Internal Control

The long view

Filings containing this phrase, every month since 2008. The last point is the current month and is still filling, so it always looks lower than it will be.

Who disclosed it

From SEC full-text search over 8-K filings. Every row links to the filing itself.

The full search on EDGAR

How it actually arrives

An 8-K's meaning is in its item number, not its text. These are the items the filings containing this phrase were filed under. The first group is something that happened to the company. The second is the phrase turning up in the ordinary course of reporting, most often in an earnings release, which is a very different thing and is usually the larger number.

This is why a headline count on its own overstates the case. Where the routine number dominates, the phrase is being tracked as language rather than as events.

Which industries file it

Companies grouped by the industry classification on their own filing. A count, not a survey.

What it obligates

Our corpus holds 77 controls across 29 frameworks whose text speaks to this. Not a judgement: these controls say so, and each is one lookup from its source document. Ordered by how much each framework has to say about it, so the one that will cost you the most work is first. Every name opens that framework in the corpus.

What an auditor will ask you to produce

The artefacts named on those controls, most frequently cited first.

• Risk assessment workpapers
• Board charter
• Control matrix
• Policies mapped to COSO 17 principles
• Internal and external communication evidence
• Fraud risk assessment results
• Code of conduct
• Org structure document

How it usually fails

Recorded when each control was verified against its source. This is where programmes that think they are covered turn out not to be.

• Principles not mapped
• Fraud assessment skipped
• Communication ad hoc
• Changes lack analysis
• Code not communicated
• Board not independent

Today's edition · How programmes fail · The obligation index