所述： “公開發行公司應實施內部稽核，其目的在於協助董事會及經理人檢查及覆核內部控制制度之缺失及衡量營運之效果及效率，並適時提供改進建議，以確保內部控制制度得以持續有效實施及作為檢討修正內部控制制度之依據。逐步確立內部稽核是一種獨立、客觀之確認及諮詢活動，用以增加價值及改善機構之營運，協助機構透過系統化及紀律化之方法，評估及改善風險管理、控制及治理過程之效果，以達成機構目標。” 說到內部控制制度，就難免會參照COSO委員會及其所發佈的《COSO內部控制整合框架》，而從1992年COSO委員會成立的背景來看，當時成立的贊助機構背景為為美國會計協會(the American Accounting Association, AAA)、美國財務主管協會(Financial Executives International, FEI)、美國會計師公會(the American Institute of Certified Public Accountants, AICPA)、美國管理會計學會(the Institute of Management Accountants, IMA)與國際內部稽核協會(The Institute of Internal Auditors, IIA)，這些機構的背景在看待內部控制制度時，免不了偏於以外部觀點要求確保財務報導的可靠性，然而內部控制制度及內部稽核畢竟是屬於公司內部營運的環節，若其設計的觀點僅從外部對財務報導的可靠性，則難免與公司營運之需求有所脫節，是以2013年的修版，即應是考量並納入了諸多實務界的意見。然而觀察在國內實際各公司組織內部稽核單位或角色的存在，在 “確保內部控制制度得以持續有效實施及作為檢討修正內部控制制度之依據”這個目的上，仍多扮演著 “檢查及覆核內部控制制度之缺失”，而較少發揮 “衡量營運之效果及效率，並適時提供改進建議”的功能。現有內部稽核人員之執行，多數思惟仍多陷於COSO委員會所發佈《COSO內部控制整合框架》修訂前的模式，偏向於稽核在財務報導的可靠性及對法規或內部規範的遵循，卻少著墨於探討“營運之效果及效率”的確保與改善。事實上，對內部稽核人員言，前兩項偏於外部與法令對稽核人員期望與要求，而對企業經營者言，後一項才是對公司或組織有所價值之所在。在以家族創業的華人公司組織，對法治或制度遵循的文化上，與歐美西方國家的制度設計文化背景仍有差異，故雖然因公司治理議題受到外部的要求及認知的逐步提升而對內部控制制度及內部稽核的重視有所改善，但公司組織控制環境仍多多少少會受到管理階層及經理人“人治”影響。若內部稽核人員能發揮其所重視的“價值”，就能導引改變組織控制環境，也就有助於強化內部控制的成果及促進組織營運管理的效果與效率。本研究所探討的，並非指陳COSO內部控制整合框架之不足，而是在闡釋COSO雖然已經在2013年提出的修訂版將關注的目標從財務報導的可靠性擴展到營運資訊的可靠性、及時性及透明性等範圍，但一般的內部稽核人員並未體認到修訂版真正想表達的意義。內部稽核人員應該要關注的議題，在執行公司內部控制制度之設計與評估時，不能只看到內部控制制度查核事項的缺失，應考量到公司組織的營運效率與效果，在該公司組織文化下的控制環境，往前想一步為何會發生這缺失？往後想一步這事件對公司組織未來的影響會如何？為進一步釐清且賦予內部稽核功能一項新的詮釋方式，本研究利用案例研究法，深入探討一傳統華人組織，因其運用COSO內部控制的整合性架構時，內部稽核人員不僅僅是由傳統觀點來看待查核實務工作，更進一步針對事件以公司組織經營者的營運視野高度，來剖析對內部控制對組織營運的影響；以及藉由稽核角色的特殊性建立信任及有效的溝通，消除在傳統組織階層間之猜測迎合心態所造成之決策偏差誤判現象，強化管理階層的領導力。總結而言，內部控制制度之設計，乃為藉由規範設計流程來達到管理管控目的，然事業體之經營，抑或組織單位作業之運行，存在著形式上或實質上的遵循差異，如何在稽核實務上，導引公司管理能真正落實，即為本研究所述之“內部稽核工作的再思考”。若進一步從定義面來看，在國際內部稽核組織的國際專業實務架構(IPPF)指引，也可見其修訂的軌跡慢慢地納入實質管理。即內部稽核的角色不僅僅是因應外部公司治理的需求而存在，也可以是藉由溝通群體層階組織，共同解決問題來促進組織營運管理改善的機制。

關鍵字

內部稽核；華人組織；控制環境；溝通

並列摘要

The internal audit is based on the “Regulations Governing Establishment of Internal Control Systems by Public Companies”: The purpose of the internal audit is to enable the Board and the Manager to review and review the Lack of Internal Control System and to measure the effectiveness and efficiency of the operation, and to provide timely suggestions for improvement to ensure the continued effective implementation of the internal control system and As a basis for reviewing the revised internal control system. The gradual establishment of an internal audit is an independent and objective confirmation and advisory activity to increase value and improve the operation of the organisation. It helps the organisation to assess and improve the effectiveness of the risk management, control and governance processes through systematic and disciplined approaches. Achieve institutional goals. ” When it comes to the internal control system, it will inevitably refer to the COSO Committee and its COSO Internal Control Integration Framework. From the background of the establishment of the COSO Committee in 1992, the background of the sponsoring organization established at that time was the American Accounting Association, ( AAA), Financial Executives International (FEI), the American Institute of Certified Public Accountants (AICPA), the Institute of Management Accountants (IMA), and the International Internal Audit Association (The Institute of Internal Auditors (IIA), the background of these institutions is inevitably biased towards ensuring the reliability of financial reporting from an external perspective when looking at the internal control system. However, the internal control system and internal auditing are after all the internal operations of the company. The design's view is only from the external reliability of financial reporting, it is inevitably out of line with the needs of the company's operations, is the revision of the 2013, that is, should be considered and incorporated into the opinions of many practical circles. However, observing the existence of internal auditing units or roles in actual domestic companies, the role of “checking and reviewing the internals of the internal control system and ensuring the internal control system as a basis for reviewing the internal control system” The lack of control system, and less the function of "measuring the effectiveness and efficiency of operations, and providing suggestions for improvement in a timely manner." The implementation of the existing internal auditors, most of the thinking is still stuck in the COSO committee issued the "COSO internal control integration framework" before the revision of the model, biased towards auditing "reliability of financial reporting and compliance with regulations or internal norms", but less Investigate the assurance and improvement of “operational effectiveness and efficiency”. In fact, for the internal auditors, the first two are biased towards the expectation and requirements of the auditors, both external and legal, while the latter is the value of the company or organization. In the Chinese company organized by the family, the culture of the rule of law or the system is still different from the institutional design culture background of the Western European countries. Therefore, although the corporate governance issues are subject to external requirements and the gradual improvement of cognition, internal control The emphasis on the system and internal audit has improved, but the company's organizational control environment is still more or less affected by the management and management of the management. If internal auditors can use the “value” they value, they can guide the change of organizational control environment, which will help strengthen the results of internal control and promote the effectiveness and efficiency of organizational operations management. This study does not refer to the shortcomings of Chen COSO's internal control integration framework, but rather explains that COSO's revised version, which was proposed in 2013, will extend the focus of attention from the reliability of financial reporting to the reliability and timelyness of operational information. Sexuality and transparency, but the general internal auditors did not recognize the meaning of the revised version. The issues that internal auditors should pay attention to when implementing the design and evaluation of the company's internal control system, do not only see the lack of internal control system check matters, should consider the operational efficiency and effectiveness of the company's organization, under the company's organizational culture The control environment, why do you want to make a mistake in the future? What is the impact of this incident on the future of the company's organization? In order to further clarify and give a new interpretation of internal audit function, this study uses case study method to deeply explore a traditional Chinese organization. Because of its integrated structure of COSO internal control, internal auditors are not only from traditional viewpoints. Looking at the verification work, and further analyzing the impact of internal control on the organization's operations on the event's operational perspective, and establishing trust and effective communication through the special nature of the audit role, eliminating the traditional organization. The speculation between the classes caters to the misjudgment of decision-making bias caused by the mentality and strengthens the leadership of the management. In summary, the design of the internal control system is to achieve the purpose of management and control by standardizing the design process. However, the operation of the business unit or the operation of the organizational unit has a formal or substantial difference in compliance, how to audit In practice, guiding the management of the company can be truly implemented, that is, the “rethinking of the internal audit work” described in this study. If we look further at the definition, the International Professional Practice Framework (IPPF) guidelines of the international internal audit organization can also be seen that the revised track is slowly incorporated into substantive management. That is to say, the role of internal auditing is not only in response to the needs of external corporate governance, but also a mechanism to promote organizational operational management improvement by communicating group level organizations and jointly solving problems.