Principle 3 - Establish Structure, Responsibility, and Authority
3.0 Establish Structure, Responsibility, and Authority
External Link to US GAO Green Book Principle 3
Overview
Management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives.
3.1 Organizational Structure
Management establishes the organizational structure necessary to enable the entity to plan, execute, control, and assess the organization in achieving its objectives. Management develops the overall responsibilities from the entity’s objectives that enable the entity to achieve its objectives and address related risks.
Management develops an organizational structure with an understanding of the overall responsibilities and assigns these responsibilities to enable the organization to operate efficiently and effectively, comply with applicable laws and regulations, and reliably report information. Based on the nature of the assigned overall responsibility and related risks, management chooses the type and number of discrete divisions, operating units, functions, and other structures needed to achieve the entity’s objectives. Management may identify discrete divisions, operating units, or functions, such as program offices and related subunits, to manage the entity’s risk responses within the internal control system.
As part of establishing an organizational structure, management considers how divisions, operating units, functions, and other structures interact to fulfill their overall responsibilities. Management establishes reporting lines within an organizational structure so that units can communicate the quality information necessary for each unit to fulfill its overall responsibilities to support the internal control system. Reporting lines are defined at all levels of the organization and provide methods of communication that can flow down, across, up, and around the structure. Management also considers the entity’s overall responsibilities to external stakeholders and establishes reporting lines that allow the entity to both communicate with and obtain information from external stakeholders.
Management periodically evaluates the organizational structure so that it meets the entity’s objectives and has adapted to any new entity objectives, such as to comply with a new law or regulation. Management also adapts the organizational structure as necessary to respond to risks and identified deficiencies in the internal control system.
3.2 Assignment of Responsibility and Delegation of Authority
To achieve the entity’s objectives and address related risks, management assigns responsibility and delegates authority to key roles throughout the entity. A key role is a position in the organizational structure that is assigned an overall responsibility of the entity. Generally, key roles relate to senior management positions within an entity.
Management considers the overall responsibilities assigned across the organizational structure, determines what key roles are needed to fulfill the assigned responsibilities, and establishes the key roles. Those in key roles can further assign responsibility for internal control to roles below them in the organizational structure, but they retain ownership for fulfilling the overall responsibilities assigned to them.
3.08
Management determines what level of authority each key role needs to fulfill a responsibility. Management delegates authority only to the extent required to achieve the entity’s objectives. As part of delegating authority, management evaluates each delegation for proper segregation of duties within the organizational structure. Segregation of duties helps prevent fraud, waste, and abuse in the entity by considering the need to separate authority, custody, and accounting in the organizational structure. As with assigning responsibility, those in key roles can
3.3 Documentation of the Internal Control System
Management develops and maintains documentation of its internal control system [documentation requirement].
Effective documentation assists in management’s design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, and to communicate that knowledge as needed to external parties, such as external auditors.
Management documents internal control to meet operational needs. Documentation of controls, including changes to controls, is evidence that controls are identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity.
The extent of documentation needed to support the design, implementation, and operating effectiveness of the five components of internal control is a matter of judgment for management. Management considers the benefits and costs of documentation for the entity as well as the size, nature, and complexity of the entity and its objectives. Some level of documentation, however, is necessary so that the components of internal control can be designed, implemented, and operating effectively.
