Any control which an organization implements has an inbuilt cost to it. Considering even a medium size enterprise, there might be several hundred controls which form part of the entire control environment. Coming to the costs of internal controls in an enterprise. My view is cost relating to internal controls can be of two types Controls Performance Costs and Controls Assessment Costs.

1. Cost of designing and implementing the controls. In the controls implementation phase, management needs to design and implement internal controls so that they adequately mitigate risks. These are normally called as cost of controls performance.

2. Secondly, Sarbanes Oxley Section 404 requires an ongoing assessment of internal controls. Assessment means assessing the design and operational effectiveness of internal controls, reporting on the controls and getting an external auditor to audit such internal controls. This whole assessment process has a cost attached to it.

One last thing I would like to add is costs of manual controls is much more than cost of automated controls. Even though automated solutions are a bit costly, in the long run it pays to have automated controls rather than manual controls.

Related Posts

Sarbanes Oxley Whistleblower Hotlines
Sarbanes Oxley Balancing Risks and Costs
Sarbanes Oxley for Fortune 500 Companies
Section 404 Implementation IT Best Practices