55 lines
1.7 KiB
Markdown
55 lines
1.7 KiB
Markdown
---
|
||
title: "Internal Controls"
|
||
type: concept
|
||
tags: [finance, accounting, compliance]
|
||
sources: [finance-bookkeeper-controller]
|
||
last_updated: 2026-05-02
|
||
---
|
||
|
||
## Definition
|
||
内部控制（Internal Controls）是企业为确保财务报告可靠性、运营效率和合规性而建立的政策和程序体系。
|
||
|
||
## Control Design Components
|
||
- **Authorization Matrices**：授权矩阵，定义谁有权批准哪些类型的交易
|
||
- **Approval Workflows**：审批工作流，确保所有重大交易经过适当审批
|
||
- **System Access Controls**：系统访问控制，限制对敏感财务系统的访问
|
||
- **Data Validation Rules**：数据验证规则，防止无效或未经授权的数据进入系统
|
||
|
||
## Control Monitoring
|
||
- 关键控制测试
|
||
- 例外情况跟踪
|
||
- 整改管理
|
||
|
||
## SOX Compliance
|
||
萨班斯-奥克斯利法案（SOX）对公众公司的内部控制提出了强制性要求：
|
||
- 控制文档化
|
||
- 测试计划
|
||
- 缺陷跟踪
|
||
- 管理层声明
|
||
|
||
## Segregation of Duties
|
||
职责分离是内部控制的核心原则：
|
||
- 交易发起人 ≠ 审批人
|
||
- 交易审批人 ≠ 记录人
|
||
> "The person who initiates a transaction should not be the same person who approves or records it."
|
||
|
||
## Policy Maintenance
|
||
- 会计政策文档化
|
||
- 程序手册维护
|
||
- 授权矩阵更新
|
||
|
||
## Core Principle
|
||
> "Internal controls exist because humans make mistakes (and occasionally worse). Trust but verify — then verify again."
|
||
> — Dana, Bookkeeper & Controller Agent
|
||
|
||
## Success Metrics
|
||
- 内部控制例外率 < 3%
|
||
- 所有控制按测试计划执行
|
||
- 零 SOX 重大缺陷
|
||
|
||
## Related Concepts
|
||
- [[Segregation-Of-Duties]]
|
||
- [[Audit Readiness]]
|
||
- [[GAAP-Compliance]]
|
||
- [[Account-Reconciliation]]
|