Preparing and auditing financial statements depend on robust internal controls that provide reasonable assurance that the data are accurate. Thus an effective accountability regime must encompass the internal controls on which the financial reports are based. These controls pertain to much of the management capacity of departments: their information and data processing systems; the maintenance and safeguarding of inventory and other assets; assurance that applicable laws and regulations are adhered to; and more. Internal controls affect the capacity of departments to deliver outputs at agreed price; even more fundamentally, they relate to the government's ownership of its departments.
The 1992 Guidelines for Internal Control Standards issued by the International Organisation of Supreme Audit Institutions (INTOSAI) defines internal control as "a management tool used to provide reasonable assurance that management's objectives are being achieved." It vests each country's audit institution with responsibility for reviewing the internal control structure and for assuring that the controls are working as intended and are adequate to achieve the desired results. The guidelines set forth the following standards for appraising the adequacy of internal controls:
- All transactions and significant events are to be clearly documented, and the documentation is to be readily available for examination.
- Transactions and significant events are to be authorised and executed only by persons acting within the scope of their authority.
- Key duties and responsibilities in authorising, processing, recording and reviewing transactions and events should be separated among individuals.
- Competent supervision is to be provided to ensure that internal control objectives are achieved.
- Resources are to be periodically compared with the recorded amounts to determine whether the two agree. The asset's vulnerability should determine the frequency of the comparison.
The guidelines characterise these controls as "the minimum acceptable standards that organisations follow when instituting internal controls and provide criteria for auditors when auditing the internal control structure." Nevertheless, these standards must be balanced against the drive to free managers to manage. An excess of controls would dampen managerial initiative and responsibility; too little control would open the flood gates to abuse and mismanagement.
It would be wrong, however, to see managerial flexibility and strong internal controls as incompatible. In fact, these controls are preconditions for removing external controls on managers. It is in this light that the management controls of New Zealand departments warrant attention. The performance and purchase agreements and the annual reports generally refer to these controls, but they rarely itemise the standards applied, how the effectiveness of the controls is tested, or the measures taken to improve them. Although this study has not examined internal controls, one should not be surprised if they were found to be stronger at the centre of departments than in field operations, more effective in dealing with financial transactions than with other aspects of performance, and more closely reviewed for those elements of performance specified in advance than for other management practices.
Ownership and management control are inextricably related. Internal control is about managers taking responsibility for the organisations they lead, not because particular tasks or outputs have been specified, or because purchasers will be displeased with the goods and services provided, but because they are in charge. In the New Zealand model, managers are not the owners, but they should see themselves as the owners' agents in ensuring that the department's work is carried out efficiently, with due regard for legal obligations, and in a manner that upholds the ethic of Public Service.
The spirit and practice of managerial responsibility must radiate through every department, and from headquarters to staff down the line. If it doesn't, sooner or later the enormous accomplishments of New Zealand reform will be challenged and possibly discredited - not by great failures of policy or strategy, but by ordinary missteps that call into question the adequacy of internal control and generate demands for reimposing external controls. To guard against this, departments must inculcate and train their employees and contractors on the legal and ethical requirements of acting according to the rules.